PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Gregory Nardone, Esq., General Counsel & Corporate Secretary, Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc.
FROM: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group, Calderwood & Harkness LLP Yuki Nakamura, Lead Associate, Litigation (General) Practice Group, Calderwood & Harkness LLP
DATE: February 14, 2025
RE: Analysis of OCC Consent Order No. OCC-2025-003 Issued January 15, 2025 Against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845)
MATTER NO.: 1045-00002
DISTRIBUTION: Diane Whitford (CEO), Patricia Langston (CCO), Thomas Ikeda (BSA Officer), Melissa Chu (CRO) — PRIVILEGED; DO NOT FORWARD
This memorandum is a confidential attorney-client privileged communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of counsel for the sole purpose of providing legal advice to Belmont Ridge Bank National Association and Belmont Ridge Financial Group, Inc. This memorandum is not intended for disclosure to, and should not be disclosed to, any third party without the express prior written consent of Calderwood & Harkness LLP and BRB's General Counsel. Inadvertent disclosure of this memorandum does not constitute a waiver of any applicable privilege.
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a comprehensive legal analysis of OCC Consent Order No. OCC-2025-003 (the "Order" or the "Consent Order"), issued and effective January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank"), OCC Charter No. 48271. Calderwood & Harkness LLP ("C&H") was engaged by BRB on February 10, 2025, as successor regulatory counsel, to advise the Bank and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG" or the "Holding Company"), on all matters arising from and related to the Consent Order, including remediation strategy, risk assessment, and potential further enforcement exposure.
The Order is the product of a targeted BSA/AML examination conducted by the Office of the Comptroller of the Currency ("OCC") between March 2024 and September 2024, focusing specifically on BRB's Bank Secrecy Act, anti-money laundering, and sanctions compliance programs, with particular emphasis on the Bank's Banking-as-a-Service ("BaaS") operations. The Examiner-in-Charge for this examination was Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017.
The Consent Order identifies five core deficiency categories requiring remediation:
(i) OFAC sanctions screening failures, primarily attributable to an integration failure between BRB's transaction monitoring platform and its largest fintech BaaS partner, NovaPay Technologies Inc., resulting in approximately 3,800,000 unscreened transactions in calendar year 2023;
(ii) SAR filing deficiencies, including a backlog of approximately 2,400 undispositioned suspicious activity alerts and an average SAR filing time of 78 days from alert generation;
(iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") failures, affecting approximately 47,000 high-risk customer accounts, predominantly those onboarded through fintech BaaS partner channels;
(iv) Transaction monitoring model validation deficiencies, stemming from BRB's failure to independently validate its Veridian TMS v.8.3 transaction monitoring system since March 2021, despite material changes to the Bank's customer base, product mix, and transaction volumes attributable to BaaS partnership expansion; and
(v) Board-level oversight deficiencies, including the absence of a dedicated Compliance Committee, inadequate BSA/AML reporting to the Board of Directors, and insufficient Board engagement with the Bank's growing BaaS risk profile.
The Order assesses a civil money penalty ("CMP") of $14,500,000, payable within 60 days of the effective date (i.e., by March 16, 2025). No criminal referral to the United States Department of Justice ("DOJ") has been made as of the date of this memorandum. However, the Order explicitly does not preclude any future referral, and the possibility remains a live risk factor that must be continuously monitored throughout the remediation period and beyond.
The Financial Crimes Enforcement Network ("FinCEN") is separately monitoring BRB's SAR filing remediation efforts. No independent FinCEN enforcement action has been filed as of the date of our engagement, but FinCEN has reserved all enforcement rights through its coordination with the OCC. The FinCEN liaison assigned to the matter is Angela Drummond, Associate Director, Enforcement Division.
Pursuant to Article VII of the Order, BRB was required to engage an independent consultant acceptable to the OCC to conduct a comprehensive assessment of the Bank's BSA/AML and OFAC compliance programs and to validate all remediation efforts. This requirement has been met: BRB selected Thornfield Consulting Group LLC ("Thornfield"), engagement reference TCG-BRB-2025-001. The OCC issued its letter of non-objection on February 5, 2025, and the engagement agreement was executed on February 10, 2025. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, with a preliminary gap assessment due by April 15, 2025, and a final validation report due by February 15, 2026.
The Order requires BRB to submit a comprehensive Remediation Action Plan ("RAP") to the OCC by May 15, 2025, and to achieve full BSA/AML program compliance by February 15, 2026.
BRFG publicly disclosed the Consent Order on January 16, 2025, the day following its issuance. BRFG common stock (NYSE: BRFG) declined approximately 13.9% on that date, closing at $41.15 per share, representing a decline of approximately $6.67 per share from the prior close. As of February 7, 2025, the stock had partially recovered to $47.82 per share, reflecting a market capitalization of approximately $8.58 billion based on 179.5 million shares outstanding. Significant shareholder Brindoval Capital Partners LP (Managing Partner: Julian Whitmore; approximately 8.3% ownership, approximately 14.9 million shares; counsel: Amberly Knox LLP, partner Steven Briggs) has communicated concerns regarding remediation costs, potential additional enforcement fines, and reputational impact on the franchise.
The total estimated financial outlay associated with the Consent Order is as follows:
• Board-approved remediation budget (exclusive of CMP): $42,500,000
• Civil money penalty: $14,500,000
• Total estimated outlay: $57,000,000
This figure represents approximately 13.8% of BRB's FY 2024 net income of $412 million, which is material but, in our assessment, manageable given the Bank's overall financial position, including a Tier 1 capital ratio of 11.2% and a total asset base of $38.7 billion.
This memorandum analyzes each of the five deficiency categories in detail, identifies specific legal obligations and compliance deadlines arising from the Order, evaluates the risk of further enforcement action by the DOJ, FinCEN, OFAC, state regulators, and private litigants, and provides preliminary strategic recommendations for the remediation period. C&H will provide updated risk assessments on a rolling basis as the remediation progresses and as additional information becomes available through the SAR lookback project, the OFAC screening gap analysis, and Thornfield's assessments.
II. Background and Procedural History
A. Belmont Ridge Bank NA — Entity Overview
Belmont Ridge Bank National Association is a national banking association chartered under the National Bank Act, 12 U.S.C. § 21 et seq., and is supervised by the OCC as its primary federal banking regulator. The Bank's key regulatory identifiers are as follows:
• OCC Charter No. 48271
• FDIC Certificate No. 31845
• RSSD ID: 1247893
• Employer Identification Number (EIN): 13-6148320
BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc., a Delaware corporation (EIN 83-2947561) whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG." BRFG is a bank holding company registered under the Bank Holding Company Act of 1956, as amended, and is subject to supervision and examination by the Board of Governors of the Federal Reserve System. The Holding Company is headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, and the Bank's principal offices are located at the same address.
As of December 31, 2024, BRB reported the following key financial metrics in its Call Report (FFIEC 031):
• Total consolidated assets: $38.7 billion
• Total deposits: $29.4 billion
• Net income for fiscal year 2024: $412 million
• Tier 1 capital ratio: 11.2%
These figures position BRB as a large community/regional banking organization, subject to the OCC's heightened supervisory standards applicable to institutions of its size and complexity.
BRB operates four core business lines: (i) retail banking, encompassing consumer deposit accounts, residential mortgage lending, and consumer credit products; (ii) commercial lending, including commercial real estate, C&I lending, and small business lending; (iii) wealth management, providing trust, investment advisory, and private banking services; and (iv) fintech Banking-as-a-Service partnerships, through which BRB provides its national bank charter and associated banking infrastructure to third-party fintech companies that offer financial products and services to their own end users.
The BaaS division is of central importance to this memorandum and to the Consent Order. As of the date of this memorandum, BRB maintains approximately 14 active BaaS partnerships. These partnerships involve BRB serving as the chartered institution for various fintech platforms, which originate customer accounts, payment transactions, and lending products using BRB's charter authority. The BaaS division has grown rapidly: total BaaS transaction volume in calendar year 2024 was approximately $74.3 billion, generating approximately $127.4 million in revenue to BRB. The BaaS channel has become a material contributor to the Bank's overall revenue and a significant driver of its risk profile — a fact that is at the heart of the regulatory deficiencies identified in the Consent Order.
BRB employs approximately 5,800 individuals across all divisions. The Bank's BSA/AML compliance department operated with a budget of $18.2 million in fiscal year 2024 and a headcount of 62 full-time equivalents ("FTEs") as of January 2025. As discussed in greater detail below, these resource levels are a critical factor in the Bank's inability to keep pace with the compliance demands generated by the rapid expansion of its BaaS operations.
BRB's most recent Community Reinvestment Act ("CRA") performance evaluation, completed by the OCC in June 2023, resulted in a rating of "Satisfactory." While the CRA rating is not directly implicated by the Consent Order, the Bank should be aware that a downgrade in CRA rating — which can result from BSA/AML compliance deficiencies — could have adverse consequences for the Bank's ability to pursue certain corporate activities, including branch openings and acquisitions.
B. Prior Supervisory History
The Consent Order did not arise in a vacuum. The OCC's findings reflect a pattern of escalating supervisory concern regarding BRB's BSA/AML compliance program, dating back to at least June 2022. The Order explicitly cites BRB's failure to adequately remediate prior supervisory actions as an aggravating factor supporting the severity of the enforcement action and the amount of the civil money penalty. The prior supervisory history is summarized as follows:
June 2022 — Matter Requiring Attention (MRA). The OCC issued a Matter Requiring Attention in connection with BRB's BSA/AML transaction monitoring program. The MRA identified specific deficiencies in the calibration and tuning of the Bank's Veridian TMS platform, noting that certain transaction monitoring scenarios were not adequately calibrated to detect suspicious activity patterns associated with the Bank's growing BaaS partnership channel. The MRA directed BRB to conduct a comprehensive review of its transaction monitoring scenarios, perform an independent model validation, and implement necessary recalibration. Although BRB committed to remediation, the OCC subsequently determined that the Bank's response was inadequate and that the underlying deficiencies persisted.
November 2023 — Matter Requiring Immediate Attention (MRIA). Escalating its supervisory posture, the OCC issued a Matter Requiring Immediate Attention in November 2023, focusing specifically on OFAC sanctions screening gaps in BRB's BaaS channels. The MRIA identified that certain transactions processed through fintech partner platforms were not being consistently routed through BRB's OFAC screening infrastructure, creating a significant risk of sanctions violations. The escalation from MRA to MRIA reflected the OCC's determination that the deficiency was a matter of urgency requiring immediate corrective action. Once again, BRB committed to remediation but failed to achieve satisfactory results prior to the commencement of the targeted BSA/AML examination in March 2024.
Representation by Drayton Mercer LLP. During the period encompassing both the June 2022 MRA and the November 2023 MRIA, as well as the 2023–2024 OCC examination cycle, BRB was represented by Drayton Mercer LLP (55 East 52nd Street, Suite 3100, New York, NY 10055), with Helen Frazier serving as lead engagement partner. As discussed further in Section XI of this memorandum, the Drayton Mercer engagement was terminated in January 2025 following issuance of the Consent Order, and C&H assumed the role of regulatory counsel effective February 10, 2025. The adequacy of Drayton Mercer's advice during the relevant period is a matter that BRB may wish to evaluate separately.
The Order's explicit citation of BRB's failure to remediate the June 2022 MRA and November 2023 MRIA is significant for several reasons. First, it demonstrates to the OCC, FinCEN, and any other reviewing authority that the Bank was on notice of these deficiencies for an extended period — in some cases more than two years — before the Consent Order was issued. Second, the failure to remediate prior supervisory actions is an aggravating factor under the OCC's enforcement guidelines, which contributed to the severity of the CMP amount and the scope of the remediation requirements. Third, the prior supervisory history may be relevant to any future DOJ or FinCEN analysis of whether BRB's conduct reflects "willful blindness" — a standard that, if met, could support criminal liability under 31 U.S.C. § 5322.
C. OCC Targeted Examination
The targeted BSA/AML examination was conducted by the OCC Northeastern District Office over a six-month period from March 2024 through September 2024. The examination was led by Jonathan Frey, National Bank Examiner, who served as Examiner-in-Charge. The scope of the examination was specifically focused on BRB's BSA/AML compliance program, with particular attention to the Bank's OFAC sanctions screening, suspicious activity reporting, customer due diligence, transaction monitoring, and board-level oversight — each of which was subsequently identified as a deficiency category in the Consent Order.
The targeted nature of the examination — as opposed to a routine full-scope safety and soundness examination — reflects the OCC's elevated level of concern regarding BRB's BSA/AML program, informed by the unremediated MRA and MRIA and by ongoing supervisory monitoring. The examination involved extensive document requests, on-site review of BRB's transaction monitoring systems and OFAC screening infrastructure, interviews with Bank personnel across the BSA/AML, BaaS, technology, and risk management functions, and sampling and testing of transactions processed through BaaS partner channels.
Concurrently with the OCC examination, BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP (engagement partner: Franklin Dorsey), completed its most recent independent BSA/AML test in September 2024. Caldera & Pope's findings identified multiple deficiencies that substantially echoed the findings subsequently documented in the Consent Order. The overlap between the independent testing results and the OCC's examination findings underscores the systemic nature of the compliance failures and the inadequacy of BRB's prior remediation efforts.
D. Issuance and Disclosure of the Consent Order
Consent Order No. OCC-2025-003 was issued and became effective on January 15, 2025. The Order was entered by stipulation and consent of BRB, without the Bank admitting or denying the OCC's findings, but consenting to the issuance of the Order and agreeing to comply with all of its terms and conditions. The consent process involved negotiations between the OCC's Enforcement and Compliance Division and BRB's then-counsel, Drayton Mercer LLP, during the period from approximately October 2024 through January 2025.
In accordance with its securities disclosure obligations under the Securities Exchange Act of 1934 and Regulation FD, BRFG publicly disclosed the Consent Order on January 16, 2025, the day following its issuance. The disclosure was made through a Current Report on Form 8-K filed with the Securities and Exchange Commission and an accompanying press release.
The market reaction to the disclosure was significant. BRFG common stock (NYSE: BRFG) declined from an implied pre-disclosure level of approximately $47.82 per share to $41.15 per share on January 16, 2025, representing a decline of approximately $6.67 per share, or 13.9%. Based on BRFG's 179.5 million shares outstanding, this decline represented a reduction in market capitalization of approximately $1.2 billion at the trough. As of February 7, 2025, the stock had partially recovered to $47.82 per share, corresponding to a market capitalization of approximately $8.58 billion ($47.82 × 179.5 million shares). The stock's partial recovery suggests that the market has, to some extent, priced in the remediation costs and assessed the Bank's ability to manage the regulatory challenge, though the recovery remains incomplete and sentiment could deteriorate if further adverse developments emerge.
The stock price decline and the magnitude of the Consent Order's financial impact have attracted the attention of significant shareholders. In particular, Brindoval Capital Partners LP (Managing Partner: Julian Whitmore), which holds approximately 8.3% of BRFG's outstanding common stock (approximately 14.9 million shares), has expressed concern through its outside counsel, Amberly Knox LLP (partner Steven Briggs), regarding remediation costs, the potential for additional enforcement fines, and the reputational impact of the Consent Order on BRFG's franchise value. The shareholder communication and associated derivative action risk are addressed in Section IX.E of this memorandum.
III. Summary of Key Consent Order Provisions and Deadlines
A. Structure of the Order
The Consent Order is structured in thirteen articles, each addressing a specific area of remediation or administrative requirement. The principal substantive articles correspond to the five core deficiency categories identified in the Order:
• Article I — Definitions and Scope
• Article II — OFAC Sanctions Screening Remediation
• Article III — SAR Filing Program Remediation
• Article IV — CDD/EDD Program Remediation
• Article V — Transaction Monitoring Model Validation and Upgrade
• Article VI — Board Oversight and Governance
• Article VII — Independent Consultant Engagement
• Article VIII — Remediation Action Plan
• Article IX — Quarterly Progress Reporting
• Article X — Civil Money Penalty
• Article XI — Compliance Self-Certification
• Article XII — Reservation of Rights (OCC, FinCEN, DOJ, OFAC)
• Article XIII — General Provisions (modification, termination, effective date)
Article VII mandates the engagement of an independent consultant acceptable to the OCC within 30 days of the Order's effective date. This requirement has been satisfied through the engagement of Thornfield Consulting Group LLC, as discussed in Section III.D below and in the Executive Summary. Article XII — the Reservation of Rights provision — is of particular significance: it expressly provides that the Order does not constitute a waiver of any right, power, or authority of the OCC, any other federal or state agency, or any other party to pursue additional enforcement, regulatory, or legal actions against BRB, its officers, directors, employees, or affiliates. This provision preserves the full spectrum of potential further enforcement actions discussed in Section IX of this memorandum.
B. Master Deadline Table
The following table consolidates all material deadlines established by the Consent Order and the related engagement agreements. BRB must treat each deadline as a firm regulatory commitment, the failure to meet which could result in additional enforcement action, modification of the Consent Order to impose more stringent requirements, or a finding that BRB has violated the terms of the Order.
Each of the foregoing deadlines carries significant consequences for non-compliance. We recommend that BRB designate a specific responsible individual and a backup for each deadline, establish internal "early warning" dates at least 30 days in advance of each regulatory deadline, and implement a formal tracking and escalation mechanism through the newly established Compliance Committee. A detailed deadline calendar with responsible party assignments is provided in Appendix B.
C. Civil Money Penalty
The Consent Order assesses a civil money penalty of $14,500,000 against BRB pursuant to 12 U.S.C. § 1818(i)(2). The CMP is due within 60 days of the effective date of the Order, which yields a payment deadline of March 16, 2025.
Payment is to be made by wire transfer to the United States Treasury in accordance with instructions to be provided by the OCC. We recommend that BRB's Treasury function, under the direction of Chief Financial Officer Samantha Reeves, initiate the wire transfer process no later than March 10, 2025, to allow adequate time for processing and confirmation prior to the deadline.
We note that the CMP is not deductible for federal income tax purposes. Under 26 U.S.C. § 162(f), as amended by the Tax Cuts and Jobs Act of 2017, no deduction is allowed for any amount paid or incurred to, or at the direction of, a government or governmental entity in relation to the violation of any law or the investigation or inquiry by such government or entity into the potential violation of any law. The $14,500,000 CMP falls squarely within this provision and must be treated as a non-deductible expense for tax purposes. BRB's tax department should be notified accordingly, and BRFG's consolidated tax returns should reflect the non-deductibility of this amount.
The CMP amount of $14,500,000, while substantial, is within the range of civil money penalties assessed by the OCC in recent BSA/AML enforcement actions against institutions of comparable size and with comparable deficiency profiles. Notably, the CMP reflects the OCC's consideration of several aggravating factors, including the prior unremediated MRA and MRIA, the volume of unscreened OFAC transactions, and the Bank's failure to maintain adequate BSA/AML resources relative to the growth and complexity of its BaaS operations. The CMP also reflects certain mitigating factors, including BRB's cooperation during the examination process, the Bank's agreement to consent to the Order, and the absence (to date) of evidence of intentional facilitation of illicit financial activity.
D. Independent Consultant Requirement (Article VII)
Article VII of the Consent Order requires BRB to engage an independent consultant acceptable to the OCC to conduct a comprehensive review and assessment of the Bank's BSA/AML and OFAC compliance programs and to validate BRB's remediation efforts. The engagement was required to be in place within 30 days of the Order's effective date — i.e., by February 15, 2025.
This requirement has been satisfied. The key details of the engagement are as follows:
Consultant: Thornfield Consulting Group LLC ("Thornfield")
Engagement Reference: TCG-BRB-2025-001
OCC Non-Objection: Received February 5, 2025. BRB submitted the proposed consultant selection to the OCC on January 27, 2025, and the OCC confirmed its non-objection within nine days.
Engagement Agreement Execution: February 10, 2025
Engagement Lead: Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory. Dr. Castellano is a recognized expert in BSA/AML compliance, with over 20 years of experience advising financial institutions on regulatory remediation and enforcement matters. She has served as an independent consultant in multiple OCC and FinCEN enforcement actions.
Team Composition:
• Robert Eastman, Senior Director, AML Transaction Monitoring — responsible for reviewing BRB's transaction monitoring framework, model validation, and SAR filing processes
• Jennifer Hwang, Director, Sanctions & OFAC Compliance — responsible for assessing OFAC screening coverage, gap analysis, and remediation validation
• Nathaniel Burgess, Director, Fintech & Payments Compliance — responsible for evaluating BaaS partnership compliance frameworks, CDD/EDD processes, and third-party risk management as they relate to BSA/AML and OFAC obligations
Engagement Fee Structure:
• Fixed fee: $6,500,000 for a 12-month engagement period (February 10, 2025 through February 15, 2026)
• Monthly installments: $541,666.67
• Expenses: Capped at $400,000 for the engagement period (covering travel, materials, and incidental costs)
• Total engagement cost: $6,900,000
Thornfield's Outside Counsel: Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, NY 10036
Key Engagement Milestones:
• On-site assessment commences: March 1, 2025
• Preliminary gap assessment delivery: April 15, 2025
• Final validation report: February 15, 2026
The Thornfield engagement is governed by an Engagement Letter that incorporates the requirements of Article VII of the Consent Order and includes provisions ensuring the OCC's right to direct the scope and manner of the engagement, receive all work product, and communicate directly with Thornfield. BRB's management team — particularly Patricia Langston (CCO), Thomas Ikeda (BSA Officer), Linda Petrosian (CIO/CTO), and Warren Ashby (Head of BaaS) — should be prepared to provide Thornfield with unrestricted access to all relevant systems, records, personnel, and documentation beginning on the March 1, 2025 on-site commencement date. C&H will coordinate with Thornfield and BRB management to establish appropriate information-sharing protocols, including protocols to protect attorney-client privileged communications.
IV. Analysis of Core Deficiency Category (i): OFAC Sanctions Screening Failures
A. Findings
The Consent Order identifies BRB's failure to screen 100% of transactions processed through its fintech BaaS channels against the Office of Foreign Assets Control sanctions lists as one of the most serious deficiencies in the Bank's compliance program. The Order's findings in this area are both specific and quantifiable, reflecting the OCC's detailed sampling and analysis during the targeted examination.
The primary locus of the screening failure was the BaaS partnership with NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner by transaction volume. NovaPay is a San Francisco-based fintech company (CEO: Ethan Garrison; 450 Mission Street, Suite 1200, San Francisco, CA 94105) that operates a consumer payments platform through which end users can send and receive money, pay bills, and conduct other financial transactions. NovaPay's platform utilizes BRB's national bank charter for the underlying banking functions, including the processing of wire transfers and Automated Clearing House ("ACH") transactions.
During calendar year 2023, NovaPay processed approximately 31,700,000 transactions through BRB's infrastructure. Of these, approximately 3,800,000 transactions — or approximately 12.0% — were not screened against OFAC sanctions lists prior to processing. The unscreened transactions included both wire transfers and ACH batches, representing the full range of payment types processed through the NovaPay channel.
The root cause of the screening gap was an integration failure between BRB's Veridian TMS/OFAC screening platform and NovaPay's transaction processing application programming interface ("API"). Specifically, certain ACH and wire batches originated through the NovaPay platform were routed through a processing pathway that bypassed BRB's OFAC screening queue entirely. The integration failure appears to have been introduced during an API update to the NovaPay platform in approximately the first quarter of 2023 and was not detected by BRB's technology or compliance teams until flagged during the OCC examination. The failure of BRB's internal controls to detect this routing error for a period of approximately six to nine months underscores the systemic weaknesses in the Bank's BaaS oversight framework.
NovaPay is BRB's largest BaaS partner by a significant margin. NovaPay accounted for approximately 41% of BRB's total BaaS transaction volume in calendar year 2024, with approximately $30.5 billion in transaction volume and approximately 2.1 million end-user accounts. The sheer scale of the NovaPay relationship amplifies the significance of the screening gap: a 12% screening failure rate applied to this volume of transactions represents a material sanctions compliance failure by any measure.
The Order also identifies potential screening gaps — of lesser magnitude but still significant — across additional BaaS partners, including FairLend Digital LLC ("FairLend") and VaultEdge Inc. ("VaultEdge"), as well as the remaining 11 active BaaS partners. The full scope of screening gaps across these additional partners has not yet been quantified and will be a principal focus of Thornfield's preliminary gap assessment, due April 15, 2025.
The Consent Order further notes the following OFAC screening statistics for calendar year 2024: BRB's OFAC screening system generated 14,320 OFAC screening hits, of which only 12 were determined to be true matches requiring blocking or rejection of the transaction. This yields a false-positive rate of approximately 99.9% ((14,320 – 12) ÷ 14,320 ≈ 99.92%). While a high false-positive rate is common in OFAC screening systems, the 99.9% rate at BRB warrants independent operational review as part of the remediation. An excessively high false-positive rate can create "alert fatigue" among compliance personnel, potentially leading to inadequate review of legitimate hits, and it suggests that the screening system's filtering parameters may not be appropriately calibrated. The remediation of OFAC screening coverage must therefore include not only achieving 100% screening across all BaaS channels but also optimizing the screening parameters to improve the signal-to-noise ratio.
B. Legal Obligations
BRB's OFAC sanctions screening obligations arise under multiple legal authorities that apply with particular force to national banks engaged in facilitating domestic and international payment transactions.
Bank Secrecy Act. The Bank Secrecy Act, 31 U.S.C. § 5311 et seq., and its implementing regulations at 31 C.F.R. Part 1010 et seq., require financial institutions, including national banks, to establish and maintain effective anti-money laundering programs that include, among other elements, internal controls reasonably designed to ensure compliance with the BSA and related regulations. An effective BSA program must encompass compliance with OFAC sanctions requirements, as the failure to screen transactions against OFAC sanctions lists directly undermines the BSA's purpose of preventing the use of the financial system for illicit purposes, including terrorism financing and sanctions evasion.
OFAC Regulations. The economic sanctions programs administered by OFAC are codified at 31 C.F.R. Parts 501 and 510–599. These regulations prohibit U.S. persons, including U.S. financial institutions, from engaging in transactions with or on behalf of sanctioned individuals, entities, and countries. OFAC's regulatory framework imposes a strict liability standard — intent is not an element of a sanctions violation. A financial institution that processes a transaction involving a sanctioned party has committed a violation regardless of whether the institution was aware of the sanctioned status. This strict liability standard makes BRB's failure to screen 3,800,000 NovaPay transactions an extraordinarily serious compliance failure, because each unscreened transaction that involved a sanctioned party would constitute an apparent violation of law.
OCC Supervisory Expectations. The OCC's supervisory expectations for OFAC compliance programs are set forth in 12 C.F.R. Part 21 and the OCC's BSA/AML examination handbook. These expectations require national banks to implement OFAC screening programs that are commensurate with the institution's risk profile — including the risk profile associated with third-party relationships such as BaaS partnerships. Critically, the OCC expects the chartered bank to screen all transactions processed through its charter, regardless of the origination channel. The delegation of transaction origination to a fintech partner does not relieve the chartered bank of its obligation to ensure that all transactions are screened against OFAC sanctions lists prior to processing.
BRB's Responsibility for BaaS Partner Transactions. This point cannot be overemphasized: BRB, as the chartered national bank, bears the ultimate and non-delegable obligation to ensure that all transactions processed through its charter are screened against applicable sanctions lists. While BRB may contractually require its BaaS partners to implement certain screening procedures, the regulatory obligation rests with BRB. The OCC, OFAC, and FinCEN will hold BRB responsible for any screening failures, regardless of whether those failures are attributable to the acts or omissions of a BaaS partner's technology platform.
Potential OFAC Civil Penalty Exposure. Under the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1705, OFAC may impose civil penalties of up to the greater of (a) $250,000 per violation or (b) twice the value of the transaction giving rise to the violation. Given the volume of unscreened transactions (3,800,000) and the potential that some of those transactions involved sanctioned parties, BRB's theoretical maximum civil penalty exposure under IEEPA is enormous. While the actual penalty, if assessed, would likely be substantially less than the theoretical maximum — particularly if BRB can demonstrate remedial action, cooperation, and the absence of actual sanctions matches — the potential exposure underscores the gravity of this deficiency.
C. Prior Supervisory Actions
As noted in Section II.B, the November 2023 MRIA specifically identified OFAC screening gaps in BRB's BaaS channels and directed BRB to take immediate corrective action. BRB's failure to remediate the MRIA is expressly cited in the Consent Order as an aggravating factor. The MRIA was issued approximately 14 months before the close of the targeted examination in September 2024, providing BRB with ample time to address the identified deficiency. The Bank's failure to do so — despite being on notice of the specific nature and location of the screening gap — is among the most significant aggravating circumstances in the Order and is likely to be a focus of any future enforcement action by OFAC or any DOJ analysis of BRB's culpability.
D. Remediation Requirements and Deadlines
The Consent Order requires BRB to achieve full OFAC screening remediation by November 1, 2025. Specifically, by that date, BRB must demonstrate that OFAC sanctions screening is fully operational for all BaaS channels, meaning that 100% of transactions processed through all 14 active BaaS partners are screened against current OFAC sanctions lists prior to processing.
The OFAC screening remediation is dependent upon several interrelated workstreams:
• Veridian TMS v.10.0 Upgrade: The OFAC screening module is a component of the Veridian transaction monitoring platform, and the required screening enhancements are part of the broader TMS v.10.0 upgrade. The TMS v.10.0 deployment (UAT complete) is required by August 1, 2025. The OFAC module must be fully operational by November 1, 2025, providing a three-month window between platform deployment and full OFAC operationalization.
• API Integration Remediation: BRB must work with NovaPay and all other BaaS partners to ensure that the API integration between each partner's transaction processing platform and BRB's OFAC screening infrastructure is properly configured to route 100% of transactions through the screening queue. This requires technical coordination with each partner's development teams and comprehensive testing across all transaction types (wire, ACH, card-based, and others).
• 100% Coverage Validation: BRB must develop and implement an OFAC remediation testing plan to validate screening coverage across all BaaS partners. This testing plan should include sampling-based transaction reconciliation, automated coverage monitoring, and exception reporting to ensure that no transactions bypass the screening queue.
E. Risk Assessment — OFAC Enforcement Exposure
The OFAC screening failure involving NovaPay presents a distinct and separate enforcement risk beyond the OCC Consent Order. The critical question is whether BRB should file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gap.
The case for filing a VSD is substantial. OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A) provide significant mitigating credit to entities that make voluntary self-disclosures of apparent violations. In cases involving VSDs, OFAC's base penalty calculation is reduced by up to 50%, and OFAC is substantially more likely to resolve the matter through a cautionary letter, a finding of violation (without a penalty), or a significantly reduced settlement amount. The 3,800,000 unscreened transactions in calendar year 2023 represent a significant potential violation population, and OFAC may become aware of the screening gap independently — either through the publicly disclosed Consent Order, through interagency information sharing with the OCC, or through future examination activity. A proactive VSD would position BRB favorably in any enforcement resolution and would demonstrate the Bank's commitment to transparency and remediation.
However, the VSD analysis is complex and involves several countervailing considerations, including the potential that a VSD filing could trigger or accelerate OFAC enforcement activity, the need to determine whether any of the 3,800,000 unscreened transactions actually involved sanctioned parties (which would transform the matter from a screening process failure into an actual sanctions violation), and the interaction between a VSD filing and the ongoing OCC remediation process. We also note that it must be determined whether any of the 12 true OFAC matches identified in the CY 2024 screening data corresponded to transactions that had previously passed through the unscreened NovaPay channel in CY 2023 or early CY 2024. If any such overlap exists, BRB's exposure is significantly heightened.
Given the complexity and significance of the VSD analysis, C&H will provide a separate, dedicated memorandum addressing the OFAC enforcement risk and VSD analysis in detail. That memorandum will be prepared in coordination with our Sanctions & Export Controls practice and will be provided within 30 days of this memorandum. We recommend that BRB not make any filing or communication with OFAC regarding the screening gap until that analysis is complete.
V. Analysis of Core Deficiency Category (ii): SAR Filing Deficiencies
A. Findings
The Consent Order identifies significant deficiencies in BRB's Suspicious Activity Report ("SAR") filing program, encompassing both timeliness of filing and the accumulation of a substantial backlog of unreviewed and undispositioned suspicious activity alerts.
As of the examination close date (September 2024), BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned. These alerts were generated by BRB's Veridian TMS through various transaction monitoring scenarios but remained in the alert queue without analysis by a compliance investigator. The backlog represents a direct failure to discharge BRB's obligation to evaluate potentially suspicious activity and, where warranted, to file timely SARs with FinCEN.
For those SARs that were filed, the average filing time was 78 days from alert generation. This is far in excess of the regulatory expectation that SARs be filed within 30 days of initial detection of suspicious activity (with a limited 30-day extension available in narrow circumstances where no suspect has been identified, yielding a maximum of 60 days). BRB's average filing time of 78 days indicates a systemic failure to allocate adequate investigative resources to the suspicious activity reporting function.
The SAR filing statistics for calendar year 2024 provide additional context:
• Total SARs filed: 3,847 (up from 2,914 in CY 2023, representing a 32% year-over-year increase)
• Total Currency Transaction Reports ("CTRs") filed: 28,612
• Total transaction monitoring alerts generated: 41,500
• SAR conversion rate: 3,847 ÷ 41,500 ≈ 9.3%
• BaaS-related SARs: 2,108 (54.8% of all SARs filed)
Several observations warrant emphasis. First, the 32% increase in SAR volume from CY 2023 to CY 2024 may reflect either an actual increase in suspicious activity in BRB's customer base (particularly in BaaS channels) or improved detection resulting from monitoring adjustments made during the examination period. Regardless of the cause, the increased volume, combined with the persistent 2,400-alert backlog, confirms that BRB's investigative capacity was fundamentally insufficient to process the volume of alerts generated by its monitoring system.
Second, the concentration of BaaS-related SARs at 54.8% of total SARs filed is striking. While BaaS transaction volume is substantial (approximately $74.3 billion in CY 2024), the disproportionate contribution of BaaS channels to BRB's SAR filing activity indicates that these channels present an elevated risk of suspicious activity — a risk that the Bank's BSA/AML program was not adequately resourced to manage. This concentration also implies that a significant portion of the 2,400-alert backlog may relate to BaaS-originated transactions, compounding the regulatory exposure associated with the Bank's BaaS partnerships.
Third, the 9.3% SAR conversion rate (SARs filed as a percentage of total alerts generated) raises questions about the calibration of BRB's transaction monitoring scenarios. Without a current model validation (as discussed in Section VII), it is difficult to determine whether the 9.3% conversion rate represents optimal detection performance, under-detection (suggesting that the monitoring system is failing to flag suspicious activity that should be investigated), or over-alerting (generating excessive false-positive alerts that consume investigative resources without yielding proportionate SAR filings). The model validation required by the Order will address this question.
B. Legal Obligations
BRB's SAR filing obligations are established by 31 U.S.C. § 5318(g) and its implementing regulation at 31 C.F.R. § 1020.320. Under these provisions, a national bank is required to file a SAR whenever it detects a known or suspected violation of law or a suspicious transaction related to money laundering, terrorist financing, or other illegal activity, provided the transaction involves or aggregates at least $5,000 in funds or other assets.
The filing timeline is critical: a SAR must be filed with FinCEN no later than 30 days after the date of initial detection of facts that may constitute a basis for filing. If no suspect has been identified at the time of initial detection, the filing deadline may be extended by an additional 30 days, to a maximum of 60 days from initial detection. There is no further extension. In no case may a SAR filing be delayed beyond 60 days.
SARs are filed electronically with FinCEN using FinCEN's Form 111 through the BSA E-Filing System. Each SAR must include a detailed narrative describing the suspicious activity, the basis for the filing, the parties involved, and any other relevant information. The quality and completeness of SAR narratives is a supervisory priority for both FinCEN and the OCC, and deficiencies in narrative quality can constitute independent compliance failures.
Failure to file timely and accurate SARs constitutes a violation of the BSA and is subject to civil money penalties under 31 U.S.C. § 5321, which provides for penalties of up to $100,000 per violation (or such higher amount as may be adjusted for inflation). In cases involving a pattern or practice of violations, or where the violations are willful, criminal liability under 31 U.S.C. § 5322 may be implicated, with penalties including fines of up to $250,000 and imprisonment of up to five years, or up to $500,000 and 10 years if the violation is committed while violating another law or as part of a pattern of illegal activity.
The OCC's supervisory expectations for SAR programs are set forth in the BSA/AML examination handbook and emphasize the importance of timely filing, adequate investigative staffing, robust quality assurance processes, and ongoing management reporting on SAR program metrics.
C. FinCEN Monitoring
FinCEN is actively monitoring BRB's SAR filing remediation through its coordination with the OCC. The FinCEN liaison assigned to BRB's matter is Angela Drummond, Associate Director, Enforcement Division. Ms. Drummond's assignment to the matter reflects FinCEN's elevated level of interest in BRB's SAR filing performance and its potential for independent enforcement action.
As of February 10, 2025, FinCEN has not filed an independent enforcement action against BRB. However, FinCEN has expressly reserved its enforcement rights through its coordination with the OCC, and the Consent Order's Reservation of Rights provision (Article XII) confirms that the Order does not preclude any separate FinCEN action. BRB's SAR filing performance during the remediation period will be scrutinized by FinCEN, and any evidence of continued filing deficiencies, inadequate backlog remediation, or the discovery of previously unreported significant suspicious activity through the SAR lookback could prompt FinCEN to pursue its own civil money penalty action.
We recommend that BRB engage proactively with FinCEN — through the OCC coordination channels established under the Consent Order — to demonstrate the Bank's commitment to SAR program remediation and to provide regular updates on backlog clearance progress. This proactive engagement is among the most important steps BRB can take to mitigate the risk of a separate FinCEN enforcement action.
D. Remediation Requirements and Deadlines
The Consent Order establishes two specific SAR-related deadlines:
• March 31, 2025: BRB must submit an interim SAR backlog status report to the OCC documenting the current status of the 2,400-alert backlog, the investigative resources deployed, the number of alerts reviewed and dispositioned to date, and the projected timeline for full backlog clearance.
• June 30, 2025: BRB must achieve full clearance of the 2,400-alert SAR backlog, meaning that all 2,400 alerts must be fully investigated, dispositioned, and — where warranted — SARs filed with FinCEN.
In addition to these specific deadlines, the Order requires BRB to reduce its average SAR filing time to within 30 days of alert generation on a going-forward basis and to establish a robust quality assurance framework for ongoing SAR filing.
The remediation of the SAR backlog and the improvement of SAR filing timeliness require a significant deployment of additional resources. BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide temporary BSA/AML analyst staffing for the remediation period. The key terms of the Pinnacle engagement are as follows:
• Number of temporary FTEs: 30
• Monthly cost per FTE: $10,000
• Engagement duration: 12 months
• Total Pinnacle engagement cost: $3,600,000 (30 FTEs × $10,000/month × 12 months)
• Key contact: Andrea Solis, Director of Managed Services
• Statement of Work Reference: PCS-BRB-2025-0012
The 30 temporary Pinnacle analysts will supplement BRB's existing 62-FTE BSA/AML department and will be principally deployed to the SAR backlog clearance effort. Given that each of the 2,400 alerts must be individually reviewed, investigated (including gathering supporting documentation and transaction details), dispositioned (with a documented decision to file or not file a SAR), and — where a SAR is warranted — narrated and filed, the per-alert workload is substantial. A reasonable estimate is that each alert will require an average of 4–6 hours of analyst time for full investigation and disposition, yielding a total workload of approximately 9,600–14,400 analyst hours for the full backlog. With 30 Pinnacle analysts and a portion of BRB's existing staff dedicated to the effort, we believe the June 30, 2025 deadline is achievable but will require disciplined project management and prioritization.
In addition to the backlog clearance, BRB must conduct a SAR lookback project to review historical alert populations — potentially extending beyond the 2,400-alert backlog to earlier periods — to determine whether additional SARs should have been filed and were not. The SAR lookback is estimated to cost $5,500,000 and will be a critical input into the assessment of BRB's further enforcement exposure. If the lookback reveals that BRB failed to file SARs on significant illicit activity — including money laundering, fraud, or sanctions-related transactions — the consequences could be severe, including heightened FinCEN enforcement risk and increased DOJ referral risk.
BRB must also establish a comprehensive quality assurance framework for ongoing SAR filing, including second-level review of all SAR decisions and narratives, periodic sampling and testing of filed SARs and no-SAR determinations, and management reporting on SAR program metrics (filing volumes, filing timeliness, conversion rates, and backlog levels).
E. Risk Assessment
The SAR filing deficiencies represent one of the highest-risk areas of the Consent Order for several reasons:
• The 2,400-alert backlog represents potentially unfiled SARs on significant suspicious activity. Until each alert has been investigated and dispositioned, BRB does not know the nature or severity of the activity flagged by these alerts. The possibility that some alerts involve serious illicit activity — including money laundering, terrorist financing, fraud, or sanctions evasion — cannot be excluded.
• If the SAR lookback reveals that BRB failed to file SARs on material suspicious activity over an extended period, the Bank faces potential FinCEN penalties, increased DOJ referral risk, and reputational harm beyond what has already been experienced.
• The concentration of 54.8% of SARs in BaaS channels suggests systemic monitoring issues in fintech partnerships. This pattern may indicate that BaaS partners are inadequately screening their end users, that the transaction profiles of BaaS end users present elevated risk, or both. In either case, the concentration raises questions about BRB's third-party risk management framework for its BaaS relationships.
• The 78-day average filing time indicates that even when suspicious activity was detected, BRB was consistently failing to meet its regulatory filing obligation. This pattern of untimely filing could be characterized as a "pattern or practice" under the civil penalty provisions of 31 U.S.C. § 5321, potentially supporting enhanced penalties in any future FinCEN action.
VI. Analysis of Core Deficiency Category (iii): CDD/EDD Failures
A. Findings
The Consent Order identifies widespread deficiencies in BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") programs, affecting approximately 47,000 high-risk customer accounts. These accounts lack adequate documentation and risk assessment necessary to satisfy BRB's regulatory obligations under the BSA and the CDD Rule.
The affected accounts are predominantly those onboarded through BRB's fintech BaaS partner channels. The three largest BaaS partners account for the vast majority of the affected accounts:
• NovaPay Technologies Inc.: Approximately 2.1 million end-user accounts onboarded through NovaPay since 2021 (NovaPay is BRB's largest BaaS partner, accounting for 41% of total BaaS transaction volume, approximately $30.5 billion in CY 2024; CEO: Ethan Garrison; 450 Mission Street, Suite 1200, San Francisco, CA 94105).
• FairLend Digital LLC: A fintech lending platform that originates consumer and small business loans through BRB's charter, with approximately $1.4 billion in loan originations through BRB in FY 2024 (onboarded 2022; CEO: Aisha Okonkwo).
• VaultEdge Inc.: A digital banking platform offering deposit accounts through BRB's charter, with approximately 870,000 deposit accounts (onboarded 2023; CEO: Marcus Tan).
Together, these three partners represent approximately 87% of BRB's total BaaS transaction volume (NovaPay 41%, FairLend 28%, VaultEdge 18%). The remaining 11 active BaaS partners collectively represent approximately 13% of total BaaS volume.
The specific CDD/EDD deficiencies identified by the OCC include:
• Incomplete beneficial ownership identification: For many accounts involving legal entities, BRB's records did not contain adequate documentation of the beneficial owners controlling the entity, as required by FinCEN's CDD Rule.
• Insufficient risk rating documentation: High-risk accounts lacked documented risk assessments explaining the basis for the risk rating assignment and the enhanced monitoring measures applied.
• Missing or outdated customer identification program ("CIP") records: Certain accounts lacked the core CIP elements — name, date of birth, address, and identification number — or contained CIP records that had not been updated to reflect changes in customer information.
• Failure to conduct periodic reviews of high-risk accounts: BRB's policies required periodic reviews of accounts rated as high-risk, but the Bank had failed to conduct these reviews on a substantial number of accounts, particularly those onboarded through BaaS channels.
The root cause of the CDD/EDD deficiencies is multifaceted, but the central factor is BRB's failure to maintain adequate control over the customer onboarding process as it was increasingly delegated to BaaS partners. In many cases, BaaS partners were performing the initial customer onboarding — including identity verification and CIP data collection — on BRB's behalf, but the information collected was either incomplete, was not transmitted to BRB in a format that allowed the Bank to independently verify and document compliance, or was not subject to adequate quality assurance review by BRB personnel. As the BaaS partner roster expanded from 2021 through 2023, the volume of accounts onboarded through these channels far outpaced BRB's capacity to conduct effective CDD/EDD.
B. Legal Obligations