PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT WORK PRODUCT DRAFT — NOT FOR FILING
COMPLIANCE SELF-CERTIFICATION
OF
BELMONT RIDGE BANK NATIONAL ASSOCIATION
PURSUANT TO CONSENT ORDER NO. OCC-2025-003
Submitted to the Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue, New York, NY 10017
Attention: Jonathan Frey, National Bank Examiner, Examiner-in-Charge
Date of Submission: February 15, 2026
Prepared By:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002
Philip Hartmann, Responsible Partner Banking & Finance Practice Group
Yuki Nakamura, Lead Associate Banking & Finance Practice Group
Prepared For:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845 EIN: 13-6148320
Holding Company:
Belmont Ridge Financial Group, Inc. ("BRFG") A Delaware corporation Ticker: BRFG (NYSE) EIN: 83-2947561
Submission Deadline: February 15, 2026, as set forth in Article [__] of Consent Order No. OCC-2025-003
DRAFTING NOTE (INTERNAL — TO BE REMOVED BEFORE FINALIZATION): This is a forward-dated draft prepared by Calderwood & Harkness LLP in February 2025 for finalization closer to the February 15, 2026 filing deadline. All factual certifications, completion dates, and supporting evidence references are placeholders to be confirmed with actual remediation results. Bracketed text "[TO BE CONFIRMED]" denotes items requiring final verification by the Bank's certifying officers, the BSA Officer, the Chief Compliance Officer, and Thornfield Consulting Group LLC prior to filing. This draft is protected by the attorney-client privilege and the work product doctrine. It should not be circulated outside of the Bank's internal legal and compliance teams and the Calderwood & Harkness engagement team without prior authorization from Philip Hartmann.
Right-click to update Table of Contents
I. INTRODUCTION AND PURPOSE
Belmont Ridge Bank National Association ("BRB" or the "Bank"), a national banking association organized under the laws of the United States and chartered by the Office of the Comptroller of the Currency ("OCC"), OCC Charter No. 48271, by and through its undersigned officers, hereby respectfully submits this Compliance Self-Certification (this "Self-Certification") to the OCC pursuant to Article [__] of Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order").
The Consent Order was issued by the OCC on January 15, 2025, following a targeted Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") examination conducted by the OCC's Northeastern District Office from March 2024 through September 2024 (the "Examination"). The Consent Order identified five core deficiency categories in the Bank's BSA/AML and sanctions compliance program, each of which required comprehensive remediation within specified timeframes:
(i) OFAC sanctions screening deficiencies, including failures to screen 100% of transactions processed through the Bank's Banking-as-a-Service ("BaaS") fintech partner channels;
(ii) Suspicious Activity Report ("SAR") filing deficiencies, including a backlog of approximately 2,400 unreviewed potentially suspicious activity alerts and systemic timeliness failures in SAR filing;
(iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") failures, including approximately 47,000 high-risk customer accounts lacking adequate CDD or EDD documentation;
(iv) Transaction monitoring model validation deficiencies, including the failure to conduct an independent model validation of the Bank's transaction monitoring system for more than three years; and
(v) Board-level oversight deficiencies, including the absence of a dedicated Compliance Committee of the Board of Directors and the inadequacy of BSA/AML reporting to the Board.
This Self-Certification is submitted in accordance with Article [__] of the Consent Order, which requires BRB to file a self-certification with the OCC on or before February 15, 2026, attesting that the Bank has achieved full implementation of its BSA/AML and sanctions compliance program in accordance with all requirements of the Consent Order. This Self-Certification is supported by the final validation report (the "Final Validation Report") of Thornfield Consulting Group LLC ("Thornfield"), the independent consultant engaged by BRB pursuant to Article VII of the Consent Order. Thornfield's engagement is referenced as TCG-BRB-2025-001. The Final Validation Report, dated [TO BE CONFIRMED — on or before February 15, 2026], is attached hereto as Exhibit A and incorporated herein by reference.
BRB hereby certifies to the OCC that it has achieved full implementation of its BSA/AML and sanctions compliance program in accordance with all requirements of the Consent Order. The Bank has remediated each of the five core deficiency categories identified in the Consent Order, has met or exceeded all deadlines and milestones specified therein, and has established sustainable compliance program enhancements designed to prevent recurrence of the identified deficiencies. The factual bases for this certification are set forth in detail in the sections that follow.
Throughout the remediation process, BRB has been advised and guided by its outside regulatory counsel, Calderwood & Harkness LLP ("C&H"), led by Philip Hartmann, Responsible Partner, Banking & Finance Practice Group. C&H was engaged on February 10, 2025, and has provided ongoing legal counsel to the Bank's management, compliance leadership, and Board of Directors in connection with the planning, execution, and documentation of all remediation activities described herein.
The Bank submits this Self-Certification with the expectation that it will serve as the basis for the OCC's assessment of BRB's compliance with the Consent Order and, ultimately, for the OCC's determination regarding the potential termination of the Consent Order in accordance with its terms.
II. PROCEDURAL BACKGROUND AND REMEDIATION TIMELINE
A. Consent Order Issuance and Immediate Response
Consent Order No. OCC-2025-003 was issued by the OCC on January 15, 2025, and became effective on that same date. The Consent Order was the result of a targeted BSA/AML examination conducted by the OCC's Northeastern District Office from March 2024 through September 2024. The Examination was led by Jonathan Frey, National Bank Examiner and Examiner-in-Charge, and focused on BRB's BSA/AML compliance program with particular emphasis on the Bank's oversight of its BaaS fintech partnerships and the adequacy of its transaction monitoring, OFAC sanctions screening, SAR filing, and CDD/EDD processes.
The issuance of the Consent Order did not occur in isolation but was preceded by a series of escalating supervisory actions. In June 2022, the OCC issued a Matter Requiring Attention ("MRA") regarding deficiencies in BRB's BSA/AML transaction monitoring program, including concerns about the adequacy of the Bank's transaction monitoring system tuning parameters and the timeliness of alert dispositions. BRB undertook certain remediation efforts in response to the June 2022 MRA; however, the OCC determined that those efforts were insufficient. In November 2023, the OCC elevated its supervisory concerns by issuing a Matter Requiring Immediate Attention ("MRIA") regarding gaps in the Bank's OFAC sanctions screening coverage, specifically identifying failures to screen all transactions processed through certain BaaS fintech partner channels. The Consent Order expressly cited BRB's failure to adequately remediate these prior supervisory actions as a basis for the enforcement action.
As part of the Consent Order, the OCC assessed a civil money penalty ("CMP") in the amount of $14,500,000 against BRB. The Consent Order required payment of the CMP within sixty (60) days of the effective date — that is, by March 16, 2025. BRB paid the CMP in full by wire transfer to the U.S. Treasury on or before March 16, 2025 [TO BE CONFIRMED — evidence of payment to be attached as Exhibit E]. The payment was authorized by the Board of Directors as part of the Board Resolution described in Section II.C below.
In connection with the public disclosure of the Consent Order, Belmont Ridge Financial Group, Inc. ("BRFG"), the Bank's parent holding company, filed a Current Report on Form 8-K with the Securities and Exchange Commission and issued a press release on January 16, 2025, disclosing the Consent Order and the related CMP assessment. BRFG also disclosed the estimated financial impact of the remediation in its Form 10-K for the fiscal year ended December 31, 2024, and in subsequent quarterly filings.
In January 2025, following issuance of the Consent Order, BRB terminated its engagement with its prior outside regulatory counsel, Drayton Mercer LLP, which had advised the Bank during the Examination period and in connection with certain of the prior remediation efforts that the OCC found to be inadequate. The decision to engage new outside counsel reflected the Bank's commitment to a fresh and comprehensive approach to remediation.
B. Engagement of Counsel and Independent Consultant
Calderwood & Harkness LLP was engaged as outside regulatory counsel to BRB effective February 10, 2025. The C&H engagement encompasses legal advice and guidance in connection with all aspects of the Bank's remediation of the Consent Order, including the development and implementation of the Comprehensive Remediation Action Plan, coordination with the independent consultant, preparation of OCC filings and progress reports, policy development, privilege oversight, and the preparation of this Self-Certification.
Article VII of the Consent Order required BRB to retain an independent consultant, acceptable to the OCC, to assess the Bank's BSA/AML and sanctions compliance program, monitor remediation activities, and deliver a final validation report. BRB proposed Thornfield Consulting Group LLC as the independent consultant, and the OCC provided its non-objection on February 5, 2025, ten days in advance of the February 15, 2025 deadline established by the Consent Order. The engagement agreement between BRB and Thornfield was executed on February 10, 2025. The engagement provides for a fixed fee of $6,500,000 for the twelve-month engagement period, plus reimbursable expenses capped at $400,000, for a total maximum engagement cost of $6,900,000.
The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, who serves as the engagement principal and primary point of contact with the OCC regarding the independent consultant's work. Dr. Castellano's team includes Robert Eastman, Senior Director, AML Transaction Monitoring, who oversees the assessment and validation of the Bank's transaction monitoring system and SAR processes; Jennifer Hwang, Director, Sanctions & OFAC Compliance, who oversees the assessment and validation of the Bank's OFAC sanctions screening program; and Nathaniel Burgess, Director, Fintech & Payments Compliance, who oversees the assessment of the Bank's BaaS partnership compliance oversight framework.
Thornfield commenced its on-site assessment at BRB's offices on March 1, 2025 [TO BE CONFIRMED]. The on-site assessment involved a comprehensive review of the Bank's BSA/AML and sanctions compliance program, including documentation review, personnel interviews, system demonstrations, data analysis, and gap identification. Thornfield delivered its preliminary gap assessment on April 15, 2025 [TO BE CONFIRMED], which informed the development of the Comprehensive Remediation Action Plan filed with the OCC on May 15, 2025 [TO BE CONFIRMED].
Thornfield's counsel, Hargrove & Stein PC, located at 7 Times Square, 34th Floor, New York, NY 10036, reviewed privilege and regulatory reporting aspects of Thornfield's work throughout the engagement to ensure that the independent consultant's reports and deliverables appropriately addressed the OCC's requirements without compromising the Bank's attorney-client privilege or work product protections.
C. Board Resolution and Governance Actions
On February 28, 2025, the Board of Directors of Belmont Ridge Bank National Association adopted a Board Resolution (the "Board Resolution") acknowledging the issuance of Consent Order No. OCC-2025-003 and the Bank's obligations thereunder [TO BE CONFIRMED — actual date]. The Board Resolution is attached hereto as Exhibit B. The Board Resolution accomplished the following governance actions:
(a) Formally acknowledged the Consent Order and the Board's understanding of its requirements;
(b) Established a dedicated Compliance Committee of the Board, to be chaired by James Rutherford, an independent director, with authority and responsibilities as set forth in the Compliance Committee Charter adopted concurrently therewith;
(c) Authorized a total remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP), encompassing all costs associated with outside counsel, the independent consultant, technology upgrades, temporary and permanent staffing, the SAR lookback project, the CDD/EDD remediation project, training, policy development, and board governance restructuring;
(d) Authorized payment of the $14,500,000 CMP to the U.S. Treasury within the timeframe required by the Consent Order; and
(e) Directed the Bank's management to take all steps necessary to achieve full compliance with the Consent Order within the specified timeframes.
The total remediation outlay authorized by the Board, including the CMP, is $57,000,000. This figure reflects the Bank's recognition of the seriousness of the deficiencies identified in the Consent Order and its commitment to achieving comprehensive and sustainable remediation. A detailed breakdown of the remediation budget is provided in Section VIII.B of this Self-Certification.
D. Key Milestone Compliance
The Consent Order established a series of deadlines and milestones for the Bank's remediation activities. The following table summarizes each milestone, the required date, and the actual completion date. BRB certifies that it has met or exceeded every milestone established by the Consent Order [TO BE CONFIRMED — all actual completion dates to be verified prior to filing].
As reflected in the table above, BRB achieved OCC non-objection to the selection of Thornfield as the independent consultant ten days ahead of the required deadline, and the engagements of both C&H and Thornfield were executed on schedule. All subsequent milestones have been met on or before their respective required dates [TO BE CONFIRMED]. The Remediation Milestone Tracker, in its final status form showing all milestones completed with actual dates, is attached hereto as Exhibit D.
III. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 1: OFAC SANCTIONS SCREENING
A. Description of Original Deficiency
The Consent Order found that BRB's Office of Foreign Assets Control ("OFAC") sanctions screening system failed to screen 100% of transactions processed through the Bank's BaaS fintech partner channels. This deficiency represented a critical gap in the Bank's sanctions compliance program and posed significant regulatory risk, given the volume and velocity of transactions flowing through BRB's BaaS partnerships.
Specifically, the OCC determined that approximately 12% of transactions originated by NovaPay Technologies Inc. ("NovaPay"), one of BRB's largest BaaS partners, were not subjected to OFAC sanctions screening. This failure encompassed both wire transfer and Automated Clearing House ("ACH") transactions. In calendar year 2023, NovaPay processed approximately 31,700,000 transactions through BRB's banking infrastructure, of which approximately 3,800,000 transactions were unscreened against OFAC sanctions lists. The unscreened transactions resulted from a combination of system configuration errors in the transaction routing architecture, inadequate integration between the NovaPay transaction processing platform and BRB's OFAC screening system, and insufficient quality assurance testing of the screening interface following system updates.
At the time of the Examination, BRB operated 14 active BaaS fintech partnerships, spanning payment processing, lending, deposit products, and card issuance. Total BaaS transaction volume for calendar year 2024 was approximately $74,300,000,000. NovaPay represented the single largest BaaS partner by transaction volume, accounting for approximately 41% of total BaaS transaction volume, or approximately $30,500,000,000. Given NovaPay's outsized share of the Bank's BaaS activity, the OFAC screening gap associated with NovaPay transactions was of particular concern to the OCC.
BRB's OFAC screening program, across all business lines, generated 14,320 screening hits in calendar year 2024. Of those hits, only 12 were determined to be true matches requiring blocking or rejection of the transaction, yielding a false-positive rate of approximately 99.9%. While this high false-positive rate is not atypical for OFAC screening systems, it contributed to operational challenges in alert management and underscored the need for improved screening accuracy and false-positive management processes as part of the broader remediation effort.
B. Remediation Actions Taken
BRB undertook comprehensive remediation actions to address the OFAC sanctions screening deficiencies identified in the Consent Order. These actions encompassed technology upgrades, policy and procedure revisions, BaaS partner engagement, and testing and validation, as described below.
Technology Upgrade. As a core component of the remediation, BRB upgraded its transaction monitoring and sanctions screening technology by implementing Veridian Analytics Inc. ("Veridian") TMS v.10.0, which includes an enhanced OFAC screening module. The upgrade was executed under an amendment to the existing Master Services Agreement between BRB and Veridian (Contract No. VA-BRB-2023-0044, as amended). The TMS v.10.0 implementation included the integration of real-time and batch OFAC sanctions screening capabilities for all 14 BaaS partner transaction flows, ensuring that every transaction — regardless of originating partner, transaction type, or processing channel — is subjected to screening against all applicable OFAC sanctions lists prior to settlement or completion. The technology upgrade is described in further detail in Section VI of this Self-Certification.
Policy and Procedures. BRB developed and implemented a comprehensive enterprise-wide OFAC Compliance Policy and a detailed OFAC Screening Procedures Manual. These documents establish standardized protocols governing all aspects of the Bank's OFAC compliance program, including:
(a) Screening methodology and coverage requirements, specifying that 100% of transactions across all business lines and BaaS partner channels must be screened;
(b) Interdiction and blocking procedures for transactions matching or potentially matching OFAC-sanctioned parties;
(c) Escalation protocols for screening hits, including defined timelines for disposition and senior management notification;
(d) Reporting requirements, including the preparation and filing of blocking reports with OFAC within the required timeframes;
(e) OFAC list management procedures, including the timely ingestion of updates to the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, and non-SDN lists, as well as country-based sanctions programs; and
(f) Roles and responsibilities of all personnel involved in the OFAC screening process, from front-line screening analysts to the BSA Officer and Chief Compliance Officer.
Screening Remediation Testing. BRB, with the assistance of Thornfield Consulting, conducted comprehensive OFAC screening remediation testing to validate that 100% of transactions across all BaaS partner channels are being screened. The testing methodology included end-to-end transaction testing across each of the 14 BaaS partner channels, validation of screening coverage for all transaction types (including wire transfers, ACH transactions, card transactions, and internal transfers), and confirmation that screening is performed against all applicable OFAC sanctions lists. The testing results confirmed 100% screening coverage [TO BE CONFIRMED].
BaaS Partner Engagement. BRB issued formal compliance remediation letters to the three largest BaaS partners identified in the Consent Order as presenting the greatest OFAC screening risk:
(a) NovaPay Technologies Inc., addressed to Ethan Garrison, Chief Executive Officer, demanding enhanced cooperation in ensuring complete and accurate transaction data transmission to support OFAC screening, as well as compliance with the revised BaaS Program Agreement compliance addendum;
(b) FairLend Digital LLC, addressed to Aisha Okonkwo, Chief Executive Officer, with substantially similar demands regarding data sharing and compliance commitments; and
(c) VaultEdge Inc., addressed to Marcus Tan, Chief Executive Officer, with substantially similar demands regarding data sharing and compliance commitments.
Each compliance remediation letter outlined the specific deficiencies identified in the Consent Order, the Bank's expectations for enhanced cooperation, and the consequences of non-compliance, including potential termination of the BaaS partnership.
OFAC Voluntary Self-Disclosure Evaluation. BRB, with the advice of C&H, evaluated whether an OFAC voluntary self-disclosure was warranted in light of the NovaPay screening gaps identified in the Consent Order. The analysis and resulting determination are documented in a privileged memorandum and are not incorporated in or attached to this Self-Certification.
Completion. OFAC screening was fully operational for all BaaS channels as of the November 1, 2025 deadline established by the Consent Order [TO BE CONFIRMED].
C. Current State and Certification
BRB certifies to the OCC that, as of the date of this Self-Certification, 100% of transactions across all business lines and all 14 BaaS partner channels are subject to real-time or batch OFAC sanctions screening against all applicable OFAC sanctions lists. There are no gaps in screening coverage. The Bank's OFAC screening system, as upgraded and validated, provides comprehensive coverage for all transaction types processed through BRB's banking infrastructure, including wire transfers, ACH transactions, card transactions, internal book transfers, and any other transaction types processed for or through BaaS partners.
Screening coverage has been verified by Thornfield Consulting in its Final Validation Report (Exhibit A). The OFAC Screening Remediation Testing Results are attached hereto as Exhibit J.
In addition to achieving 100% screening coverage, BRB has redesigned its false-positive management processes to maintain screening accuracy while reducing unnecessary operational burden. The revised false-positive management procedures include enhanced fuzzy-matching algorithms, improved name-matching logic, and streamlined disposition workflows. These enhancements are designed to ensure that genuine OFAC matches are promptly identified and actioned while reducing the volume of false-positive alerts that consume analyst resources.
BRB has also established ongoing monitoring and periodic testing protocols to ensure the continued integrity of OFAC screening coverage. These protocols include quarterly screening coverage validation testing, daily automated monitoring of screening system uptime and transaction flow coverage, and immediate escalation procedures in the event that any gap in screening coverage is detected.
IV. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 2: SAR FILING DEFICIENCIES
A. Description of Original Deficiency
The Consent Order identified significant deficiencies in BRB's SAR filing processes. These deficiencies were multifaceted, encompassing both a substantial backlog of unreviewed alerts and systemic timeliness failures in the filing of SARs with the Financial Crimes Enforcement Network ("FinCEN").
As of the September 2024 examination date, BRB had accumulated a backlog of approximately 2,400 potentially suspicious activity alerts that had been generated by the Bank's transaction monitoring system but had not been reviewed, investigated, or dispositioned by the Bank's BSA/AML analysts. The existence of this backlog meant that potentially suspicious transactions had gone uninvestigated for extended periods, creating significant regulatory and law enforcement risk.
Beyond the backlog, the OCC found that BRB's average SAR filing time — measured from the date of alert generation to the date of SAR filing with FinCEN — was approximately 78 days. This filing timeline significantly exceeded the regulatory expectation that SARs be filed in a timely manner, generally within 30 days of initial detection of potentially suspicious activity. The protracted filing timelines were attributable to a combination of insufficient analyst staffing, inadequate alert prioritization and triage protocols, inefficient investigation workflows, and the absence of a robust quality assurance framework.
The following data provides context for the scope and scale of BRB's SAR filing operations and the deficiencies identified:
• Total SARs filed in calendar year 2024: 3,847
• Total SARs filed in calendar year 2023: 2,914
• BaaS-related SARs in calendar year 2024: 2,108, representing approximately 54.8% of all SARs filed
• Total transaction monitoring alerts generated in calendar year 2024: 41,500
• SAR conversion rate (SARs filed as a percentage of total alerts): approximately 9.3%
The concentration of BaaS-related SARs — comprising more than half of all SARs filed — reflected the elevated risk profile associated with the Bank's BaaS partnerships and underscored the importance of adequate monitoring and reporting resources dedicated to BaaS transaction activity.
B. Remediation Actions Taken
BRB implemented a comprehensive set of remediation actions to address the SAR filing deficiencies identified in the Consent Order, encompassing temporary staffing augmentation, backlog clearance, a lookback project, revised policies and procedures, and a quality assurance framework.
Temporary Staffing Augmentation. To support the immediate backlog clearance effort and the broader SAR lookback project, BRB engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy 30 temporary full-time equivalent ("FTE") analysts. The engagement was executed under Statement of Work Reference No. PCS-BRB-2025-0012, with a total contract value of $3,600,000 for a twelve-month period (calculated at a rate of $10,000 per month per FTE). The Pinnacle analysts were deployed to BRB's offices and integrated into the Bank's BSA/AML investigation and SAR filing workflows, operating under the direct supervision of Thomas Ikeda, BSA Officer, and the Bank's permanent compliance staff. The temporary analysts supplemented the Bank's existing BSA/AML department staffing, which was increased from 62 to 77 permanent FTEs as described in Section VIII.A of this Self-Certification.
SAR Backlog Triage Protocol. BRB developed and implemented a SAR backlog triage protocol designed to prioritize the review and disposition of the approximately 2,400 backlogged alerts. The triage protocol employed risk-ranking criteria to sequence the review process, ensuring that the highest-risk alerts were addressed first. The risk-ranking criteria included:
(a) Transaction amount and aggregate dollar value;
(b) Customer risk rating, with Tier 1 (high-risk) customers prioritized;
(c) Alert type, with certain alert typologies (e.g., structuring, rapid movement of funds, OFAC-adjacent activity) receiving higher priority;
(d) BaaS partner association, with alerts related to NovaPay, FairLend Digital, and VaultEdge prioritized given the elevated concerns associated with those partners; and
(e) Age of the alert, with the oldest unreviewed alerts receiving prioritization to reduce the maximum aging of the backlog.
SAR Lookback Project. In addition to clearing the existing backlog of 2,400 alerts, BRB conducted a comprehensive SAR lookback project to identify and address any additional potentially suspicious activity that may not have been detected or reported during the period of deficient monitoring and reporting. The lookback project was conducted with the assistance of Pinnacle analysts and under the oversight of Thornfield Consulting. The lookback project was budgeted at $5,500,000 and encompassed the definition of the lookback period, the identification of relevant transaction types and customer populations, and the development of a statistically valid sampling methodology to ensure that the lookback was both comprehensive and efficient. The lookback project resulted in the identification and filing of additional SARs as warranted [TO BE CONFIRMED — number of additional SARs, if any, to be included].
Backlog Clearance. The SAR backlog of approximately 2,400 alerts was fully dispositioned by the June 30, 2025 target date established in the Consent Order [TO BE CONFIRMED]. Each alert was reviewed, investigated, and either escalated for SAR filing or closed with a documented rationale for the no-file determination. The SAR Backlog Clearance Completion Report is attached hereto as Exhibit G.
Interim Reporting. BRB filed an Interim SAR Backlog Status Report with the OCC on or before March 31, 2025, as required by the Consent Order [TO BE CONFIRMED]. The interim report provided the OCC with an update on the status of the backlog clearance effort, including the number of alerts reviewed and dispositioned to date, the risk ranking of remaining alerts, and projected timeline for full clearance.
Revised SAR Policy and Procedures. BRB adopted a comprehensive Revised SAR Policy and Procedures document establishing clear and enforceable standards for all aspects of the SAR filing process. The revised policy establishes the following key requirements:
(a) A 30-day filing timeliness standard, measured from the date of alert generation (or, in cases of manual referral, from the date of referral) to the date of SAR filing with FinCEN;
(b) Defined escalation protocols for alerts that require expedited review or senior management notification, including alerts involving potential terrorism financing, sanctions evasion, or other high-priority typologies;
(c) Quality review requirements, including mandatory supervisory review of all SAR narratives prior to filing and a defined checklist of narrative completeness standards; and
(d) Narrative drafting standards, including minimum content requirements for SAR narratives, standardized formatting, and requirements for the inclusion of supporting transaction data and customer information.
SAR Quality Assurance Framework. BRB developed and implemented a SAR Quality Assurance ("QA") framework designed to provide ongoing assurance regarding the quality, accuracy, and timeliness of SAR filings. The QA framework includes the following components:
(a) QA sampling, encompassing both random sampling of filed SARs and risk-based targeted sampling of SARs in higher-risk categories;
(b) Error tracking and categorization, with defined error types and severity levels;
(c) Root cause analysis of identified errors, including assessment of whether errors are systemic or isolated; and
(d) Corrective action procedures, including remedial training, process adjustments, and, where warranted, disciplinary action.
C. Current State and Certification
BRB certifies to the OCC that, as of the date of this Self-Certification, the SAR backlog identified in the Consent Order has been fully cleared. All approximately 2,400 previously backlogged alerts have been reviewed, investigated, and dispositioned, and SARs have been filed with FinCEN in all cases where filing was warranted.
BRB further certifies that SAR filing timeliness has been reduced from the 78-day average identified in the Consent Order to within 30 days of alert generation [TO BE CONFIRMED — actual metric to be inserted]. The Bank has implemented a sustainable QA process that provides ongoing assurance of SAR filing quality, accuracy, and timeliness.
The performance of BRB's SAR filing processes has been validated by Thornfield Consulting in its Final Validation Report (Exhibit A). The remediation of SAR filing deficiencies represents a fundamental improvement in the Bank's ability to detect, investigate, and report suspicious activity to law enforcement in a timely and effective manner.
V. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 3: CDD/EDD FAILURES
A. Description of Original Deficiency
The Consent Order identified pervasive failures in BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes, particularly with respect to high-risk customer accounts onboarded through the Bank's BaaS fintech partner channels. The OCC determined that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation. These deficiencies were concentrated in accounts onboarded through three of BRB's largest BaaS partners:
(a) NovaPay Technologies Inc., through which BRB maintained approximately 2.1 million end-user accounts. NovaPay's rapid customer onboarding processes, while designed for consumer convenience, resulted in incomplete or insufficient collection of customer identification information, risk assessment documentation, and beneficial ownership information for a substantial subset of accounts;
(b) FairLend Digital LLC, which originated approximately $1.4 billion in consumer and small business loans through BRB in fiscal year 2024. The lending onboarding process for FairLend Digital-originated loans did not consistently capture EDD documentation required for higher-risk borrowers, including those in certain geographic regions, industries, or transaction patterns warranting enhanced scrutiny; and
(c) VaultEdge Inc., through which BRB maintained approximately 870,000 deposit accounts. VaultEdge's account opening processes presented similar deficiencies, with inadequate verification of customer identity, insufficient risk-rating documentation, and incomplete beneficial ownership records for business accounts.
The 47,000 high-risk accounts identified as lacking adequate CDD or EDD documentation represented a significant vulnerability in the Bank's BSA/AML compliance program, as the inability to adequately identify, verify, and assess the risk profile of customers is a foundational failure that undermines the effectiveness of all downstream BSA/AML controls, including transaction monitoring, suspicious activity identification, and OFAC sanctions screening.
B. Remediation Actions Taken
BRB undertook a comprehensive CDD/EDD remediation project to address the deficiencies identified in the Consent Order. The project was executed on a phased basis, with defined milestones aligned to the Consent Order's requirements, and was budgeted at $4,300,000.
Remediation Methodology. BRB developed a CDD/EDD remediation methodology employing risk-based prioritization principles. The methodology prioritized the remediation of BaaS-onboarded accounts based on customer risk score, transaction volume, and BaaS partner association. Accounts with the highest risk scores, the greatest transaction volumes, and associations with the BaaS partners of greatest concern (NovaPay, FairLend Digital, and VaultEdge) were remediated first. This risk-based approach ensured that the accounts presenting the greatest potential for illicit finance risk were addressed at the earliest possible stage of the remediation project.
Phased Approach. The Consent Order established two key milestones for the CDD/EDD remediation:
(a) 50% Milestone (23,500 accounts): Targeted for July 15, 2025. BRB achieved remediation of 23,500 of the 47,000 identified accounts by this date [TO BE CONFIRMED].
(b) 100% Milestone (47,000 accounts): Targeted for January 15, 2026. BRB achieved remediation of all 47,000 identified accounts by this date [TO BE CONFIRMED].
The phased approach allowed BRB to demonstrate measurable progress to the OCC at the midpoint of the remediation timeline while maintaining momentum toward full completion. The CDD/EDD Remediation Completion Report, documenting the remediation of all 47,000 accounts, is attached hereto as Exhibit H.
Revised CDD/EDD Policy. BRB adopted a comprehensive Revised CDD/EDD Policy addressing all aspects of the Bank's customer identification and due diligence requirements. The revised policy covers the following areas:
(a) Customer Identification Program ("CIP") procedures, including documentary and non-documentary verification methods;
(b) Risk rating methodology, including the criteria and factors used to assign risk ratings to customers and accounts, with specific provisions for BaaS-onboarded customers;
(c) Beneficial ownership requirements, including compliance with FinCEN's Beneficial Ownership Rule and the collection and verification of beneficial ownership information for legal entity customers;
(d) Enhanced Due Diligence standards for high-risk customers, including those in high-risk jurisdictions, industries, or product categories, as well as politically exposed persons and their associates;
(e) Ongoing monitoring standards, including requirements for transaction activity monitoring relative to expected account activity and for the identification of changes in customer risk profile;
(f) Periodic review cycles, specifying the frequency and scope of CDD/EDD reviews based on customer risk rating (e.g., annual reviews for high-risk customers, biennial reviews for medium-risk customers); and
(g) Specific requirements for BaaS-onboarded customers, reflecting the unique risks and operational considerations associated with customers onboarded through fintech partner platforms rather than through BRB's own direct channels.
BaaS Partner CDD/EDD Responsibility Matrix. A critical component of the CDD/EDD remediation was the development of a BaaS Partner CDD/EDD Responsibility Matrix. This matrix delineates, for each of the Bank's 14 BaaS partners, the respective responsibilities of BRB (as the chartered national bank) and the fintech partner for customer onboarding and ongoing due diligence activities. The responsibility matrix reflects the fundamental regulatory principle that BRB, as the bank charter holder, retains ultimate responsibility for BSA/AML compliance for all customer accounts and transactions processed through its banking infrastructure, regardless of whether certain onboarding or due diligence functions are delegated to fintech partners. The matrix specifies which CDD/EDD functions may be performed by fintech partners, the standards to which those functions must be performed, BRB's oversight and quality assurance responsibilities, and the escalation procedures for identified deficiencies.
Progress Tracking. BRB deployed a CDD/EDD progress tracking dashboard to monitor remediation progress against the established milestones in real time. The dashboard was used to generate regular progress reports for the Compliance Committee, senior management, and the OCC. The dashboard tracked the number of accounts remediated, the percentage of completion against the 50% and 100% milestones, the distribution of remediated accounts by BaaS partner and risk category, and any accounts requiring escalation or special handling.
C. Current State and Certification
BRB certifies to the OCC that, as of the date of this Self-Certification, all 47,000 high-risk customer accounts identified in the Consent Order as lacking adequate CDD or EDD documentation have been fully remediated [TO BE CONFIRMED]. Each account has been reviewed, and appropriate CDD and/or EDD documentation has been obtained, verified, and recorded in the Bank's systems of record.
BRB has established an ongoing periodic review cycle to ensure that CDD/EDD documentation for all customer accounts, including those onboarded through BaaS partner channels, is maintained and updated on a regular basis in accordance with the Revised CDD/EDD Policy. The periodic review cycle is designed to prevent recurrence of the documentation gaps identified in the Consent Order and to support the ongoing effectiveness of the Bank's BSA/AML compliance program.
The CDD/EDD remediation has been validated by Thornfield Consulting in its Final Validation Report (Exhibit A).
VI. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 4: TRANSACTION MONITORING MODEL VALIDATION
A. Description of Original Deficiency
The Consent Order found that BRB's transaction monitoring system had not been independently validated in more than three years. BRB utilized the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"), under Contract No. VA-BRB-2023-0044. The most recent independent model validation of the Veridian TMS had been conducted in March 2021, more than three years prior to the commencement of the Examination in March 2024. Regulatory guidance, including the OCC's supervisory expectations and interagency guidance on BSA/AML compliance, establishes the expectation that transaction monitoring models be independently validated on a periodic basis — at minimum annually, or more frequently when material changes to the model, the transaction environment, or the institution's risk profile warrant additional validation.
In addition to the absence of a timely independent validation, the OCC found that the tuning parameters governing the Veridian TMS alert generation thresholds had not been updated since October 2022. Given the significant growth in BRB's BaaS transaction volume between October 2022 and the time of the Examination — including a substantial increase in the number of BaaS partnerships and the volume and complexity of transactions processed — the stale tuning parameters raised concerns about whether the transaction monitoring system was calibrated to detect the types and patterns of suspicious activity relevant to BRB's current risk profile.
For context, BRB filed 28,612 Currency Transaction Reports ("CTRs") in calendar year 2024, reflecting the substantial volume of cash and cash-equivalent transactions flowing through the Bank's infrastructure.
B. Remediation Actions Taken
BRB implemented comprehensive remediation actions to address the transaction monitoring model validation deficiencies, encompassing a major technology upgrade, independent model validation, tuning parameter recalibration, and the establishment of an ongoing validation schedule.
Technology Upgrade to Veridian TMS v.10.0. BRB executed an amendment to its Master Services Agreement with Veridian Analytics Inc. to upgrade from TMS v.8.3 to TMS v.10.0. The upgrade represented a significant enhancement to the Bank's transaction monitoring capabilities, including improved alert detection algorithms, expanded scenario coverage for BaaS-related transaction typologies, enhanced case management functionality, and the integrated OFAC screening module described in Section III.B of this Self-Certification. The financial terms of the upgrade were as follows:
• One-time implementation fee: $2,800,000
• Incremental annual licensing: $1,900,000 per year
• New annual contract value ("ACV"): $6,000,000 per year (increased from $4,100,000 per year under the prior TMS v.8.3 licensing agreement)
A Statement of Work was executed with Veridian specifically addressing the OFAC screening module enhancement as an integral component of the TMS v.10.0 upgrade, ensuring that sanctions screening and transaction monitoring capabilities were deployed as a unified system.
Contingency Planning. As part of prudent project management, BRB evaluated an alternative transaction monitoring platform — Ridgeline Data Systems LLC ("Ridgeline") — as a contingency in the event that the Veridian TMS v.10.0 implementation encountered material delays or performance issues. The Ridgeline platform was evaluated at a proposed ACV of $7,200,000 per year on a five-year term, with a total contract value of $36,000,000. The evaluation, including a detailed vendor comparison assessing functionality, integration requirements, implementation timeline, total cost of ownership, and regulatory suitability, was documented in a vendor comparison memorandum. Ultimately, the Veridian TMS v.10.0 implementation proceeded on schedule, and the Ridgeline contingency was not activated.
Implementation and Deployment. The technology implementation timeline was carefully mapped to the Consent Order deadlines to ensure that the upgraded system was operational within the required timeframes. Veridian TMS v.10.0 User Acceptance Testing ("UAT") was completed and the system was deployed into the production environment by August 1, 2025, as required by the Consent Order [TO BE CONFIRMED].
Independent Model Validation. Following deployment of the Veridian TMS v.10.0, BRB engaged an independent model validation team to conduct a comprehensive validation of the upgraded transaction monitoring system. The independent model validation was completed by October 1, 2025, as required by the Consent Order [TO BE CONFIRMED]. The validation assessed the model's conceptual soundness, data integrity, scenario coverage, alert generation logic, tuning parameter calibration, and overall effectiveness in detecting suspicious activity across all of BRB's business lines and BaaS partner channels. The Independent Model Validation Report for Veridian TMS v.10.0 is attached hereto as Exhibit I.
Tuning Parameter Recalibration. In connection with the TMS v.10.0 upgrade and independent model validation, BRB conducted a comprehensive review and recalibration of all tuning parameters governing the system's alert generation thresholds. The recalibration included a thorough above-the-line/below-the-line threshold review to ensure that alert thresholds are appropriately calibrated to the Bank's current transaction volumes, customer risk profiles, and BaaS partnership activity. The recalibrated tuning parameters reflect the significant changes in BRB's business profile and risk environment since the prior tuning parameter update in October 2022.
Ongoing Validation Schedule. BRB has established a periodic model validation schedule requiring that the Veridian TMS v.10.0 (and any successor transaction monitoring system) be independently validated at least annually. The annual validation cycle will assess continued model performance, the appropriateness of tuning parameters in light of any changes to the Bank's business profile or risk environment, and the need for any model enhancements or adjustments. The validation schedule is documented in the Bank's Revised BSA/AML Policy and the Model Risk Management Framework.
C. Current State and Certification
BRB certifies to the OCC that, as of the date of this Self-Certification, the Veridian TMS v.10.0 has been deployed, independently validated, and is operating with current, appropriately calibrated tuning parameters [TO BE CONFIRMED]. The upgraded transaction monitoring system provides comprehensive coverage for all of BRB's business lines and BaaS partner transaction flows, with enhanced detection capabilities, improved case management functionality, and integrated OFAC screening.
The deployment and validation of the Veridian TMS v.10.0 has been validated by Thornfield Consulting in its Final Validation Report (Exhibit A).
VII. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 5: BOARD-LEVEL OVERSIGHT
A. Description of Original Deficiency
The Consent Order found that the Board of Directors of BRFG — which exercises oversight of BRB as its principal banking subsidiary — did not have a dedicated Compliance Committee. BSA/AML compliance oversight was handled in an ad hoc manner by the full Board and, to a limited extent, by the Audit Committee and Risk Committee, neither of which had a specific mandate for BSA/AML and sanctions compliance oversight.
The OCC further found that BSA/AML reporting to the Board was limited to quarterly presentations that did not include key performance metrics essential for effective Board-level oversight. Specifically, the Board did not receive regular reporting on SAR volumes and filing timeliness, OFAC screening hit rates and disposition outcomes, customer risk ratings and CDD/EDD compliance status, transaction monitoring alert volumes and SAR conversion rates, or risk assessments by BaaS partner. The absence of these metrics meant that the Board lacked the information necessary to discharge its oversight responsibilities for the Bank's BSA/AML and sanctions compliance program, to identify emerging risks, and to hold management accountable for compliance program performance.
B. Remediation Actions Taken
BRB implemented comprehensive governance remediation actions to address the Board-level oversight deficiencies identified in the Consent Order.
Establishment of the Compliance Committee. As described in Section II.C of this Self-Certification, the Board of Directors adopted the Board Resolution on February 28, 2025, establishing a dedicated Compliance Committee as a standing committee of the Board [TO BE CONFIRMED]. The Compliance Committee is chaired by James Rutherford, an independent director with extensive experience in banking regulation and compliance. The Committee's membership includes:
• James Rutherford — Committee Chair
• Arthur Connelly — Lead Independent Director and Chair of the Risk Committee
• Margaret Dao — Chair of the Audit Committee
• Sandra Villarreal — Independent Director
• Keith Yamamoto — Independent Director
The composition of the Compliance Committee was designed to ensure that the Committee benefits from a diversity of perspectives and expertise, including deep familiarity with the Bank's risk management framework (through Mr. Connelly's dual role on the Risk Committee), its internal audit function and financial reporting controls (through Ms. Dao's role as Audit Committee Chair), and its broader business operations and strategic direction.
Compliance Committee Charter. The Board adopted a Compliance Committee Charter (attached hereto as Exhibit C) that defines the Committee's composition, qualifications, authority, responsibilities, meeting frequency, and reporting obligations. Key provisions of the Charter include:
(a) Composition and Qualifications: The Committee shall consist of no fewer than three independent directors, at least one of whom shall have significant experience in banking regulation, BSA/AML compliance, or financial crimes prevention;
(b) Authority: The Committee has the authority to retain independent advisors, to access all Bank information and personnel relevant to its oversight responsibilities, and to direct management to take corrective action as necessary;
(c) Responsibilities: The Committee is responsible for overseeing the Bank's BSA/AML and sanctions compliance program, reviewing and approving BSA/AML policies and procedures, reviewing compliance performance metrics, overseeing the Bank's BaaS compliance oversight framework, and reporting to the full Board on compliance matters;
(d) Meeting Frequency: The Committee is required to meet monthly during the remediation period, transitioning to no less than quarterly following the OCC's determination that the Consent Order has been fully satisfied; and
(e) Reporting Obligations: The Committee is required to provide a report to the full Board following each meeting and to deliver an annual assessment of the Bank's BSA/AML and sanctions compliance program to the full Board and to the OCC.
Bylaws Amendment. The BRFG corporate bylaws were amended to incorporate the Compliance Committee as a standing committee of the Board, ensuring that the Committee's existence and authority are embedded in the corporation's governing documents and are not subject to dissolution without a formal bylaws amendment approved by the Board.
Compliance Committee Reporting Framework. BRB developed and implemented a Compliance Committee Reporting Framework that provides the Committee with comprehensive, standardized BSA/AML and sanctions compliance metrics on a monthly and quarterly basis. The reporting framework includes the following metrics:
• SAR volumes (total and by BaaS partner), including trends and comparisons to prior periods
• SAR filing timeliness (average days from alert generation to SAR filing)
• OFAC screening hit rates, disposition outcomes, and true match rates
• CDD/EDD remediation progress (during the remediation period, tracked against the 47,000-account target; on an ongoing basis, periodic review cycle compliance)
• Transaction monitoring alert volumes and SAR conversion rates
• BaaS partner risk ratings and risk assessment updates
• Remediation milestone status (during the remediation period)
• Regulatory examination findings, supervisory actions, and corrective action status
• BSA/AML budget utilization and staffing levels