1045-00002 · Calderwood & Harkness LLP · documents

cover-letter-occ-transmitting-rap.docx DOCUMENT Antitrust

21 / 84 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Attorneys at Law

1285 Avenue of the Americas, 40th Floor New York, New York 10019

Telephone: (212) 558-4000 Facsimile: (212) 558-3588 www.calderwoodharkness.com

May 15, 2025

VIA HAND DELIVERY AND ELECTRONIC SUBMISSION (OCC CONNECT)

Jonathan Frey, National Bank Examiner Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017

Re: Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845) — Submission of Comprehensive Remediation Action Plan Pursuant to Consent Order No. OCC-2025-003

Dear Mr. Frey:

Calderwood & Harkness LLP ("C&H" or the "Firm") serves as outside regulatory counsel to Belmont Ridge Bank National Association ("BRB" or the "Bank"), a nationally chartered commercial banking institution headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. We write on behalf of BRB to transmit the enclosed Comprehensive Remediation Action Plan (the "RAP" or the "Plan") for review and approval by the Office of the Comptroller of the Currency (the "OCC"). This submission is made in full satisfaction of the Bank's obligation, under Paragraph 8(a) of Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order"), to deliver a comprehensive, board-approved remediation action plan to the Examiner-in-Charge within 120 calendar days of the effective date of the Consent Order. As of the date of this letter, the 120-day submission deadline falls on May 15, 2025; accordingly, this submission is timely. This matter is tracked internally at the Firm under C&H Matter No. 1045-00002.

I. Background — The Consent Order and Engagement Context

As the OCC is aware, the Consent Order was issued on January 15, 2025, following a targeted Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") examination of BRB conducted by the OCC's Northeastern District Office between approximately March 2024 and September 2024. The examination focused principally on the Bank's BSA/AML compliance infrastructure as it relates to its expanding Banking-as-a-Service ("BaaS") business line, which has grown significantly since 2021 and now encompasses fourteen distinct fintech partner relationships generating substantial payment, wire transfer, and automated clearing house ("ACH") transaction volumes.

The Consent Order identified five core deficiency categories in BRB's BSA/AML compliance program, each of which the RAP is designed to address comprehensively:

1. Inadequate OFAC Sanctions Screening Protocols. The OCC found that BRB's Office of Foreign Assets Control ("OFAC") sanctions screening protocols were materially deficient, particularly with respect to fintech BaaS transaction flows. The examination revealed that approximately 3,800,000 wire and ACH transactions originated through BRB's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), during calendar year 2023 were not subjected to real-time or batch OFAC screening. This figure represents approximately 12% of the roughly 31,700,000 total NovaPay transactions processed during CY 2023. The screening gap was attributable to a combination of an improperly configured API integration between BRB's core banking platform and the Veridian Analytics Inc. OFAC screening module, and inadequate quality assurance controls over BaaS-originated transactions.

2. Deficient SAR Filing Timeliness and Quality. The examination identified a substantial backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024, accumulated across both the Bank's retail banking division and its BaaS partner channels. Additionally, the OCC found that for those Suspicious Activity Reports ("SARs") that were filed during the examination period, the average filing time from alert generation to FinCEN submission was approximately 78 calendar days — well in excess of the 30-calendar-day regulatory expectation and materially exceeding the Bank's own internal policy target of 45 days. The OCC further noted qualitative deficiencies in SAR narratives, including insufficient detail regarding the suspicious activity identified and inadequate documentation of investigative steps taken.

3. Insufficient Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD"). The Consent Order cited inadequate CDD/EDD procedures for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through BRB's fintech BaaS partner channels. The OCC determined that these accounts had been subjected to a standardized onboarding process that failed to apply risk-based due diligence commensurate with the elevated risk profiles associated with the customer types, geographies, and transaction patterns characteristic of BaaS-originated accounts. In particular, the examination found that beneficial ownership information was incomplete or absent for a significant subset of these accounts.

4. Inadequate Transaction Monitoring System Model Validation. The OCC found that BRB's primary transaction monitoring system — Veridian Analytics Inc. Transaction Monitoring System version 8.3 ("TMS v.8.3") — had not been independently validated since March 2021, and that its tuning parameters had last been updated in October 2022. Given the significant growth in BaaS transaction volumes and the introduction of new product types since the last validation, the OCC concluded that the TMS was operating with outdated rules, thresholds, and typologies that were inadequately calibrated to detect the suspicious activity patterns prevalent in BRB's current transaction environment.

5. Board-Level Oversight Deficiencies in BSA/AML Governance. The Consent Order identified deficiencies in the Board of Directors' oversight of BSA/AML compliance, including the absence of a dedicated compliance committee at the board level, infrequent and insufficiently detailed reporting from the BSA Officer to the Board, and a lack of documented evidence that the Board had meaningfully evaluated the adequacy of BSA/AML resources in light of BRB's evolving risk profile driven by BaaS expansion.

In addition to requiring submission of the RAP, the Consent Order assessed a civil money penalty of $14,500,000 against BRB, payable to the United States Treasury within 60 calendar days of the effective date of the Consent Order. As described below, this penalty was timely paid on March 16, 2025.

Calderwood & Harkness LLP was formally engaged by BRB on February 10, 2025, to serve as outside regulatory counsel advising and guiding the Bank through a comprehensive compliance-program uplift designed to achieve full compliance with all requirements of the Consent Order. Since the commencement of our engagement, we have worked in close and continuous coordination with BRB's senior management team, including Chief Compliance Officer Patricia Langston, BSA Officer and AML Program Director Thomas Ikeda, and General Counsel and Corporate Secretary Gregory Nardone. The RAP was also developed in coordination with the OCC-approved independent consultant, Thornfield Consulting Group LLC ("Thornfield"), whose engagement was led by Managing Director Dr. Vivian Castellano (Thornfield engagement reference TCG-BRB-2025-001). Thornfield's on-site assessment of BRB's BSA/AML compliance program commenced on March 1, 2025, and its preliminary gap assessment, dated April 15, 2025, has been instrumental in shaping the specific remediation strategies, resource allocations, and milestone timelines set forth in the RAP.

II. Summary of Interim Compliance Actions Completed to Date

The Bank recognizes the urgency and seriousness of the deficiencies identified in the Consent Order and has not waited for submission of the RAP to begin remediation. In the approximately four months since the Consent Order was issued, BRB has already completed several significant actions required by the Consent Order, and we wish to bring the OCC's attention to these steps as evidence of the Bank's good faith and commitment to timely and effective compliance:

• Board Resolution (February 28, 2025). On February 28, 2025, the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), BRB's parent holding company, adopted a formal resolution acknowledging the issuance of the Consent Order, accepting responsibility for the identified deficiencies, and committing the full resources of the organization to remediation. The resolution established a dedicated Compliance Committee of the Board, chaired by independent director James Rutherford, who brings more than 25 years of experience in financial services regulation and compliance. The resolution further authorized a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty, to fund the comprehensive compliance-program uplift contemplated by the RAP. A copy of the Board Resolution is enclosed herewith as Enclosure 9.

• Independent Consultant Engagement (February 10, 2025). Thornfield Consulting Group LLC was engaged as the OCC-mandated independent consultant pursuant to Paragraph 7 of the Consent Order, following the OCC's formal non-objection to Thornfield's qualifications and proposed scope of work, received by BRB on February 5, 2025. Thornfield's engagement encompasses an independent assessment of BRB's BSA/AML compliance program, ongoing monitoring of remediation progress, and issuance of a final validation report upon completion of all remediation workstreams. Dr. Vivian Castellano, Thornfield's Managing Director overseeing this engagement, has extensive experience with BSA/AML remediation projects for nationally chartered banking institutions and has previously served as an independent consultant in similar OCC enforcement actions.

• Civil Money Penalty Payment (March 16, 2025). The $14,500,000 civil money penalty assessed by the Consent Order was timely paid by BRB to the United States Treasury on March 16, 2025, well within the 60-calendar-day payment deadline of March 16, 2025. BRB has retained records of the wire transfer confirmation and Treasury acknowledgment of receipt, copies of which are available upon request.

• Interim SAR Backlog Status Report (March 31, 2025). In accordance with Paragraph 10(b) of the Consent Order, BRB timely submitted an interim status report on SAR backlog clearance to the OCC on March 31, 2025. That report documented the disposition of approximately 680 of the 2,400 unreviewed alerts identified at the time of the examination, with the remaining alerts prioritized for disposition on an accelerated timeline as detailed in Workstream 2 of the RAP.

• Thornfield Preliminary Gap Assessment (April 15, 2025). On April 15, 2025, Thornfield delivered its preliminary gap assessment to BRB and the OCC. The assessment confirmed the deficiencies identified in the Consent Order, provided additional granularity regarding root causes and systemic control weaknesses, and offered recommendations that have been incorporated into the RAP. A copy of Thornfield's preliminary gap assessment is enclosed herewith as Enclosure 10.

• Temporary Staffing Deployment. To address the immediate capacity constraints contributing to the SAR backlog and the CDD/EDD remediation challenge, BRB engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy 30 full-time-equivalent ("FTE") BSA/AML analysts to support SAR backlog clearance, CDD/EDD account remediation, and other critical remediation workstreams. These temporary analysts commenced work on a rolling basis beginning in March 2025 and are currently fully integrated into BRB's compliance operations under the supervision of BSA Officer Thomas Ikeda.

• Technology Upgrade Initiated. BRB has executed an amendment to its existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the upgrade of the Bank's transaction monitoring system from TMS v.8.3 to TMS v.10.0 and the enhancement of the Veridian OFAC screening module to address the real-time and batch screening deficiencies identified in the Consent Order. The technology upgrade project is currently in the requirements-gathering and design phase, with user acceptance testing ("UAT") targeted for completion by August 1, 2025, as detailed in Workstream 4 of the RAP.

III. Description of the Comprehensive Remediation Action Plan

The enclosed RAP is the product of an intensive, cross-functional effort involving BRB's senior management, the BSA/AML compliance department, information technology division, internal audit function, Calderwood & Harkness, and Thornfield Consulting Group. The Plan addresses all five core deficiency categories identified in the Consent Order through five integrated remediation workstreams, each of which is set forth in a dedicated workstream plan document that contains defined milestones, clear lines of accountability, detailed resource allocations, measurable success criteria, and specific testing and validation protocols. The five workstreams are summarized as follows:

Workstream 1 — OFAC Sanctions Screening Remediation. This workstream addresses the sanctions screening gaps identified across all 14 of BRB's BaaS partner channels, with particular emphasis on the NovaPay transaction flows that gave rise to the most significant screening failures. The workstream encompasses a complete redesign of BRB's real-time and batch OFAC screening workflows, including the reconfiguration and enhancement of the Veridian OFAC module, the implementation of API-level screening controls at each BaaS partner integration point, the establishment of a quality assurance framework for ongoing screening coverage monitoring, and the development of exception-handling and escalation protocols. Workstream 1 targets full operationalization of the redesigned OFAC screening infrastructure across all BaaS channels by November 1, 2025. The workstream plan is enclosed herewith as Enclosure 3.

Workstream 2 — SAR Backlog Clearance & Process Improvement. This workstream targets the full disposition of the 2,400 unreviewed suspicious activity alerts identified as of September 2024, with a completion deadline of June 30, 2025. Concurrently, the workstream implements a fundamentally revised SAR policy and procedure framework designed to achieve a sustainable 30-calendar-day filing turnaround from alert generation to FinCEN submission. The workstream also encompasses a comprehensive SAR lookback project covering both retail banking and BaaS channels for the period from January 1, 2022, through December 31, 2024, to identify and remediate any SARs that should have been filed but were not. The SAR lookback project has been allocated a dedicated budget of $5,500,000 and will be conducted under Thornfield's oversight. The workstream plan is enclosed herewith as Enclosure 4.

Workstream 3 — CDD/EDD Remediation. This workstream provides for the risk-based remediation of the approximately 47,000 high-risk customer accounts identified in the Consent Order. Remediation will proceed in two phases: Phase 1 targets remediation of 50% of the accounts (approximately 23,500 accounts), prioritized by risk tier, by July 15, 2025; Phase 2 targets remediation of the remaining 50% (for a total of 47,000 accounts) by January 15, 2026. Remediation activities include the collection and verification of beneficial ownership information, the application of risk-appropriate EDD procedures, the re-scoring of customer risk ratings using a revised risk-rating methodology, and the exit of any accounts that fail to meet updated CDD/EDD requirements following good-faith remediation efforts. This workstream has been allocated a dedicated budget of $4,300,000. The workstream plan is enclosed herewith as Enclosure 5.

Workstream 4 — Transaction Monitoring Model Validation & Tuning. This workstream covers the upgrade of BRB's transaction monitoring system from Veridian TMS v.8.3 to TMS v.10.0, with UAT completion targeted for August 1, 2025. The upgrade includes the implementation of new rules, scenarios, and typologies calibrated to BRB's current transaction environment, including BaaS-specific monitoring scenarios. Following deployment, an independent model validation will be conducted by a qualified third party (subject to OCC non-objection) by October 1, 2025, in accordance with OCC Bulletin 2011-12 and supplementary interagency guidance on model risk management. The total Year 1 cost for this workstream is $4,700,000, comprising $2,800,000 in implementation costs and $1,900,000 in incremental annual licensing fees. The workstream plan is enclosed herewith as Enclosure 6.

Workstream 5 — BSA/AML Program Governance & Training Enhancement. This workstream addresses the board-level oversight deficiencies identified in the Consent Order through the formalization of the newly established Compliance Committee, the adoption of a revised BSA/AML governance framework, and the implementation of enhanced reporting protocols from the BSA Officer and Chief Compliance Officer to the Board. The workstream also provides for an organizational restructuring of BRB's BSA/AML department, including an expansion from the current 62 full-time employees to a target of 77 full-time employees through 15 permanent hires across investigative analyst, quality assurance, and supervisory roles. Additionally, the workstream encompasses the design and rollout of an enterprise-wide BSA/AML training program covering all Bank employees, with specialized modules for the Board, senior management, BaaS relationship managers, and front-line personnel. This workstream has been allocated a budget of $1,800,000 for training and policy development, plus $500,000 for board and governance restructuring activities. The workstream plan is enclosed herewith as Enclosure 7.

Each workstream plan contains detailed project timelines, responsible-party assignments, resource budgets, key performance indicators, quality assurance checkpoints, and escalation procedures. The enclosed Remediation Milestone Tracker (Enclosure 8) provides a consolidated view of all workstream milestones and their interdependencies.

IV. Remediation Budget Summary

The Board of Directors of BRFG has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty. When combined with the civil money penalty, the total anticipated financial outlay associated with the Consent Order and the remediation effort is approximately $57,000,000. The key components of the $42,500,000 remediation budget are summarized below:

The Bank has confirmed that adequate capital and liquidity resources are available to fund the remediation budget without material adverse impact to the Bank's safety and soundness position or its regulatory capital ratios.

V. Key Milestones and Deadlines

The following table summarizes the remaining critical milestones for the remediation effort, each of which is aligned with the specific requirements and deadlines set forth in the Consent Order:

BRB is committed to meeting or exceeding each of these milestones and will promptly notify the OCC of any material developments that may affect the Bank's ability to do so.

VI. Enclosures

Enclosed with this letter for the OCC's review and approval are the following documents, each of which forms an integral part of this submission:

1. Comprehensive Remediation Action Plan (master document)

2. Remediation Action Plan — Executive Summary

3. Workstream 1: OFAC Sanctions Screening Remediation Plan

4. Workstream 2: SAR Backlog Clearance & Process Improvement Plan

5. Workstream 3: CDD/EDD Remediation Plan

6. Workstream 4: Transaction Monitoring Model Validation & Tuning Plan

7. Workstream 5: BSA/AML Program Governance & Training Enhancement Plan

8. Remediation Milestone Tracker

9. Board Resolution dated February 28, 2025 (Acknowledgment of Consent Order and Establishment of Compliance Committee)

10. Thornfield Consulting Group LLC — Preliminary Gap Assessment (dated April 15, 2025)

VII. Cooperation and Availability

BRB and Calderwood & Harkness remain fully committed to open, transparent, and proactive cooperation with the OCC throughout the entirety of the remediation process. The Bank recognizes that effective remediation requires a strong and collaborative working relationship with its primary federal regulator and is dedicated to ensuring that the OCC receives all information necessary to monitor the Bank's progress.

The undersigned, Philip Hartmann, as the responsible partner at Calderwood & Harkness for this engagement, and Patricia Langston, BRB's Chief Compliance Officer, are available to discuss the Plan, respond to any questions, or provide supplementary information at the OCC's convenience. We welcome the opportunity to meet with you and your examination team at any time to review the RAP in detail or to address any aspects of the submission that may warrant further discussion or clarification.

BRB will continue to provide the OCC with quarterly progress reports as required by Paragraph 12 of the Consent Order. The first such quarterly progress report is due on September 15, 2025, and the Bank is already preparing the reporting framework and data collection processes necessary to ensure that these reports are comprehensive, accurate, and submitted on a timely basis.

Finally, we note that BRB remains attentive to its obligations in connection with the Financial Crimes Enforcement Network's ("FinCEN") parallel monitoring of the Bank's SAR filing remediation efforts. BRB is coordinating closely with FinCEN to ensure that all SAR-related remediation activities conducted under the RAP are consistent with FinCEN's expectations and reporting requirements. To the extent that any aspect of FinCEN's parallel monitoring gives rise to issues relevant to the OCC's oversight of the remediation effort, BRB will promptly bring such issues to the OCC's attention.

We appreciate the OCC's attention to this submission and look forward to working cooperatively with you and your team as BRB implements the Comprehensive Remediation Action Plan. Should you require any additional information or wish to schedule a meeting to discuss the Plan, please do not hesitate to contact me at the address below or by telephone or email.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127

Email: phartmann@calderwoodharkness.com

On behalf of Belmont Ridge Bank National Association

Enclosures (10)

cc (via electronic mail):

Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association

Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association

Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association

James Rutherford, Chair, Compliance Committee, Board of Directors, Belmont Ridge Financial Group, Inc.

Dr. Vivian Castellano, Managing Director, Thornfield Consulting Group LLC

Budget Category	Vendor / Description	Estimated Cost
Outside Regulatory Counsel	Calderwood & Harkness LLP	$8,000,000
Independent Consultant	Thornfield Consulting Group LLC (incl. expenses)	$6,900,000
Technology Upgrade	Veridian Analytics Inc. (TMS v.10.0 + OFAC module, Year 1)	$4,700,000
SAR Lookback Project	Workstream 2 dedicated budget	$5,500,000
CDD/EDD Remediation	Workstream 3 dedicated budget	$4,300,000
Temporary Staffing	Pinnacle Compliance Solutions LLC (30 FTEs)	$3,600,000
Internal Headcount Additions	15 permanent FTE hires (Year 1 compensation & onboarding)	$2,250,000
Training & Policy Development	Workstream 5 dedicated budget	$1,800,000
Board / Governance Restructuring	Compliance Committee, charter development, reporting	$500,000
Contingency & Miscellaneous	Unforeseen costs, ancillary vendor engagements	$4,950,000
Total Remediation Budget	$42,500,000
Target Date	Milestone
June 30, 2025	SAR backlog clearance — 2,400 alerts fully dispositioned
July 15, 2025	CDD/EDD 50% remediation milestone — 23,500 accounts remediated
August 1, 2025	Veridian TMS v.10.0 UAT complete and deployed to production
September 15, 2025	First quarterly progress report submitted to OCC
October 1, 2025	Independent model validation of upgraded TMS completed
November 1, 2025	OFAC screening fully operational across all 14 BaaS channels
December 15, 2025	Second quarterly progress report submitted to OCC
January 15, 2026	CDD/EDD 100% remediation milestone — 47,000 accounts remediated
February 15, 2026	Full compliance program implementation; Thornfield final validation report delivered; Consent Order compliance self-certification submitted to OCC

PRIVILEGED & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Attorneys at Law
1285 Avenue of the Americas, 40th Floor New York, New York 10019
Telephone: (212) 558-4000 Facsimile: (212) 558-3588 www.calderwoodharkness.com
May 15, 2025
VIA HAND DELIVERY AND ELECTRONIC SUBMISSION (OCC CONNECT)
Jonathan Frey, National Bank Examiner Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017
Re: Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845) — Submission of Comprehensive Remediation Action Plan Pursuant to Consent Order No. OCC-2025-003
Dear Mr. Frey:
Calderwood & Harkness LLP ("C&H" or the "Firm") serves as outside regulatory counsel to Belmont Ridge Bank National Association ("BRB" or the "Bank"), a nationally chartered commercial banking institution headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. We write on behalf of BRB to transmit the enclosed Comprehensive Remediation Action Plan (the "RAP" or the "Plan") for review and approval by the Office of the Comptroller of the Currency (the "OCC"). This submission is made in full satisfaction of the Bank's obligation, under Paragraph 8(a) of Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order"), to deliver a comprehensive, board-approved remediation action plan to the Examiner-in-Charge within 120 calendar days of the effective date of the Consent Order. As of the date of this letter, the 120-day submission deadline falls on May 15, 2025; accordingly, this submission is timely. This matter is tracked internally at the Firm under C&H Matter No. 1045-00002.
I. Background — The Consent Order and Engagement Context
As the OCC is aware, the Consent Order was issued on January 15, 2025, following a targeted Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") examination of BRB conducted by the OCC's Northeastern District Office between approximately March 2024 and September 2024. The examination focused principally on the Bank's BSA/AML compliance infrastructure as it relates to its expanding Banking-as-a-Service ("BaaS") business line, which has grown significantly since 2021 and now encompasses fourteen distinct fintech partner relationships generating substantial payment, wire transfer, and automated clearing house ("ACH") transaction volumes.
The Consent Order identified five core deficiency categories in BRB's BSA/AML compliance program, each of which the RAP is designed to address comprehensively:
1. Inadequate OFAC Sanctions Screening Protocols. The OCC found that BRB's Office of Foreign Assets Control ("OFAC") sanctions screening protocols were materially deficient, particularly with respect to fintech BaaS transaction flows. The examination revealed that approximately 3,800,000 wire and ACH transactions originated through BRB's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), during calendar year 2023 were not subjected to real-time or batch OFAC screening. This figure represents approximately 12% of the roughly 31,700,000 total NovaPay transactions processed during CY 2023. The screening gap was attributable to a combination of an improperly configured API integration between BRB's core banking platform and the Veridian Analytics Inc. OFAC screening module, and inadequate quality assurance controls over BaaS-originated transactions.
2. Deficient SAR Filing Timeliness and Quality. The examination identified a substantial backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024, accumulated across both the Bank's retail banking division and its BaaS partner channels. Additionally, the OCC found that for those Suspicious Activity Reports ("SARs") that were filed during the examination period, the average filing time from alert generation to FinCEN submission was approximately 78 calendar days — well in excess of the 30-calendar-day regulatory expectation and materially exceeding the Bank's own internal policy target of 45 days. The OCC further noted qualitative deficiencies in SAR narratives, including insufficient detail regarding the suspicious activity identified and inadequate documentation of investigative steps taken.
3. Insufficient Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD"). The Consent Order cited inadequate CDD/EDD procedures for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through BRB's fintech BaaS partner channels. The OCC determined that these accounts had been subjected to a standardized onboarding process that failed to apply risk-based due diligence commensurate with the elevated risk profiles associated with the customer types, geographies, and transaction patterns characteristic of BaaS-originated accounts. In particular, the examination found that beneficial ownership information was incomplete or absent for a significant subset of these accounts.
4. Inadequate Transaction Monitoring System Model Validation. The OCC found that BRB's primary transaction monitoring system — Veridian Analytics Inc. Transaction Monitoring System version 8.3 ("TMS v.8.3") — had not been independently validated since March 2021, and that its tuning parameters had last been updated in October 2022. Given the significant growth in BaaS transaction volumes and the introduction of new product types since the last validation, the OCC concluded that the TMS was operating with outdated rules, thresholds, and typologies that were inadequately calibrated to detect the suspicious activity patterns prevalent in BRB's current transaction environment.
5. Board-Level Oversight Deficiencies in BSA/AML Governance. The Consent Order identified deficiencies in the Board of Directors' oversight of BSA/AML compliance, including the absence of a dedicated compliance committee at the board level, infrequent and insufficiently detailed reporting from the BSA Officer to the Board, and a lack of documented evidence that the Board had meaningfully evaluated the adequacy of BSA/AML resources in light of BRB's evolving risk profile driven by BaaS expansion.
In addition to requiring submission of the RAP, the Consent Order assessed a civil money penalty of $14,500,000 against BRB, payable to the United States Treasury within 60 calendar days of the effective date of the Consent Order. As described below, this penalty was timely paid on March 16, 2025.
Calderwood & Harkness LLP was formally engaged by BRB on February 10, 2025, to serve as outside regulatory counsel advising and guiding the Bank through a comprehensive compliance-program uplift designed to achieve full compliance with all requirements of the Consent Order. Since the commencement of our engagement, we have worked in close and continuous coordination with BRB's senior management team, including Chief Compliance Officer Patricia Langston, BSA Officer and AML Program Director Thomas Ikeda, and General Counsel and Corporate Secretary Gregory Nardone. The RAP was also developed in coordination with the OCC-approved independent consultant, Thornfield Consulting Group LLC ("Thornfield"), whose engagement was led by Managing Director Dr. Vivian Castellano (Thornfield engagement reference TCG-BRB-2025-001). Thornfield's on-site assessment of BRB's BSA/AML compliance program commenced on March 1, 2025, and its preliminary gap assessment, dated April 15, 2025, has been instrumental in shaping the specific remediation strategies, resource allocations, and milestone timelines set forth in the RAP.
II. Summary of Interim Compliance Actions Completed to Date
The Bank recognizes the urgency and seriousness of the deficiencies identified in the Consent Order and has not waited for submission of the RAP to begin remediation. In the approximately four months since the Consent Order was issued, BRB has already completed several significant actions required by the Consent Order, and we wish to bring the OCC's attention to these steps as evidence of the Bank's good faith and commitment to timely and effective compliance:
• Board Resolution (February 28, 2025). On February 28, 2025, the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), BRB's parent holding company, adopted a formal resolution acknowledging the issuance of the Consent Order, accepting responsibility for the identified deficiencies, and committing the full resources of the organization to remediation. The resolution established a dedicated Compliance Committee of the Board, chaired by independent director James Rutherford, who brings more than 25 years of experience in financial services regulation and compliance. The resolution further authorized a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty, to fund the comprehensive compliance-program uplift contemplated by the RAP. A copy of the Board Resolution is enclosed herewith as Enclosure 9.
• Independent Consultant Engagement (February 10, 2025). Thornfield Consulting Group LLC was engaged as the OCC-mandated independent consultant pursuant to Paragraph 7 of the Consent Order, following the OCC's formal non-objection to Thornfield's qualifications and proposed scope of work, received by BRB on February 5, 2025. Thornfield's engagement encompasses an independent assessment of BRB's BSA/AML compliance program, ongoing monitoring of remediation progress, and issuance of a final validation report upon completion of all remediation workstreams. Dr. Vivian Castellano, Thornfield's Managing Director overseeing this engagement, has extensive experience with BSA/AML remediation projects for nationally chartered banking institutions and has previously served as an independent consultant in similar OCC enforcement actions.
• Civil Money Penalty Payment (March 16, 2025). The $14,500,000 civil money penalty assessed by the Consent Order was timely paid by BRB to the United States Treasury on March 16, 2025, well within the 60-calendar-day payment deadline of March 16, 2025. BRB has retained records of the wire transfer confirmation and Treasury acknowledgment of receipt, copies of which are available upon request.
• Interim SAR Backlog Status Report (March 31, 2025). In accordance with Paragraph 10(b) of the Consent Order, BRB timely submitted an interim status report on SAR backlog clearance to the OCC on March 31, 2025. That report documented the disposition of approximately 680 of the 2,400 unreviewed alerts identified at the time of the examination, with the remaining alerts prioritized for disposition on an accelerated timeline as detailed in Workstream 2 of the RAP.
• Thornfield Preliminary Gap Assessment (April 15, 2025). On April 15, 2025, Thornfield delivered its preliminary gap assessment to BRB and the OCC. The assessment confirmed the deficiencies identified in the Consent Order, provided additional granularity regarding root causes and systemic control weaknesses, and offered recommendations that have been incorporated into the RAP. A copy of Thornfield's preliminary gap assessment is enclosed herewith as Enclosure 10.
• Temporary Staffing Deployment. To address the immediate capacity constraints contributing to the SAR backlog and the CDD/EDD remediation challenge, BRB engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy 30 full-time-equivalent ("FTE") BSA/AML analysts to support SAR backlog clearance, CDD/EDD account remediation, and other critical remediation workstreams. These temporary analysts commenced work on a rolling basis beginning in March 2025 and are currently fully integrated into BRB's compliance operations under the supervision of BSA Officer Thomas Ikeda.
• Technology Upgrade Initiated. BRB has executed an amendment to its existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the upgrade of the Bank's transaction monitoring system from TMS v.8.3 to TMS v.10.0 and the enhancement of the Veridian OFAC screening module to address the real-time and batch screening deficiencies identified in the Consent Order. The technology upgrade project is currently in the requirements-gathering and design phase, with user acceptance testing ("UAT") targeted for completion by August 1, 2025, as detailed in Workstream 4 of the RAP.
III. Description of the Comprehensive Remediation Action Plan
The enclosed RAP is the product of an intensive, cross-functional effort involving BRB's senior management, the BSA/AML compliance department, information technology division, internal audit function, Calderwood & Harkness, and Thornfield Consulting Group. The Plan addresses all five core deficiency categories identified in the Consent Order through five integrated remediation workstreams, each of which is set forth in a dedicated workstream plan document that contains defined milestones, clear lines of accountability, detailed resource allocations, measurable success criteria, and specific testing and validation protocols. The five workstreams are summarized as follows:
Workstream 1 — OFAC Sanctions Screening Remediation. This workstream addresses the sanctions screening gaps identified across all 14 of BRB's BaaS partner channels, with particular emphasis on the NovaPay transaction flows that gave rise to the most significant screening failures. The workstream encompasses a complete redesign of BRB's real-time and batch OFAC screening workflows, including the reconfiguration and enhancement of the Veridian OFAC module, the implementation of API-level screening controls at each BaaS partner integration point, the establishment of a quality assurance framework for ongoing screening coverage monitoring, and the development of exception-handling and escalation protocols. Workstream 1 targets full operationalization of the redesigned OFAC screening infrastructure across all BaaS channels by November 1, 2025. The workstream plan is enclosed herewith as Enclosure 3.
Workstream 2 — SAR Backlog Clearance & Process Improvement. This workstream targets the full disposition of the 2,400 unreviewed suspicious activity alerts identified as of September 2024, with a completion deadline of June 30, 2025. Concurrently, the workstream implements a fundamentally revised SAR policy and procedure framework designed to achieve a sustainable 30-calendar-day filing turnaround from alert generation to FinCEN submission. The workstream also encompasses a comprehensive SAR lookback project covering both retail banking and BaaS channels for the period from January 1, 2022, through December 31, 2024, to identify and remediate any SARs that should have been filed but were not. The SAR lookback project has been allocated a dedicated budget of $5,500,000 and will be conducted under Thornfield's oversight. The workstream plan is enclosed herewith as Enclosure 4.
Workstream 3 — CDD/EDD Remediation. This workstream provides for the risk-based remediation of the approximately 47,000 high-risk customer accounts identified in the Consent Order. Remediation will proceed in two phases: Phase 1 targets remediation of 50% of the accounts (approximately 23,500 accounts), prioritized by risk tier, by July 15, 2025; Phase 2 targets remediation of the remaining 50% (for a total of 47,000 accounts) by January 15, 2026. Remediation activities include the collection and verification of beneficial ownership information, the application of risk-appropriate EDD procedures, the re-scoring of customer risk ratings using a revised risk-rating methodology, and the exit of any accounts that fail to meet updated CDD/EDD requirements following good-faith remediation efforts. This workstream has been allocated a dedicated budget of $4,300,000. The workstream plan is enclosed herewith as Enclosure 5.
Workstream 4 — Transaction Monitoring Model Validation & Tuning. This workstream covers the upgrade of BRB's transaction monitoring system from Veridian TMS v.8.3 to TMS v.10.0, with UAT completion targeted for August 1, 2025. The upgrade includes the implementation of new rules, scenarios, and typologies calibrated to BRB's current transaction environment, including BaaS-specific monitoring scenarios. Following deployment, an independent model validation will be conducted by a qualified third party (subject to OCC non-objection) by October 1, 2025, in accordance with OCC Bulletin 2011-12 and supplementary interagency guidance on model risk management. The total Year 1 cost for this workstream is $4,700,000, comprising $2,800,000 in implementation costs and $1,900,000 in incremental annual licensing fees. The workstream plan is enclosed herewith as Enclosure 6.
Workstream 5 — BSA/AML Program Governance & Training Enhancement. This workstream addresses the board-level oversight deficiencies identified in the Consent Order through the formalization of the newly established Compliance Committee, the adoption of a revised BSA/AML governance framework, and the implementation of enhanced reporting protocols from the BSA Officer and Chief Compliance Officer to the Board. The workstream also provides for an organizational restructuring of BRB's BSA/AML department, including an expansion from the current 62 full-time employees to a target of 77 full-time employees through 15 permanent hires across investigative analyst, quality assurance, and supervisory roles. Additionally, the workstream encompasses the design and rollout of an enterprise-wide BSA/AML training program covering all Bank employees, with specialized modules for the Board, senior management, BaaS relationship managers, and front-line personnel. This workstream has been allocated a budget of $1,800,000 for training and policy development, plus $500,000 for board and governance restructuring activities. The workstream plan is enclosed herewith as Enclosure 7.
Each workstream plan contains detailed project timelines, responsible-party assignments, resource budgets, key performance indicators, quality assurance checkpoints, and escalation procedures. The enclosed Remediation Milestone Tracker (Enclosure 8) provides a consolidated view of all workstream milestones and their interdependencies.
IV. Remediation Budget Summary
The Board of Directors of BRFG has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty. When combined with the civil money penalty, the total anticipated financial outlay associated with the Consent Order and the remediation effort is approximately $57,000,000. The key components of the $42,500,000 remediation budget are summarized below:
The Bank has confirmed that adequate capital and liquidity resources are available to fund the remediation budget without material adverse impact to the Bank's safety and soundness position or its regulatory capital ratios.
V. Key Milestones and Deadlines
The following table summarizes the remaining critical milestones for the remediation effort, each of which is aligned with the specific requirements and deadlines set forth in the Consent Order:
BRB is committed to meeting or exceeding each of these milestones and will promptly notify the OCC of any material developments that may affect the Bank's ability to do so.
VI. Enclosures
Enclosed with this letter for the OCC's review and approval are the following documents, each of which forms an integral part of this submission:
1. Comprehensive Remediation Action Plan (master document)
2. Remediation Action Plan — Executive Summary
3. Workstream 1: OFAC Sanctions Screening Remediation Plan
4. Workstream 2: SAR Backlog Clearance & Process Improvement Plan
5. Workstream 3: CDD/EDD Remediation Plan
6. Workstream 4: Transaction Monitoring Model Validation & Tuning Plan
7. Workstream 5: BSA/AML Program Governance & Training Enhancement Plan
8. Remediation Milestone Tracker
9. Board Resolution dated February 28, 2025 (Acknowledgment of Consent Order and Establishment of Compliance Committee)
10. Thornfield Consulting Group LLC — Preliminary Gap Assessment (dated April 15, 2025)
VII. Cooperation and Availability
BRB and Calderwood & Harkness remain fully committed to open, transparent, and proactive cooperation with the OCC throughout the entirety of the remediation process. The Bank recognizes that effective remediation requires a strong and collaborative working relationship with its primary federal regulator and is dedicated to ensuring that the OCC receives all information necessary to monitor the Bank's progress.
The undersigned, Philip Hartmann, as the responsible partner at Calderwood & Harkness for this engagement, and Patricia Langston, BRB's Chief Compliance Officer, are available to discuss the Plan, respond to any questions, or provide supplementary information at the OCC's convenience. We welcome the opportunity to meet with you and your examination team at any time to review the RAP in detail or to address any aspects of the submission that may warrant further discussion or clarification.
BRB will continue to provide the OCC with quarterly progress reports as required by Paragraph 12 of the Consent Order. The first such quarterly progress report is due on September 15, 2025, and the Bank is already preparing the reporting framework and data collection processes necessary to ensure that these reports are comprehensive, accurate, and submitted on a timely basis.
Finally, we note that BRB remains attentive to its obligations in connection with the Financial Crimes Enforcement Network's ("FinCEN") parallel monitoring of the Bank's SAR filing remediation efforts. BRB is coordinating closely with FinCEN to ensure that all SAR-related remediation activities conducted under the RAP are consistent with FinCEN's expectations and reporting requirements. To the extent that any aspect of FinCEN's parallel monitoring gives rise to issues relevant to the OCC's oversight of the remediation effort, BRB will promptly bring such issues to the OCC's attention.
We appreciate the OCC's attention to this submission and look forward to working cooperatively with you and your team as BRB implements the Comprehensive Remediation Action Plan. Should you require any additional information or wish to schedule a meeting to discuss the Plan, please do not hesitate to contact me at the address below or by telephone or email.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127
Email: phartmann@calderwoodharkness.com
On behalf of Belmont Ridge Bank National Association
Enclosures (10)
cc (via electronic mail):
Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
James Rutherford, Chair, Compliance Committee, Board of Directors, Belmont Ridge Financial Group, Inc.
Dr. Vivian Castellano, Managing Director, Thornfield Consulting Group LLC
Budget Category | Vendor / Description | Estimated Cost
Outside Regulatory Counsel | Calderwood & Harkness LLP | $8,000,000
Independent Consultant | Thornfield Consulting Group LLC (incl. expenses) | $6,900,000
Technology Upgrade | Veridian Analytics Inc. (TMS v.10.0 + OFAC module, Year 1) | $4,700,000
SAR Lookback Project | Workstream 2 dedicated budget | $5,500,000
CDD/EDD Remediation | Workstream 3 dedicated budget | $4,300,000
Temporary Staffing | Pinnacle Compliance Solutions LLC (30 FTEs) | $3,600,000
Internal Headcount Additions | 15 permanent FTE hires (Year 1 compensation & onboarding) | $2,250,000
Training & Policy Development | Workstream 5 dedicated budget | $1,800,000
Board / Governance Restructuring | Compliance Committee, charter development, reporting | $500,000
Contingency & Miscellaneous | Unforeseen costs, ancillary vendor engagements | $4,950,000
Total Remediation Budget | $42,500,000
Target Date | Milestone
June 30, 2025 | SAR backlog clearance — 2,400 alerts fully dispositioned
July 15, 2025 | CDD/EDD 50% remediation milestone — 23,500 accounts remediated
August 1, 2025 | Veridian TMS v.10.0 UAT complete and deployed to production
September 15, 2025 | First quarterly progress report submitted to OCC
October 1, 2025 | Independent model validation of upgraded TMS completed
November 1, 2025 | OFAC screening fully operational across all 14 BaaS channels
December 15, 2025 | Second quarterly progress report submitted to OCC
January 15, 2026 | CDD/EDD 100% remediation milestone — 47,000 accounts remediated
February 15, 2026 | Full compliance program implementation; Thornfield final validation report delivered; Consent Order compliance self-certification submitted to OCC

PRIVILEGED & CONFIDENTIAL

VIA HAND DELIVERY AND ELECTRONIC SUBMISSION (OCC CONNECT)

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts