CONSOLIDATED BSA/AML & SANCTIONS POLICY SUITE
REDLINE INDEX
Master Index of Revised Policies, Procedures, and Manuals BSA/AML and Sanctions Compliance Program Remediation
Prepared for:
Belmont Ridge Bank National Association OCC Charter No. 48271 FDIC Certificate No. 31845
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No. 1045-00002
Responsible Partner: Philip Hartmann Banking & Finance Practice Group
Date: May 15, 2025
Submitted concurrent with Comprehensive Remediation Action Plan to the Office of the Comptroller of the Currency
Consent Order Reference: OCC Consent Order No. OCC-2025-003 Issued January 15, 2025
CLASSIFICATION: ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
This document and the materials referenced herein are protected by the attorney-client privilege, the work-product doctrine, and the common-interest privilege. This document has been prepared by Calderwood & Harkness LLP at the direction of and for the benefit of its client, Belmont Ridge Bank National Association and its parent holding company, Belmont Ridge Financial Group, Inc. (NYSE: BRFG). Any unauthorized review, use, disclosure, or distribution of this document or the materials referenced herein is strictly prohibited. If you have received this document in error, please contact Philip Hartmann at Calderwood & Harkness LLP immediately at (212) 555-0187.
Version: 1.0 — Initial Compilation
Right-click to update Table of Contents
Section 1: Purpose and Background
1.1 Purpose of This Index
This document serves as the master organizing framework for the complete suite of revised Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance policies, procedures, and manuals produced during the comprehensive remediation program undertaken by Belmont Ridge Bank National Association ("BRB" or "Belmont Ridge" or the "Bank") in response to Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025. The remediation program is being conducted under the supervision of Calderwood & Harkness LLP ("C&H") and is subject to independent validation by the Board-appointed independent consultant, Thornfield Consulting Group LLC ("Thornfield").
This Consolidated BSA/AML & Sanctions Policy Suite — Redline Index (this "Index") catalogs each document produced or materially amended in the course of the remediation by the following identifying attributes:
(a) Document title and reference number;
(b) Version number, in accordance with the version control conventions set forth in Section 5 below;
(c) Effective date, or, where the document remains in draft, target date for finalization;
(d) Document type — specifically, whether the document constitutes a policy, procedure, manual, template, framework, analysis, regulatory correspondence, vendor agreement, or other document category;
(e) Responsible owner — the BRB officer or, in the case of privileged work product, the C&H attorney accountable for the document's ongoing maintenance and periodic review;
(f) The specific article or articles of the Consent Order addressed by the document;
(g) The remediation workstream to which the document pertains; and
(h) Current status, as further described in Section 1.4 below.
The intended audience for this Index includes the following individuals and entities:
• BRFG Board of Directors and Compliance Committee: chaired by James Rutherford, the Compliance Committee has primary Board-level oversight responsibility for the remediation program and the BSA/AML and sanctions compliance program generally;
• BRB Senior Management: including, without limitation, Patricia Langston (Chief Compliance Officer), Thomas Ikeda (BSA Officer), and the other senior officers identified in the distribution list set forth in Section 7;
• OCC Supervisory Staff: specifically, Jonathan Frey, Examiner-in-Charge, OCC Northeastern District Office, to whom non-privileged portions of this Index and the underlying documents will be made available in connection with the OCC's ongoing supervisory oversight, subject at all times to the privilege protocols described herein; and
• Thornfield Consulting Group LLC: specifically, Dr. Vivian Castellano, Managing Director and engagement lead, and her team, for purposes of independent validation of the remediation program, subject to the Access & Cooperation Protocol (Document 6-03) and the Privilege & Confidentiality Side Letter (Document 6-04).
This Index is intended to function as a living document throughout the remediation period, and will be updated by C&H as documents progress through the review, validation, and approval lifecycle described herein.
1.2 Regulatory Background
Consent Order. On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association, a national banking association organized under the National Bank Act and chartered by the OCC (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of a targeted BSA/AML examination conducted by the OCC from approximately March 2024 through September 2024, and constitutes the most significant enforcement action taken against the Bank in its 37-year operating history.
The Consent Order identifies five core deficiency categories in the Bank's BSA/AML and sanctions compliance program:
(i) Inadequate OFAC Sanctions Screening for Fintech BaaS Channels. The OCC found that BRB failed to implement adequate Office of Foreign Assets Control ("OFAC") sanctions screening procedures for transactions processed through its Banking-as-a-Service ("BaaS") fintech partner channels. Specifically, the OCC identified that approximately 12% of transactions processed through BRB's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), were not subjected to any OFAC screening during calendar year 2023 — representing approximately 3,800,000 of 31,700,000 total NovaPay transactions in that period. The screening gap resulted from a systems integration failure between BRB's OFAC screening module and NovaPay's transaction processing platform that was neither identified nor remediated during the period at issue.
(ii) Deficient SAR Filing Timeliness and Quality. The OCC found that BRB's Suspicious Activity Report ("SAR") filing program suffered from material timeliness and quality deficiencies. At the time of examination completion in September 2024, BRB maintained a backlog of 2,400 unreviewed transaction monitoring alerts. Furthermore, the average time from alert generation to SAR filing was 78 days, far exceeding the 30-day regulatory expectation established by FinCEN guidance. SAR narrative quality was also found to be deficient, with incomplete descriptions of suspicious activity and inadequate supporting documentation.
(iii) Insufficient CDD/EDD for High-Risk Customers Onboarded Through Fintech Partners. The OCC identified approximately 47,000 high-risk customer accounts that lacked adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") documentation, the substantial majority of which were customer accounts onboarded through BRB's fintech BaaS partner channels. The deficiency encompassed missing beneficial ownership information, inadequate source-of-funds documentation, and the absence of risk-appropriate ongoing monitoring for accounts designated as high-risk.
(iv) Inadequate Model Validation for the Transaction Monitoring System. The OCC determined that BRB's transaction monitoring system — the Veridian Analytics Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3") — had not been subjected to an independent model validation since March 2021, and that its detection scenario parameters had not been tuned since October 2022. This represented a period of more than four years without independent validation and more than two years without parameter tuning, during which BRB's transaction volumes had grown substantially — driven in large part by the expansion of its BaaS program.
(v) Board-Level Oversight Deficiencies. The OCC found that BRB's Board of Directors (which, as the Bank is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), overlaps with the BRFG Board) had failed to exercise adequate oversight of the Bank's BSA/AML and sanctions compliance program. Specifically, the Board lacked a dedicated Compliance Committee, BSA/AML reporting to the Board was infrequent and insufficiently detailed, and the Board had failed to take timely corrective action in response to prior supervisory findings.
Prior Supervisory History
The Consent Order did not arise in a vacuum. BRB's BSA/AML compliance program had been the subject of escalating supervisory concern for more than two years prior to the Consent Order's issuance:
• June 2022 — Matter Requiring Attention ("MRA"). The OCC issued an MRA citing deficiencies in BRB's BSA/AML transaction monitoring program, including concerns regarding alert management capacity and the need for enhanced detection scenarios in light of growing BaaS transaction volumes.
• November 2023 — Matter Requiring Immediate Attention ("MRIA"). The OCC escalated to an MRIA, citing OFAC screening gaps specific to BaaS partner transaction flows. The MRIA explicitly directed BRB to implement remedial measures within 90 days. BRB retained outside counsel, Drayton Mercer LLP ("Drayton Mercer"), to assist with the remediation effort, but the MRIA was not adequately remediated within the specified timeframe or at any point prior to the commencement of the targeted examination in March 2024.
Both the June 2022 MRA and the November 2023 MRIA were inadequately remediated under the direction of prior outside counsel, Drayton Mercer LLP (Helen Frazier, Partner, 55 East 52nd Street, Suite 3100, New York, NY 10055). BRB terminated the Drayton Mercer engagement effective January 2025 and engaged Calderwood & Harkness LLP to serve as lead outside counsel for the remediation program.
Civil Money Penalty
As part of the Consent Order, the OCC assessed a civil money penalty ("CMP") of $14,500,000 against BRB pursuant to 12 U.S.C. § 1818(i)(2). The CMP was paid by wire transfer to the United States Treasury on March 16, 2025. The CMP is non-deductible for federal income tax purposes under 26 U.S.C. § 162(f).
Remediation Deadlines. The Consent Order establishes the following principal compliance deadlines:
• May 15, 2025: Submission of a Comprehensive Remediation Action Plan ("RAP") to the OCC. This Index is being submitted concurrent with the RAP on this date.
• February 15, 2026: Full implementation of all remediation measures and self-certification of compliance by the Bank's Chief Executive Officer, supported by the final validation report of the independent consultant.
Interim milestones associated with each remediation workstream are detailed in Section 2 below.
1.3 Scope of the Policy Suite
The policy suite indexed in this document encompasses all policies, procedures, manuals, frameworks, templates, and operational documents that have been revised, created, or materially amended as part of the remediation program undertaken in response to the Consent Order. The scope of the policy suite is as follows:
Organizational Structure. The documents are organized by five primary remediation workstreams, corresponding to the five core deficiency categories identified in the Consent Order, plus additional cross-cutting categories addressing governance, training, independent consultant engagement, regulatory correspondence, BaaS partner oversight, staffing, regulatory risk, OCC reporting deliverables, and master remediation plan documentation. A sixth cross-cutting section addresses outside counsel engagement and advisory documents.
Business Line Coverage. The policy suite encompasses all BRB business lines, including:
• Retail Banking;
• Commercial Lending;
• Wealth Management; and
• Fintech Banking-as-a-Service ("BaaS") partnerships, encompassing all 14 active BaaS partners as of the date of this Index.
Regulatory Touchpoints. The policy suite addresses BRB's compliance obligations across all applicable regulatory touchpoints, including:
• The Office of the Comptroller of the Currency ("OCC"), as the Bank's primary federal regulator;
• The Financial Crimes Enforcement Network ("FinCEN"), as the administrator of the BSA and the agency to which SARs and other BSA reports are filed; and
• The Office of Foreign Assets Control ("OFAC"), as the agency responsible for administering and enforcing U.S. economic sanctions programs.
1.4 Document Control Conventions
The following conventions are used throughout this Index and govern the version control, classification, and status tracking of all documents in the policy suite:
Version Numbering. All documents follow a Major.Minor versioning convention:
• Version 1.0 designates the initial remediation version of a document — that is, the first version produced or materially revised in connection with the Consent Order remediation program.
• Version 1.1, 1.2, etc., designates incremental revisions to the initial remediation version, typically reflecting comments from internal stakeholders, C&H review, or Thornfield feedback.
• Version 2.0 designates a comprehensive post-validation update, typically incorporating findings from Thornfield's independent assessment or from changes arising from new system deployments (e.g., the Veridian TMS v.10.0 upgrade).
• Version 3.0 designates a comprehensive post-implementation revision, expected in January 2026, in preparation for the February 15, 2026 self-certification filing.
Redline Convention. All redline versions are tracked-changes drafts prepared against the prior version of the applicable document that was in effect as of the Consent Order date (January 15, 2025). Where a document is entirely new — i.e., where no prior version existed — the redline is prepared against a blank baseline, and the document is so noted. A clean version accompanies each redline document.
Responsible Owner. The "responsible owner" designation identifies the BRB officer (or, in the case of privileged work product, the C&H attorney) who is accountable for the document's ongoing maintenance and periodic review. The responsible owner is the individual who must authorize any changes to the document and who is responsible for ensuring that the document remains current and accurate.
Consent Order Article References. All Consent Order article references used in this Index correspond to the article numbering set forth in the Article-by-Article Annotated Summary of OCC Consent Order No. OCC-2025-003 prepared by Calderwood & Harkness LLP, a copy of which has been distributed to all individuals on the distribution list set forth in Section 7.
Status Categories. Each document in this Index is assigned one of the following status categories:
• "Draft — Under Review" — The document has been prepared or revised but has not yet received final approval from the responsible owner and, where applicable, from C&H and/or Thornfield.
• "Final — Approved" — The document has received final approval from the responsible owner and any required external reviewers, and is in effect for operational purposes.
• "Final — Board Adopted" — The document has been formally adopted by the BRFG Board of Directors or the Compliance Committee, as applicable, by Board resolution or Committee action.
• "Pending Thornfield Validation" — The document has been submitted to Thornfield Consulting for independent review and validation, and is awaiting Thornfield's assessment and any recommended revisions.
• "Final — C&H Work Product" — The document constitutes attorney work product prepared by Calderwood & Harkness LLP and is subject to attorney-client privilege and work-product protection.
• "Final — Executed" — The document is a contract, agreement, or other legal instrument that has been fully executed by all parties.
• "Final — Submitted" or "Final — Submitted to OCC" — The document has been transmitted to the OCC, FinCEN, or other regulatory body in connection with the remediation program.
• "Under Negotiation" — The document is a vendor agreement or similar instrument that remains subject to ongoing negotiation between BRB and the applicable counterparty.
• "Active" — The document is a living document that is updated on a rolling basis.
• "Included in RAP submission" — The document is a component of the Comprehensive Remediation Action Plan submitted to the OCC on May 15, 2025.
• "Draft — Placeholder" — The document is a forward-dated deliverable for which a preliminary template or outline has been prepared, but substantive content will be developed closer to the applicable filing deadline.
Section 2: Summary of Remediation Workstreams and Consent Order Cross-References
2.1 Workstream Overview
The remediation program is organized into five primary workstreams, each corresponding to one of the five core deficiency categories identified in the Consent Order. The following table provides a summary overview of each workstream, including the nature of the deficiency, key metrics, and critical deadlines.
Workstream 1: OFAC Sanctions Screening Remediation
Workstream 1 addresses the Consent Order's findings regarding BRB's failure to implement adequate OFAC sanctions screening for fintech BaaS channel transactions. The most significant finding relates to BRB's largest BaaS partner, NovaPay Technologies Inc., where the OCC identified that approximately 12% of NovaPay transactions — representing approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023 — were not subjected to any OFAC sanctions screening due to a systems integration failure between BRB's OFAC screening module and NovaPay's transaction processing platform. The screening gap also extended, to varying degrees, to other BaaS partner transaction flows. The full OFAC operationalization deadline — meaning 100% screening coverage of all BaaS partner transaction flows on a real-time or near-real-time basis — is November 1, 2025.
Workstream 2: SAR Backlog Clearance & Process Improvement
Workstream 2 addresses the Consent Order's findings regarding the Bank's SAR filing program, including a backlog of 2,400 unreviewed transaction monitoring alerts as of September 2024, an average SAR filing time of 78 days from alert generation (versus the 30-day regulatory expectation), and quality deficiencies in SAR narratives and supporting documentation. BRB has engaged Pinnacle Compliance Solutions LLC to deploy 30 temporary full-time-equivalent analyst positions to supplement BRB's permanent staff in clearing the alert backlog. The SAR backlog clearance target date is June 30, 2025.
Workstream 3: CDD/EDD Remediation
Workstream 3 addresses the Consent Order's findings regarding inadequate Customer Due Diligence and Enhanced Due Diligence documentation for approximately 47,000 high-risk customer accounts, the substantial majority of which were onboarded through BRB's fintech BaaS partner channels. The remediation is structured in two phases: the first phase targets completion of CDD/EDD remediation for 50% of the identified accounts (23,500 accounts) by July 15, 2025; the second phase targets 100% completion (all 47,000 accounts) by January 15, 2026.
Workstream 4: Transaction Monitoring Model Validation & Tuning
Workstream 4 addresses the Consent Order's findings regarding the Veridian Analytics Transaction Monitoring System, version 8.3, which had not been independently validated since March 2021 and whose detection scenario parameters had not been tuned since October 2022. BRB is pursuing an upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, which incorporates enhanced detection scenarios, improved BaaS-channel analytics, and modernized alert management capabilities. The upgrade is subject to the following milestones: user acceptance testing ("UAT") completion by August 1, 2025, and independent model validation completion by October 1, 2025. For calendar year 2024, the Veridian TMS generated 41,500 alerts, of which 3,847 resulted in SAR filings (a 9.3% SAR conversion rate).
Workstream 5: BSA/AML Program Governance & Training Enhancement
Workstream 5 addresses the Consent Order's findings regarding Board-level oversight deficiencies, including the absence of a dedicated Compliance Committee, inadequate BSA/AML reporting metrics, and insufficient Board engagement with compliance program matters. In response, the BRFG Board of Directors adopted a Board Resolution on February 28, 2025 — within the 45-day deadline established by the Consent Order — formally acknowledging the Consent Order, establishing a standing Compliance Committee (chaired by James Rutherford), authorizing the $42,500,000 remediation budget (exclusive of the $14,500,000 CMP), and directing management cooperation with Calderwood & Harkness LLP and Thornfield Consulting Group LLC.
Workstream Summary Table
2.2 Consent Order Article Mapping Key
The following reference key maps the article numbers of OCC Consent Order No. OCC-2025-003 to their substantive topics. This mapping key is used throughout this Index to cross-reference each indexed document to the specific Consent Order provisions that it addresses.
Note: The article numbers set forth in this mapping key are based on the structure of the Consent Order as analyzed in the Article-by-Article Annotated Summary prepared by C&H. All cross-references to Consent Order articles throughout this Index are consistent with that Annotated Summary, which has been distributed to all individuals on the distribution list set forth in Section 7.
Section 3: Master Document Index
This section constitutes the core of this Index and provides a comprehensive catalog of all 74 documents produced, revised, or materially amended in connection with the remediation program, organized by workstream and cross-cutting category. For each document, this section provides the identifying attributes described in Section 1.1, together with a substantive description of the document's contents and purpose.
3.1 Workstream 1 — OFAC Sanctions Screening Remediation
Workstream 1 encompasses all policies, procedures, analysis memoranda, testing frameworks, remediation plans, and vendor work product related to the remediation of the OFAC sanctions screening deficiencies identified in the Consent Order. Seven documents are indexed under this workstream.
Document 1-01: Revised OFAC Compliance Policy
Document Type: Policy Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Article V
This document constitutes the enterprise-wide OFAC compliance policy for Belmont Ridge Bank National Association, comprehensively revised as part of the remediation program. The Revised OFAC Compliance Policy addresses sanctions screening requirements applicable to all BRB business lines, including retail banking, commercial lending, wealth management, and — critically — the BaaS fintech partner channel that was the subject of the Consent Order's most significant OFAC-related finding. The policy establishes BRB's obligations with respect to interdiction and blocking procedures for transactions involving Specially Designated Nationals ("SDN"), Sectoral Sanctions Identifications ("SSI"), and other parties appearing on OFAC's various sanctions lists, including non-SDN lists such as the Foreign Sanctions Evaders List and the Correspondent Account or Payable-Through Account Sanctions List. The policy specifies escalation and reporting protocols, including the mandatory 10-day OFAC blocking report requirement for blocked transactions. The policy also establishes requirements for sanctions list management — specifically, the procedures for downloading, updating, and integrating OFAC list updates into BRB's screening systems — and sets forth the responsibilities of BaaS partners with respect to cooperation in the screening process. Recordkeeping requirements are specified in accordance with OFAC's record retention regulations. This policy replaces the prior OFAC compliance policy, which failed to address BaaS channel screening requirements and was identified by the OCC as a root cause of the NovaPay screening gap.
Document 1-02: OFAC Screening Procedures Manual
Document Type: Procedure Manual Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article V
This document provides detailed operational procedures for the execution of OFAC sanctions screening across all BRB transaction types and channels. The manual addresses both real-time screening workflows (applicable to wire transfers, card transactions, and certain BaaS partner transaction flows) and batch screening workflows (applicable to ACH transactions and certain legacy BaaS partner integrations). The manual includes step-by-step procedures for hit review and disposition, including the evaluation of potential matches, the documentation of disposition decisions, and the criteria for escalation to the BSA Officer. Particular attention is given to false-positive management — a critical operational challenge given that BRB's OFAC screening system generated 14,320 screening hits in calendar year 2024, of which only 12 were confirmed true matches, reflecting a false-positive rate of approximately 99.9%. The manual sets forth escalation procedures to BSA Officer Thomas Ikeda for confirmed or potential true matches, and details the procedures for OFAC reporting, including the preparation and filing of blocking reports and the submission of voluntary self-disclosures where warranted.
Document 1-03: OFAC Compliance Gap Analysis Memorandum
Document Type: Privileged Analysis Version: 1.0 Date: March 2025 Status: Final — C&H Work Product Responsible Owner: Philip Hartmann, Calderwood & Harkness LLP (external) Consent Order Article(s): Article V
This privileged memorandum constitutes C&H's comprehensive assessment of BRB's OFAC compliance program across all business lines, identifying all material gaps and deficiencies. The analysis encompasses the 12% unscreened NovaPay transaction flow (approximately 3,800,000 of 31,700,000 NovaPay transactions in calendar year 2023), BaaS channel integration deficiencies affecting partners beyond NovaPay, list management gaps relating to the timeliness and completeness of OFAC list updates across all screening platforms, and interdiction workflow failures that impeded the timely blocking of transactions involving sanctioned parties. The memorandum also identifies root causes for each identified gap, including technology failures, process deficiencies, staffing shortfalls, and governance weaknesses. This document is attorney-client privileged and constitutes attorney work product.
Document 1-04: OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis
Document Type: Privileged Analysis Version: 1.0 Date: March 2025 Status: Final — C&H Work Product Responsible Owner: Philip Hartmann, Calderwood & Harkness LLP (external) Consent Order Article(s): Article V
This privileged memorandum presents C&H's analysis of whether BRB should file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gap. The analysis considers the scope of the screening failure — approximately 3,800,000 unscreened transactions in calendar year 2023 out of 31,700,000 total NovaPay transactions — and evaluates the potential for apparent violations of OFAC regulations resulting from the failure to screen those transactions against the SDN List and other applicable OFAC lists. The memorandum provides a strategic assessment of enforcement risk, including an analysis of OFAC's Enforcement Guidelines, the potential mitigating effect of a VSD under OFAC's framework, the interplay between the OCC Consent Order and potential OFAC enforcement, and the reputational and financial consequences of alternative courses of action. This document is attorney-client privileged and constitutes attorney work product.
Document 1-05: OFAC Remediation Testing Plan
Document Type: Testing Framework Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Articles V, IX
This document establishes the framework for validating that 100% of all BaaS partner transactions are subjected to OFAC sanctions screening following the completion of the remediation. The testing plan specifies the testing methodology, including both automated system-validation testing and manual sample-based testing; sample sizes calibrated to provide statistically significant confidence levels for each BaaS partner channel; testing frequency (initial go-live validation, monthly ongoing testing, and quarterly comprehensive testing); and acceptance criteria for determining that the screening program is operating as designed. The testing plan is designed to generate the evidentiary record necessary to support the November 1, 2025 full OFAC screening operationalization milestone and to provide the Compliance Committee and the OCC with assurance of screening completeness on an ongoing basis.
Document 1-06: Workstream 1: OFAC Sanctions Screening Remediation Plan
Document Type: Remediation Plan Version: 1.0 Date: May 2025 Status: Included in RAP submission Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Article V
This document constitutes the comprehensive remediation plan for Workstream 1, submitted as a component of the Comprehensive Remediation Action Plan transmitted to the OCC on May 15, 2025. The plan sets forth the remediation objectives, milestones, resource requirements, accountability assignments, risk factors, and contingency measures for achieving full OFAC sanctions screening compliance across all BRB business lines and BaaS partner channels by November 1, 2025.
Document 1-07: Veridian Analytics — Statement of Work for OFAC Module Enhancement
Document Type: Vendor SOW Version: 1.0 Date: March 2025 Status: Under Negotiation Responsible Owner: Linda Petrosian, CIO/CTO Consent Order Article(s): Article V
This document is a draft statement of work for the enhancement of the Veridian Analytics OFAC screening module to enable real-time screening integration for all 14 active BaaS partner transaction flows. The SOW specifies the technical requirements for integrating BaaS partner APIs with BRB's OFAC screening infrastructure, batch processing enhancements for legacy partner integrations, automated list management and update capabilities, and performance benchmarks. The SOW is part of the broader amendment to Contract No. VA-BRB-2023-0044 and is aligned with the November 1, 2025 deadline for full OFAC screening operationalization. The SOW remains under negotiation between BRB and Veridian Analytics as of the date of this Index.
3.2 Workstream 2 — SAR Backlog Clearance & Process Improvement
Workstream 2 encompasses all policies, procedures, operational protocols, quality assurance frameworks, and reporting documents related to the remediation of the SAR filing timeliness and quality deficiencies identified in the Consent Order, as well as the clearance of the 2,400-alert backlog. Six documents are indexed under this workstream.
Document 2-01: Revised SAR Policy & Procedures
Document Type: Policy/Procedure Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article IV
This document constitutes the revised SAR filing policy and procedures for BRB, designed to achieve and sustain a 30-day turnaround from alert generation to SAR filing — representing a substantial improvement from the 78-day average identified by the OCC. The policy establishes tiered escalation protocols based on alert severity, transaction amount, and customer risk profile; quality review requirements, including mandatory supervisory review of all SAR narratives prior to filing; narrative drafting standards that specify required content elements, evidentiary documentation standards, and formatting requirements; and continuous monitoring of SAR filing timeliness metrics to enable real-time identification of bottlenecks or backlogs. The policy covers SAR filing for both retail banking customers and BaaS-channel customers, with specific procedures addressing BaaS-related SARs — which comprised 2,108 of 3,847 total SARs filed by BRB in calendar year 2024 (54.8% of all filings). The procedures manual component includes workflows for each stage of the SAR lifecycle, from alert review through filing, post-filing monitoring, and 90-day continuing activity reviews.
Document 2-02: SAR Lookback Scope & Methodology Memorandum
Document Type: Methodology Version: 1.0 Date: March 2025 Status: Final — Approved Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article IV
This memorandum defines the scope and methodology for the SAR lookback review required under the Consent Order. The memorandum specifies the lookback period (covering the full period of identified deficiency), the transaction types and customer populations in scope, the sampling methodology for alert re-review, and the criteria for determining whether previously unreviewed or inadequately reviewed alerts warrant SAR filing. The memorandum also establishes the SAR filing standards applicable to lookback-identified suspicious activity, including enhanced narrative requirements to explain the context of the delay. The budgeted cost for the lookback review is $5,500,000, encompassing temporary staffing, technology tools, quality assurance, and C&H advisory oversight.
Document 2-03: SAR Backlog Triage Protocol
Document Type: Operational Protocol Version: 1.0 Date: February 2025 Status: Final — Approved Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article IV
This protocol establishes the prioritization framework for the disposition of the 2,400 unreviewed transaction monitoring alerts identified by the OCC as of September 2024. The protocol sets forth risk-ranking criteria, including transaction amount, customer risk rating, alert type and detection scenario, and BaaS partner association. Alerts are classified into three triage categories: Priority 1 (highest risk — requiring review within 48 hours of assignment), Priority 2 (elevated risk — requiring review within 5 business days), and Priority 3 (standard risk — requiring review within 10 business days). The protocol also specifies the assignment methodology for distributing alerts between Pinnacle temporary staff (30 FTEs under the direction of Andrea Solis) and BRB's permanent BSA/AML analysts, with appropriate supervisory oversight and quality control mechanisms.
Document 2-04: SAR Quality Assurance Framework
Document Type: QA Framework Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Articles IV, IX
This framework establishes the post-remediation quality assurance program for BRB's SAR filing operations. The framework specifies a dual-track QA sampling methodology encompassing both random sampling (applied to a statistically significant percentage of all SAR filings) and risk-based sampling (targeted at BaaS-channel SARs, high-dollar SARs, and SARs associated with specific detection scenarios identified as historically problematic). The framework includes error tracking and classification procedures, root cause analysis protocols for identified deficiencies, corrective action procedures (including individual analyst remediation and systemic process improvements), and a continuous improvement process designed to demonstrate sustainable compliance to the OCC and Thornfield.
Document 2-05: Interim SAR Backlog Status Report (March 31, 2025 OCC Submission)
Document Type: Regulatory Report Version: 1.0 Date: March 2025 Status: Final — Submitted to OCC Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Articles IV, IX
This document is the interim status report submitted to the OCC on March 31, 2025, as required by the Consent Order's reporting provisions. The report provides a detailed account of progress toward the disposition of the 2,400 unreviewed alerts, including the number of alerts reviewed, SARs filed, alerts closed without filing (with disposition rationale), and alerts remaining in the queue. The report also addresses staffing deployment status — specifically, the on-boarding and ramp-up of the 30 Pinnacle FTEs — and provides a projected timeline for achieving the June 30, 2025 full backlog clearance target. This report was transmitted to Jonathan Frey, Examiner-in-Charge, at the OCC Northeastern District Office.
Document 2-06: Workstream 2: SAR Backlog Clearance & Process Improvement Plan
Document Type: Remediation Plan Version: 1.0 Date: May 2025 Status: Included in RAP submission Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article IV
This document constitutes the comprehensive remediation plan for Workstream 2, submitted as a component of the Comprehensive Remediation Action Plan transmitted to the OCC on May 15, 2025. The plan integrates the backlog clearance effort (utilizing Pinnacle temporary staffing resources), the process improvement initiatives (including the revised SAR Policy & Procedures and the QA Framework), and the lookback review. The plan reflects the total staffing cost for the Pinnacle engagement of $3,600,000 for the 12-month term (30 FTEs × $10,000/month = $300,000/month; SOW Ref. PCS-BRB-2025-0012), plus the $5,500,000 lookback budget.
3.3 Workstream 3 — CDD/EDD Remediation
Workstream 3 encompasses all policies, procedures, methodology documents, responsibility matrices, technical specifications, and remediation plans related to the remediation of the CDD/EDD deficiencies for the 47,000 high-risk customer accounts identified in the Consent Order. Five documents are indexed under this workstream.
Document 3-01: Revised CDD/EDD Policy
Document Type: Policy Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Article VI
This document constitutes the revised Customer Due Diligence and Enhanced Due Diligence policy for BRB. The policy establishes updated customer identification procedures in compliance with the Customer Identification Program ("CIP") requirements of the USA PATRIOT Act and FinCEN's implementing regulations, a revised risk rating methodology that incorporates factors specific to BaaS-onboarded customers, enhanced beneficial ownership requirements that exceed the minimum regulatory thresholds in light of BRB's risk profile, ongoing monitoring standards calibrated to customer risk ratings, and periodic review cycles (annual for high-risk customers, biennial for medium-risk, triennial for low-risk). The policy includes a dedicated section addressing the specific CDD/EDD requirements applicable to customers onboarded through BRB's fintech BaaS partners, including source-of-funds documentation requirements, transaction pattern monitoring, and the delineation of BRB's retained responsibilities versus delegated partner responsibilities. The policy is designed to address the full scope of CDD and EDD deficiencies identified by the OCC with respect to the 47,000 high-risk accounts.
Document 3-02: CDD/EDD Remediation Methodology & Prioritization Memorandum
Document Type: Methodology Version: 1.0 Date: March 2025 Status: Final — Approved Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article VI
This memorandum establishes the risk-based triage and prioritization methodology for the remediation of the 47,000 high-risk customer accounts lacking adequate CDD/EDD documentation. Accounts are prioritized based on a composite risk score incorporating the following factors: the customer's current risk rating, transaction volume, the BaaS partner through which the account was onboarded, the nature and severity of the documentation deficiency, and the customer's geographic exposure to jurisdictions identified as high-risk by OFAC, FATF, or BRB's internal risk assessment. Accounts onboarded through BRB's three largest BaaS partners — NovaPay (41% of BaaS volume, $30,500,000,000 in CY 2024 transaction volume), FairLend Digital (28%), and VaultEdge (18%) — are prioritized first, given the concentration of volume and risk in those channels. The remaining 11 BaaS partners collectively account for approximately 13% of BaaS volume. The remediation is structured in two phases: 50% completion (23,500 accounts) by July 15, 2025, and 100% completion (all 47,000 accounts) by January 15, 2026. The budgeted cost for the CDD/EDD remediation effort is $4,300,000.
Document 3-03: BaaS Partner CDD/EDD Responsibility Matrix
Document Type: RACI Matrix Version: 1.0 Date: April 2025 (draft) Status: Draft — Under Review Responsible Owner: Warren Ashby, Head of BaaS Division Consent Order Article(s): Article VI
This document sets forth a detailed RACI (Responsible, Accountable, Consulted, Informed) matrix delineating the respective obligations of BRB and each of its 14 active BaaS fintech partners with respect to CDD/EDD processes across the customer lifecycle — from initial onboarding through ongoing monitoring and periodic review. The matrix specifies BRB's retained responsibilities as the chartered national bank and the ultimate regulatory obligor, and the duties that are delegated to the BaaS partners under their respective program agreements. Particular detail is provided for BRB's three largest BaaS partners: NovaPay Technologies Inc. (CEO: Ethan Garrison), FairLend Digital LLC (CEO: Aisha Okonkwo), and VaultEdge Inc. (CEO: Marcus Tan). For each partner, the matrix addresses customer identification, beneficial ownership, source of funds, ongoing transaction monitoring, suspicious activity escalation, and periodic CDD/EDD refresh. The matrix is designed to be incorporated into the revised BaaS Program Agreement Template Compliance Addendum (Document 7-02).
Document 3-04: CDD/EDD Progress Tracking Dashboard Specifications Memorandum
Document Type: Technical Specification Version: 1.0 Date: March 2025 Status: Final — Approved Responsible Owner: Linda Petrosian, CIO/CTO Consent Order Article(s): Articles VI, IX
This memorandum provides the design specifications for a centralized dashboard to track progress on the CDD/EDD remediation effort. The dashboard specifications include recommended key performance indicators and metrics (accounts remediated, accounts remaining, percentage complete by BaaS partner, percentage complete by risk tier, average remediation cycle time, escalation volumes), data sources and system integrations, reporting frequency (real-time dashboard with weekly snapshot reports), and visualization requirements. The dashboard is designed to support Compliance Committee monthly reporting, Board quarterly reporting, and OCC milestone tracking.
Document 3-05: Workstream 3: CDD/EDD Remediation Plan
Document Type: Remediation Plan Version: 1.0 Date: May 2025 Status: Included in RAP submission Responsible Owner: Patricia Langston, Chief Compliance Officer Consent Order Article(s): Article VI
This document constitutes the comprehensive remediation plan for Workstream 3, submitted as a component of the Comprehensive Remediation Action Plan transmitted to the OCC on May 15, 2025. The plan integrates the prioritization methodology, the resource deployment strategy, the BaaS partner coordination requirements, and the milestone tracking framework into a unified remediation roadmap.
3.4 Workstream 4 — Transaction Monitoring Model Validation & Tuning
Workstream 4 encompasses all remediation plans, vendor agreements, risk assessments, comparative analyses, due diligence materials, and related documents pertaining to the Veridian TMS upgrade and independent model validation. Seven documents are indexed under this workstream.
Document 4-01: Workstream 4: Transaction Monitoring Model Validation & Tuning Plan
Document Type: Remediation Plan Version: 1.0 Date: May 2025 Status: Included in RAP submission Responsible Owner: Thomas Ikeda, BSA Officer Consent Order Article(s): Article III
This document constitutes the comprehensive remediation plan for Workstream 4, submitted as a component of the Comprehensive Remediation Action Plan. The plan addresses the full scope of the Consent Order's findings regarding transaction monitoring deficiencies. Specifically, the plan covers the upgrade path from Veridian TMS v.8.3 (the currently deployed system, last independently validated in March 2021 with parameters last tuned in October 2022) to Veridian TMS v.10.0, which incorporates enhanced detection scenarios, improved BaaS-channel analytics, modernized alert management and workflow capabilities, and enhanced reporting and data visualization tools. The plan specifies the following key milestones: completion of user acceptance testing by August 1, 2025; completion of independent model validation by October 1, 2025; and ongoing periodic validation on an annual basis thereafter. The plan also addresses tuning parameter updates, including a comprehensive review and recalibration of above-the-line and below-the-line detection thresholds based on current transaction volumes and patterns. The plan references CY 2024 transaction monitoring statistics: 41,500 alerts generated, of which 3,847 resulted in SAR filings, representing a SAR conversion rate of 9.3%.
Document 4-02: Veridian Analytics — Amendment to Master Services Agreement (TMS v.10.0)
Document Type: Vendor Agreement Version: 1.0 Date: March 2025 Status: Under Negotiation Responsible Owner: Linda Petrosian, CIO/CTO Consent Order Article(s): Article III
This document is the draft amendment to Contract No. VA-BRB-2023-0044, the existing Master Services Agreement between BRB and Veridian Analytics, Inc. The amendment provides for the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0 and includes the following key commercial terms: a one-time implementation fee of $2,800,000; incremental annual licensing fees of $1,900,000, bringing the total annual contract value to $6,000,000 per year (up from the current annual contract value of $4,100,000 per year); an implementation timeline aligned with the August 1, 2025 UAT deadline mandated by the Consent Order remediation schedule; performance benchmarks for system availability, processing throughput, and alert generation accuracy; delay remedies, including liquidated damages for Veridian's failure to meet implementation milestones; and provisions for post-implementation support. The existing contract term runs through December 2026. The amendment remains under negotiation as of the date of this Index.
Document 4-03: Technology Implementation Timeline & Risk Assessment Memorandum
Document Type: Risk Assessment Version: 1.0 Date: March 2025 Status: Final — C&H Work Product Responsible Owner: Philip Hartmann, Calderwood & Harkness LLP (external) Consent Order Article(s): Article III
This privileged memorandum maps the Veridian upgrade milestones to the Consent Order's compliance deadlines, specifically the August 1, 2025 UAT completion date, the October 1, 2025 independent model validation date, and the November 1, 2025 OFAC full operationalization date (the latter being relevant insofar as the Veridian OFAC module enhancement is interdependent with the TMS upgrade). The memorandum identifies specific risk factors that could cause delays, including vendor resource constraints, data migration complexity, integration challenges with BaaS partner systems, and testing failures, and prescribes mitigation strategies for each identified risk. The memorandum also establishes contingency trigger criteria — i.e., the conditions under which BRB should activate its contingency plan to engage Ridgeline Data Systems LLC as an alternative transaction monitoring vendor. This document is attorney-client privileged and constitutes attorney work product.
Document 4-04: Veridian vs. Ridgeline Vendor Comparison Memorandum
Document Type: Analysis Version: 1.0 Date: March 2025 Status: Final — C&H Work Product Responsible Owner: Philip Hartmann, Calderwood & Harkness LLP (external) Consent Order Article(s): Article III
This privileged memorandum provides a detailed comparative analysis of the two transaction monitoring system options under consideration by BRB: (a) the Veridian TMS v.10.0 upgrade, at a total cost of $2,800,000 one-time implementation plus $6,000,000 per year annual contract value, and (b) a full-platform migration to Ridgeline Data Systems' transaction monitoring solution, at a proposed annual contract value of $7,200,000 per year for a five-year term, representing a total contract value of $36,000,000. The analysis evaluates the two options across multiple dimensions, including technical capabilities and detection scenario flexibility, implementation risk and timeline impact (given the Consent Order's fixed deadlines), total cost of ownership over a five-year horizon, vendor financial stability and operational track record, regulatory perception, and the disruption risk associated with a full platform migration during an active remediation. The memorandum recommends proceeding with the Veridian TMS v.10.0 upgrade as the primary path, with Ridgeline maintained as a contingency option should the Veridian upgrade encounter material delays or performance deficiencies. This document is attorney-client privileged and constitutes attorney work product.
Document 4-05: Third-Party Technology Vendor Due Diligence Checklist
Document Type: Template/Checklist Version: 1.0 Date: March 2025 Status: Final — Approved Responsible Owner: Melissa Chu, Chief Risk Officer Consent Order Article(s): Article III
This document is a standardized due diligence checklist for use in evaluating third-party technology vendors providing BSA/AML-related services to BRB. The checklist is aligned with OCC third-party risk management guidance, specifically OCC Bulletin 2013-29 (as supplemented by OCC Bulletin 2023-17), and addresses the following due diligence categories: information security and data protection (including SOC 2 Type II certification, penetration testing, and encryption standards); business continuity and disaster recovery; regulatory compliance history and certifications; financial viability and stability (including audited financial statement review); performance monitoring and service-level agreement requirements; subcontractor management; and concentration risk. The checklist has been used in connection with the Veridian and Ridgeline evaluations and is intended for ongoing use in all future BSA/AML technology vendor engagements.
Document 4-06: Ridgeline Data Systems — Non-Disclosure Agreement (Mutual)
Document Type: Vendor NDA Version: 1.0 Date: March 2025 Status: Final — Executed Responsible Owner: Gregory Nardone, General Counsel Consent Order Article(s): Article III
This document is the fully executed mutual non-disclosure agreement between BRB and Ridgeline Data Systems LLC, a Delaware limited liability company with its principal office at 500 West Monroe Street, Suite 2800, Chicago, IL 60661 (key contact: David Marchetti, Chief Revenue Officer). The NDA was executed for the purpose of enabling BRB to evaluate Ridgeline's transaction monitoring platform as a potential alternative or contingency to the Veridian TMS v.10.0 upgrade. The NDA contains standard confidentiality terms, including a two-year term, customary permitted disclosures, and injunctive relief provisions.
Document 4-07: Ridgeline Data Systems — Term Sheet Review Memorandum
Document Type: Analysis Version: 1.0 Date: March 2025 Status: Final — C&H Work Product Responsible Owner: Philip Hartmann, Calderwood & Harkness LLP (external) Consent Order Article(s): Article III
This privileged memorandum provides C&H's analysis of Ridgeline Data Systems' proposed commercial terms: $7,200,000 per year for a five-year term, yielding a total contract value of $36,000,000. The memorandum identifies key negotiation points, including pricing structure and volume-based adjustments, implementation timeline and milestone commitments, risk allocation provisions (including liability caps, indemnification, and insurance requirements), regulatory compliance representations and warranties, termination rights, and data ownership and migration provisions. The memorandum assesses the terms against market benchmarks and against the commercial terms of the Veridian relationship. This document is attorney-client privileged and constitutes attorney work product.
3.5 Workstream 5 — BSA/AML Program Governance & Training Enhancement
Workstream 5 encompasses all governance documents, board resolutions, committee charters, bylaws amendments, reporting frameworks, training plans, staffing plans, and related materials pertaining to the enhancement of BRB's BSA/AML program governance infrastructure and training program. Eleven documents are indexed under this workstream.
Document 5-01: Board Resolution — Acknowledgment of Consent Order & Establishment of Compliance Committee
Document Type: Board Resolution Version: 1.0 Date: February 28, 2025 Status: Final — Board Adopted Responsible Owner: Diane Whitford, Chief Executive Officer and Board Chair Consent Order Article(s): Article VIII
This Board Resolution was adopted by the BRFG Board of Directors at a special meeting held on February 28, 2025, within the 45-day deadline established by the Consent Order from its January 15, 2025 effective date. The resolution: (a) formally acknowledges OCC Consent Order No. OCC-2025-003 and the Board's understanding of its obligations thereunder; (b) establishes a standing Compliance Committee of the Board, chaired by independent director James Rutherford, with oversight responsibility for the BSA/AML and sanctions compliance program and for monitoring the remediation program; (c) authorizes a total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty), representing the Board's commitment to providing sufficient financial resources for program remediation; and (d) directs BRB management to cooperate fully with Calderwood & Harkness LLP as outside counsel and Thornfield Consulting Group LLC as independent consultant in the execution of the remediation program.
Document 5-02: Compliance Committee Charter
Document Type: Charter Version: 1.0 Date: February 2025 Status: Final — Board Adopted Responsible Owner: James Rutherford, Compliance Committee Chair Consent Order Article(s): Article VIII
This document establishes the charter for the newly created standing Compliance Committee of the BRFG Board of Directors. The charter defines the Committee's composition (minimum three independent directors), qualifications for membership (including BSA/AML-relevant experience or willingness to obtain requisite training), authority and responsibilities (including primary Board-level oversight of the BSA/AML and sanctions compliance program, monitoring of Consent Order remediation progress, review of BSA/AML reporting metrics, oversight of the independent consultant engagement, and authority to commission independent assessments). The charter specifies a monthly meeting frequency during the remediation period, with authority to convene special meetings as necessary. The charter also defines the Committee's reporting obligations to the full Board, and its relationship to the Audit Committee (chaired by Margaret Dao) and the Risk Committee (chaired by Arthur Connelly), including protocols for information sharing, joint sessions, and issue escalation among the three committees.
Document 5-03: Amended Corporate Bylaws — Compliance Committee Provisions (Redline)
Document Type: Bylaws Amendment Version: 1.0 (redline) Date: February 2025 Status: Final — Board Adopted Responsible Owner: Gregory Nardone, General Counsel Consent Order Article(s): Article VIII
This document presents the redline version of the amendments to BRFG's Corporate Bylaws adding provisions establishing the Compliance Committee as a standing committee of the Board. The redline is tracked against the prior version of the Bylaws in effect as of the Consent Order date. The amendments add a new article establishing the Compliance Committee, specify its composition and authority, and cross-reference the Compliance Committee Charter for detailed procedural requirements.