1045-00002 · Calderwood & Harkness LLP · documents

conflicts-check-memorandum.docx DOCUMENT Antitrust

18 / 84 ← → ✕

Contract analysis Extract to table

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

FOR INTERNAL USE ONLY

TO: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group

FROM: Conflicts Department, Calderwood & Harkness LLP

DATE: February 9, 2025

RE: Conflicts Check Results — Proposed Engagement of Belmont Ridge Bank National Association — BSA/AML & Sanctions Compliance Program Uplift

Conflicts Check No.: CC-2025-01124

Matter No.: 1045-00002

1. Purpose and Summary

This memorandum documents the results of the comprehensive conflicts of interest check conducted by the Conflicts Department of Calderwood & Harkness LLP ("C&H" or the "Firm") in connection with the proposed engagement of Belmont Ridge Bank National Association ("BRB") for regulatory advisory services. The proposed engagement relates to BSA/AML and sanctions compliance-program remediation in response to OCC Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency on January 15, 2025. The Consent Order requires BRB to undertake a comprehensive uplift of its Bank Secrecy Act/Anti-Money Laundering compliance program, sanctions screening infrastructure, and related internal controls, particularly with respect to BRB's banking-as-a-service ("BaaS") business line and its fintech partner relationships.

The conflicts check was initiated on February 7, 2025, at the request of Philip Hartmann, Responsible Partner in the Banking & Finance Practice Group, and Marcus Delgado, Billing Partner in the intellectual Property Practice Group. The request was submitted through the Firm's standard conflicts intake system (Intake Form No. IF-2025-0489) and was accompanied by the preliminary engagement letter, a copy of the Consent Order, and a party identification memorandum prepared by Mr. Hartmann's team. All searches were conducted on February 7 and February 8, 2025, using the Firm's Glenrock Health ITCONFLICTS database, supplemented by manual review of the Firm's historical engagement records, lateral hire disclosures, and individual attorney certification responses.

The scope of the conflicts check encompassed all entities and individuals reasonably anticipated to be involved in or affected by the proposed engagement, including the client entities, their officers and directors, relevant regulatory agencies and personnel, third-party consultants, technology vendors, auditors, staffing providers, predecessor counsel, significant shareholders, shareholder counsel, and fintech/BaaS partners. A total of 38 entities and individuals were searched, as detailed in Section 4 below.

Conclusion: No disqualifying conflicts of interest have been identified under the New York Rules of Professional Conduct (Rules 1.7, 1.8, 1.9, 1.10, and 1.18), the applicable ethical rules governing C&H's practice, or C&H's internal conflicts policies. The proposed engagement may proceed, subject to the observations and ongoing monitoring recommendations set forth in Section 6 below. Those recommendations relate to (i) the sensitivity of evaluating predecessor counsel's work product, (ii) potential shareholder-management friction involving a significant shareholder, (iii) the possibility that certain fintech BaaS partners may become adverse to BRB during the remediation process, and (iv) the cross-staffing of an intellectual Property Practice Group partner on a primarily regulatory engagement. None of these observations rises to the level of a disqualifying conflict, but each warrants ongoing vigilance and, in certain scenarios, supplemental conflicts review.

2. Engagement Team

The following attorneys have been identified as the proposed engagement team for Matter No. 1045-00002. Each team member has been individually screened against the full party list set forth in Section 4, including searches for personal relationships, financial interests, prior employment, and any other circumstance that could give rise to an actual or apparent conflict of interest.

• Philip Hartmann — Responsible Partner, Banking & Finance Practice Group. Mr. Hartmann is a partner in the Firm's New York office and has been with C&H since 2009. He specializes in bank regulatory matters, enforcement defense, and compliance-program design. Mr. Hartmann will serve as the engagement's Responsible Partner, maintaining overall supervisory responsibility for the representation, client relationship management, and communications with the OCC and FinCEN. Mr. Hartmann has confirmed that he has no personal conflicts, financial interests in any party identified on the party list, or relationships with any regulator personnel that would preclude his participation in this engagement.

• Marcus Delgado — Billing Partner, intellectual Property Practice Group. Mr. Delgado is a partner in the Firm's New York office and joined C&H in 2015. He specializes in technology licensing, patent portfolio management, and fintech intellectual property matters. Mr. Delgado is cross-staffed on this engagement due to the significant fintech patent and licensing compliance overlap inherent in BRB's BaaS arrangements. His role will encompass review and negotiation of technology licensing agreements with AML technology vendors, evaluation of intellectual property provisions in BaaS partner agreements, and assessment of proprietary technology issues raised by the compliance-program remediation. Mr. Delgado has confirmed that he has no personal conflicts, financial interests in any party identified on the party list, or current IP representations that would create a conflict with the BRB engagement.

• Yuki Nakamura — Lead Associate, Litigation (General) Practice Group. Ms. Nakamura is a sixth-year associate in the Firm's New York office. She has significant experience in regulatory enforcement defense, internal investigations, and compliance remediation matters. Ms. Nakamura will serve as the lead associate on the engagement, responsible for day-to-day management of the remediation work stream, coordination with BRB's internal compliance team, and oversight of the OCC-mandated independent consultant's engagement. Ms. Nakamura has confirmed that she has no personal conflicts or relationships that would preclude her participation.

• Carlos Espinoza — Working Associate, Litigation (General) Practice Group. Mr. Espinoza is a third-year associate in the Firm's New York office. He has experience in banking regulatory matters and BSA/AML compliance advisory work. Mr. Espinoza will support Ms. Nakamura in all aspects of the engagement, including document review, regulatory correspondence drafting, and research. Mr. Espinoza has confirmed that he has no personal conflicts or relationships that would preclude his participation.

All four team members have been individually screened against the complete party list set forth in Section 4 below. No individual conflicts of any nature have been identified for any member of the proposed engagement team.

3. Scope of Engagement

The proposed engagement encompasses the following scope of work, as described in the preliminary engagement letter dated February 6, 2025, and as further refined in discussions between Mr. Hartmann and BRB's General Counsel, Gregory Nardone:

C&H is to serve as outside regulatory counsel to BRB, advising on and assisting with all aspects of BSA/AML and sanctions compliance-program remediation required by OCC Consent Order No. OCC-2025-003. The engagement specifically encompasses the following work streams:

(a) Compliance Program Uplift and Remediation Strategy. Development and implementation of a comprehensive remediation plan to address the deficiencies identified in the Consent Order, including but not limited to inadequate transaction monitoring, deficient suspicious activity report ("SAR") filing processes, insufficient OFAC sanctions screening for BaaS partner transactions, and gaps in customer due diligence and enhanced due diligence procedures.

(b) Regulatory Engagement. Serving as BRB's primary counsel in all communications and interactions with the OCC, including the OCC's Northeastern District Office and the Examiner-in-Charge, Jonathan Frey, as well as with FinCEN's Enforcement Division and Associate Director Angela Drummond. This includes preparation of regulatory submissions, progress reports, and responses to examination findings.

(c) Independent Consultant Oversight. Advising BRB on the engagement and oversight of the OCC-mandated independent consultant, Thornfield Consulting Group LLC. This includes reviewing and negotiating the terms of the independent consultant's engagement, coordinating the scope of the consultant's review, evaluating the consultant's findings and recommendations, and managing BRB's response to the consultant's reports.

(d) Technology Vendor Negotiations. Representing BRB in negotiations with AML technology vendors, including (i) amendments to BRB's existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the TMS v.10.0 transaction monitoring system upgrade, and (ii) evaluation and potential negotiation of a replacement AML technology platform with Ridgeline Data Systems LLC or other vendors.

(e) BaaS Partner Compliance Remediation. Drafting and negotiating compliance remediation correspondence and contractual amendments with BRB's fintech BaaS partners, with particular focus on the three largest partners by transaction volume: NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.

(f) Compliance Infrastructure Restructuring. Advising on the restructuring of BRB's internal compliance organization, including reporting lines, staffing levels, governance frameworks, and the integration of temporary compliance staffing resources from Pinnacle Compliance Solutions LLC.

(g) Managed Services and Staffing Agreements. Drafting and negotiating agreements with temporary compliance staffing providers, including the managed services agreement with Pinnacle Compliance Solutions LLC.

The estimated engagement value is $8,000,000, structured in two phases:

• Phase 1: February 10, 2025 through May 15, 2025. Estimated value: $4,800,000. Phase 1 encompasses initial remediation planning, regulatory engagement strategy development, independent consultant onboarding and initial review, technology vendor evaluation, and BaaS partner compliance notification.

• Phase 2: May 16, 2025 through February 15, 2026. Estimated value: $3,200,000. Phase 2 encompasses implementation of remediation measures, ongoing regulatory reporting, technology system implementation oversight, BaaS partner contractual amendments, and preparation for OCC validation review.

Given the breadth of the engagement and the number of third parties involved, the conflicts check was conducted against an expansive party list. The engagement involves interaction with multiple third parties in capacities ranging from potential adversaries to co-parties, vendors, regulators, and consultants. All identified parties have been screened as set forth in the following section.

4. Parties Searched

The following entities and individuals were searched against the Firm's Glenrock Health ITCONFLICTS database, the Firm's historical engagement records (dating to the Firm's founding), lateral hire conflict disclosures, and individual attorney certifications. Searches were conducted using all known names, aliases, identifiers, and associated entities. A total of 38 discrete parties (entities and individuals) were searched. The results of each search are reported in Section 5.

4.1 Client Entities

The following entities constitute the proposed client for purposes of this engagement:

Principal Office Address: 680 Lexington Avenue, 22nd Floor, New York, NY 10022.

Financial Profile: As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion, based on BRB's Call Report filed with the FDIC. BRFG is publicly traded on the New York Stock Exchange under the ticker symbol "BRFG." As of February 7, 2025, BRFG had approximately 179.5 million shares of common stock outstanding, with a closing share price of $47.82, resulting in an approximate market capitalization of $8.58 billion.

Both BRB and BRFG are included in the client party list because BRFG is the bank holding company parent of BRB, and the Consent Order's requirements and the remediation engagement implicate governance and oversight functions at both the bank and holding company levels. For purposes of C&H's conflicts analysis, BRB and BRFG are treated as a single client group.

4.2 Client Key Personnel (Officers and Directors)

The following officers and directors of BRB and BRFG have been individually searched in the conflicts database. These individuals are identified because they are likely to be the primary points of contact within the client organization, because their conduct and decisions may be at issue in the remediation, and because several of them are specifically referenced in the Consent Order:

The above list encompasses all senior officers of BRB with direct responsibility for the compliance functions at issue, as well as the independent directors of BRFG who serve on the board committees most likely to be engaged in remediation oversight (Risk Committee, Audit Committee, and Compliance Committee). Additional officers and directors not listed above may be screened on a rolling basis as the engagement progresses and their involvement becomes relevant.

4.3 Regulators. The following regulatory agencies and personnel have been searched:

Note Regarding Government Entities: Government regulatory agencies are not subject to the standard adverse-party conflicts analysis applicable to private parties. The OCC and FinCEN are not "clients" or "adverse parties" for purposes of Rules 1.7 or 1.9 of the New York Rules of Professional Conduct. However, they have been searched in the Firm's conflicts database solely to identify any attorney relationship conflicts — that is, whether any member of the C&H engagement team has a current or prior personal or professional relationship with any identified regulator personnel that could create an appearance of impropriety, compromise the Firm's ability to advocate effectively on behalf of BRB, or raise concerns under applicable revolving-door statutes and regulations. The search also identified whether C&H currently represents any other banking client in a matter before the OCC or FinCEN that could create a positional or issue conflict with the proposed BRB engagement.

4.4 Adverse and Related Third Parties

The following entities and their key personnel have been searched as adverse or related third parties. These parties are anticipated to interact with C&H during the course of the engagement in various capacities, including as OCC-mandated consultants, technology vendors, auditors, staffing providers, predecessor counsel, significant shareholders, and shareholder counsel:

4.5 Key Fintech / BaaS Partners

The following fintech companies are BRB's three largest banking-as-a-service ("BaaS") partners by transaction volume. These partners maintain contractual relationships with BRB under which BRB provides the banking charter, regulatory compliance infrastructure, and deposit or lending capabilities that underpin the partners' consumer- or business-facing products. The BaaS business line is central to the Consent Order's findings and will be a primary focus of the remediation engagement:

Note Regarding Additional BaaS Partners: BRB maintains a total of 14 active BaaS partner relationships. The remaining 11 BaaS partners collectively represent approximately 13% of BRB's total BaaS transaction volume. Only the top three partners by volume — NovaPay Technologies, FairLend Digital, and VaultEdge — have been individually screened at this stage, as they are the partners most likely to be directly implicated in the remediation engagement given their proportionate share of BaaS transaction activity and their prominence in the Consent Order's findings. The identities and details of the remaining 11 BaaS partners will be obtained from BRB during the initial phase of the engagement and will be screened on an ongoing basis as their identities become relevant to C&H's work. The engagement team should ensure that supplemental conflicts checks are submitted through the Firm's standard intake process as additional BaaS partner identities are confirmed.

5. Conflicts Check Results

The following subsections report the results of the conflicts check for each party or group of parties identified in Section 4 above. For each party, the memorandum reports: (a) the results of the database search, including whether any current or prior C&H representation was identified; (b) whether any current adverse representation was identified; (c) any relevant observations or contextual notes; and (d) the conflict determination (CLEAR, CONFLICT, or WAIVABLE CONFLICT).

5.1 Client Entities (BRB and BRFG)

Database search result: No current or prior representations of Belmont Ridge Bank National Association or Belmont Ridge Financial Group, Inc. were identified in C&H's Glenrock Health ITCONFLICTS database or the Firm's historical engagement records. Searches were conducted using all known names, EINs, RSSD IDs, OCC Charter Number, FDIC Certificate Number, and NYSE ticker symbol. Variant name searches were also conducted (including "Belmont Ridge," "BRB," "BRFG," and partial name matches) to ensure comprehensive coverage. No matches were returned.

No current adverse representation: C&H does not currently represent any party in any pending or active matter that is adverse to BRB or BRFG, whether in litigation, transactional, regulatory, or advisory contexts.

Prior matter search: No record of any prior C&H engagement involving BRB, BRFG, or any known predecessor entity was identified. Based on publicly available information, neither BRB nor BRFG has undergone any name changes or mergers that would require additional predecessor-name searches beyond those already conducted.

Result: CLEAR — No conflict.

5.2 Client Key Personnel

Database search result: Individual searches were conducted for all 15 officers and directors listed in Section 4.2 above. Each individual was searched by full name, with variant spellings and common name permutations also checked. Where available, additional identifiers (e.g., professional affiliations, bar admissions, and prior employment) were used to distinguish common names and reduce the risk of false negatives.

No current or prior representation: No C&H engagement was identified in which any of the 15 listed individuals was a client, an opposing party, a witness, a subject of an investigation, or otherwise personally involved in a manner that would create a conflict under the applicable rules. No personal representation of any listed individual by any C&H attorney was identified.

No personal relationship conflicts: No member of the engagement team reported any personal or professional relationship with any of the 15 listed individuals.

Result: CLEAR — No conflict.

5.3 Regulators (OCC, FinCEN)

Government entity note: As federal government agencies, the Office of the Comptroller of the Currency and the Financial Crimes Enforcement Network are not treated as adverse parties for purposes of the conflicts analysis under the New York Rules of Professional Conduct. Government agencies lack the capacity to provide informed consent to conflicts waivers and are not "clients" within the meaning of Rules 1.7 or 1.9. The search of these agencies and their personnel was conducted solely to identify attorney relationship conflicts — i.e., circumstances in which an C&H attorney's personal or professional relationship with a government official could create an appearance of impropriety or compromise the Firm's ability to advocate zealously on behalf of BRB.

Jonathan Frey (OCC, National Bank Examiner / Examiner-in-Charge): The name "Jonathan Frey" was searched in the Firm's database and personnel records. No personal or professional relationships were identified between Mr. Frey and any member of the engagement team. No C&H attorney has reported a prior working relationship, social acquaintance, or family connection with Mr. Frey. No member of the engagement team previously worked at the OCC in any capacity that would have involved supervision of or collaboration with Mr. Frey.

Angela Drummond (FinCEN, Associate Director, Enforcement Division): The name "Angela Drummond" was searched in the Firm's database and personnel records. No personal or professional relationships were identified between Ms. Drummond and any member of the engagement team. No C&H attorney has reported a prior working relationship, social acquaintance, or family connection with Ms. Drummond.

General regulatory matters: C&H has represented other banking clients in matters before the OCC and FinCEN. A review of those representations confirms that none involves issues or legal positions that would create a positional conflict or issue conflict with the proposed BRB engagement. Specifically, C&H does not currently represent any other bank in a BSA/AML consent order remediation matter in which BRB is referenced, implicated, or otherwise involved. There is no circumstance in which a legal position C&H would advance on behalf of BRB would be materially adverse to a legal position C&H is advancing on behalf of another client before the same regulatory body.

Result: CLEAR — No conflict.

5.4 Thornfield Consulting Group LLC

Database search result: No current or prior representation of Thornfield Consulting Group LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Thornfield"), and known address.

No adverse representation: C&H does not currently represent any party in any matter adverse to Thornfield Consulting Group LLC.

Note regarding Thornfield's role: Thornfield is not an adverse party in this engagement. Rather, Thornfield has been retained at the direction of the OCC as the independent consultant required by the Consent Order to conduct an independent review of BRB's BSA/AML compliance program and to report its findings and recommendations to the OCC. While the independent consultant's role necessarily involves a degree of independence from BRB, Thornfield's function is collaborative rather than adversarial. C&H will oversee Thornfield's engagement on behalf of BRB, including reviewing and commenting on Thornfield's work plans, coordinating access to BRB personnel and documents, and managing BRB's response to Thornfield's findings. The relationship between C&H and Thornfield is expected to be cooperative, though C&H will advocate for BRB's interests in any areas of disagreement regarding the consultant's conclusions or recommendations.

Thornfield personnel: Individual searches were conducted for the four identified Thornfield personnel: Dr. Vivian Castellano (Managing Director), Robert Eastman (Senior Director), Jennifer Hwang (Director), and Nathaniel Burgess (Director). No individual conflicts were identified for any of these persons. No member of the C&H engagement team has a personal or professional relationship with any Thornfield team member.

Result: CLEAR — No conflict.

5.5 Hargrove & Stein PC

Database search result: No current or prior C&H engagement was identified in which Hargrove & Stein PC appeared as a client, opposing counsel, co-counsel, or in any other capacity. The search was conducted using the firm's full name, abbreviated name, and known address.

No relationship conflicts: No member of the C&H engagement team has reported any current or prior affiliation with Hargrove & Stein PC, including prior employment, of-counsel relationships, or personal relationships with any Hargrove & Stein attorney. No lateral hire disclosures referenced Hargrove & Stein in connection with any matter that could create a conflict.

Result: CLEAR — No conflict.

5.6 Veridian Analytics Inc.

Database search result: No current representation of Veridian Analytics Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Veridian"), known address, and, where available, corporate identifiers.

Prior representation search: No record of any prior C&H representation of Veridian Analytics was identified. C&H has not previously served as counsel to Veridian in any transactional, litigation, regulatory, or advisory matter.

Adverse representation search: No current C&H matter was identified in which C&H represents a party adverse to Veridian Analytics in any context.

Note regarding Veridian's role in the engagement: Veridian Analytics is BRB's incumbent AML technology vendor, providing the transaction monitoring system ("TMS") and sanctions screening platform currently deployed by BRB. The Consent Order specifically identified deficiencies in Veridian's TMS configuration and BRB's implementation of the system as contributing factors to the compliance failures at issue. The proposed engagement will involve C&H representing BRB's interests in negotiating amendments to the existing Veridian Master Services Agreement (Contract No. VA-BRB-2023-0044) to implement the TMS v.10.0 upgrade. The estimated implementation cost is $2.8 million, with incremental annual licensing costs of approximately $1.9 million. C&H will advocate on behalf of BRB in these negotiations, seeking favorable terms regarding implementation timelines, performance warranties, service-level agreements, and allocation of remediation costs. While this positions C&H opposite Veridian in a negotiation context, Veridian is not an C&H client, and there is no duty of loyalty owed to Veridian by the Firm. This commercial negotiation does not give rise to a conflict of interest under any applicable rule.

Result: CLEAR — No conflict.

5.7 Ridgeline Data Systems LLC

Database search result: No current or prior representation of Ridgeline Data Systems LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Ridgeline"), and known address.

No adverse representation identified: C&H does not currently represent any party adverse to Ridgeline Data Systems in any matter.

Note regarding Ridgeline's role: Ridgeline Data Systems is an alternative AML technology vendor that BRB is evaluating as a potential replacement for Veridian Analytics. Ridgeline has submitted a preliminary proposal to BRB for a comprehensive AML compliance technology platform at a proposed annual cost of approximately $7.2 million over a five-year term, representing a total contract value of approximately $36.0 million. If BRB elects to pursue the Ridgeline solution, C&H may be involved in evaluating the proposal, conducting due diligence on Ridgeline's platform capabilities, and negotiating definitive agreements on behalf of BRB. As with Veridian, Ridgeline is not an C&H client, and any future negotiation on behalf of BRB would not create a conflict.

Result: CLEAR — No conflict.

5.8 Caldera & Pope LLP

Database search result: No current representation of Caldera & Pope LLP was identified in C&H's conflicts database. No matter was identified in which Caldera & Pope appeared as opposing counsel, co-counsel, or in any other capacity in connection with an C&H engagement.

Note regarding Caldera & Pope's role: Caldera & Pope serves as BRB's external auditor, performing the annual financial statement audit (with an annual audit fee of approximately $3.4 million). Caldera & Pope also serves as BRB's contracted BSA/AML independent testing firm, performing periodic testing of BRB's BSA/AML compliance controls (with a 2024 engagement fee of approximately $1.1 million). C&H's engagement may involve coordination with Caldera & Pope on audit findings and compliance testing results relevant to the remediation. No adversity between C&H (or BRB) and Caldera & Pope is anticipated in connection with this engagement. However, if in the course of remediation it becomes necessary to evaluate whether Caldera & Pope's prior independent testing was adequate, the relationship dynamics could shift, and a supplemental review would be appropriate at that time.

Result: CLEAR — No conflict.

5.9 Pinnacle Compliance Solutions LLC

Database search result: No current or prior representation of Pinnacle Compliance Solutions LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Pinnacle"), and known address.

No adverse representation identified: C&H does not currently represent any party adverse to Pinnacle Compliance Solutions in any matter.

Note regarding Pinnacle's role: Pinnacle is a temporary compliance staffing provider that BRB is engaging to supplement its internal BSA/AML compliance team during the remediation period. The engagement is documented under Statement of Work Reference PCS-BRB-2025-0012 and involves the deployment of approximately 30 full-time equivalent compliance analysts to BRB over a 12-month period, at an estimated total cost of $3.6 million. C&H has drafted or will draft the managed services agreement governing Pinnacle's engagement on behalf of BRB. C&H represents BRB's interests in this vendor relationship. Pinnacle is not an C&H client, and no conflict exists.

Result: CLEAR — No conflict.

5.10 Drayton Mercer LLP

Database search result: No current representation of Drayton Mercer LLP was identified in C&H's conflicts database. No current matter was identified in which C&H and Drayton Mercer serve as co-counsel for a common client, and no current matter was identified in which C&H and Drayton Mercer appear as opposing counsel.

Observation regarding predecessor counsel: Drayton Mercer LLP served as BRB's prior outside regulatory counsel from approximately 2019 through January 2025. The engagement was led by partner Helen Frazier. Based on information provided by BRB's General Counsel, Gregory Nardone, BRB terminated the Drayton Mercer engagement following the issuance of the Consent Order on January 15, 2025. C&H is effectively succeeding Drayton Mercer as BRB's outside regulatory counsel for BSA/AML and related compliance matters.

Potential issue noted: In the course of the remediation engagement, C&H may need to review Drayton Mercer's prior work product, including legal memoranda, regulatory submissions, compliance assessments, and correspondence with the OCC, dating from the 2019–2024 period. In particular, the Consent Order references a Matter Requiring Attention ("MRA") issued by the OCC in June 2022 and an escalated Matter Requiring Immediate Attention ("MRIA") issued in November 2023. C&H's remediation work may require an assessment of whether the advice provided by Drayton Mercer during that period contributed to BRB's failure to adequately remediate the deficiencies identified in the MRA and MRIA prior to the issuance of the Consent Order.

While this does not create a disqualifying conflict of interest — Drayton Mercer is not an C&H client, C&H owes no duty of loyalty or confidentiality to Drayton Mercer, and there is no rule prohibiting an attorney from evaluating the work of predecessor counsel on behalf of a client — the engagement team should be aware of the inherent sensitivity of any assessment of predecessor counsel's performance. The Firm's obligations run solely to BRB, and any evaluation of Drayton Mercer's conduct would be undertaken in furtherance of BRB's interests. Nonetheless, given the professional courtesy norms of the bar and the possibility that any formal criticism of Drayton Mercer's advice could become relevant in future proceedings (e.g., a potential malpractice claim by BRB against Drayton Mercer), the engagement team should exercise caution in documenting any such assessment and should consult with C&H's General Counsel before undertaking any formal liability analysis relating to Drayton Mercer's prior representation.

Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.1).

5.11 Brindoval Capital Partners LP

Database search result: No current representation of Brindoval Capital Partners LP was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Brindoval"), known address, and the name of its managing partner, Julian Whitmore.

No adverse representation identified: C&H does not currently represent any party adverse to Brindoval Capital Partners in any matter.

Note regarding Brindoval's role: Brindoval Capital Partners is a significant shareholder of BRFG, holding approximately 8.3% of BRFG's outstanding common stock, which represents approximately 14.9 million shares of the approximately 179.5 million shares outstanding. Based on information provided by BRB's General Counsel, Brindoval has expressed concern regarding the financial and reputational impact of the Consent Order, including the estimated total remediation cost of $42.5 million (exclusive of any civil money penalty) and potential total outlay of $57.0 million (inclusive of the $14.5 million civil money penalty imposed by the Consent Order). BRFG's stock price declined approximately 13.9% — from approximately $47.82 per share to $41.15 per share — on January 16, 2025, the first trading day following public disclosure of the Consent Order. The stock has partially recovered to $47.82 per share as of the close of trading on February 7, 2025.

While Brindoval's interests as a shareholder are generally aligned with those of BRB and BRFG in seeking efficient and effective remediation, there is potential for shareholder-management friction, particularly with respect to the scope and cost of remediation measures. Brindoval may advocate for a more cost-conscious remediation approach, while BRB's management and board, advised by C&H, may determine that a more comprehensive (and costly) remediation is necessary to satisfy the OCC's expectations and protect the institution's charter. C&H's client in this engagement is BRB/BRFG (the entities), not individual shareholders such as Brindoval. The interests of the entities are determined by their boards and management, not by individual shareholders, and C&H owes no duty to Brindoval.

However, the engagement team should be aware of the potential for shareholder-management tension and the possibility that Brindoval or its counsel could take adversarial action in response to remediation decisions, including but not limited to shareholder demand letters, derivative litigation, or proxy-related activism. If any such adversarial action materializes, a supplemental conflicts review should be conducted promptly.

Brindoval counsel — Amberly Knox LLP (Steven Briggs, Partner): The name of Brindoval's outside counsel, Amberly Knox LLP, and the name of the partner handling the Brindoval relationship, Steven Briggs, were searched in C&H's conflicts database. No current or prior representation of Amberly Knox LLP was identified. No C&H matter was identified in which Amberly Knox LLP appeared as opposing counsel, co-counsel, or in any other capacity. No member of the engagement team has a personal or professional relationship with Steven Briggs or any other Amberly Knox attorney.

Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.2).

5.12 NovaPay Technologies Inc.

Database search result: No current or prior representation of NovaPay Technologies Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("NovaPay"), known address, and the name of its CEO, Ethan Garrison.

No adverse representation identified: C&H does not currently represent any party adverse to NovaPay Technologies in any matter.

Note regarding NovaPay's role and potential for future adversity: NovaPay Technologies is BRB's largest BaaS partner, accounting for approximately 41% of BRB's total BaaS transaction volume, or approximately $30.5 billion in transaction activity during calendar year 2024. NovaPay operates a consumer payments and peer-to-peer transfer application serving approximately 2.1 million end-user accounts, all of which are ultimately banked through BRB's national bank charter.

NovaPay is particularly significant to the remediation engagement because the Consent Order specifically identified failures in OFAC sanctions screening for BaaS partner transactions as a critical compliance deficiency. According to the Consent Order, approximately 3.8 million NovaPay transactions — representing approximately 12% of the 31.7 million total NovaPay transactions processed in calendar year 2023 — were not screened against the OFAC Specially Designated Nationals and blocked Persons List prior to settlement. This represents the single largest category of unscreened transactions identified in the Consent Order and was a central basis for the OCC's enforcement action.

C&H will draft compliance remediation correspondence to NovaPay on behalf of BRB, and the engagement may require C&H to negotiate amendments to the NovaPay BaaS partner agreement to impose enhanced compliance obligations, including mandatory real-time sanctions screening, expanded customer due diligence requirements, enhanced data sharing and reporting obligations, and contractual representations and warranties regarding compliance program adequacy. NovaPay may resist some or all of these enhanced obligations, particularly to the extent they impose additional costs or operational burdens on NovaPay's platform.

At present, the NovaPay relationship is contractual rather than adversarial, and NovaPay is not an C&H client. No disqualifying conflict exists. However, if the relationship between BRB and NovaPay deteriorates to the point of material adversity — for example, if NovaPay refuses to accept enhanced compliance terms, if BRB terminates or threatens to terminate the BaaS partnership, if indemnification claims arise, or if regulatory apportionment disputes develop — the engagement team should conduct a supplemental conflicts review at that time to confirm that no new conflicts have emerged.

Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.3).

5.13 FairLend Digital LLC

Database search result: No current or prior representation of FairLend Digital LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("FairLend"), known address, and the name of its CEO, Aisha Okonkwo.

No adverse representation identified: C&H does not currently represent any party adverse to FairLend Digital in any matter.

Note regarding FairLend's role: FairLend Digital is BRB's second-largest BaaS partner, accounting for approximately 28% of BRB's total BaaS transaction volume and approximately $1.4 billion in loan originations through BRB's charter in fiscal year 2024. FairLend operates an online small-business lending platform that relies on BRB's bank charter for loan origination, funding, and regulatory compliance coverage. C&H will draft compliance remediation correspondence to FairLend on behalf of BRB. Similar considerations regarding potential future adversity apply as described in Section 5.12 above with respect to NovaPay. FairLend may resist enhanced compliance requirements or contractual amendments, and the engagement team should monitor the relationship for signs of material adversity.

Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.3).

5.14 VaultEdge Inc.

Database search result: No current or prior representation of VaultEdge Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("VaultEdge"), known address, and the name of its CEO, Marcus Tan.

No adverse representation identified: C&H does not currently represent any party adverse to VaultEdge in any matter.

Note regarding VaultEdge's role: VaultEdge is BRB's third-largest BaaS partner, accounting for approximately 18% of BRB's total BaaS transaction volume and maintaining approximately 870,000 deposit accounts on BRB's platform. VaultEdge operates a digital savings and neobanking platform. Similar considerations regarding potential future adversity apply as described in Sections 5.12 and 5.13 above with respect to NovaPay and FairLend. The engagement team should monitor the relationship for signs of material adversity.

Result: CLEAR — No conflict.

6. Observations and Monitoring Recommendations

While no disqualifying conflicts of interest have been identified, the following observations and monitoring recommendations are provided for the engagement team's guidance. These recommendations are intended to ensure ongoing compliance with the Firm's ethical obligations throughout the duration of the engagement, which is expected to extend through at least February 15, 2026.

6.1 Predecessor Counsel Sensitivity

The engagement may involve evaluation of the advice and work product of BRB's predecessor outside regulatory counsel, Drayton Mercer LLP (lead partner: Helen Frazier), during the 2019–2024 period. This is particularly likely with respect to BRB's response to the OCC's June 2022 Matter Requiring Attention and the November 2023 escalation to a Matter Requiring Immediate Attention. The Consent Order suggests that BRB's remediation efforts during the 2022–2024 period were inadequate, and an assessment of whether Drayton Mercer's counsel contributed to that inadequacy may be relevant to the remediation strategy, internal governance review, and potential claims analysis.

While no conflicts issue exists — Drayton Mercer is not and has never been an C&H client, and C&H owes no duty of loyalty or confidentiality to Drayton Mercer — the engagement team should exercise caution in several respects:

(a) Any written assessment of Drayton Mercer's prior performance should be clearly marked as attorney work product and should be prepared with the understanding that it could become discoverable in future proceedings, including potential malpractice litigation by BRB against Drayton Mercer.

(b) The engagement team should not communicate directly with Helen Frazier or any other Drayton Mercer attorney regarding BRB matters without first consulting with BRB's General Counsel, Gregory Nardone, and obtaining appropriate authorization.

(c) If BRB requests that C&H prepare a formal liability analysis regarding the quality of Drayton Mercer's prior legal advice — for example, in connection with a potential malpractice claim — the engagement team should consult with C&H's General Counsel before undertaking that analysis, as such work may implicate additional ethical considerations and may warrant a separate engagement letter.

6.2 Shareholder Tension

Brindoval Capital Partners LP, as an approximately 8.3% shareholder of BRFG, has expressed concerns regarding the cost of remediation (estimated at $42.5 million exclusive of the $14.5 million civil money penalty, for a total estimated outlay of approximately $57.0 million) and the impact of the Consent Order on BRFG's stock price and financial performance. BRFG's stock price declined approximately 13.9% to $41.15 per share on January 16, 2025, upon public disclosure of the Consent Order, and has partially recovered to $47.82 per share as of February 7, 2025.

C&H's client is BRB/BRFG (the corporate entities), not Brindoval or any other individual shareholder. The interests of the entities are determined by their boards of directors and management teams, in the exercise of their fiduciary duties. If Brindoval or its counsel (Amberly Knox LLP / Steven Briggs) initiates any adversarial action in response to remediation decisions — including but not limited to books-and-records demands, shareholder demand letters under Delaware General Corporation Law Section 220, derivative litigation, or proxy contests — the engagement team should take the following steps:

(a) Promptly notify the Conflicts Department to initiate a supplemental conflicts review.

(b) Assess whether the adversarial action creates a conflict between BRB's board/management and Brindoval that could implicate C&H's ability to continue representing the entities.

(c) Consider whether separate counsel should be engaged by BRB/BRFG to handle the shareholder dispute while C&H continues to focus on the regulatory remediation engagement.

At present, no adversarial action by Brindoval has been identified, and no conflict exists.

6.3 Fintech BaaS Partners — Potential Future Adversity

NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. are currently contractual counterparties of BRB and are expected to cooperate with BRB's remediation efforts. However, the remediation engagement may require C&H to draft demands for enhanced compliance cooperation, expanded data sharing and reporting, and contractual amendments that impose additional obligations on these partners. To the extent any BaaS partner resists these demands, the relationship could become materially adversarial.

Specific scenarios that could give rise to adversity include:

(a) A BaaS partner's refusal to accept amended compliance terms, leading to termination or threatened termination of the partnership agreement.

(b) Disputes over the allocation of remediation costs, including the costs of implementing enhanced sanctions screening, transaction monitoring, and customer due diligence.

(c) Indemnification claims by BRB against a BaaS partner for losses arising from the partner's compliance failures or inadequate data practices.

(d) Regulatory apportionment disputes in which a BaaS partner seeks to attribute responsibility for compliance failures to BRB, or vice versa.

If any such scenario materializes, the engagement team should promptly submit a supplemental conflicts check request to the Conflicts Department. At present, no adversity exists, and no conflict has been identified.

Additionally, BRB's remaining 11 BaaS partners (not individually identified in this memorandum) should be screened on a rolling basis as their identities become relevant to the engagement. The engagement team should submit party identification information for these partners to the Conflicts Department as soon as practicable following the commencement of the engagement.

6.4 Marcus Delgado — Cross-Staffing Note

Marcus Delgado, Billing Partner, is a member of C&H's intellectual Property Practice Group and is cross-staffed on this engagement due to the significant fintech patent and licensing compliance overlap inherent in BRB's BaaS arrangements. Mr. Delgado's role will focus on technology licensing agreements with AML technology vendors, intellectual property provisions in BaaS partner agreements, and proprietary technology issues.

No IP-related adverse representation has been identified that would create a conflict with the BRB engagement. However, Mr. Delgado's ongoing IP practice involves representation of various technology companies. If Mr. Delgado's practice involves any current or future representation of a fintech company that is also a BaaS partner of BRB — whether one of the three identified partners (NovaPay, FairLend, VaultEdge) or any of the remaining 11 unidentified partners — a supplemental conflicts review should be conducted to assess whether the dual representation creates a conflict. Mr. Delgado should promptly notify the Conflicts Department if he becomes aware of any such overlap.

7. Engagement Team Certifications

Each member of the proposed engagement team has been individually screened against the complete party list set forth in Section 4 and has confirmed, through the Firm's standard individual certification process, that he or she has no personal conflicts of interest, financial interests, familial or personal relationships, prior employment affiliations, or any other circumstance that would preclude participation in the proposed engagement of Belmont Ridge Bank National Association. The individual certifications are summarized as follows:

• Philip Hartmann — Responsible Partner, Banking & Finance Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual that would create an appearance of impropriety. Mr. Hartmann confirmed that he does not hold any securities in BRFG or any identified entity.

• Marcus Delgado — Billing Partner, intellectual Property Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual that would create an appearance of impropriety. Mr. Delgado confirmed that he does not currently represent any entity that is a BaaS partner of BRB and is not aware of any pending matter in his IP practice that could create a conflict.

• Yuki Nakamura — Lead Associate, Litigation (General) Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual. Ms. Nakamura confirmed that she has no prior involvement with any matter involving BRB, BRFG, or any identified party.

• Carlos Espinoza — Working Associate, Litigation (General) Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual. Mr. Espinoza confirmed that he has no prior involvement with any matter involving BRB, BRFG, or any identified party.

Individual certification forms are retained in the engagement file and are available for review upon request.

8. Conclusion and Clearance

Based on the comprehensive search of C&H's Glenrock Health ITCONFLICTS database, historical engagement records, lateral hire disclosures, and individual attorney certifications, and based on the analysis set forth in Sections 5 and 6 above, the Conflicts Department hereby issues the following clearance:

Conflicts Check No. CC-2025-01124 is CLEARED.

No disqualifying conflicts of interest have been identified with respect to any party searched in connection with the proposed engagement of Belmont Ridge Bank National Association for BSA/AML and sanctions compliance-program remediation advisory services. The proposed engagement, assigned Matter No. 1045-00002, may proceed in accordance with the Firm's standard engagement procedures.

This clearance is issued subject to the following conditions:

1. The monitoring recommendations set forth in Section 6 (Sections 6.1 through 6.4) should be implemented for the duration of the engagement.

2. Supplemental conflicts checks should be conducted on a rolling basis as new parties are identified during the engagement, including but not limited to the remaining 11 BaaS partners not individually screened in this memorandum.

3. If any existing relationship described herein becomes materially adversarial — including but not limited to adversity involving BaaS partners, the significant shareholder Brindoval Capital Partners, or predecessor counsel Drayton Mercer — the engagement team should promptly submit a supplemental conflicts check request to the Conflicts Department.

4. The engagement team should notify the Conflicts Department immediately upon becoming aware of any change in circumstances that could affect this clearance, including the addition of new engagement team members, the identification of new adverse parties, or any development giving rise to a potential personal conflict of any team member.

This clearance does not constitute legal advice regarding the ethical permissibility of the engagement. The Responsible Partner remains responsible for exercising independent professional judgment regarding the Firm's ethical obligations throughout the duration of the engagement.

9. Approval

Prepared by:

________________________________________

Elena R. Fitzpatrick Senior Conflicts Analyst Conflicts Department Calderwood & Harkness LLP

Date: February 9, 2025

Reviewed and Approved by:

________________________________________

The Honorable David N. Whitaker (Ret.) Partner, Conflicts Committee Calderwood & Harkness LLP

Date: February 9, 2025

Distribution:

• Philip Hartmann, Responsible Partner — Banking & Finance Practice Group

• Marcus Delgado, Billing Partner — Intellectual Property Practice Group

• Engagement File, Matter No. 1045-00002

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT — FOR INTERNAL USE ONLY

This memorandum is a confidential communication prepared by the Conflicts Department of Calderwood & Harkness LLP and is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the individuals identified in the distribution list above. Any unauthorized review, use, disclosure, or distribution of this memorandum is strictly prohibited. If you have received this memorandum in error, please notify the Conflicts Department immediately and destroy all copies.

Entity	Full Legal Name	Entity Type	Jurisdiction	Identifiers
BRB	Belmont Ridge Bank National Association	National Banking Association	Federal (OCC Charter); Headquarters: New York, NY	OCC Charter No. 48271; FDIC Certificate No. 31845; EIN 13-6148320; RSSD ID 1247893
BRFG	Belmont Ridge Financial Group, Inc.	Corporation (Bank Holding Company)	Delaware	EIN 83-2947561; NYSE: BRFG
Name	Title
Diane Whitford	Chief Executive Officer & Board Chair, BRB / BRFG
Raymond Okoye	President & Chief Operating Officer, BRB
Samantha Reeves	Chief Financial Officer, BRB / BRFG
Gregory Nardone	General Counsel & Corporate Secretary, BRB / BRFG
Patricia Langston	Chief Compliance Officer, BRB
Thomas Ikeda	BSA Officer / AML Program Director, BRB
Melissa Chu	Chief Risk Officer, BRB
Warren Ashby	Head of Fintech Partnerships / BaaS Division, BRB
Linda Petrosian	Chief Information Officer / Chief Technology Officer, BRB
Derek Ballard	Head of Internal Audit, BRB
Arthur Connelly	Lead Independent Director; Risk Committee Chair, BRFG Board of Directors
Margaret Dao	Audit Committee Chair, BRFG Board of Directors
James Rutherford	Compliance Committee Chair, BRFG Board of Directors
Sandra Villarreal	Independent Director, BRFG Board of Directors
Keith Yamamoto	Independent Director, BRFG Board of Directors
Entity	Role	Key Contact
Office of the Comptroller of the Currency (OCC)	Primary federal banking regulator of BRB; issued Consent Order No. OCC-2025-003 on January 15, 2025	Jonathan Frey, National Bank Examiner / Examiner-in-Charge, Northeastern District Office, 340 Madison Avenue, New York, NY 10017
Financial Crimes Enforcement Network (FinCEN)	Secondary regulator; Bureau of the U.S. Department of the Treasury responsible for BSA enforcement; monitoring BRB's SAR filing remediation; has reserved enforcement rights under the Consent Order	Angela Drummond, Associate Director, Enforcement Division
Entity	Full Legal Name	Role in Matter	Entity Type; Jurisdiction	Key Contact(s)
Thornfield Consulting Group LLC	Thornfield Consulting Group LLC	OCC-mandated independent consultant; will conduct independent review of BRB's BSA/AML program and report findings to the OCC	Delaware LLC; 200 Park Avenue South, 15th Floor, New York, NY 10003	Dr. Vivian Castellano, Managing Director; Robert Eastman, Senior Director; Jennifer Hwang, Director; Nathaniel Burgess, Director
Hargrove & Stein PC	Hargrove & Stein PC	Counsel to Thornfield Consulting Group LLC	Professional Corporation; New York; 7 Times Square, 34th Floor, New York, NY 10036	Not specifically identified at this time

Veridian Analytics Inc.	Veridian Analytics Inc.	Incumbent AML technology vendor to BRB (transaction monitoring system and sanctions screening platform); Veridian's system was cited in the Consent Order as a contributing factor to compliance deficiencies	Delaware corporation; 1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303	Priya Subramanian, VP of Client Solutions
Ridgeline Data Systems LLC	Ridgeline Data Systems LLC	Alternative AML technology vendor under evaluation by BRB as a potential replacement for Veridian Analytics	Delaware LLC; 500 West Monroe Street, Suite 2800, Chicago, IL 60661	David Marchetti, Chief Revenue Officer
Caldera & Pope LLP	Caldera & Pope LLP	External auditor to BRB (financial statement audit) and contracted BSA/AML independent testing firm	LLP; Illinois; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606	Franklin Dorsey, CPA, Engagement Partner
Pinnacle Compliance Solutions LLC	Pinnacle Compliance Solutions LLC	Temporary compliance staffing provider; BRB is engaging Pinnacle to provide managed compliance analyst resources during the remediation period	New York LLC; 90 Broad Street, 20th Floor, New York, NY 10004	Andrea Solis, Director of Managed Services
Drayton Mercer LLP	Drayton Mercer LLP	Former outside regulatory counsel to BRB; served as BRB's primary outside counsel for bank regulatory matters from 2019 through January 2025; engagement terminated by BRB following issuance of the Consent Order	LLP; New York; 55 East 52nd Street, Suite 3100, New York, NY 10055	Helen Frazier, Former Lead Partner
Brindoval Capital Partners LP	Brindoval Capital Partners LP	Significant shareholder of BRFG; holds approximately 8.3% of BRFG's outstanding common stock (approximately 14.9 million shares of 179.5 million outstanding)	Delaware LP; 399 Park Avenue, 24th Floor, New York, NY 10022	Julian Whitmore, Managing Partner
Amberly Knox LLP	Amberly Knox LLP	Outside counsel to Brindoval Capital Partners LP	LLP; New York; 600 Third Avenue, New York, NY 10016	Steven Briggs, Partner
Entity	Full Legal Name	Role	Entity Type; Jurisdiction	Key Contact
NovaPay Technologies Inc.	NovaPay Technologies Inc.	BaaS partner; consumer payments and peer-to-peer transfer application; approximately 2.1 million end-user accounts; 41% of BRB's total BaaS transaction volume (approximately $30.5 billion in calendar year 2024); onboarded as BaaS partner in 2021	Delaware corporation; 450 Mission Street, Suite 1200, San Francisco, CA 94105	Ethan Garrison, CEO
FairLend Digital LLC	FairLend Digital LLC	BaaS partner; online small-business lending platform; approximately $1.4 billion in loan originations through BRB in fiscal year 2024; 28% of BRB's total BaaS transaction volume; onboarded as BaaS partner in 2022	Delaware LLC; 100 Summer Street, Suite 800, Boston, MA 02110	Aisha Okonkwo, CEO
VaultEdge Inc.	VaultEdge Inc.	BaaS partner; digital savings and neobanking platform; approximately 870,000 deposit accounts; 18% of BRB's total BaaS transaction volume; onboarded as BaaS partner in 2023	Delaware corporation; 2200 Ross Avenue, Suite 3600, Dallas, TX 75201	Marcus Tan, CEO

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
FOR INTERNAL USE ONLY
TO: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group
FROM: Conflicts Department, Calderwood & Harkness LLP
DATE: February 9, 2025
RE: Conflicts Check Results — Proposed Engagement of Belmont Ridge Bank National Association — BSA/AML & Sanctions Compliance Program Uplift
Conflicts Check No.: CC-2025-01124
Matter No.: 1045-00002
1. Purpose and Summary
This memorandum documents the results of the comprehensive conflicts of interest check conducted by the Conflicts Department of Calderwood & Harkness LLP ("C&H" or the "Firm") in connection with the proposed engagement of Belmont Ridge Bank National Association ("BRB") for regulatory advisory services. The proposed engagement relates to BSA/AML and sanctions compliance-program remediation in response to OCC Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency on January 15, 2025. The Consent Order requires BRB to undertake a comprehensive uplift of its Bank Secrecy Act/Anti-Money Laundering compliance program, sanctions screening infrastructure, and related internal controls, particularly with respect to BRB's banking-as-a-service ("BaaS") business line and its fintech partner relationships.
The conflicts check was initiated on February 7, 2025, at the request of Philip Hartmann, Responsible Partner in the Banking & Finance Practice Group, and Marcus Delgado, Billing Partner in the intellectual Property Practice Group. The request was submitted through the Firm's standard conflicts intake system (Intake Form No. IF-2025-0489) and was accompanied by the preliminary engagement letter, a copy of the Consent Order, and a party identification memorandum prepared by Mr. Hartmann's team. All searches were conducted on February 7 and February 8, 2025, using the Firm's Glenrock Health ITCONFLICTS database, supplemented by manual review of the Firm's historical engagement records, lateral hire disclosures, and individual attorney certification responses.
The scope of the conflicts check encompassed all entities and individuals reasonably anticipated to be involved in or affected by the proposed engagement, including the client entities, their officers and directors, relevant regulatory agencies and personnel, third-party consultants, technology vendors, auditors, staffing providers, predecessor counsel, significant shareholders, shareholder counsel, and fintech/BaaS partners. A total of 38 entities and individuals were searched, as detailed in Section 4 below.
Conclusion: No disqualifying conflicts of interest have been identified under the New York Rules of Professional Conduct (Rules 1.7, 1.8, 1.9, 1.10, and 1.18), the applicable ethical rules governing C&H's practice, or C&H's internal conflicts policies. The proposed engagement may proceed, subject to the observations and ongoing monitoring recommendations set forth in Section 6 below. Those recommendations relate to (i) the sensitivity of evaluating predecessor counsel's work product, (ii) potential shareholder-management friction involving a significant shareholder, (iii) the possibility that certain fintech BaaS partners may become adverse to BRB during the remediation process, and (iv) the cross-staffing of an intellectual Property Practice Group partner on a primarily regulatory engagement. None of these observations rises to the level of a disqualifying conflict, but each warrants ongoing vigilance and, in certain scenarios, supplemental conflicts review.
2. Engagement Team
The following attorneys have been identified as the proposed engagement team for Matter No. 1045-00002. Each team member has been individually screened against the full party list set forth in Section 4, including searches for personal relationships, financial interests, prior employment, and any other circumstance that could give rise to an actual or apparent conflict of interest.
•  Philip Hartmann — Responsible Partner, Banking & Finance Practice Group. Mr. Hartmann is a partner in the Firm's New York office and has been with C&H since 2009. He specializes in bank regulatory matters, enforcement defense, and compliance-program design. Mr. Hartmann will serve as the engagement's Responsible Partner, maintaining overall supervisory responsibility for the representation, client relationship management, and communications with the OCC and FinCEN. Mr. Hartmann has confirmed that he has no personal conflicts, financial interests in any party identified on the party list, or relationships with any regulator personnel that would preclude his participation in this engagement.
•  Marcus Delgado — Billing Partner, intellectual Property Practice Group. Mr. Delgado is a partner in the Firm's New York office and joined C&H in 2015. He specializes in technology licensing, patent portfolio management, and fintech intellectual property matters. Mr. Delgado is cross-staffed on this engagement due to the significant fintech patent and licensing compliance overlap inherent in BRB's BaaS arrangements. His role will encompass review and negotiation of technology licensing agreements with AML technology vendors, evaluation of intellectual property provisions in BaaS partner agreements, and assessment of proprietary technology issues raised by the compliance-program remediation. Mr. Delgado has confirmed that he has no personal conflicts, financial interests in any party identified on the party list, or current IP representations that would create a conflict with the BRB engagement.
•  Yuki Nakamura — Lead Associate, Litigation (General) Practice Group. Ms. Nakamura is a sixth-year associate in the Firm's New York office. She has significant experience in regulatory enforcement defense, internal investigations, and compliance remediation matters. Ms. Nakamura will serve as the lead associate on the engagement, responsible for day-to-day management of the remediation work stream, coordination with BRB's internal compliance team, and oversight of the OCC-mandated independent consultant's engagement. Ms. Nakamura has confirmed that she has no personal conflicts or relationships that would preclude her participation.
•  Carlos Espinoza — Working Associate, Litigation (General) Practice Group. Mr. Espinoza is a third-year associate in the Firm's New York office. He has experience in banking regulatory matters and BSA/AML compliance advisory work. Mr. Espinoza will support Ms. Nakamura in all aspects of the engagement, including document review, regulatory correspondence drafting, and research. Mr. Espinoza has confirmed that he has no personal conflicts or relationships that would preclude his participation.
All four team members have been individually screened against the complete party list set forth in Section 4 below. No individual conflicts of any nature have been identified for any member of the proposed engagement team.
3. Scope of Engagement
The proposed engagement encompasses the following scope of work, as described in the preliminary engagement letter dated February 6, 2025, and as further refined in discussions between Mr. Hartmann and BRB's General Counsel, Gregory Nardone:
C&H is to serve as outside regulatory counsel to BRB, advising on and assisting with all aspects of BSA/AML and sanctions compliance-program remediation required by OCC Consent Order No. OCC-2025-003. The engagement specifically encompasses the following work streams:
(a) Compliance Program Uplift and Remediation Strategy. Development and implementation of a comprehensive remediation plan to address the deficiencies identified in the Consent Order, including but not limited to inadequate transaction monitoring, deficient suspicious activity report ("SAR") filing processes, insufficient OFAC sanctions screening for BaaS partner transactions, and gaps in customer due diligence and enhanced due diligence procedures.
(b) Regulatory Engagement. Serving as BRB's primary counsel in all communications and interactions with the OCC, including the OCC's Northeastern District Office and the Examiner-in-Charge, Jonathan Frey, as well as with FinCEN's Enforcement Division and Associate Director Angela Drummond. This includes preparation of regulatory submissions, progress reports, and responses to examination findings.
(c) Independent Consultant Oversight. Advising BRB on the engagement and oversight of the OCC-mandated independent consultant, Thornfield Consulting Group LLC. This includes reviewing and negotiating the terms of the independent consultant's engagement, coordinating the scope of the consultant's review, evaluating the consultant's findings and recommendations, and managing BRB's response to the consultant's reports.
(d) Technology Vendor Negotiations. Representing BRB in negotiations with AML technology vendors, including (i) amendments to BRB's existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the TMS v.10.0 transaction monitoring system upgrade, and (ii) evaluation and potential negotiation of a replacement AML technology platform with Ridgeline Data Systems LLC or other vendors.
(e) BaaS Partner Compliance Remediation. Drafting and negotiating compliance remediation correspondence and contractual amendments with BRB's fintech BaaS partners, with particular focus on the three largest partners by transaction volume: NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.
(f) Compliance Infrastructure Restructuring. Advising on the restructuring of BRB's internal compliance organization, including reporting lines, staffing levels, governance frameworks, and the integration of temporary compliance staffing resources from Pinnacle Compliance Solutions LLC.
(g) Managed Services and Staffing Agreements. Drafting and negotiating agreements with temporary compliance staffing providers, including the managed services agreement with Pinnacle Compliance Solutions LLC.
The estimated engagement value is $8,000,000, structured in two phases:
•  Phase 1: February 10, 2025 through May 15, 2025. Estimated value: $4,800,000. Phase 1 encompasses initial remediation planning, regulatory engagement strategy development, independent consultant onboarding and initial review, technology vendor evaluation, and BaaS partner compliance notification.
•  Phase 2: May 16, 2025 through February 15, 2026. Estimated value: $3,200,000. Phase 2 encompasses implementation of remediation measures, ongoing regulatory reporting, technology system implementation oversight, BaaS partner contractual amendments, and preparation for OCC validation review.
Given the breadth of the engagement and the number of third parties involved, the conflicts check was conducted against an expansive party list. The engagement involves interaction with multiple third parties in capacities ranging from potential adversaries to co-parties, vendors, regulators, and consultants. All identified parties have been screened as set forth in the following section.
4. Parties Searched
The following entities and individuals were searched against the Firm's Glenrock Health ITCONFLICTS database, the Firm's historical engagement records (dating to the Firm's founding), lateral hire conflict disclosures, and individual attorney certifications. Searches were conducted using all known names, aliases, identifiers, and associated entities. A total of 38 discrete parties (entities and individuals) were searched. The results of each search are reported in Section 5.
4.1 Client Entities
The following entities constitute the proposed client for purposes of this engagement:
Principal Office Address: 680 Lexington Avenue, 22nd Floor, New York, NY 10022.
Financial Profile: As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion, based on BRB's Call Report filed with the FDIC. BRFG is publicly traded on the New York Stock Exchange under the ticker symbol "BRFG." As of February 7, 2025, BRFG had approximately 179.5 million shares of common stock outstanding, with a closing share price of $47.82, resulting in an approximate market capitalization of $8.58 billion.
Both BRB and BRFG are included in the client party list because BRFG is the bank holding company parent of BRB, and the Consent Order's requirements and the remediation engagement implicate governance and oversight functions at both the bank and holding company levels. For purposes of C&H's conflicts analysis, BRB and BRFG are treated as a single client group.
4.2 Client Key Personnel (Officers and Directors)
The following officers and directors of BRB and BRFG have been individually searched in the conflicts database. These individuals are identified because they are likely to be the primary points of contact within the client organization, because their conduct and decisions may be at issue in the remediation, and because several of them are specifically referenced in the Consent Order:
The above list encompasses all senior officers of BRB with direct responsibility for the compliance functions at issue, as well as the independent directors of BRFG who serve on the board committees most likely to be engaged in remediation oversight (Risk Committee, Audit Committee, and Compliance Committee). Additional officers and directors not listed above may be screened on a rolling basis as the engagement progresses and their involvement becomes relevant.
4.3 Regulators.  The following regulatory agencies and personnel have been searched:
Note Regarding Government Entities: Government regulatory agencies are not subject to the standard adverse-party conflicts analysis applicable to private parties. The OCC and FinCEN are not "clients" or "adverse parties" for purposes of Rules 1.7 or 1.9 of the New York Rules of Professional Conduct. However, they have been searched in the Firm's conflicts database solely to identify any attorney relationship conflicts — that is, whether any member of the C&H engagement team has a current or prior personal or professional relationship with any identified regulator personnel that could create an appearance of impropriety, compromise the Firm's ability to advocate effectively on behalf of BRB, or raise concerns under applicable revolving-door statutes and regulations. The search also identified whether C&H currently represents any other banking client in a matter before the OCC or FinCEN that could create a positional or issue conflict with the proposed BRB engagement.
4.4 Adverse and Related Third Parties
The following entities and their key personnel have been searched as adverse or related third parties. These parties are anticipated to interact with C&H during the course of the engagement in various capacities, including as OCC-mandated consultants, technology vendors, auditors, staffing providers, predecessor counsel, significant shareholders, and shareholder counsel:
4.5 Key Fintech / BaaS Partners
The following fintech companies are BRB's three largest banking-as-a-service ("BaaS") partners by transaction volume. These partners maintain contractual relationships with BRB under which BRB provides the banking charter, regulatory compliance infrastructure, and deposit or lending capabilities that underpin the partners' consumer- or business-facing products. The BaaS business line is central to the Consent Order's findings and will be a primary focus of the remediation engagement:
Note Regarding Additional BaaS Partners: BRB maintains a total of 14 active BaaS partner relationships. The remaining 11 BaaS partners collectively represent approximately 13% of BRB's total BaaS transaction volume. Only the top three partners by volume — NovaPay Technologies, FairLend Digital, and VaultEdge — have been individually screened at this stage, as they are the partners most likely to be directly implicated in the remediation engagement given their proportionate share of BaaS transaction activity and their prominence in the Consent Order's findings. The identities and details of the remaining 11 BaaS partners will be obtained from BRB during the initial phase of the engagement and will be screened on an ongoing basis as their identities become relevant to C&H's work. The engagement team should ensure that supplemental conflicts checks are submitted through the Firm's standard intake process as additional BaaS partner identities are confirmed.
5. Conflicts Check Results
The following subsections report the results of the conflicts check for each party or group of parties identified in Section 4 above. For each party, the memorandum reports: (a) the results of the database search, including whether any current or prior C&H representation was identified; (b) whether any current adverse representation was identified; (c) any relevant observations or contextual notes; and (d) the conflict determination (CLEAR, CONFLICT, or WAIVABLE CONFLICT).
5.1 Client Entities (BRB and BRFG)
Database search result: No current or prior representations of Belmont Ridge Bank National Association or Belmont Ridge Financial Group, Inc. were identified in C&H's Glenrock Health ITCONFLICTS database or the Firm's historical engagement records. Searches were conducted using all known names, EINs, RSSD IDs, OCC Charter Number, FDIC Certificate Number, and NYSE ticker symbol. Variant name searches were also conducted (including "Belmont Ridge," "BRB," "BRFG," and partial name matches) to ensure comprehensive coverage. No matches were returned.
No current adverse representation: C&H does not currently represent any party in any pending or active matter that is adverse to BRB or BRFG, whether in litigation, transactional, regulatory, or advisory contexts.
Prior matter search: No record of any prior C&H engagement involving BRB, BRFG, or any known predecessor entity was identified. Based on publicly available information, neither BRB nor BRFG has undergone any name changes or mergers that would require additional predecessor-name searches beyond those already conducted.
Result: CLEAR — No conflict.
5.2 Client Key Personnel
Database search result: Individual searches were conducted for all 15 officers and directors listed in Section 4.2 above. Each individual was searched by full name, with variant spellings and common name permutations also checked. Where available, additional identifiers (e.g., professional affiliations, bar admissions, and prior employment) were used to distinguish common names and reduce the risk of false negatives.
No current or prior representation: No C&H engagement was identified in which any of the 15 listed individuals was a client, an opposing party, a witness, a subject of an investigation, or otherwise personally involved in a manner that would create a conflict under the applicable rules. No personal representation of any listed individual by any C&H attorney was identified.
No personal relationship conflicts: No member of the engagement team reported any personal or professional relationship with any of the 15 listed individuals.
Result: CLEAR — No conflict.
5.3 Regulators (OCC, FinCEN)
Government entity note: As federal government agencies, the Office of the Comptroller of the Currency and the Financial Crimes Enforcement Network are not treated as adverse parties for purposes of the conflicts analysis under the New York Rules of Professional Conduct. Government agencies lack the capacity to provide informed consent to conflicts waivers and are not "clients" within the meaning of Rules 1.7 or 1.9. The search of these agencies and their personnel was conducted solely to identify attorney relationship conflicts — i.e., circumstances in which an C&H attorney's personal or professional relationship with a government official could create an appearance of impropriety or compromise the Firm's ability to advocate zealously on behalf of BRB.
Jonathan Frey (OCC, National Bank Examiner / Examiner-in-Charge): The name "Jonathan Frey" was searched in the Firm's database and personnel records. No personal or professional relationships were identified between Mr. Frey and any member of the engagement team. No C&H attorney has reported a prior working relationship, social acquaintance, or family connection with Mr. Frey. No member of the engagement team previously worked at the OCC in any capacity that would have involved supervision of or collaboration with Mr. Frey.
Angela Drummond (FinCEN, Associate Director, Enforcement Division): The name "Angela Drummond" was searched in the Firm's database and personnel records. No personal or professional relationships were identified between Ms. Drummond and any member of the engagement team. No C&H attorney has reported a prior working relationship, social acquaintance, or family connection with Ms. Drummond.
General regulatory matters: C&H has represented other banking clients in matters before the OCC and FinCEN. A review of those representations confirms that none involves issues or legal positions that would create a positional conflict or issue conflict with the proposed BRB engagement. Specifically, C&H does not currently represent any other bank in a BSA/AML consent order remediation matter in which BRB is referenced, implicated, or otherwise involved. There is no circumstance in which a legal position C&H would advance on behalf of BRB would be materially adverse to a legal position C&H is advancing on behalf of another client before the same regulatory body.
Result: CLEAR — No conflict.
5.4 Thornfield Consulting Group LLC
Database search result: No current or prior representation of Thornfield Consulting Group LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Thornfield"), and known address.
No adverse representation: C&H does not currently represent any party in any matter adverse to Thornfield Consulting Group LLC.
Note regarding Thornfield's role: Thornfield is not an adverse party in this engagement. Rather, Thornfield has been retained at the direction of the OCC as the independent consultant required by the Consent Order to conduct an independent review of BRB's BSA/AML compliance program and to report its findings and recommendations to the OCC. While the independent consultant's role necessarily involves a degree of independence from BRB, Thornfield's function is collaborative rather than adversarial. C&H will oversee Thornfield's engagement on behalf of BRB, including reviewing and commenting on Thornfield's work plans, coordinating access to BRB personnel and documents, and managing BRB's response to Thornfield's findings. The relationship between C&H and Thornfield is expected to be cooperative, though C&H will advocate for BRB's interests in any areas of disagreement regarding the consultant's conclusions or recommendations.
Thornfield personnel: Individual searches were conducted for the four identified Thornfield personnel: Dr. Vivian Castellano (Managing Director), Robert Eastman (Senior Director), Jennifer Hwang (Director), and Nathaniel Burgess (Director). No individual conflicts were identified for any of these persons. No member of the C&H engagement team has a personal or professional relationship with any Thornfield team member.
Result: CLEAR — No conflict.
5.5 Hargrove & Stein PC
Database search result: No current or prior C&H engagement was identified in which Hargrove & Stein PC appeared as a client, opposing counsel, co-counsel, or in any other capacity. The search was conducted using the firm's full name, abbreviated name, and known address.
No relationship conflicts: No member of the C&H engagement team has reported any current or prior affiliation with Hargrove & Stein PC, including prior employment, of-counsel relationships, or personal relationships with any Hargrove & Stein attorney. No lateral hire disclosures referenced Hargrove & Stein in connection with any matter that could create a conflict.
Result: CLEAR — No conflict.
5.6 Veridian Analytics Inc.
Database search result: No current representation of Veridian Analytics Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Veridian"), known address, and, where available, corporate identifiers.
Prior representation search: No record of any prior C&H representation of Veridian Analytics was identified. C&H has not previously served as counsel to Veridian in any transactional, litigation, regulatory, or advisory matter.
Adverse representation search: No current C&H matter was identified in which C&H represents a party adverse to Veridian Analytics in any context.
Note regarding Veridian's role in the engagement: Veridian Analytics is BRB's incumbent AML technology vendor, providing the transaction monitoring system ("TMS") and sanctions screening platform currently deployed by BRB. The Consent Order specifically identified deficiencies in Veridian's TMS configuration and BRB's implementation of the system as contributing factors to the compliance failures at issue. The proposed engagement will involve C&H representing BRB's interests in negotiating amendments to the existing Veridian Master Services Agreement (Contract No. VA-BRB-2023-0044) to implement the TMS v.10.0 upgrade. The estimated implementation cost is $2.8 million, with incremental annual licensing costs of approximately $1.9 million. C&H will advocate on behalf of BRB in these negotiations, seeking favorable terms regarding implementation timelines, performance warranties, service-level agreements, and allocation of remediation costs. While this positions C&H opposite Veridian in a negotiation context, Veridian is not an C&H client, and there is no duty of loyalty owed to Veridian by the Firm. This commercial negotiation does not give rise to a conflict of interest under any applicable rule.
Result: CLEAR — No conflict.
5.7 Ridgeline Data Systems LLC
Database search result: No current or prior representation of Ridgeline Data Systems LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Ridgeline"), and known address.
No adverse representation identified: C&H does not currently represent any party adverse to Ridgeline Data Systems in any matter.
Note regarding Ridgeline's role: Ridgeline Data Systems is an alternative AML technology vendor that BRB is evaluating as a potential replacement for Veridian Analytics. Ridgeline has submitted a preliminary proposal to BRB for a comprehensive AML compliance technology platform at a proposed annual cost of approximately $7.2 million over a five-year term, representing a total contract value of approximately $36.0 million. If BRB elects to pursue the Ridgeline solution, C&H may be involved in evaluating the proposal, conducting due diligence on Ridgeline's platform capabilities, and negotiating definitive agreements on behalf of BRB. As with Veridian, Ridgeline is not an C&H client, and any future negotiation on behalf of BRB would not create a conflict.
Result: CLEAR — No conflict.
5.8 Caldera & Pope LLP
Database search result: No current representation of Caldera & Pope LLP was identified in C&H's conflicts database. No matter was identified in which Caldera & Pope appeared as opposing counsel, co-counsel, or in any other capacity in connection with an C&H engagement.
Note regarding Caldera & Pope's role: Caldera & Pope serves as BRB's external auditor, performing the annual financial statement audit (with an annual audit fee of approximately $3.4 million). Caldera & Pope also serves as BRB's contracted BSA/AML independent testing firm, performing periodic testing of BRB's BSA/AML compliance controls (with a 2024 engagement fee of approximately $1.1 million). C&H's engagement may involve coordination with Caldera & Pope on audit findings and compliance testing results relevant to the remediation. No adversity between C&H (or BRB) and Caldera & Pope is anticipated in connection with this engagement. However, if in the course of remediation it becomes necessary to evaluate whether Caldera & Pope's prior independent testing was adequate, the relationship dynamics could shift, and a supplemental review would be appropriate at that time.
Result: CLEAR — No conflict.
5.9 Pinnacle Compliance Solutions LLC
Database search result: No current or prior representation of Pinnacle Compliance Solutions LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Pinnacle"), and known address.
No adverse representation identified: C&H does not currently represent any party adverse to Pinnacle Compliance Solutions in any matter.
Note regarding Pinnacle's role: Pinnacle is a temporary compliance staffing provider that BRB is engaging to supplement its internal BSA/AML compliance team during the remediation period. The engagement is documented under Statement of Work Reference PCS-BRB-2025-0012 and involves the deployment of approximately 30 full-time equivalent compliance analysts to BRB over a 12-month period, at an estimated total cost of $3.6 million. C&H has drafted or will draft the managed services agreement governing Pinnacle's engagement on behalf of BRB. C&H represents BRB's interests in this vendor relationship. Pinnacle is not an C&H client, and no conflict exists.
Result: CLEAR — No conflict.
5.10 Drayton Mercer LLP
Database search result: No current representation of Drayton Mercer LLP was identified in C&H's conflicts database. No current matter was identified in which C&H and Drayton Mercer serve as co-counsel for a common client, and no current matter was identified in which C&H and Drayton Mercer appear as opposing counsel.
Observation regarding predecessor counsel: Drayton Mercer LLP served as BRB's prior outside regulatory counsel from approximately 2019 through January 2025. The engagement was led by partner Helen Frazier. Based on information provided by BRB's General Counsel, Gregory Nardone, BRB terminated the Drayton Mercer engagement following the issuance of the Consent Order on January 15, 2025. C&H is effectively succeeding Drayton Mercer as BRB's outside regulatory counsel for BSA/AML and related compliance matters.
Potential issue noted: In the course of the remediation engagement, C&H may need to review Drayton Mercer's prior work product, including legal memoranda, regulatory submissions, compliance assessments, and correspondence with the OCC, dating from the 2019–2024 period. In particular, the Consent Order references a Matter Requiring Attention ("MRA") issued by the OCC in June 2022 and an escalated Matter Requiring Immediate Attention ("MRIA") issued in November 2023. C&H's remediation work may require an assessment of whether the advice provided by Drayton Mercer during that period contributed to BRB's failure to adequately remediate the deficiencies identified in the MRA and MRIA prior to the issuance of the Consent Order.
While this does not create a disqualifying conflict of interest — Drayton Mercer is not an C&H client, C&H owes no duty of loyalty or confidentiality to Drayton Mercer, and there is no rule prohibiting an attorney from evaluating the work of predecessor counsel on behalf of a client — the engagement team should be aware of the inherent sensitivity of any assessment of predecessor counsel's performance. The Firm's obligations run solely to BRB, and any evaluation of Drayton Mercer's conduct would be undertaken in furtherance of BRB's interests. Nonetheless, given the professional courtesy norms of the bar and the possibility that any formal criticism of Drayton Mercer's advice could become relevant in future proceedings (e.g., a potential malpractice claim by BRB against Drayton Mercer), the engagement team should exercise caution in documenting any such assessment and should consult with C&H's General Counsel before undertaking any formal liability analysis relating to Drayton Mercer's prior representation.
Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.1).
5.11 Brindoval Capital Partners LP
Database search result: No current representation of Brindoval Capital Partners LP was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("Brindoval"), known address, and the name of its managing partner, Julian Whitmore.
No adverse representation identified: C&H does not currently represent any party adverse to Brindoval Capital Partners in any matter.
Note regarding Brindoval's role: Brindoval Capital Partners is a significant shareholder of BRFG, holding approximately 8.3% of BRFG's outstanding common stock, which represents approximately 14.9 million shares of the approximately 179.5 million shares outstanding. Based on information provided by BRB's General Counsel, Brindoval has expressed concern regarding the financial and reputational impact of the Consent Order, including the estimated total remediation cost of $42.5 million (exclusive of any civil money penalty) and potential total outlay of $57.0 million (inclusive of the $14.5 million civil money penalty imposed by the Consent Order). BRFG's stock price declined approximately 13.9% — from approximately $47.82 per share to $41.15 per share — on January 16, 2025, the first trading day following public disclosure of the Consent Order. The stock has partially recovered to $47.82 per share as of the close of trading on February 7, 2025.
While Brindoval's interests as a shareholder are generally aligned with those of BRB and BRFG in seeking efficient and effective remediation, there is potential for shareholder-management friction, particularly with respect to the scope and cost of remediation measures. Brindoval may advocate for a more cost-conscious remediation approach, while BRB's management and board, advised by C&H, may determine that a more comprehensive (and costly) remediation is necessary to satisfy the OCC's expectations and protect the institution's charter. C&H's client in this engagement is BRB/BRFG (the entities), not individual shareholders such as Brindoval. The interests of the entities are determined by their boards and management, not by individual shareholders, and C&H owes no duty to Brindoval.
However, the engagement team should be aware of the potential for shareholder-management tension and the possibility that Brindoval or its counsel could take adversarial action in response to remediation decisions, including but not limited to shareholder demand letters, derivative litigation, or proxy-related activism. If any such adversarial action materializes, a supplemental conflicts review should be conducted promptly.
Brindoval counsel — Amberly Knox LLP (Steven Briggs, Partner): The name of Brindoval's outside counsel, Amberly Knox LLP, and the name of the partner handling the Brindoval relationship, Steven Briggs, were searched in C&H's conflicts database. No current or prior representation of Amberly Knox LLP was identified. No C&H matter was identified in which Amberly Knox LLP appeared as opposing counsel, co-counsel, or in any other capacity. No member of the engagement team has a personal or professional relationship with Steven Briggs or any other Amberly Knox attorney.
Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.2).
5.12 NovaPay Technologies Inc.
Database search result: No current or prior representation of NovaPay Technologies Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("NovaPay"), known address, and the name of its CEO, Ethan Garrison.
No adverse representation identified: C&H does not currently represent any party adverse to NovaPay Technologies in any matter.
Note regarding NovaPay's role and potential for future adversity: NovaPay Technologies is BRB's largest BaaS partner, accounting for approximately 41% of BRB's total BaaS transaction volume, or approximately $30.5 billion in transaction activity during calendar year 2024. NovaPay operates a consumer payments and peer-to-peer transfer application serving approximately 2.1 million end-user accounts, all of which are ultimately banked through BRB's national bank charter.
NovaPay is particularly significant to the remediation engagement because the Consent Order specifically identified failures in OFAC sanctions screening for BaaS partner transactions as a critical compliance deficiency. According to the Consent Order, approximately 3.8 million NovaPay transactions — representing approximately 12% of the 31.7 million total NovaPay transactions processed in calendar year 2023 — were not screened against the OFAC Specially Designated Nationals and blocked Persons List prior to settlement. This represents the single largest category of unscreened transactions identified in the Consent Order and was a central basis for the OCC's enforcement action.
C&H will draft compliance remediation correspondence to NovaPay on behalf of BRB, and the engagement may require C&H to negotiate amendments to the NovaPay BaaS partner agreement to impose enhanced compliance obligations, including mandatory real-time sanctions screening, expanded customer due diligence requirements, enhanced data sharing and reporting obligations, and contractual representations and warranties regarding compliance program adequacy. NovaPay may resist some or all of these enhanced obligations, particularly to the extent they impose additional costs or operational burdens on NovaPay's platform.
At present, the NovaPay relationship is contractual rather than adversarial, and NovaPay is not an C&H client. No disqualifying conflict exists. However, if the relationship between BRB and NovaPay deteriorates to the point of material adversity — for example, if NovaPay refuses to accept enhanced compliance terms, if BRB terminates or threatens to terminate the BaaS partnership, if indemnification claims arise, or if regulatory apportionment disputes develop — the engagement team should conduct a supplemental conflicts review at that time to confirm that no new conflicts have emerged.
Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.3).
5.13 FairLend Digital LLC
Database search result: No current or prior representation of FairLend Digital LLC was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("FairLend"), known address, and the name of its CEO, Aisha Okonkwo.
No adverse representation identified: C&H does not currently represent any party adverse to FairLend Digital in any matter.
Note regarding FairLend's role: FairLend Digital is BRB's second-largest BaaS partner, accounting for approximately 28% of BRB's total BaaS transaction volume and approximately $1.4 billion in loan originations through BRB's charter in fiscal year 2024. FairLend operates an online small-business lending platform that relies on BRB's bank charter for loan origination, funding, and regulatory compliance coverage. C&H will draft compliance remediation correspondence to FairLend on behalf of BRB. Similar considerations regarding potential future adversity apply as described in Section 5.12 above with respect to NovaPay. FairLend may resist enhanced compliance requirements or contractual amendments, and the engagement team should monitor the relationship for signs of material adversity.
Result: CLEAR — No conflict. Monitoring recommendation noted (see Section 6.3).
5.14 VaultEdge Inc.
Database search result: No current or prior representation of VaultEdge Inc. was identified in C&H's conflicts database. The search was conducted using the entity's full legal name, abbreviated name ("VaultEdge"), known address, and the name of its CEO, Marcus Tan.
No adverse representation identified: C&H does not currently represent any party adverse to VaultEdge in any matter.
Note regarding VaultEdge's role: VaultEdge is BRB's third-largest BaaS partner, accounting for approximately 18% of BRB's total BaaS transaction volume and maintaining approximately 870,000 deposit accounts on BRB's platform. VaultEdge operates a digital savings and neobanking platform. Similar considerations regarding potential future adversity apply as described in Sections 5.12 and 5.13 above with respect to NovaPay and FairLend. The engagement team should monitor the relationship for signs of material adversity.
Result: CLEAR — No conflict.
6. Observations and Monitoring Recommendations
While no disqualifying conflicts of interest have been identified, the following observations and monitoring recommendations are provided for the engagement team's guidance. These recommendations are intended to ensure ongoing compliance with the Firm's ethical obligations throughout the duration of the engagement, which is expected to extend through at least February 15, 2026.
6.1 Predecessor Counsel Sensitivity
The engagement may involve evaluation of the advice and work product of BRB's predecessor outside regulatory counsel, Drayton Mercer LLP (lead partner: Helen Frazier), during the 2019–2024 period. This is particularly likely with respect to BRB's response to the OCC's June 2022 Matter Requiring Attention and the November 2023 escalation to a Matter Requiring Immediate Attention. The Consent Order suggests that BRB's remediation efforts during the 2022–2024 period were inadequate, and an assessment of whether Drayton Mercer's counsel contributed to that inadequacy may be relevant to the remediation strategy, internal governance review, and potential claims analysis.
While no conflicts issue exists — Drayton Mercer is not and has never been an C&H client, and C&H owes no duty of loyalty or confidentiality to Drayton Mercer — the engagement team should exercise caution in several respects:
(a) Any written assessment of Drayton Mercer's prior performance should be clearly marked as attorney work product and should be prepared with the understanding that it could become discoverable in future proceedings, including potential malpractice litigation by BRB against Drayton Mercer.
(b) The engagement team should not communicate directly with Helen Frazier or any other Drayton Mercer attorney regarding BRB matters without first consulting with BRB's General Counsel, Gregory Nardone, and obtaining appropriate authorization.
(c) If BRB requests that C&H prepare a formal liability analysis regarding the quality of Drayton Mercer's prior legal advice — for example, in connection with a potential malpractice claim — the engagement team should consult with C&H's General Counsel before undertaking that analysis, as such work may implicate additional ethical considerations and may warrant a separate engagement letter.
6.2 Shareholder Tension
Brindoval Capital Partners LP, as an approximately 8.3% shareholder of BRFG, has expressed concerns regarding the cost of remediation (estimated at $42.5 million exclusive of the $14.5 million civil money penalty, for a total estimated outlay of approximately $57.0 million) and the impact of the Consent Order on BRFG's stock price and financial performance. BRFG's stock price declined approximately 13.9% to $41.15 per share on January 16, 2025, upon public disclosure of the Consent Order, and has partially recovered to $47.82 per share as of February 7, 2025.
C&H's client is BRB/BRFG (the corporate entities), not Brindoval or any other individual shareholder. The interests of the entities are determined by their boards of directors and management teams, in the exercise of their fiduciary duties. If Brindoval or its counsel (Amberly Knox LLP / Steven Briggs) initiates any adversarial action in response to remediation decisions — including but not limited to books-and-records demands, shareholder demand letters under Delaware General Corporation Law Section 220, derivative litigation, or proxy contests — the engagement team should take the following steps:
(a) Promptly notify the Conflicts Department to initiate a supplemental conflicts review.
(b) Assess whether the adversarial action creates a conflict between BRB's board/management and Brindoval that could implicate C&H's ability to continue representing the entities.
(c) Consider whether separate counsel should be engaged by BRB/BRFG to handle the shareholder dispute while C&H continues to focus on the regulatory remediation engagement.
At present, no adversarial action by Brindoval has been identified, and no conflict exists.
6.3 Fintech BaaS Partners — Potential Future Adversity
NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. are currently contractual counterparties of BRB and are expected to cooperate with BRB's remediation efforts. However, the remediation engagement may require C&H to draft demands for enhanced compliance cooperation, expanded data sharing and reporting, and contractual amendments that impose additional obligations on these partners. To the extent any BaaS partner resists these demands, the relationship could become materially adversarial.
Specific scenarios that could give rise to adversity include:
(a) A BaaS partner's refusal to accept amended compliance terms, leading to termination or threatened termination of the partnership agreement.
(b) Disputes over the allocation of remediation costs, including the costs of implementing enhanced sanctions screening, transaction monitoring, and customer due diligence.
(c) Indemnification claims by BRB against a BaaS partner for losses arising from the partner's compliance failures or inadequate data practices.
(d) Regulatory apportionment disputes in which a BaaS partner seeks to attribute responsibility for compliance failures to BRB, or vice versa.
If any such scenario materializes, the engagement team should promptly submit a supplemental conflicts check request to the Conflicts Department. At present, no adversity exists, and no conflict has been identified.
Additionally, BRB's remaining 11 BaaS partners (not individually identified in this memorandum) should be screened on a rolling basis as their identities become relevant to the engagement. The engagement team should submit party identification information for these partners to the Conflicts Department as soon as practicable following the commencement of the engagement.
6.4 Marcus Delgado — Cross-Staffing Note
Marcus Delgado, Billing Partner, is a member of C&H's intellectual Property Practice Group and is cross-staffed on this engagement due to the significant fintech patent and licensing compliance overlap inherent in BRB's BaaS arrangements. Mr. Delgado's role will focus on technology licensing agreements with AML technology vendors, intellectual property provisions in BaaS partner agreements, and proprietary technology issues.
No IP-related adverse representation has been identified that would create a conflict with the BRB engagement. However, Mr. Delgado's ongoing IP practice involves representation of various technology companies. If Mr. Delgado's practice involves any current or future representation of a fintech company that is also a BaaS partner of BRB — whether one of the three identified partners (NovaPay, FairLend, VaultEdge) or any of the remaining 11 unidentified partners — a supplemental conflicts review should be conducted to assess whether the dual representation creates a conflict. Mr. Delgado should promptly notify the Conflicts Department if he becomes aware of any such overlap.
7. Engagement Team Certifications
Each member of the proposed engagement team has been individually screened against the complete party list set forth in Section 4 and has confirmed, through the Firm's standard individual certification process, that he or she has no personal conflicts of interest, financial interests, familial or personal relationships, prior employment affiliations, or any other circumstance that would preclude participation in the proposed engagement of Belmont Ridge Bank National Association. The individual certifications are summarized as follows:
•  Philip Hartmann — Responsible Partner, Banking & Finance Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual that would create an appearance of impropriety. Mr. Hartmann confirmed that he does not hold any securities in BRFG or any identified entity.
•  Marcus Delgado — Billing Partner, intellectual Property Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual that would create an appearance of impropriety. Mr. Delgado confirmed that he does not currently represent any entity that is a BaaS partner of BRB and is not aware of any pending matter in his IP practice that could create a conflict.
•  Yuki Nakamura — Lead Associate, Litigation (General) Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual. Ms. Nakamura confirmed that she has no prior involvement with any matter involving BRB, BRFG, or any identified party.
•  Carlos Espinoza — Working Associate, Litigation (General) Practice Group. Certified February 8, 2025. Confirmed no conflicts, no financial interests in any identified party, no personal relationships with any identified individual. Mr. Espinoza confirmed that he has no prior involvement with any matter involving BRB, BRFG, or any identified party.
Individual certification forms are retained in the engagement file and are available for review upon request.
8. Conclusion and Clearance
Based on the comprehensive search of C&H's Glenrock Health ITCONFLICTS database, historical engagement records, lateral hire disclosures, and individual attorney certifications, and based on the analysis set forth in Sections 5 and 6 above, the Conflicts Department hereby issues the following clearance:
Conflicts Check No. CC-2025-01124 is CLEARED.
No disqualifying conflicts of interest have been identified with respect to any party searched in connection with the proposed engagement of Belmont Ridge Bank National Association for BSA/AML and sanctions compliance-program remediation advisory services. The proposed engagement, assigned Matter No. 1045-00002, may proceed in accordance with the Firm's standard engagement procedures.
This clearance is issued subject to the following conditions:
1.  The monitoring recommendations set forth in Section 6 (Sections 6.1 through 6.4) should be implemented for the duration of the engagement.
2.  Supplemental conflicts checks should be conducted on a rolling basis as new parties are identified during the engagement, including but not limited to the remaining 11 BaaS partners not individually screened in this memorandum.
3.  If any existing relationship described herein becomes materially adversarial — including but not limited to adversity involving BaaS partners, the significant shareholder Brindoval Capital Partners, or predecessor counsel Drayton Mercer — the engagement team should promptly submit a supplemental conflicts check request to the Conflicts Department.
4.  The engagement team should notify the Conflicts Department immediately upon becoming aware of any change in circumstances that could affect this clearance, including the addition of new engagement team members, the identification of new adverse parties, or any development giving rise to a potential personal conflict of any team member.
This clearance does not constitute legal advice regarding the ethical permissibility of the engagement. The Responsible Partner remains responsible for exercising independent professional judgment regarding the Firm's ethical obligations throughout the duration of the engagement.
9. Approval
Prepared by:
________________________________________
Elena R. Fitzpatrick Senior Conflicts Analyst Conflicts Department Calderwood & Harkness LLP
Date: February 9, 2025
Reviewed and Approved by:
________________________________________
The Honorable David N. Whitaker (Ret.) Partner, Conflicts Committee Calderwood & Harkness LLP
Date: February 9, 2025
Distribution:
•  Philip Hartmann, Responsible Partner — Banking & Finance Practice Group
•  Marcus Delgado, Billing Partner — Intellectual Property Practice Group
•  Engagement File, Matter No. 1045-00002
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT — FOR INTERNAL USE ONLY
This memorandum is a confidential communication prepared by the Conflicts Department of Calderwood & Harkness LLP and is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the individuals identified in the distribution list above. Any unauthorized review, use, disclosure, or distribution of this memorandum is strictly prohibited. If you have received this memorandum in error, please notify the Conflicts Department immediately and destroy all copies.
Entity | Full Legal Name | Entity Type | Jurisdiction | Identifiers
BRB | Belmont Ridge Bank National Association | National Banking Association | Federal (OCC Charter); Headquarters: New York, NY | OCC Charter No. 48271; FDIC Certificate No. 31845; EIN 13-6148320; RSSD ID 1247893
BRFG | Belmont Ridge Financial Group, Inc. | Corporation (Bank Holding Company) | Delaware | EIN 83-2947561; NYSE: BRFG
Name | Title
Diane Whitford | Chief Executive Officer & Board Chair, BRB / BRFG
Raymond Okoye | President & Chief Operating Officer, BRB
Samantha Reeves | Chief Financial Officer, BRB / BRFG
Gregory Nardone | General Counsel & Corporate Secretary, BRB / BRFG
Patricia Langston | Chief Compliance Officer, BRB
Thomas Ikeda | BSA Officer / AML Program Director, BRB
Melissa Chu | Chief Risk Officer, BRB
Warren Ashby | Head of Fintech Partnerships / BaaS Division, BRB
Linda Petrosian | Chief Information Officer / Chief Technology Officer, BRB
Derek Ballard | Head of Internal Audit, BRB
Arthur Connelly | Lead Independent Director; Risk Committee Chair, BRFG Board of Directors
Margaret Dao | Audit Committee Chair, BRFG Board of Directors
James Rutherford | Compliance Committee Chair, BRFG Board of Directors
Sandra Villarreal | Independent Director, BRFG Board of Directors
Keith Yamamoto | Independent Director, BRFG Board of Directors
Entity | Role | Key Contact
Office of the Comptroller of the Currency (OCC) | Primary federal banking regulator of BRB; issued Consent Order No. OCC-2025-003 on January 15, 2025 | Jonathan Frey, National Bank Examiner / Examiner-in-Charge, Northeastern District Office, 340 Madison Avenue, New York, NY 10017
Financial Crimes Enforcement Network (FinCEN) | Secondary regulator; Bureau of the U.S. Department of the Treasury responsible for BSA enforcement; monitoring BRB's SAR filing remediation; has reserved enforcement rights under the Consent Order | Angela Drummond, Associate Director, Enforcement Division
Entity | Full Legal Name | Role in Matter | Entity Type; Jurisdiction | Key Contact(s)
Thornfield Consulting Group LLC | Thornfield Consulting Group LLC | OCC-mandated independent consultant; will conduct independent review of BRB's BSA/AML program and report findings to the OCC | Delaware LLC; 200 Park Avenue South, 15th Floor, New York, NY 10003 | Dr. Vivian Castellano, Managing Director; Robert Eastman, Senior Director; Jennifer Hwang, Director; Nathaniel Burgess, Director
Hargrove & Stein PC | Hargrove & Stein PC | Counsel to Thornfield Consulting Group LLC | Professional Corporation; New York; 7 Times Square, 34th Floor, New York, NY 10036 | Not specifically identified at this time
Veridian Analytics Inc. | Veridian Analytics Inc. | Incumbent AML technology vendor to BRB (transaction monitoring system and sanctions screening platform); Veridian's system was cited in the Consent Order as a contributing factor to compliance deficiencies | Delaware corporation; 1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303 | Priya Subramanian, VP of Client Solutions
Ridgeline Data Systems LLC | Ridgeline Data Systems LLC | Alternative AML technology vendor under evaluation by BRB as a potential replacement for Veridian Analytics | Delaware LLC; 500 West Monroe Street, Suite 2800, Chicago, IL 60661 | David Marchetti, Chief Revenue Officer
Caldera & Pope LLP | Caldera & Pope LLP | External auditor to BRB (financial statement audit) and contracted BSA/AML independent testing firm | LLP; Illinois; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606 | Franklin Dorsey, CPA, Engagement Partner
Pinnacle Compliance Solutions LLC | Pinnacle Compliance Solutions LLC | Temporary compliance staffing provider; BRB is engaging Pinnacle to provide managed compliance analyst resources during the remediation period | New York LLC; 90 Broad Street, 20th Floor, New York, NY 10004 | Andrea Solis, Director of Managed Services
Drayton Mercer LLP | Drayton Mercer LLP | Former outside regulatory counsel to BRB; served as BRB's primary outside counsel for bank regulatory matters from 2019 through January 2025; engagement terminated by BRB following issuance of the Consent Order | LLP; New York; 55 East 52nd Street, Suite 3100, New York, NY 10055 | Helen Frazier, Former Lead Partner
Brindoval Capital Partners LP | Brindoval Capital Partners LP | Significant shareholder of BRFG; holds approximately 8.3% of BRFG's outstanding common stock (approximately 14.9 million shares of 179.5 million outstanding) | Delaware LP; 399 Park Avenue, 24th Floor, New York, NY 10022 | Julian Whitmore, Managing Partner
Amberly Knox LLP | Amberly Knox LLP | Outside counsel to Brindoval Capital Partners LP | LLP; New York; 600 Third Avenue, New York, NY 10016 | Steven Briggs, Partner
Entity | Full Legal Name | Role | Entity Type; Jurisdiction | Key Contact
NovaPay Technologies Inc. | NovaPay Technologies Inc. | BaaS partner; consumer payments and peer-to-peer transfer application; approximately 2.1 million end-user accounts; 41% of BRB's total BaaS transaction volume (approximately $30.5 billion in calendar year 2024); onboarded as BaaS partner in 2021 | Delaware corporation; 450 Mission Street, Suite 1200, San Francisco, CA 94105 | Ethan Garrison, CEO
FairLend Digital LLC | FairLend Digital LLC | BaaS partner; online small-business lending platform; approximately $1.4 billion in loan originations through BRB in fiscal year 2024; 28% of BRB's total BaaS transaction volume; onboarded as BaaS partner in 2022 | Delaware LLC; 100 Summer Street, Suite 800, Boston, MA 02110 | Aisha Okonkwo, CEO
VaultEdge Inc. | VaultEdge Inc. | BaaS partner; digital savings and neobanking platform; approximately 870,000 deposit accounts; 18% of BRB's total BaaS transaction volume; onboarded as BaaS partner in 2023 | Delaware corporation; 2200 Ross Avenue, Suite 3600, Dallas, TX 75201 | Marcus Tan, CEO

MEMORANDUM

FOR INTERNAL USE ONLY

Record

Parties

Dates

Amounts