1045-00002 · Calderwood & Harkness LLP · documents

comprehensive-remediation-action-plan-draft.docx DOCUMENT Antitrust

17 / 84 ← → ✕

Contract analysis Extract to table

COMPREHENSIVE REMEDIATION ACTION PLAN

BELMONT RIDGE BANK NATIONAL ASSOCIATION

Prepared in Response to OCC Consent Order No. OCC-2025-003

Prepared by:

Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002

Prepared for:

Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845

For Submission to:

Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, NY 10017

Attn: Jonathan Frey, National Bank Examiner / Examiner-in-Charge

Date of Submission: May 15, 2025

Classification: ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL (To the extent applicable; portions intended for regulatory submission)

Document Status: DRAFT — Subject to revision prior to final OCC submission

© 2025 Calderwood & Harkness LLP. All rights reserved. This document has been prepared by Calderwood & Harkness LLP for the sole use of Belmont Ridge Bank National Association and is intended for submission to the Office of the Comptroller of the Currency. Unauthorized reproduction or distribution is prohibited.

I. EXECUTIVE SUMMARY

A. Purpose of the Remediation Action Plan

This Comprehensive Remediation Action Plan (the "RAP" or "Plan") is submitted by Belmont Ridge Bank National Association ("BRB" or the "Bank") pursuant to the requirements of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Consent Order"). The Consent Order directed the Bank to submit, within 120 days of the effective date thereof, a comprehensive remediation plan addressing all identified deficiencies in the Bank's compliance program and related operations. This Plan is submitted in satisfaction of that requirement.

The Plan addresses, in detail, all deficiencies identified in the Consent Order concerning BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program, Office of Foreign Assets Control ("OFAC") sanctions screening, suspicious activity monitoring and reporting, customer due diligence ("CDD") and enhanced due diligence ("EDD") practices, transaction monitoring model validation, and board-level governance and oversight. Each category of deficiency is addressed through a dedicated workstream, with defined milestones, responsible parties, resource allocations, and measurable success criteria.

This Plan has been prepared by Calderwood & Harkness LLP ("C&H"), outside regulatory counsel to BRB, in collaboration with BRB management and the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"). The Plan reflects the findings of Thornfield's preliminary gap assessment delivered on April 15, 2025, as well as the Bank's own internal assessments, the findings of the OCC targeted BSA/AML examination conducted from March 2024 through September 2024, and the independent BSA/AML testing completed by Caldera & Pope LLP in September 2024. The Plan is intended to provide the OCC with a clear, actionable, and comprehensive roadmap for the Bank's return to full regulatory compliance within the twelve-month remediation period established by the Consent Order.

B. Background and Regulatory Context

BRB is a national banking association chartered under the National Bank Act, 12 U.S.C. § 21 et seq., and supervised by the Office of the Comptroller of the Currency. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion. The Bank maintains its principal offices at 680 Lexington Avenue, 22nd Floor, New York, New York 10022.

BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and bank holding company listed on the New York Stock Exchange under the ticker symbol "BRFG." BRFG is supervised by the Board of Governors of the Federal Reserve System as a bank holding company under the Bank Holding Company Act of 1956, as amended.

The Bank operates through four core business lines: (i) retail banking, encompassing consumer deposit accounts, mortgage lending, and consumer credit products; (ii) commercial lending, including commercial real estate, middle-market lending, and small business lending; (iii) wealth management, offering private banking, investment advisory, and trust services; and (iv) fintech Banking-as-a-Service ("BaaS") partnerships, under which the Bank serves as the issuing bank and charter sponsor for technology-driven financial services companies. As of the date of this Plan, BRB maintains relationships with fourteen (14) active fintech sponsors operating through BRB's national bank charter.

The Bank's BaaS business has grown significantly since its inception. In calendar year 2024, BaaS total transaction volume reached approximately $74.3 billion, generating revenue to BRB of approximately $127.4 million. The scale and complexity of this business line are central to the regulatory concerns underlying the Consent Order, as described in greater detail throughout this Plan. BRB employs approximately 5,800 persons across all business lines and corporate functions.

Examination History and Prior Supervisory Actions. The Consent Order followed an extended period of supervisory concern regarding BRB's BSA/AML program, particularly as it relates to the Bank's BaaS operations. The chronology of relevant supervisory events is as follows:

• June 2022 — Matter Requiring Attention ("MRA"): The OCC issued an MRA identifying deficiencies in the Bank's BSA/AML transaction monitoring capabilities, including inadequate staffing levels, delayed alert disposition, and outdated monitoring scenarios that failed to account for the growth in BaaS transaction volumes. The Bank was directed to enhance its transaction monitoring program and staffing levels.

• November 2023 — Matter Requiring Immediate Attention ("MRIA"): The OCC elevated its supervisory concerns by issuing an MRIA regarding gaps in the Bank's OFAC sanctions screening processes, specifically identifying the failure to screen all transactions processed through the NovaPay Technologies channel. The MRIA required prompt remediation and enhanced reporting.

• March 2024 – September 2024 — Targeted BSA/AML Examination: The OCC conducted a targeted examination of BRB's BSA/AML compliance program, with particular focus on BaaS operations, OFAC screening, SAR filing timeliness, CDD/EDD practices, and transaction monitoring model governance. The examination concluded in September 2024 with findings that formed the basis of the Consent Order.

• September 2024 — Caldera & Pope Independent BSA/AML Testing: Contemporaneously with the conclusion of the OCC examination, Caldera & Pope LLP completed an independent BSA/AML test that identified deficiencies substantially echoing the OCC's examination findings, including inadequate SAR filing processes, CDD/EDD documentation gaps, and outdated transaction monitoring model parameters.

The Consent Order, issued on January 15, 2025, cites the Bank's failure to adequately remediate the June 2022 MRA and the November 2023 MRIA as an aggravating factor. The Consent Order assesses a civil money penalty ("CMP") of $14.5 million, which was payable within sixty (60) days of the effective date (i.e., by March 16, 2025). The Bank paid the CMP in full on March 14, 2025.

Parallel Regulatory Matters. As of the date of this Plan, no criminal referral to the U.S. Department of Justice ("DOJ") has been made in connection with the matters underlying the Consent Order. However, the Consent Order does not preclude future referral, and the Bank acknowledges the possibility of further governmental inquiry. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. FinCEN's liaison for this matter is Angela Drummond, Associate Director, Enforcement Division. While no separate FinCEN enforcement action has been filed, FinCEN has expressly reserved its rights to take independent enforcement action, consistent with the OCC's coordination framework described in the Consent Order. The Bank, through C&H, maintains ongoing communication with FinCEN regarding the Bank's remediation progress, and this Plan addresses FinCEN's monitoring interests.

C. Summary of Core Deficiency Categories

The Consent Order identifies five principal categories of deficiency in BRB's BSA/AML compliance program. These categories, summarized below and addressed in detail in Sections IV through VIII of this Plan, form the organizing framework for the Bank's remediation efforts.

1. OFAC Sanctions Screening Deficiencies (Workstream 1). The Bank's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels. The most significant gap was identified in the NovaPay Technologies transaction flow, where approximately 12% of wire and Automated Clearing House ("ACH") transactions were not screened against OFAC sanctions lists during calendar year 2023. This represented approximately 3.8 million unscreened transactions out of a total of 31.7 million NovaPay transactions during the relevant period. Additional, less significant screening gaps were identified in other BaaS partner transaction flows. The failure to achieve comprehensive sanctions screening constitutes a fundamental deficiency in the Bank's OFAC compliance program and presents significant enforcement risk.

2. SAR Filing Deficiencies (Workstream 2). As of September 2024, a backlog of approximately 2,400 potentially suspicious activity alerts remained unreviewed within the Bank's transaction monitoring system. The average time from alert generation to SAR filing was 78 days, significantly exceeding the 30-day regulatory expectation for timely filing of SARs with FinCEN. The accumulation of this backlog reflects inadequate staffing levels, inefficient workflow processes, and insufficient management oversight of the SAR filing function.

3. CDD/EDD Failures (Workstream 3). Approximately 47,000 high-risk customer accounts, predominantly onboarded through the Bank's fintech BaaS partners, were identified as lacking adequate CDD or EDD documentation. These deficiencies include missing or incomplete Customer Identification Program ("CIP") verification, absent beneficial ownership records, incomplete risk assessments, and the failure to conduct periodic reviews of high-risk customers. The volume of deficient accounts reflects systemic weaknesses in the Bank's customer onboarding controls and in the delineation of due diligence responsibilities between BRB and its fintech partners.

4. Model Validation Deficiencies (Workstream 4). The Bank's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — a gap of more than three years at the time of the OCC examination. The system's tuning parameters had last been updated in October 2022, more than two years prior to the examination. The OCC found that the absence of regular validation and tuning resulted in both the under-detection of potentially suspicious activity and the generation of excessive false-positive alerts, undermining the effectiveness of the Bank's monitoring program.

5. Board Oversight Deficiencies (Workstream 5). Prior to the Consent Order, the BRFG Board of Directors did not maintain a dedicated Compliance Committee. BSA/AML reporting to the full Board was conducted on a quarterly basis and excluded key performance and risk metrics, including SAR filing volumes and timeliness, OFAC screening hit rates, and individualized risk ratings for each BaaS partner. The OCC concluded that the Board lacked the information and governance infrastructure necessary for effective oversight of the Bank's compliance program, particularly given the scale and risk profile of the BaaS business.

D. Summary of Remediation Approach

The Bank's remediation approach is organized into five integrated workstreams, each corresponding to a category of deficiency identified in the Consent Order, together with a cross-cutting BaaS partnership oversight initiative that supports multiple workstreams. Each workstream is defined by specific milestones, responsible parties, dedicated resource allocations, and measurable success criteria. The workstreams are designed to operate concurrently, with coordination managed through the Remediation Steering Committee described in Section III.

The total remediation budget for the Plan is $42.5 million, exclusive of the $14.5 million CMP. The total financial outlay, including the CMP, is $57.0 million. The Board of Directors of BRFG authorized this remediation budget by resolution adopted on February 28, 2025.

The remediation period extends from February 10, 2025, through February 15, 2026, representing approximately twelve months of intensive remediation activity. The engagement with C&H is structured in two phases: Phase 1 (Assessment and Remediation Plan Development, from February 10, 2025 through May 15, 2025) and Phase 2 (Implementation and Monitoring, from May 16, 2025 through February 15, 2026). The independent consultant, Thornfield, is providing ongoing assessment and validation throughout the twelve-month engagement, with its final validation report due on February 15, 2026.

The Board of Directors of BRFG adopted a formal resolution on February 28, 2025, acknowledging the Consent Order, establishing a dedicated Compliance Committee of the Board, and authorizing the $42.5 million remediation budget. This resolution reflects the Board's commitment to full and timely compliance with the Consent Order and to the establishment of a compliance infrastructure commensurate with the Bank's risk profile.

E. Key Personnel

The following individuals hold key responsibilities in connection with the remediation program and are identified for the OCC's reference:

BRB / BRFG Management and Officers:

• Diane Whitford — Chief Executive Officer and Board Chair, Belmont Ridge Financial Group, Inc.

• Raymond Okoye — President and Chief Operating Officer

• Gregory Nardone — General Counsel and Corporate Secretary

• Patricia Langston — Chief Compliance Officer (appointed January 2024)

• Thomas Ikeda — BSA Officer / AML Program Director (appointed March 2023)

• Melissa Chu — Chief Risk Officer

• Warren Ashby — Head of Fintech Partnerships / BaaS Division

• Linda Petrosian — Chief Information Officer / Chief Technology Officer

• Derek Ballard — Head of Internal Audit

• Samantha Reeves — Chief Financial Officer (responsible for CMP payment and vendor disbursements)

BRFG Board of Directors (relevant committee assignments):

• James Rutherford — Chair, Compliance Committee (newly established)

• Arthur Connelly — Lead Independent Director; Chair, Risk Committee; Member, Compliance Committee

• Margaret Dao — Chair, Audit Committee

• Sandra Villarreal — Member, Compliance Committee

• Keith Yamamoto — Member, Compliance Committee

Outside Counsel — Calderwood & Harkness LLP:

• Philip Hartmann — Responsible Partner

• Yuki Nakamura — Lead Associate

• Carlos Espinoza — Working Associate

• Marcus Delgado — Billing Partner (cross-staffed for fintech patent/licensing compliance overlap in BaaS arrangements)

Independent Consultant — Thornfield Consulting Group LLC:

• Dr. Vivian Castellano — Managing Director, Engagement Lead

• Robert Eastman — Senior Director, AML Transaction Monitoring

• Jennifer Hwang — Director, Sanctions & OFAC Compliance

• Nathaniel Burgess — Director, Fintech & Payments Compliance

II. CONSENT ORDER REQUIREMENTS AND COMPLIANCE OBLIGATIONS

A. Summary of Consent Order Articles

OCC Consent Order No. OCC-2025-003 contains multiple substantive articles imposing specific obligations on BRB, each with defined deadlines or performance standards. This Section provides an article-by-article summary of the Consent Order's requirements and the Bank's corresponding obligations. Each article is cross-referenced to the workstream(s) within this Plan that address the requirement.

Article I — Effective Date and General Provisions. The Consent Order became effective on January 15, 2025. It remains in effect until terminated by the OCC upon written notification. The Bank consented to the issuance of the Consent Order without admitting or denying any of the OCC's findings, except as to facts admitted in the stipulation accompanying the Consent Order. The Consent Order is enforceable under 12 U.S.C. § 1818.

Article II — Comprehensive Remediation Action Plan. The Bank is required to submit to the OCC a comprehensive remediation action plan within 120 days of the effective date (i.e., by May 15, 2025). The plan must address each deficiency identified in the Consent Order, including OFAC sanctions screening, SAR filing processes, CDD/EDD practices, transaction monitoring model validation, and board-level governance. This Plan constitutes the Bank's submission in satisfaction of Article II.

Article III — OFAC Sanctions Screening. The Bank is required to achieve 100% screening coverage for all transactions across all business lines, including all BaaS partner channels, by no later than November 1, 2025. The Bank must implement real-time screening capabilities for wire, ACH, card, and all BaaS partner transaction flows and must adopt revised OFAC compliance policies and procedures.

Article IV — SAR Filing Remediation. The Bank is required to clear the existing backlog of approximately 2,400 unreviewed suspicious activity alerts by no later than June 30, 2025. The Bank must reduce its average SAR filing time to within 30 days of alert generation on a sustained basis and must conduct a comprehensive lookback review to identify any potentially suspicious activity that was missed during the period in which the backlog accumulated.

Article V — Customer Due Diligence and Enhanced Due Diligence. The Bank is required to complete CDD/EDD remediation for 100% of the approximately 47,000 identified high-risk accounts by January 15, 2026, with an interim milestone of 50% completion (23,500 accounts) by July 15, 2025. The Bank must revise its CDD/EDD policies and procedures for all channels, including BaaS, and must establish clear responsibility allocations between the Bank and its fintech partners.

Article VI — Transaction Monitoring Model Validation. The Bank is required to conduct an independent validation of its transaction monitoring system by October 1, 2025. The Bank must re-tune all monitoring scenarios, thresholds, and parameters and must establish a policy requiring annual independent model validation and periodic tuning reviews.

Article VII — Board Oversight and Governance. The Bank is required to establish a dedicated Compliance Committee of the Board within 45 days of the effective date (i.e., by March 1, 2025). The Compliance Committee must receive monthly reporting during the remediation period on specified metrics, including SAR volumes, OFAC screening coverage, CDD/EDD remediation progress, and BaaS partner risk ratings.

Article VIII — Independent Consultant. The Bank is required to retain an independent consultant, acceptable to the OCC, to assess the Bank's BSA/AML compliance program, monitor remediation progress, and deliver a final validation report by February 15, 2026. The independent consultant must have access to all Bank records, personnel, and facilities relevant to the engagement.

Article IX — Civil Money Penalty. A civil money penalty of $14,500,000 is assessed against the Bank, payable within 60 days of the effective date (by March 16, 2025). The CMP was paid in full on March 14, 2025.

Article X — Reporting Requirements. The Bank is required to submit quarterly progress reports to the OCC detailing remediation status across all workstreams. The first quarterly report is due September 15, 2025; the second quarterly report is due December 15, 2025. An interim SAR backlog status report is due March 31, 2025. A compliance self-certification is due February 15, 2026.

Article XI — Cooperation. The Bank is required to cooperate fully with the OCC and the independent consultant throughout the remediation period, including providing unrestricted access to records, personnel, and facilities.

Article XII — Miscellaneous Provisions. The Consent Order provides that it does not preclude any additional action by the OCC, FinCEN, or other federal agencies. The Bank is required to notify the OCC promptly of any material development that may affect compliance with the Consent Order.

B. Mapping of Consent Order Requirements to Workstreams

The following table provides a cross-reference mapping each substantive article of the Consent Order to the corresponding workstream(s) within this Plan. Several Consent Order requirements overlap across workstreams; in these cases, coordination responsibilities are identified in the Accountability Matrix in Section XI.

C. Compliance Deadline Calendar

The following table consolidates all key compliance deadlines under the Consent Order and this Plan, listed in chronological order. This calendar is reproduced in expanded form in Appendix A.

III. GOVERNANCE AND OVERSIGHT FRAMEWORK FOR THE REMEDIATION

A. Remediation Steering Committee

To ensure coordinated execution across all workstreams, the Bank has established a Remediation Steering Committee (the "Steering Committee") responsible for the day-to-day management, coordination, and oversight of remediation activities. The Steering Committee serves as the central governance body for the remediation program, ensuring alignment of workstream activities, resolution of cross-functional dependencies, and timely escalation of material issues.

Composition. The Steering Committee is composed of the following members:

• Gregory Nardone (Chair) — General Counsel and Corporate Secretary

• Patricia Langston — Chief Compliance Officer

• Thomas Ikeda — BSA Officer / AML Program Director

• Melissa Chu — Chief Risk Officer

• Warren Ashby — Head of Fintech Partnerships / BaaS Division

• Linda Petrosian — Chief Information Officer / Chief Technology Officer

• Derek Ballard — Head of Internal Audit

Meeting Cadence. The Steering Committee meets weekly during Phase 1 of the remediation (February 10, 2025 through May 15, 2025) and bi-weekly during Phase 2 (May 16, 2025 through February 15, 2026). The Steering Committee may convene special sessions as needed to address urgent matters or milestone-critical issues.

Reporting Line. The Steering Committee reports directly to the Chief Executive Officer (Diane Whitford) and the Board Compliance Committee (James Rutherford, Chair). The Steering Committee provides a written status report to the CEO and Compliance Committee following each meeting, summarizing workstream progress, open issues, risk items, and any requests for escalation or resource reallocation. Meeting agendas and minutes are maintained as part of the remediation record and are available for OCC review.

Decision-Making Authority. The Steering Committee has the authority to approve workstream-level decisions, allocate resources within the approved budget, and prioritize competing remediation activities. Decisions that involve material changes to remediation milestones, budget reallocations exceeding $500,000, or potential deviations from Consent Order requirements require escalation to the CEO and, where appropriate, the Board Compliance Committee.

B. Board-Level Oversight

Compliance Committee. In direct response to Consent Order Article VII, the Board of Directors of BRFG established a dedicated Compliance Committee by formal resolution adopted on February 28, 2025. The Compliance Committee is a standing committee of the Board with specific authority and responsibility for oversight of the Bank's BSA/AML compliance program, OFAC sanctions compliance, and remediation activities under the Consent Order.

Compliance Committee Members:

• James Rutherford (Chair) — Independent Director; former Senior Deputy Comptroller, OCC (retired 2018)

• Arthur Connelly — Lead Independent Director; also serves as Chair of the Risk Committee

• Sandra Villarreal — Independent Director; former General Counsel, National Bank of the Southwest

• Keith Yamamoto — Independent Director; former Managing Director, Global Financial Crimes Compliance, Westvale Group

The membership of the Compliance Committee has been selected to ensure the committee possesses requisite expertise in regulatory compliance, BSA/AML matters, and financial services risk management. The OCC's attention is respectfully directed to the qualifications of the committee membership, which include extensive experience in federal bank supervision, compliance law, and financial crimes compliance.

Reporting Cadence. Management provides monthly reporting to the Compliance Committee during the remediation period. Following the conclusion of the remediation period, reporting will transition to a quarterly cadence, unless the Compliance Committee or the OCC determines that more frequent reporting remains necessary.

Key Metrics for Board Reporting. The monthly Compliance Committee reporting package includes the following metrics and information:

(a) SAR filing volumes (total, by business line, and by BaaS partner) and filing timeliness metrics (average days from alert generation to filing, percentage of SARs filed within 30 days);

(b) OFAC screening hit rates, coverage percentages (by business line and BaaS partner channel), and disposition statistics (true matches, false positives, blocked transactions);

(c) CDD/EDD remediation progress against milestones, including number of accounts remediated, percentage completion, and projected completion date;

(d) Transaction monitoring alert volumes, disposition statistics, and SAR conversion rates;

(e) Risk ratings by BaaS partner, including any changes in risk rating and the rationale therefor;

(f) Remediation milestone tracker, showing status of all milestones identified in this Plan (on track, at risk, or delayed);

(g) Budget expenditures and variance from approved budget;

(h) Summary of any material communications with the OCC, FinCEN, or the independent consultant; and

(i) Open issues, risk items, and recommendations for Board action.

Audit Committee. The Audit Committee, chaired by Margaret Dao, receives parallel reporting on internal audit activities and independent testing results related to the remediation. The Audit Committee reviews the scope and findings of internal audit work conducted by Derek Ballard's team, as well as the results of independent testing by Caldera & Pope LLP.

Risk Committee. The Risk Committee, chaired by Arthur Connelly, receives escalation of enterprise risk issues related to the remediation, including technology implementation risks, BaaS partner non-cooperation risks, and reputational risks arising from the enforcement action.

C. Outside Counsel Role and Engagement

Calderwood & Harkness LLP serves as outside regulatory counsel to BRB and BRFG in connection with the Consent Order and all related remediation activities. C&H's engagement encompasses regulatory advisory services, remediation plan development and drafting, regulatory correspondence with the OCC and FinCEN, independent consultant oversight, and general strategic counsel regarding the Bank's compliance posture.

C&H Team. The C&H team assigned to this engagement is led by Philip Hartmann, a senior partner in C&H's Financial Institutions Regulatory Practice with over 25 years of experience in bank regulatory enforcement matters. The team includes:

• Philip Hartmann — Responsible Partner; oversight of all regulatory interactions, remediation strategy, and Board-level advisory

• Yuki Nakamura — Lead Associate; day-to-day management of workstream coordination, SAR backlog oversight, and BaaS partner compliance matters

• Carlos Espinoza — Working Associate; CDD/EDD remediation support, transaction monitoring model validation, and policy drafting

• Marcus Delgado — Billing Partner; also cross-staffed for fintech patent and licensing compliance matters that intersect with BaaS arrangements

Engagement Structure. The engagement is structured in two phases:

• Phase 1 — Assessment and Remediation Plan Development (February 10, 2025 through May 15, 2025): Estimated fees of $4,800,000. Phase 1 encompasses the initial assessment of Consent Order requirements, coordination with Thornfield's preliminary gap assessment, development and drafting of this Plan, early-stage regulatory communications with the OCC, and assistance with initial remediation activities (including the SAR Backlog Triage Protocol and interim reporting).

• Phase 2 — Implementation and Monitoring (May 16, 2025 through February 15, 2026): Estimated fees of $3,200,000. Phase 2 encompasses ongoing regulatory advisory services, support for implementation of all workstream activities, preparation of quarterly OCC progress reports, oversight of independent consultant activities, and preparation of the final compliance self-certification.

The total estimated fees for the engagement are $8,000,000. The engagement letter includes a fee collar of ±15%, such that fee overruns above $9,200,000 require written approval from Gregory Nardone, General Counsel. Expenses are capped at $250,000, exclusive of expert and consultant costs that are billed directly to BRB under separate arrangements.

D. Independent Consultant Oversight

Engagement and Non-Objection. Thornfield Consulting Group LLC was engaged effective February 10, 2025, pursuant to Consent Order Article VIII (Engagement Reference: TCG-BRB-2025-001). The OCC's non-objection to Thornfield's engagement was received on February 5, 2025, following submission of Thornfield's qualifications, proposed scope of work, and conflicts clearance documentation.

Thornfield Team. Thornfield has assembled a team of experienced BSA/AML compliance professionals with direct expertise in the areas covered by the Consent Order:

• Dr. Vivian Castellano — Managing Director, Engagement Lead. Dr. Castellano leads the overall engagement and is the primary point of contact for BRB management and the OCC. She has over 20 years of experience in BSA/AML compliance, including prior service as a Senior Compliance Examiner at the Federal Reserve Bank of New York.

• Robert Eastman — Senior Director, AML Transaction Monitoring. Mr. Eastman leads Thornfield's assessment and validation activities related to the Bank's transaction monitoring system, including the Veridian TMS v.10.0 upgrade and independent model validation (Workstreams 2 and 4).

• Jennifer Hwang — Director, Sanctions & OFAC Compliance. Ms. Hwang leads the sanctions-specific assessment, including validation of the Bank's OFAC screening remediation (Workstream 1).

• Nathaniel Burgess — Director, Fintech & Payments Compliance. Mr. Burgess leads the assessment of the Bank's BaaS partnership oversight framework and CDD/EDD remediation (Workstream 3 and BaaS Oversight).

Timeline. Thornfield's on-site assessment commenced on March 1, 2025, and its preliminary gap assessment was delivered on April 15, 2025. The findings and recommendations of the preliminary gap assessment have been incorporated into this Plan and are summarized in Appendix D. Thornfield will continue to provide ongoing monitoring and validation services throughout the remediation period, with its final validation report due on February 15, 2026.

Reporting Relationship. Thornfield reports its findings to both BRB management and the OCC. The Bank is required to cooperate fully with Thornfield per the Access and Cooperation Protocol established at the outset of the engagement. Thornfield has unfettered access to all Bank records, personnel, systems, and facilities relevant to the engagement. All Thornfield work product is shared with BRB and C&H, and Thornfield coordinates the timing and content of its reports to the OCC through the Oversight and Communication Protocol.

Fee Structure. Thornfield's engagement fee is a fixed fee of $6,500,000, payable in monthly installments of $541,666.67 over the twelve-month engagement period. Expenses are capped at $400,000 above the fixed fee. The total engagement cost is $6,900,000.

Thornfield's Counsel. Thornfield is represented by Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036, in connection with any legal matters arising from the engagement.

E. Privilege and Confidentiality Protocols

The Bank, C&H, and Thornfield have established a comprehensive privilege and confidentiality protocol governing all communications related to the remediation. This protocol is documented in the Privilege and Confidentiality Side Letter executed among the parties and is designed to preserve the attorney-client privilege and work product protection attaching to C&H's legal advice while facilitating the necessary flow of information to the OCC and FinCEN.

Key Principles of the Privilege Protocol:

• All communications between BRB and C&H for the purpose of obtaining or providing legal advice are subject to the attorney-client privilege and the work product doctrine.

• A common-interest privilege framework has been established among BRB, C&H, and Thornfield, recognizing their shared interest in BRB's compliance with the Consent Order. This framework permits the sharing of privileged information among the parties without waiver, subject to the terms of the Privilege and Confidentiality Side Letter.

• Information shared with the OCC and FinCEN in connection with the remediation is provided pursuant to regulatory reporting obligations and does not constitute a waiver of attorney-client privilege over C&H's underlying legal advice. The Bank specifically reserves its privilege with respect to all C&H legal analysis, strategic recommendations, and attorney work product.

• All remediation-related documents are classified and maintained in accordance with the privilege protocol, with clear delineation between documents intended for regulatory submission and documents protected by privilege. Document management guidelines have been distributed to all key personnel, including instructions regarding email communications, document labeling, and storage.

• Thornfield's reports to the OCC are factual and assessment-oriented in nature and are coordinated with BRB and C&H prior to submission. To the extent that Thornfield's reports incorporate or reference C&H legal advice, appropriate redactions or privilege designations are applied.

IV. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION

A. Current State and Identified Deficiencies

The Consent Order's most acute finding concerns the Bank's failure to achieve comprehensive OFAC sanctions screening for all transactions processed through its fintech BaaS channels. The Bank's OFAC screening infrastructure, as configured prior to the remediation, was designed to screen all transactions originated through the Bank's traditional retail and commercial banking channels. However, the integration of BaaS partner transaction flows into the screening architecture was incomplete, resulting in material gaps in coverage.

NovaPay Technologies Screening Gap. The most significant deficiency was identified in the transaction flow associated with NovaPay Technologies Inc. ("NovaPay"), the Bank's largest BaaS partner by transaction volume. During calendar year 2023, approximately 12% of NovaPay's wire transfer and ACH transactions were not routed through the Bank's OFAC screening module prior to processing and settlement. This represented approximately 3.8 million unscreened transactions out of a total of 31.7 million NovaPay transactions during the period. The root cause of this gap was an API integration deficiency in the data pipeline connecting NovaPay's transaction processing platform to the Bank's Veridian OFAC screening module. Specifically, certain transaction types originated through NovaPay's mobile application were routed through an alternate processing path that bypassed the screening queue.

NovaPay Profile. NovaPay Technologies Inc. is the Bank's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion total BaaS volume in CY 2024). NovaPay offers consumer payment and peer-to-peer transfer services to approximately 2.1 million end-user accounts, all operating under BRB's national bank charter. NovaPay's Chief Executive Officer is Ethan Garrison, and its principal offices are located at 450 Mission Street, Suite 1200, San Francisco, California 94105. NovaPay was onboarded as a BaaS partner in 2021.

OFAC Screening Statistics. In calendar year 2024, the Bank's OFAC screening system generated 14,320 screening hits across all business lines. Of these, 12 were true matches requiring blocking or rejection. The false-positive rate was approximately 99.9% ((14,320 – 12) ÷ 14,320). While a high false-positive rate is not uncommon in OFAC screening, the Bank recognizes that false-positive optimization must be pursued in tandem with the primary objective of achieving 100% screening coverage.

Prior Supervisory History. The OFAC screening deficiency was the subject of the MRIA issued by the OCC in November 2023, which specifically identified the NovaPay screening gap and required prompt remediation. The Bank's prior outside counsel, Drayton Mercer LLP (Helen Frazier, former lead partner), provided guidance on the MRIA response, but the remediation was not completed to the OCC's satisfaction. The Consent Order cites the Bank's failure to adequately remediate the November 2023 MRIA as an aggravating factor.

Additional BaaS Partner Screening Gaps. In addition to the NovaPay gap, the OCC examination and Thornfield's preliminary assessment identified less significant OFAC screening gaps in several other BaaS partner transaction flows. While these gaps were smaller in scale than the NovaPay deficiency, they reflect a systemic weakness in the Bank's integration architecture for BaaS partner transactions and must be remediated across all 14 BaaS partner channels.

B. Remediation Objectives

The objectives of Workstream 1 are as follows:

1. Achieve 100% OFAC Screening Coverage. The Bank will implement sanctions screening for 100% of all transactions across all business lines, including all 14 BaaS partner channels, screened against current OFAC sanctions lists in real time prior to settlement.

2. Implement Real-Time Screening. The Bank will deploy real-time screening capabilities for all transaction types, including wire transfers, ACH transactions, card transactions, and all BaaS partner transaction flows, ensuring that no transaction is processed or settled without first being screened against applicable sanctions lists.

3. Implement Enhanced Batch Screening. The Bank will implement enhanced batch screening processes for retrospective screening (to address the historical NovaPay gap) and periodic rescreening of existing customers and counterparties against updated sanctions lists.

4. Reduce False-Positive Rates. The Bank will pursue optimization of its screening algorithms and tuning parameters to reduce the false-positive rate while maintaining 100% screening coverage. False-positive reduction will be achieved through improved matching logic, enhanced list management, and scenario-specific tuning.

5. Establish Robust Escalation and Reporting Procedures. The Bank will implement documented procedures for the escalation, interdiction, and blocking of sanctions-matched transactions, as well as timely OFAC reporting, including the 10-day blocking report requirement.

C. Remediation Activities and Milestones

The following activities will be undertaken to achieve the objectives of Workstream 1:

1. Veridian OFAC Module Enhancement. As part of the broader Veridian TMS v.10.0 upgrade (described in detail in Workstream 4, Section VII), the Bank will deploy an enhanced OFAC screening module with integrated real-time screening capabilities for all 14 BaaS partner transaction flows. A Statement of Work has been executed with Veridian Analytics Inc. (contact: Priya Subramanian, Vice President of Client Solutions) covering the design, development, testing, and deployment of the enhanced OFAC module. The enhanced module will integrate with the Bank's existing core banking platform and will be designed to intercept all transaction types — including wire, ACH, card, and BaaS partner-specific transaction formats — at the point of initiation, prior to settlement.

The enhanced OFAC module will support comprehensive list management, covering the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, the Non-SDN Menu-Based Sanctions List, and all other OFAC lists as may be updated from time to time. The module will incorporate automated list update functionality, ensuring that the Bank's screening reflects the most current OFAC list publications within hours of release.

2. BaaS Channel Integration. Working under the direction of Warren Ashby (Head of Fintech Partnerships) and Linda Petrosian (CIO/CTO), the Bank's technology team will redesign the data architecture connecting each of the 14 BaaS partner transaction processing platforms to the enhanced OFAC screening module. The redesigned architecture will ensure that all BaaS partner API connections route transactions through the enhanced screening module before settlement, with no exception paths or bypass routes. Each partner integration will be individually tested and validated before the partner's transaction flow is migrated to the new architecture.

The integration design phase is targeted for completion by June 15, 2025, with phased migration of partner transaction flows commencing thereafter. NovaPay Technologies, as the highest-volume partner, will be prioritized for integration to address the specific deficiency identified in the Consent Order.

3. Policy and Procedure Updates. The Bank will draft and approve a revised OFAC Compliance Policy and an OFAC Screening Procedures Manual. These documents will comprehensively address the following topics:

(a) Scope of OFAC screening obligations, covering all transaction types and all business lines;

(b) Real-time screening workflows, including system architecture, data flows, and exception handling;

(d) 10-day OFAC blocking report requirements, including preparation, review, and filing procedures;

(e) False-positive disposition and escalation procedures;

(f) Periodic rescreening protocols for existing customers and counterparties;

(g) List management procedures, including automated and manual update protocols;

(h) Recordkeeping and documentation requirements; and

(i) Roles and responsibilities of the BSA/AML department, BaaS Division, and IT department in OFAC compliance.

The revised policy and procedures are targeted for approval by July 1, 2025.

4. NovaPay-Specific Remediation. C&H, on behalf of BRB, has issued a compliance remediation letter to NovaPay Technologies (addressed to Ethan Garrison, CEO) demanding the following:

(a) Enhanced cooperation with BRB's remediation efforts, including full transparency regarding NovaPay's transaction processing architecture;

(b) Provision of complete transaction data for all NovaPay transactions processed during the period in which the screening gap existed, to facilitate retrospective screening;

(d) Compliance commitments regarding NovaPay's own internal controls, including confirmation that NovaPay will not implement any changes to its transaction processing platform that could affect the integrity of BRB's OFAC screening without prior written approval from BRB; and

(e) Acknowledgment of BRB's contractual right to conduct compliance audits of NovaPay's systems and processes.

NovaPay's response is being tracked, and any failure to cooperate will be escalated through the BaaS partner non-cooperation protocols described in Section IX.

5. Testing and Validation. The Bank will implement an OFAC remediation testing plan establishing the methodology for validating that 100% of BaaS transactions are screened prior to settlement upon deployment of the enhanced OFAC module. The testing plan will include:

(a) Sample-based verification across all 14 BaaS partner channels, with statistically significant sample sizes;

(b) End-to-end transaction flow testing for each partner integration, including stress testing under peak transaction volumes;

(d) Regression testing following system updates or partner platform changes; and

COMPREHENSIVE REMEDIATION ACTION PLAN
BELMONT RIDGE BANK NATIONAL ASSOCIATION
Prepared in Response to OCC Consent Order No. OCC-2025-003
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845
For Submission to:
Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, NY 10017
Attn: Jonathan Frey, National Bank Examiner / Examiner-in-Charge
Date of Submission: May 15, 2025
Classification: ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL (To the extent applicable; portions intended for regulatory submission)
Document Status: DRAFT — Subject to revision prior to final OCC submission
© 2025 Calderwood & Harkness LLP. All rights reserved. This document has been prepared by Calderwood & Harkness LLP for the sole use of Belmont Ridge Bank National Association and is intended for submission to the Office of the Comptroller of the Currency. Unauthorized reproduction or distribution is prohibited.
I. EXECUTIVE SUMMARY
A. Purpose of the Remediation Action Plan
This Comprehensive Remediation Action Plan (the "RAP" or "Plan") is submitted by Belmont Ridge Bank National Association ("BRB" or the "Bank") pursuant to the requirements of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Consent Order"). The Consent Order directed the Bank to submit, within 120 days of the effective date thereof, a comprehensive remediation plan addressing all identified deficiencies in the Bank's compliance program and related operations. This Plan is submitted in satisfaction of that requirement.
The Plan addresses, in detail, all deficiencies identified in the Consent Order concerning BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program, Office of Foreign Assets Control ("OFAC") sanctions screening, suspicious activity monitoring and reporting, customer due diligence ("CDD") and enhanced due diligence ("EDD") practices, transaction monitoring model validation, and board-level governance and oversight. Each category of deficiency is addressed through a dedicated workstream, with defined milestones, responsible parties, resource allocations, and measurable success criteria.
This Plan has been prepared by Calderwood & Harkness LLP ("C&H"), outside regulatory counsel to BRB, in collaboration with BRB management and the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"). The Plan reflects the findings of Thornfield's preliminary gap assessment delivered on April 15, 2025, as well as the Bank's own internal assessments, the findings of the OCC targeted BSA/AML examination conducted from March 2024 through September 2024, and the independent BSA/AML testing completed by Caldera & Pope LLP in September 2024. The Plan is intended to provide the OCC with a clear, actionable, and comprehensive roadmap for the Bank's return to full regulatory compliance within the twelve-month remediation period established by the Consent Order.
B. Background and Regulatory Context
BRB is a national banking association chartered under the National Bank Act, 12 U.S.C. § 21 et seq., and supervised by the Office of the Comptroller of the Currency. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion. The Bank maintains its principal offices at 680 Lexington Avenue, 22nd Floor, New York, New York 10022.
BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and bank holding company listed on the New York Stock Exchange under the ticker symbol "BRFG." BRFG is supervised by the Board of Governors of the Federal Reserve System as a bank holding company under the Bank Holding Company Act of 1956, as amended.
The Bank operates through four core business lines: (i) retail banking, encompassing consumer deposit accounts, mortgage lending, and consumer credit products; (ii) commercial lending, including commercial real estate, middle-market lending, and small business lending; (iii) wealth management, offering private banking, investment advisory, and trust services; and (iv) fintech Banking-as-a-Service ("BaaS") partnerships, under which the Bank serves as the issuing bank and charter sponsor for technology-driven financial services companies. As of the date of this Plan, BRB maintains relationships with fourteen (14) active fintech sponsors operating through BRB's national bank charter.
The Bank's BaaS business has grown significantly since its inception. In calendar year 2024, BaaS total transaction volume reached approximately $74.3 billion, generating revenue to BRB of approximately $127.4 million. The scale and complexity of this business line are central to the regulatory concerns underlying the Consent Order, as described in greater detail throughout this Plan. BRB employs approximately 5,800 persons across all business lines and corporate functions.
Examination History and Prior Supervisory Actions. The Consent Order followed an extended period of supervisory concern regarding BRB's BSA/AML program, particularly as it relates to the Bank's BaaS operations. The chronology of relevant supervisory events is as follows:
• June 2022 — Matter Requiring Attention ("MRA"): The OCC issued an MRA identifying deficiencies in the Bank's BSA/AML transaction monitoring capabilities, including inadequate staffing levels, delayed alert disposition, and outdated monitoring scenarios that failed to account for the growth in BaaS transaction volumes. The Bank was directed to enhance its transaction monitoring program and staffing levels.
• November 2023 — Matter Requiring Immediate Attention ("MRIA"): The OCC elevated its supervisory concerns by issuing an MRIA regarding gaps in the Bank's OFAC sanctions screening processes, specifically identifying the failure to screen all transactions processed through the NovaPay Technologies channel. The MRIA required prompt remediation and enhanced reporting.
• March 2024 – September 2024 — Targeted BSA/AML Examination: The OCC conducted a targeted examination of BRB's BSA/AML compliance program, with particular focus on BaaS operations, OFAC screening, SAR filing timeliness, CDD/EDD practices, and transaction monitoring model governance. The examination concluded in September 2024 with findings that formed the basis of the Consent Order.
• September 2024 — Caldera & Pope Independent BSA/AML Testing: Contemporaneously with the conclusion of the OCC examination, Caldera & Pope LLP completed an independent BSA/AML test that identified deficiencies substantially echoing the OCC's examination findings, including inadequate SAR filing processes, CDD/EDD documentation gaps, and outdated transaction monitoring model parameters.
The Consent Order, issued on January 15, 2025, cites the Bank's failure to adequately remediate the June 2022 MRA and the November 2023 MRIA as an aggravating factor. The Consent Order assesses a civil money penalty ("CMP") of $14.5 million, which was payable within sixty (60) days of the effective date (i.e., by March 16, 2025). The Bank paid the CMP in full on March 14, 2025.
Parallel Regulatory Matters. As of the date of this Plan, no criminal referral to the U.S. Department of Justice ("DOJ") has been made in connection with the matters underlying the Consent Order. However, the Consent Order does not preclude future referral, and the Bank acknowledges the possibility of further governmental inquiry. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. FinCEN's liaison for this matter is Angela Drummond, Associate Director, Enforcement Division. While no separate FinCEN enforcement action has been filed, FinCEN has expressly reserved its rights to take independent enforcement action, consistent with the OCC's coordination framework described in the Consent Order. The Bank, through C&H, maintains ongoing communication with FinCEN regarding the Bank's remediation progress, and this Plan addresses FinCEN's monitoring interests.
C. Summary of Core Deficiency Categories
The Consent Order identifies five principal categories of deficiency in BRB's BSA/AML compliance program. These categories, summarized below and addressed in detail in Sections IV through VIII of this Plan, form the organizing framework for the Bank's remediation efforts.
1. OFAC Sanctions Screening Deficiencies (Workstream 1). The Bank's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels. The most significant gap was identified in the NovaPay Technologies transaction flow, where approximately 12% of wire and Automated Clearing House ("ACH") transactions were not screened against OFAC sanctions lists during calendar year 2023. This represented approximately 3.8 million unscreened transactions out of a total of 31.7 million NovaPay transactions during the relevant period. Additional, less significant screening gaps were identified in other BaaS partner transaction flows. The failure to achieve comprehensive sanctions screening constitutes a fundamental deficiency in the Bank's OFAC compliance program and presents significant enforcement risk.
2. SAR Filing Deficiencies (Workstream 2). As of September 2024, a backlog of approximately 2,400 potentially suspicious activity alerts remained unreviewed within the Bank's transaction monitoring system. The average time from alert generation to SAR filing was 78 days, significantly exceeding the 30-day regulatory expectation for timely filing of SARs with FinCEN. The accumulation of this backlog reflects inadequate staffing levels, inefficient workflow processes, and insufficient management oversight of the SAR filing function.
3. CDD/EDD Failures (Workstream 3). Approximately 47,000 high-risk customer accounts, predominantly onboarded through the Bank's fintech BaaS partners, were identified as lacking adequate CDD or EDD documentation. These deficiencies include missing or incomplete Customer Identification Program ("CIP") verification, absent beneficial ownership records, incomplete risk assessments, and the failure to conduct periodic reviews of high-risk customers. The volume of deficient accounts reflects systemic weaknesses in the Bank's customer onboarding controls and in the delineation of due diligence responsibilities between BRB and its fintech partners.
4. Model Validation Deficiencies (Workstream 4). The Bank's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — a gap of more than three years at the time of the OCC examination. The system's tuning parameters had last been updated in October 2022, more than two years prior to the examination. The OCC found that the absence of regular validation and tuning resulted in both the under-detection of potentially suspicious activity and the generation of excessive false-positive alerts, undermining the effectiveness of the Bank's monitoring program.
5. Board Oversight Deficiencies (Workstream 5). Prior to the Consent Order, the BRFG Board of Directors did not maintain a dedicated Compliance Committee. BSA/AML reporting to the full Board was conducted on a quarterly basis and excluded key performance and risk metrics, including SAR filing volumes and timeliness, OFAC screening hit rates, and individualized risk ratings for each BaaS partner. The OCC concluded that the Board lacked the information and governance infrastructure necessary for effective oversight of the Bank's compliance program, particularly given the scale and risk profile of the BaaS business.
D. Summary of Remediation Approach
The Bank's remediation approach is organized into five integrated workstreams, each corresponding to a category of deficiency identified in the Consent Order, together with a cross-cutting BaaS partnership oversight initiative that supports multiple workstreams. Each workstream is defined by specific milestones, responsible parties, dedicated resource allocations, and measurable success criteria. The workstreams are designed to operate concurrently, with coordination managed through the Remediation Steering Committee described in Section III.
The total remediation budget for the Plan is $42.5 million, exclusive of the $14.5 million CMP. The total financial outlay, including the CMP, is $57.0 million. The Board of Directors of BRFG authorized this remediation budget by resolution adopted on February 28, 2025.
The remediation period extends from February 10, 2025, through February 15, 2026, representing approximately twelve months of intensive remediation activity. The engagement with C&H is structured in two phases: Phase 1 (Assessment and Remediation Plan Development, from February 10, 2025 through May 15, 2025) and Phase 2 (Implementation and Monitoring, from May 16, 2025 through February 15, 2026). The independent consultant, Thornfield, is providing ongoing assessment and validation throughout the twelve-month engagement, with its final validation report due on February 15, 2026.
The Board of Directors of BRFG adopted a formal resolution on February 28, 2025, acknowledging the Consent Order, establishing a dedicated Compliance Committee of the Board, and authorizing the $42.5 million remediation budget. This resolution reflects the Board's commitment to full and timely compliance with the Consent Order and to the establishment of a compliance infrastructure commensurate with the Bank's risk profile.
E. Key Personnel
The following individuals hold key responsibilities in connection with the remediation program and are identified for the OCC's reference:
BRB / BRFG Management and Officers:
• Diane Whitford — Chief Executive Officer and Board Chair, Belmont Ridge Financial Group, Inc.
• Raymond Okoye — President and Chief Operating Officer
• Gregory Nardone — General Counsel and Corporate Secretary
• Patricia Langston — Chief Compliance Officer (appointed January 2024)
• Thomas Ikeda — BSA Officer / AML Program Director (appointed March 2023)
• Melissa Chu — Chief Risk Officer
• Warren Ashby — Head of Fintech Partnerships / BaaS Division
• Linda Petrosian — Chief Information Officer / Chief Technology Officer
• Derek Ballard — Head of Internal Audit
• Samantha Reeves — Chief Financial Officer (responsible for CMP payment and vendor disbursements)
BRFG Board of Directors (relevant committee assignments):
• James Rutherford — Chair, Compliance Committee (newly established)
• Arthur Connelly — Lead Independent Director; Chair, Risk Committee; Member, Compliance Committee
• Margaret Dao — Chair, Audit Committee
• Sandra Villarreal — Member, Compliance Committee
• Keith Yamamoto — Member, Compliance Committee
Outside Counsel — Calderwood & Harkness LLP:
• Philip Hartmann — Responsible Partner
• Yuki Nakamura — Lead Associate
• Carlos Espinoza — Working Associate
• Marcus Delgado — Billing Partner (cross-staffed for fintech patent/licensing compliance overlap in BaaS arrangements)
Independent Consultant — Thornfield Consulting Group LLC:
• Dr. Vivian Castellano — Managing Director, Engagement Lead
• Robert Eastman — Senior Director, AML Transaction Monitoring
• Jennifer Hwang — Director, Sanctions & OFAC Compliance
• Nathaniel Burgess — Director, Fintech & Payments Compliance
II. CONSENT ORDER REQUIREMENTS AND COMPLIANCE OBLIGATIONS
A. Summary of Consent Order Articles
OCC Consent Order No. OCC-2025-003 contains multiple substantive articles imposing specific obligations on BRB, each with defined deadlines or performance standards. This Section provides an article-by-article summary of the Consent Order's requirements and the Bank's corresponding obligations. Each article is cross-referenced to the workstream(s) within this Plan that address the requirement.
Article I — Effective Date and General Provisions. The Consent Order became effective on January 15, 2025. It remains in effect until terminated by the OCC upon written notification. The Bank consented to the issuance of the Consent Order without admitting or denying any of the OCC's findings, except as to facts admitted in the stipulation accompanying the Consent Order. The Consent Order is enforceable under 12 U.S.C. § 1818.
Article II — Comprehensive Remediation Action Plan. The Bank is required to submit to the OCC a comprehensive remediation action plan within 120 days of the effective date (i.e., by May 15, 2025). The plan must address each deficiency identified in the Consent Order, including OFAC sanctions screening, SAR filing processes, CDD/EDD practices, transaction monitoring model validation, and board-level governance. This Plan constitutes the Bank's submission in satisfaction of Article II.
Article III — OFAC Sanctions Screening. The Bank is required to achieve 100% screening coverage for all transactions across all business lines, including all BaaS partner channels, by no later than November 1, 2025. The Bank must implement real-time screening capabilities for wire, ACH, card, and all BaaS partner transaction flows and must adopt revised OFAC compliance policies and procedures.
Article IV — SAR Filing Remediation. The Bank is required to clear the existing backlog of approximately 2,400 unreviewed suspicious activity alerts by no later than June 30, 2025. The Bank must reduce its average SAR filing time to within 30 days of alert generation on a sustained basis and must conduct a comprehensive lookback review to identify any potentially suspicious activity that was missed during the period in which the backlog accumulated.
Article V — Customer Due Diligence and Enhanced Due Diligence. The Bank is required to complete CDD/EDD remediation for 100% of the approximately 47,000 identified high-risk accounts by January 15, 2026, with an interim milestone of 50% completion (23,500 accounts) by July 15, 2025. The Bank must revise its CDD/EDD policies and procedures for all channels, including BaaS, and must establish clear responsibility allocations between the Bank and its fintech partners.
Article VI — Transaction Monitoring Model Validation. The Bank is required to conduct an independent validation of its transaction monitoring system by October 1, 2025. The Bank must re-tune all monitoring scenarios, thresholds, and parameters and must establish a policy requiring annual independent model validation and periodic tuning reviews.
Article VII — Board Oversight and Governance. The Bank is required to establish a dedicated Compliance Committee of the Board within 45 days of the effective date (i.e., by March 1, 2025). The Compliance Committee must receive monthly reporting during the remediation period on specified metrics, including SAR volumes, OFAC screening coverage, CDD/EDD remediation progress, and BaaS partner risk ratings.
Article VIII — Independent Consultant. The Bank is required to retain an independent consultant, acceptable to the OCC, to assess the Bank's BSA/AML compliance program, monitor remediation progress, and deliver a final validation report by February 15, 2026. The independent consultant must have access to all Bank records, personnel, and facilities relevant to the engagement.
Article IX — Civil Money Penalty. A civil money penalty of $14,500,000 is assessed against the Bank, payable within 60 days of the effective date (by March 16, 2025). The CMP was paid in full on March 14, 2025.
Article X — Reporting Requirements. The Bank is required to submit quarterly progress reports to the OCC detailing remediation status across all workstreams. The first quarterly report is due September 15, 2025; the second quarterly report is due December 15, 2025. An interim SAR backlog status report is due March 31, 2025. A compliance self-certification is due February 15, 2026.
Article XI — Cooperation. The Bank is required to cooperate fully with the OCC and the independent consultant throughout the remediation period, including providing unrestricted access to records, personnel, and facilities.
Article XII — Miscellaneous Provisions. The Consent Order provides that it does not preclude any additional action by the OCC, FinCEN, or other federal agencies. The Bank is required to notify the OCC promptly of any material development that may affect compliance with the Consent Order.
B. Mapping of Consent Order Requirements to Workstreams
The following table provides a cross-reference mapping each substantive article of the Consent Order to the corresponding workstream(s) within this Plan. Several Consent Order requirements overlap across workstreams; in these cases, coordination responsibilities are identified in the Accountability Matrix in Section XI.
C. Compliance Deadline Calendar
The following table consolidates all key compliance deadlines under the Consent Order and this Plan, listed in chronological order. This calendar is reproduced in expanded form in Appendix A.
III. GOVERNANCE AND OVERSIGHT FRAMEWORK FOR THE REMEDIATION
A. Remediation Steering Committee
To ensure coordinated execution across all workstreams, the Bank has established a Remediation Steering Committee (the "Steering Committee") responsible for the day-to-day management, coordination, and oversight of remediation activities. The Steering Committee serves as the central governance body for the remediation program, ensuring alignment of workstream activities, resolution of cross-functional dependencies, and timely escalation of material issues.
Composition. The Steering Committee is composed of the following members:
• Gregory Nardone (Chair) — General Counsel and Corporate Secretary
• Patricia Langston — Chief Compliance Officer
• Thomas Ikeda — BSA Officer / AML Program Director
• Melissa Chu — Chief Risk Officer
• Warren Ashby — Head of Fintech Partnerships / BaaS Division
• Linda Petrosian — Chief Information Officer / Chief Technology Officer
• Derek Ballard — Head of Internal Audit
Meeting Cadence. The Steering Committee meets weekly during Phase 1 of the remediation (February 10, 2025 through May 15, 2025) and bi-weekly during Phase 2 (May 16, 2025 through February 15, 2026). The Steering Committee may convene special sessions as needed to address urgent matters or milestone-critical issues.
Reporting Line. The Steering Committee reports directly to the Chief Executive Officer (Diane Whitford) and the Board Compliance Committee (James Rutherford, Chair). The Steering Committee provides a written status report to the CEO and Compliance Committee following each meeting, summarizing workstream progress, open issues, risk items, and any requests for escalation or resource reallocation. Meeting agendas and minutes are maintained as part of the remediation record and are available for OCC review.
Decision-Making Authority. The Steering Committee has the authority to approve workstream-level decisions, allocate resources within the approved budget, and prioritize competing remediation activities. Decisions that involve material changes to remediation milestones, budget reallocations exceeding $500,000, or potential deviations from Consent Order requirements require escalation to the CEO and, where appropriate, the Board Compliance Committee.
B. Board-Level Oversight
Compliance Committee. In direct response to Consent Order Article VII, the Board of Directors of BRFG established a dedicated Compliance Committee by formal resolution adopted on February 28, 2025. The Compliance Committee is a standing committee of the Board with specific authority and responsibility for oversight of the Bank's BSA/AML compliance program, OFAC sanctions compliance, and remediation activities under the Consent Order.
Compliance Committee Members:
• James Rutherford (Chair) — Independent Director; former Senior Deputy Comptroller, OCC (retired 2018)
• Arthur Connelly — Lead Independent Director; also serves as Chair of the Risk Committee
• Sandra Villarreal — Independent Director; former General Counsel, National Bank of the Southwest
• Keith Yamamoto — Independent Director; former Managing Director, Global Financial Crimes Compliance, Westvale Group
The membership of the Compliance Committee has been selected to ensure the committee possesses requisite expertise in regulatory compliance, BSA/AML matters, and financial services risk management. The OCC's attention is respectfully directed to the qualifications of the committee membership, which include extensive experience in federal bank supervision, compliance law, and financial crimes compliance.
Reporting Cadence. Management provides monthly reporting to the Compliance Committee during the remediation period. Following the conclusion of the remediation period, reporting will transition to a quarterly cadence, unless the Compliance Committee or the OCC determines that more frequent reporting remains necessary.
Key Metrics for Board Reporting. The monthly Compliance Committee reporting package includes the following metrics and information:
(a) SAR filing volumes (total, by business line, and by BaaS partner) and filing timeliness metrics (average days from alert generation to filing, percentage of SARs filed within 30 days);
(b) OFAC screening hit rates, coverage percentages (by business line and BaaS partner channel), and disposition statistics (true matches, false positives, blocked transactions);
(c) CDD/EDD remediation progress against milestones, including number of accounts remediated, percentage completion, and projected completion date;
(d) Transaction monitoring alert volumes, disposition statistics, and SAR conversion rates;
(e) Risk ratings by BaaS partner, including any changes in risk rating and the rationale therefor;
(f) Remediation milestone tracker, showing status of all milestones identified in this Plan (on track, at risk, or delayed);
(g) Budget expenditures and variance from approved budget;
(h) Summary of any material communications with the OCC, FinCEN, or the independent consultant; and
(i) Open issues, risk items, and recommendations for Board action.
Audit Committee. The Audit Committee, chaired by Margaret Dao, receives parallel reporting on internal audit activities and independent testing results related to the remediation. The Audit Committee reviews the scope and findings of internal audit work conducted by Derek Ballard's team, as well as the results of independent testing by Caldera & Pope LLP.
Risk Committee. The Risk Committee, chaired by Arthur Connelly, receives escalation of enterprise risk issues related to the remediation, including technology implementation risks, BaaS partner non-cooperation risks, and reputational risks arising from the enforcement action.
C. Outside Counsel Role and Engagement
Calderwood & Harkness LLP serves as outside regulatory counsel to BRB and BRFG in connection with the Consent Order and all related remediation activities. C&H's engagement encompasses regulatory advisory services, remediation plan development and drafting, regulatory correspondence with the OCC and FinCEN, independent consultant oversight, and general strategic counsel regarding the Bank's compliance posture.
C&H Team. The C&H team assigned to this engagement is led by Philip Hartmann, a senior partner in C&H's Financial Institutions Regulatory Practice with over 25 years of experience in bank regulatory enforcement matters. The team includes:
• Philip Hartmann — Responsible Partner; oversight of all regulatory interactions, remediation strategy, and Board-level advisory
• Yuki Nakamura — Lead Associate; day-to-day management of workstream coordination, SAR backlog oversight, and BaaS partner compliance matters
• Carlos Espinoza — Working Associate; CDD/EDD remediation support, transaction monitoring model validation, and policy drafting
• Marcus Delgado — Billing Partner; also cross-staffed for fintech patent and licensing compliance matters that intersect with BaaS arrangements
Engagement Structure. The engagement is structured in two phases:
• Phase 1 — Assessment and Remediation Plan Development (February 10, 2025 through May 15, 2025): Estimated fees of $4,800,000. Phase 1 encompasses the initial assessment of Consent Order requirements, coordination with Thornfield's preliminary gap assessment, development and drafting of this Plan, early-stage regulatory communications with the OCC, and assistance with initial remediation activities (including the SAR Backlog Triage Protocol and interim reporting).
• Phase 2 — Implementation and Monitoring (May 16, 2025 through February 15, 2026): Estimated fees of $3,200,000. Phase 2 encompasses ongoing regulatory advisory services, support for implementation of all workstream activities, preparation of quarterly OCC progress reports, oversight of independent consultant activities, and preparation of the final compliance self-certification.
The total estimated fees for the engagement are $8,000,000. The engagement letter includes a fee collar of ±15%, such that fee overruns above $9,200,000 require written approval from Gregory Nardone, General Counsel. Expenses are capped at $250,000, exclusive of expert and consultant costs that are billed directly to BRB under separate arrangements.
D. Independent Consultant Oversight
Engagement and Non-Objection. Thornfield Consulting Group LLC was engaged effective February 10, 2025, pursuant to Consent Order Article VIII (Engagement Reference: TCG-BRB-2025-001). The OCC's non-objection to Thornfield's engagement was received on February 5, 2025, following submission of Thornfield's qualifications, proposed scope of work, and conflicts clearance documentation.
Thornfield Team. Thornfield has assembled a team of experienced BSA/AML compliance professionals with direct expertise in the areas covered by the Consent Order:
• Dr. Vivian Castellano — Managing Director, Engagement Lead. Dr. Castellano leads the overall engagement and is the primary point of contact for BRB management and the OCC. She has over 20 years of experience in BSA/AML compliance, including prior service as a Senior Compliance Examiner at the Federal Reserve Bank of New York.
• Robert Eastman — Senior Director, AML Transaction Monitoring. Mr. Eastman leads Thornfield's assessment and validation activities related to the Bank's transaction monitoring system, including the Veridian TMS v.10.0 upgrade and independent model validation (Workstreams 2 and 4).
• Jennifer Hwang — Director, Sanctions & OFAC Compliance. Ms. Hwang leads the sanctions-specific assessment, including validation of the Bank's OFAC screening remediation (Workstream 1).
• Nathaniel Burgess — Director, Fintech & Payments Compliance. Mr. Burgess leads the assessment of the Bank's BaaS partnership oversight framework and CDD/EDD remediation (Workstream 3 and BaaS Oversight).
Timeline. Thornfield's on-site assessment commenced on March 1, 2025, and its preliminary gap assessment was delivered on April 15, 2025. The findings and recommendations of the preliminary gap assessment have been incorporated into this Plan and are summarized in Appendix D. Thornfield will continue to provide ongoing monitoring and validation services throughout the remediation period, with its final validation report due on February 15, 2026.
Reporting Relationship. Thornfield reports its findings to both BRB management and the OCC. The Bank is required to cooperate fully with Thornfield per the Access and Cooperation Protocol established at the outset of the engagement. Thornfield has unfettered access to all Bank records, personnel, systems, and facilities relevant to the engagement. All Thornfield work product is shared with BRB and C&H, and Thornfield coordinates the timing and content of its reports to the OCC through the Oversight and Communication Protocol.
Fee Structure. Thornfield's engagement fee is a fixed fee of $6,500,000, payable in monthly installments of $541,666.67 over the twelve-month engagement period. Expenses are capped at $400,000 above the fixed fee. The total engagement cost is $6,900,000.
Thornfield's Counsel. Thornfield is represented by Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036, in connection with any legal matters arising from the engagement.
E. Privilege and Confidentiality Protocols
The Bank, C&H, and Thornfield have established a comprehensive privilege and confidentiality protocol governing all communications related to the remediation. This protocol is documented in the Privilege and Confidentiality Side Letter executed among the parties and is designed to preserve the attorney-client privilege and work product protection attaching to C&H's legal advice while facilitating the necessary flow of information to the OCC and FinCEN.
Key Principles of the Privilege Protocol:
• All communications between BRB and C&H for the purpose of obtaining or providing legal advice are subject to the attorney-client privilege and the work product doctrine.
• A common-interest privilege framework has been established among BRB, C&H, and Thornfield, recognizing their shared interest in BRB's compliance with the Consent Order. This framework permits the sharing of privileged information among the parties without waiver, subject to the terms of the Privilege and Confidentiality Side Letter.
• Information shared with the OCC and FinCEN in connection with the remediation is provided pursuant to regulatory reporting obligations and does not constitute a waiver of attorney-client privilege over C&H's underlying legal advice. The Bank specifically reserves its privilege with respect to all C&H legal analysis, strategic recommendations, and attorney work product.
• All remediation-related documents are classified and maintained in accordance with the privilege protocol, with clear delineation between documents intended for regulatory submission and documents protected by privilege. Document management guidelines have been distributed to all key personnel, including instructions regarding email communications, document labeling, and storage.
• Thornfield's reports to the OCC are factual and assessment-oriented in nature and are coordinated with BRB and C&H prior to submission. To the extent that Thornfield's reports incorporate or reference C&H legal advice, appropriate redactions or privilege designations are applied.
IV. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION
A. Current State and Identified Deficiencies
The Consent Order's most acute finding concerns the Bank's failure to achieve comprehensive OFAC sanctions screening for all transactions processed through its fintech BaaS channels. The Bank's OFAC screening infrastructure, as configured prior to the remediation, was designed to screen all transactions originated through the Bank's traditional retail and commercial banking channels. However, the integration of BaaS partner transaction flows into the screening architecture was incomplete, resulting in material gaps in coverage.
NovaPay Technologies Screening Gap. The most significant deficiency was identified in the transaction flow associated with NovaPay Technologies Inc. ("NovaPay"), the Bank's largest BaaS partner by transaction volume. During calendar year 2023, approximately 12% of NovaPay's wire transfer and ACH transactions were not routed through the Bank's OFAC screening module prior to processing and settlement. This represented approximately 3.8 million unscreened transactions out of a total of 31.7 million NovaPay transactions during the period. The root cause of this gap was an API integration deficiency in the data pipeline connecting NovaPay's transaction processing platform to the Bank's Veridian OFAC screening module. Specifically, certain transaction types originated through NovaPay's mobile application were routed through an alternate processing path that bypassed the screening queue.
NovaPay Profile. NovaPay Technologies Inc. is the Bank's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion total BaaS volume in CY 2024). NovaPay offers consumer payment and peer-to-peer transfer services to approximately 2.1 million end-user accounts, all operating under BRB's national bank charter. NovaPay's Chief Executive Officer is Ethan Garrison, and its principal offices are located at 450 Mission Street, Suite 1200, San Francisco, California 94105. NovaPay was onboarded as a BaaS partner in 2021.
OFAC Screening Statistics. In calendar year 2024, the Bank's OFAC screening system generated 14,320 screening hits across all business lines. Of these, 12 were true matches requiring blocking or rejection. The false-positive rate was approximately 99.9% ((14,320 – 12) ÷ 14,320). While a high false-positive rate is not uncommon in OFAC screening, the Bank recognizes that false-positive optimization must be pursued in tandem with the primary objective of achieving 100% screening coverage.
Prior Supervisory History. The OFAC screening deficiency was the subject of the MRIA issued by the OCC in November 2023, which specifically identified the NovaPay screening gap and required prompt remediation. The Bank's prior outside counsel, Drayton Mercer LLP (Helen Frazier, former lead partner), provided guidance on the MRIA response, but the remediation was not completed to the OCC's satisfaction. The Consent Order cites the Bank's failure to adequately remediate the November 2023 MRIA as an aggravating factor.
Additional BaaS Partner Screening Gaps. In addition to the NovaPay gap, the OCC examination and Thornfield's preliminary assessment identified less significant OFAC screening gaps in several other BaaS partner transaction flows. While these gaps were smaller in scale than the NovaPay deficiency, they reflect a systemic weakness in the Bank's integration architecture for BaaS partner transactions and must be remediated across all 14 BaaS partner channels.
B. Remediation Objectives
The objectives of Workstream 1 are as follows:
1. Achieve 100% OFAC Screening Coverage. The Bank will implement sanctions screening for 100% of all transactions across all business lines, including all 14 BaaS partner channels, screened against current OFAC sanctions lists in real time prior to settlement.
2. Implement Real-Time Screening. The Bank will deploy real-time screening capabilities for all transaction types, including wire transfers, ACH transactions, card transactions, and all BaaS partner transaction flows, ensuring that no transaction is processed or settled without first being screened against applicable sanctions lists.
3. Implement Enhanced Batch Screening. The Bank will implement enhanced batch screening processes for retrospective screening (to address the historical NovaPay gap) and periodic rescreening of existing customers and counterparties against updated sanctions lists.
4. Reduce False-Positive Rates. The Bank will pursue optimization of its screening algorithms and tuning parameters to reduce the false-positive rate while maintaining 100% screening coverage. False-positive reduction will be achieved through improved matching logic, enhanced list management, and scenario-specific tuning.
5. Establish Robust Escalation and Reporting Procedures. The Bank will implement documented procedures for the escalation, interdiction, and blocking of sanctions-matched transactions, as well as timely OFAC reporting, including the 10-day blocking report requirement.
C. Remediation Activities and Milestones
The following activities will be undertaken to achieve the objectives of Workstream 1:
1. Veridian OFAC Module Enhancement. As part of the broader Veridian TMS v.10.0 upgrade (described in detail in Workstream 4, Section VII), the Bank will deploy an enhanced OFAC screening module with integrated real-time screening capabilities for all 14 BaaS partner transaction flows. A Statement of Work has been executed with Veridian Analytics Inc. (contact: Priya Subramanian, Vice President of Client Solutions) covering the design, development, testing, and deployment of the enhanced OFAC module. The enhanced module will integrate with the Bank's existing core banking platform and will be designed to intercept all transaction types — including wire, ACH, card, and BaaS partner-specific transaction formats — at the point of initiation, prior to settlement.
The enhanced OFAC module will support comprehensive list management, covering the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, the Non-SDN Menu-Based Sanctions List, and all other OFAC lists as may be updated from time to time. The module will incorporate automated list update functionality, ensuring that the Bank's screening reflects the most current OFAC list publications within hours of release.
2. BaaS Channel Integration. Working under the direction of Warren Ashby (Head of Fintech Partnerships) and Linda Petrosian (CIO/CTO), the Bank's technology team will redesign the data architecture connecting each of the 14 BaaS partner transaction processing platforms to the enhanced OFAC screening module. The redesigned architecture will ensure that all BaaS partner API connections route transactions through the enhanced screening module before settlement, with no exception paths or bypass routes. Each partner integration will be individually tested and validated before the partner's transaction flow is migrated to the new architecture.
The integration design phase is targeted for completion by June 15, 2025, with phased migration of partner transaction flows commencing thereafter. NovaPay Technologies, as the highest-volume partner, will be prioritized for integration to address the specific deficiency identified in the Consent Order.
3. Policy and Procedure Updates. The Bank will draft and approve a revised OFAC Compliance Policy and an OFAC Screening Procedures Manual. These documents will comprehensively address the following topics:
(a) Scope of OFAC screening obligations, covering all transaction types and all business lines;
(b) Real-time screening workflows, including system architecture, data flows, and exception handling;
(c) Interdiction and blocking procedures, including escalation chains and decision authority;
(d) 10-day OFAC blocking report requirements, including preparation, review, and filing procedures;
(e) False-positive disposition and escalation procedures;
(f) Periodic rescreening protocols for existing customers and counterparties;
(g) List management procedures, including automated and manual update protocols;
(h) Recordkeeping and documentation requirements; and
(i) Roles and responsibilities of the BSA/AML department, BaaS Division, and IT department in OFAC compliance.
The revised policy and procedures are targeted for approval by July 1, 2025.
4. NovaPay-Specific Remediation. C&H, on behalf of BRB, has issued a compliance remediation letter to NovaPay Technologies (addressed to Ethan Garrison, CEO) demanding the following:
(a) Enhanced cooperation with BRB's remediation efforts, including full transparency regarding NovaPay's transaction processing architecture;
(b) Provision of complete transaction data for all NovaPay transactions processed during the period in which the screening gap existed, to facilitate retrospective screening;
(c) Technical cooperation with BRB's IT team and Veridian Analytics to implement the redesigned API integration;
(d) Compliance commitments regarding NovaPay's own internal controls, including confirmation that NovaPay will not implement any changes to its transaction processing platform that could affect the integrity of BRB's OFAC screening without prior written approval from BRB; and
(e) Acknowledgment of BRB's contractual right to conduct compliance audits of NovaPay's systems and processes.
NovaPay's response is being tracked, and any failure to cooperate will be escalated through the BaaS partner non-cooperation protocols described in Section IX.
5. Testing and Validation. The Bank will implement an OFAC remediation testing plan establishing the methodology for validating that 100% of BaaS transactions are screened prior to settlement upon deployment of the enhanced OFAC module. The testing plan will include:
(a) Sample-based verification across all 14 BaaS partner channels, with statistically significant sample sizes;
(b) End-to-end transaction flow testing for each partner integration, including stress testing under peak transaction volumes;
(c) Negative testing to confirm that transaction bypass paths have been eliminated;
(d) Regression testing following system updates or partner platform changes; and
(e) Independent validation by Thornfield (Jennifer Hwang) to confirm that the Bank's testing methodology is sound and that screening coverage is complete.
6. Voluntary Self-Disclosure Consideration. C&H and the Bank are conducting an analysis of whether to file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gap. The 3.8 million unscreened transactions in CY 2023 present a potential apparent violation of OFAC regulations if any of those transactions involved sanctioned persons or entities. The analysis considers the following factors: the volume of unscreened transactions, the likelihood that any unscreened transaction involved a sanctioned party (based on retrospective screening results), the potential mitigating credit afforded by a VSD, and the potential risks of disclosure. The determination will be finalized in consultation with C&H and Thornfield and communicated to the OCC as appropriate.
Milestone Schedule — Workstream 1:
D. Resource Allocation
The resource allocation for Workstream 1 is as follows:
• Veridian OFAC Module Enhancement. The costs of the enhanced OFAC screening module are included within the overall Veridian TMS v.10.0 upgrade: $2,800,000 one-time implementation cost, plus $1,900,000 per year incremental licensing. Upon completion of the upgrade, the Bank's total annual Veridian contract value will be $6,000,000 per year (up from the current $4,100,000 per year).
• Internal IT Resources. Linda Petrosian's IT team will dedicate significant engineering resources to the BaaS channel integration effort, including systems architects, API developers, and quality assurance engineers. These resources are funded through the Bank's existing IT budget, supplemented by the Board-authorized remediation allocation.
• Thornfield OFAC Assessment. Jennifer Hwang, Director of Sanctions & OFAC Compliance at Thornfield, leads the sanctions-specific assessment and validation activities. The costs of Thornfield's OFAC-related work are included within the overall Thornfield fixed fee of $6,500,000.
• BaaS Partner Coordination. Warren Ashby's BaaS Division team provides coordination resources for partner engagement, contract amendment negotiation, and compliance remediation letter follow-up.
E. Success Criteria
Workstream 1 will be considered successfully completed when the following criteria are satisfied:
1. One hundred percent (100%) of transactions across all business lines and all 14 BaaS partner channels are screened against current OFAC sanctions lists in real time prior to settlement, as demonstrated through testing and validated by Thornfield.
2. Documented, tested, and validated screening workflows exist for each transaction type and each BaaS partner channel, with no exception paths or bypass routes.
3. The revised OFAC Compliance Policy and OFAC Screening Procedures Manual have been approved and disseminated to all relevant personnel.
4. Thornfield has validated the full operationalization of the enhanced OFAC screening module by November 1, 2025, and has confirmed the completeness and effectiveness of the Bank's screening remediation by November 15, 2025.
5. The Bank has determined and documented its position regarding the OFAC voluntary self-disclosure and has taken appropriate action.
V. WORKSTREAM 2: SAR BACKLOG CLEARANCE AND PROCESS IMPROVEMENT
A. Current State and Identified Deficiencies
At the time of the OCC examination's conclusion in September 2024, the Bank's BSA/AML department maintained a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned. This backlog had accumulated over a period of several months as a result of insufficient staffing, inefficient workflow processes, and the rapid growth in transaction monitoring alert volumes driven by the expansion of the Bank's BaaS business.
Alert Volumes and SAR Filing Statistics. In calendar year 2024, the Bank's transaction monitoring system generated 41,500 alerts. Of these, 3,847 resulted in the filing of SARs with FinCEN, yielding a SAR conversion rate of 9.3%. This conversion rate, while within the range observed at peer institutions, is evaluated in the context of the Bank's significantly elevated alert backlog and the potential for under-filing during the period in which the backlog accumulated.
The average time from alert generation to SAR filing during the relevant period was 78 days, substantially exceeding the 30-day regulatory expectation for timely SAR filing. This delay reflects both the backlog accumulation and inefficiencies in the Bank's investigation and drafting workflows.
Year-Over-Year Trends. Total SARs filed increased from 2,914 in CY 2023 to 3,847 in CY 2024, representing a 32% year-over-year increase. This increase is attributable in part to the growth in BaaS transaction volumes and in part to the Bank's efforts to increase filing capacity in response to the OCC examination.
BaaS Concentration. BaaS-related SARs accounted for 2,108 of the 3,847 total SARs filed in CY 2024, or 54.8% of all filings. This disproportionate concentration reflects the elevated BSA/AML risk profile of the Bank's fintech BaaS business and the fact that BaaS channels generate a significant proportion of the Bank's highest-risk transaction activity.
Staffing. At the time of the OCC examination, the Bank's BSA/AML department consisted of 62 full-time equivalent employees ("FTEs"). The OCC found this staffing level insufficient to manage the volume of alerts, investigations, and SAR filings generated by the Bank's operations, particularly given the scale and complexity of the BaaS business. The staffing deficiency contributed directly to the accumulation of the alert backlog.
Prior Supervisory History. The SAR filing deficiency traces to the MRA issued by the OCC in June 2022, which identified deficiencies in the Bank's BSA/AML transaction monitoring capabilities, including delayed alert disposition and inadequate staffing. While the Bank took certain steps to address the June 2022 MRA, these measures proved insufficient to prevent the accumulation of the backlog identified in the 2024 examination.
B. Remediation Objectives
The objectives of Workstream 2 are as follows:
1. Clear Entire Alert Backlog. The Bank will disposition all 2,400 unreviewed alerts by June 30, 2025, ensuring that each alert is reviewed, investigated (where warranted), and either filed as a SAR or closed with appropriate documentation.
2. Reduce SAR Filing Time. The Bank will reduce its average SAR filing time to within 30 days of alert generation, measured on a rolling monthly basis, and will sustain this performance level on an ongoing basis.
3. Conduct Comprehensive Lookback Review. The Bank will conduct a comprehensive lookback review to identify any potentially suspicious activity that may have been missed during the period in which the backlog accumulated. The lookback will cover both retail and BaaS channels and will employ a risk-based methodology.
4. Establish Sustainable Processes. The Bank will establish staffing levels and workflow processes sufficient to prevent future backlog accumulation, including a capacity model calibrated to current and projected alert volumes.
5. Implement Quality Assurance Framework. The Bank will implement a quality assurance ("QA") framework for SAR filing, including random and risk-based sampling, error tracking, root cause analysis, and corrective action procedures.
C. Remediation Activities and Milestones
1. Backlog Triage. The Bank has implemented a SAR Backlog Triage Protocol that establishes risk-ranking criteria for the 2,400 unreviewed alerts. The triage criteria include transaction amount, customer risk rating, alert type, BaaS partner association, geographic exposure, and the presence of any known red flags. Based on these criteria, each alert has been assigned to one of three triage categories:
• Priority 1 (High Risk): Alerts involving transaction amounts exceeding $100,000, customers with elevated risk ratings (high or very high), alerts associated with NovaPay or other high-volume BaaS partners, and alerts involving potential sanctions or OFAC concerns. Priority 1 alerts are targeted for disposition first.
• Priority 2 (Medium Risk): Alerts involving moderate transaction amounts, medium-risk customers, and standard BaaS partner associations. Priority 2 alerts are dispositioned following completion of Priority 1.
• Priority 3 (Lower Risk): Alerts involving smaller transaction amounts, lower-risk customers, and well-established relationship accounts. Priority 3 alerts are dispositioned last, but no later than the June 30, 2025 deadline.
2. Temporary Staffing Deployment. The Bank has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide 30 full-time-equivalent BSA/AML analysts for a period of 12 months (SOW Reference: PCS-BRB-2025-0012; Andrea Solis, Director of Managed Services). The Pinnacle analysts were deployed and trained by March 15, 2025. These temporary analysts support backlog clearance, the SAR lookback project, and ongoing alert disposition during the remediation period. All Pinnacle staff operate under the direct supervision of Thomas Ikeda, BSA Officer, with quality review oversight provided by the Bank's senior investigative staff.
The Pinnacle engagement contract specifies that all Pinnacle analysts must hold at least two years of relevant BSA/AML investigation experience, must have passed Pinnacle's internal competency assessment, and must complete BRB-specific training covering the Bank's policies, procedures, systems, and BaaS partner profiles prior to commencing work. The Bank retains the right to remove and replace any Pinnacle analyst whose performance does not meet BRB's quality standards.
3. SAR Lookback Project. The Bank will conduct a comprehensive SAR lookback covering the period from January 1, 2023 through September 30, 2024, encompassing the period during which the alert backlog accumulated. The lookback methodology is documented in the SAR Lookback Scope and Methodology Memorandum, which will be finalized by April 30, 2025. The lookback will employ the following approach:
(a) Population Identification: Identification of all transaction monitoring alerts generated during the lookback period, including alerts that were reviewed but may have been improperly dispositioned, and transactions that may not have generated alerts due to outdated monitoring scenarios;
(b) Sample Selection: A statistically valid, risk-stratified sampling methodology covering both retail and BaaS channels, with over-sampling of high-risk populations;
(c) Investigation and Filing: Full investigation of sampled transactions and filing of SARs where warranted;
(d) Retroactive Filing: Filing of any SARs identified through the lookback that should have been filed during the lookback period but were not; and
(e) Documentation: Comprehensive documentation of the lookback methodology, findings, and outcomes.
The lookback budget is $5,500,000, covering investigation costs, Pinnacle analyst time dedicated to the lookback, C&H advisory time, and any technology costs associated with historical data extraction and analysis.
4. Policy and Procedure Updates. The Bank will draft and approve a revised SAR Policy and Procedures establishing the following standards:
(a) A 30-day filing target from alert generation to SAR submission;
(b) Escalation protocols for complex investigations requiring additional time;
(c) Quality review requirements, including supervisory review of all SAR narratives prior to filing;
(d) Narrative drafting standards specifying the content, format, and level of detail required in SAR narratives;
(e) Alert disposition documentation requirements; and
(f) Management reporting requirements, including daily backlog monitoring and weekly filing timeliness metrics.
5. Quality Assurance Framework. Upon completion of the backlog clearance, the Bank will implement a post-remediation QA process that includes:
(a) Random sampling of filed SARs (minimum 10% per month) for quality review;
(b) Risk-based sampling of high-risk SARs (100% of SARs involving BaaS partners exceeding defined transaction thresholds);
(c) Error tracking and classification, with root cause analysis for identified deficiencies;
(d) Corrective action procedures, including retraining, process modifications, and disciplinary measures as warranted; and
(e) Monthly QA reporting to the BSA Officer and CCO, with quarterly reporting to the Compliance Committee.
Milestone Schedule — Workstream 2:
D. Resource Allocation
The resource allocation for Workstream 2 is as follows:
• Pinnacle Compliance Solutions Temporary Staffing: 30 FTEs × $10,000 per month × 12 months = $3,600,000.
• SAR Lookback Project: $5,500,000, covering investigation costs, analyst time, C&H advisory support, and historical data extraction and analysis.
• Internal BSA/AML Department: 62 existing FTEs remain deployed in their current roles, with backlog clearance activities supplementing ongoing operations. An additional 15 new permanent FTEs are being hired as part of Workstream 5 (Governance and Training Enhancement), at an incremental annual cost of $2,250,000 (15 FTEs × $150,000 average fully loaded cost).
• Total Post-Remediation Headcount Target: 77 permanent FTEs (62 existing + 15 new), plus 30 Pinnacle temporary FTEs during the remediation period. The combined workforce of 107 FTEs during the remediation period is designed to simultaneously address the alert backlog, conduct the lookback, maintain current-state alert processing, and handle the anticipated increase in alert volume associated with the TMS upgrade.
E. Success Criteria
Workstream 2 will be considered successfully completed when the following criteria are satisfied:
1. The alert backlog is reduced to zero as of June 30, 2025, with all 2,400 previously unreviewed alerts fully dispositioned (either filed as SARs or closed with documented rationale).
2. The Bank's average SAR filing time is consistently at or below 30 days on a rolling monthly basis, as measured from the date of alert generation to the date of SAR filing with FinCEN.
3. The SAR lookback project is substantially complete by September 30, 2025, with all identified suspicious activity appropriately filed.
4. The QA framework is operational, with error rates below defined thresholds as established in the revised SAR Policy and Procedures.
5. Thornfield has validated the sustainability of the Bank's SAR filing process and has confirmed that the Bank's staffing levels, workflows, and quality controls are adequate to prevent future backlog accumulation.
VI. WORKSTREAM 3: CDD/EDD REMEDIATION
A. Current State and Identified Deficiencies
The OCC examination and Thornfield's preliminary gap assessment identified approximately 47,000 high-risk customer accounts that lack adequate CDD or EDD documentation. These accounts are predominantly associated with customers onboarded through the Bank's fintech BaaS partners. The deficiencies encompass a range of documentation ga

COMPREHENSIVE REMEDIATION ACTION PLAN

BELMONT RIDGE BANK NATIONAL ASSOCIATION

I. EXECUTIVE SUMMARY

II. CONSENT ORDER REQUIREMENTS AND COMPLIANCE OBLIGATIONS

III. GOVERNANCE AND OVERSIGHT FRAMEWORK FOR THE REMEDIATION

IV. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION

Record

Parties

Dates

Amounts