1045-00002 · Calderwood & Harkness LLP · documents

director-do-liability-analysis-memo.docx DOCUMENT Antitrust

22 / 84 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019

MEMORANDUM

To: Board of Directors, Belmont Ridge Financial Group, Inc.; Gregory Nardone, Esq., General Counsel & Corporate Secretary, Belmont Ridge Bank National Association

From: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group; Yuki Nakamura, Lead Associate, Litigation (General) Practice Group

Date: February 14, 2025

Re: Analysis of Director and Officer Liability Exposure in Connection with OCC Consent Order No. OCC-2025-003 — BSA/AML and Sanctions Compliance Deficiencies

Matter No.: 1045-00002

Classification: Attorney-Client Privileged; Attorney Work Product — Prepared in Anticipation of Litigation

Right-click to update Table of Contents

I. Executive Summary

This memorandum has been prepared at the request of the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG") and Gregory Nardone, General Counsel and Corporate Secretary of Belmont Ridge Bank National Association ("BRB" or the "Bank"), to assess the individual liability exposure of directors and officers of BRB (OCC Charter No. 48271; FDIC Certificate No. 31845) and its holding company, BRFG (a Delaware corporation; NYSE: BRFG), arising from OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025.

The Consent Order identifies five core deficiency categories in BRB's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") sanctions compliance program: (i) OFAC sanctions screening failures in fintech Banking-as-a-Service ("BaaS") channels, specifically involving the NovaPay partnership; (ii) Suspicious Activity Report ("SAR") filing deficiencies, including an approximate 2,400-alert backlog; (iii) Customer Due Diligence/Enhanced Due Diligence ("CDD/EDD") failures across approximately 47,000 high-risk accounts; (iv) model validation failures with respect to the Veridian Transaction Monitoring System version 8.3 ("Veridian TMS v.8.3"); and (v) board-level oversight deficiencies, including the absence of a dedicated compliance committee and inadequate BSA/AML performance reporting to the Board. The OCC assessed a civil money penalty of $14,500,000 against the institution, due March 16, 2025. The total remediation outlay, inclusive of the Board-approved $42.5 million remediation budget and the $14.5 million CMP, is estimated at $57.0 million.

The key risk areas for individual directors and officers that are analyzed in this memorandum include: (a) personal civil money penalties under 12 U.S.C. § 1818(i); (b) removal and prohibition proceedings under 12 U.S.C. § 1818(e); (c) shareholder derivative litigation under Delaware law; and (d) potential securities fraud exposure under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934.

Summary Assessment. The risk of individual regulatory enforcement action by the OCC is currently assessed as moderate but elevated. While the Consent Order is directed at the institution and no individual enforcement proceedings have been initiated as of this date, the three-year escalation from an initial Matter Requiring Attention ("MRA") in June 2022 to a Matter Requiring Immediate Attention ("MRIA") in November 2023, and ultimately to the Consent Order in January 2025, creates a supervisory record that could support individual actions — particularly against the BSA Officer, the CEO, and directors who chaired relevant oversight committees during the entire relevant period. The risk of shareholder derivative litigation is assessed as significant, given the stock price decline of approximately 13.9% (from approximately $47.82 per share to $41.15 per share on January 16, 2025, the first trading day following public disclosure of the Consent Order) and the $57.0 million total remediation outlay. The aggregate market capitalization loss on the date of disclosure was approximately $1.197 billion. These figures, combined with the Consent Order's specific criticisms of board-level oversight, provide a factual foundation for Caremark-based fiduciary duty claims that could survive a motion to dismiss. Securities class action risk is assessed as moderate-to-high, consistent with historical patterns following significant enforcement actions against publicly traded financial institutions accompanied by material stock declines.

The named current Board members whose potential liability exposure is analyzed herein are:

• Diane Whitford, Chair of the Board and Chief Executive Officer

• Arthur Connelly, Lead Independent Director and Risk Committee Chair

• Margaret Dao, Audit Committee Chair

• James Rutherford, Compliance Committee Chair (newly created pursuant to the Consent Order)

• Sandra Villarreal, Independent Director

• Keith Yamamoto, Independent Director

The named current officers with potential exposure are:

• Raymond Okoye, President and Chief Operating Officer

• Samantha Reeves, Chief Financial Officer

• Gregory Nardone, General Counsel and Corporate Secretary

• Patricia Langston, Chief Compliance Officer (appointed January 2024)

• Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023)

• Melissa Chu, Chief Risk Officer

• Warren Ashby, Head of Fintech Partnerships and BaaS Division

• Linda Petrosian, Chief Information Officer and Chief Technology Officer

• Derek Ballard, Head of Internal Audit

The D&O insurance adequacy for the institution and all named individuals requires immediate review, and this memorandum sets forth specific recommendations for coverage analysis, notice obligations, and potential supplemental coverage procurement. The sections that follow provide a detailed factual background, a comprehensive analysis of the applicable legal framework, an individual exposure assessment matrix for each director and officer, and prioritized recommendations for mitigating the risks identified herein.

II. Factual Background

A. Institutional Profile

Belmont Ridge Bank National Association is a national banking association chartered under 12 U.S.C. § 21 et seq., with OCC Charter No. 48271 and FDIC Certificate No. 31845. The Bank's RSSD ID is 1247893. BRB is a wholly-owned subsidiary of Belmont Ridge Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange under the ticker symbol "BRFG." The employer identification numbers are 83-2947561 (BRFG) and 13-6148320 (BRB), respectively.

The Bank is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. As of February 7, 2025, BRFG had approximately 179.5 million shares of common stock outstanding and an aggregate market capitalization of approximately $8.58 billion based on a closing share price of $47.82.

BRB operates four core business lines: retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service ("BaaS") partnerships. As of the date of this memorandum, BRB maintains active BaaS relationships with fourteen fintech sponsor companies. The BaaS business line generated revenue of approximately $127.4 million during calendar year 2024, representing a material and growing component of the Bank's overall revenue base. The significance of this revenue stream underscores the business model risk attendant to any curtailment of BaaS partner relationships resulting from the Consent Order or associated remediation activities.

The Bank employs approximately 5,800 individuals across all business lines and functions. Prior to the commencement of remediation activities, the BSA/AML department comprised sixty-two full-time equivalent employees ("FTEs"). As discussed in greater detail in Section VII below, the Bank's remediation plan contemplates a substantial increase in BSA/AML staffing through both permanent hires and temporary contractor engagements.

B. Supervisory History and Escalation

The supervisory history leading to the Consent Order reflects a pattern of escalating regulatory concern over a period of approximately three years. A comprehensive understanding of this timeline is critical to the individual liability analysis because the duration and progression of unresolved supervisory findings bear directly on whether particular directors and officers demonstrated "continuing disregard" for the safety and soundness of the institution — the standard applicable to removal and prohibition proceedings under 12 U.S.C. § 1818(e) — and whether "red flags" were sufficiently addressed for purposes of Caremark oversight liability analysis.

The key supervisory events are set forth in chronological order below:

March 2021: Last Independent Model Validation of Veridian TMS v.8.3. The last independent validation of the Veridian Transaction Monitoring System version 8.3, the Bank's primary automated transaction monitoring platform, was completed in March 2021 — more than three years before the commencement of the OCC's targeted examination. This gap significantly exceeds the OCC's supervisory expectations for model validation frequency, which generally call for independent validation at least annually for high-risk models and no less frequently than every two years for all models used in BSA/AML compliance. The absence of a current validation during the period of rapid growth in BaaS transaction volumes is a central focus of the Consent Order's findings.

June 2022: OCC Issues Matter Requiring Attention (MRA). The OCC issued an MRA directed at BSA/AML transaction monitoring deficiencies. The MRA identified concerns with the calibration and effectiveness of transaction monitoring scenarios and recommended that the Bank conduct a comprehensive review of its transaction monitoring system parameters. At this time, the Board was informed of the MRA through existing reporting channels. The MRA represented the initial formal supervisory finding and the first clear "red flag" in the supervisory record.

October 2022: Last Tuning of Veridian TMS v.8.3 Parameters. The last adjustment to the Veridian TMS v.8.3 monitoring parameters was completed in October 2022, approximately four months after the MRA was issued. It does not appear that this tuning exercise was performed as a comprehensive response to the MRA's findings; rather, available documentation suggests it was a routine periodic adjustment. No independent validation accompanied this tuning exercise.

November 2023: OCC Issues Matter Requiring Immediate Attention (MRIA). Approximately seventeen months after the initial MRA, and following a determination that the MRA had not been satisfactorily addressed, the OCC escalated its concerns by issuing an MRIA regarding OFAC sanctions screening gaps. The MRIA specifically identified deficiencies in the Bank's screening of transactions processed through BaaS channels — the same deficiency category that features prominently in the Consent Order. The escalation from MRA to MRIA is significant because it reflects the OCC's determination that the prior concerns had not been adequately remediated and that the matter required immediate corrective action. The MRIA was communicated to the Board.

January 2024: Appointment of Patricia Langston as Chief Compliance Officer. In response to the MRIA and the growing supervisory pressure, BRB appointed Patricia Langston as Chief Compliance Officer. Ms. Langston was brought in specifically to strengthen the compliance function and address the deficiencies identified by the OCC. Her relatively short tenure — approximately one year prior to the issuance of the Consent Order — is a relevant mitigating factor in assessing her individual liability exposure, though it does not eliminate such exposure entirely.

March 2024 – September 2024: OCC Targeted BSA/AML Examination. The OCC commenced a targeted BSA/AML examination of BRB in March 2024. The examination was conducted under the direction of Jonathan Frey, National Bank Examiner, from the OCC Northeastern District Office located at 340 Madison Avenue, New York, New York 10017. The examination extended through September 2024 — a duration of approximately six months, reflecting the breadth and severity of the issues identified.

September 2024: Caldera & Pope LLP Independent BSA/AML Testing Completed. In September 2024, concurrently with the conclusion of the OCC's targeted examination, BRB's independent testing firm, Caldera & Pope LLP (Franklin Dorsey, engagement partner), completed its independent BSA/AML testing. The Caldera & Pope report identified multiple deficiencies that echoed the findings subsequently included in the Consent Order. The Caldera & Pope findings were reported to the Audit Committee (chaired by Margaret Dao). The timing and substance of these findings are relevant to the liability analysis because they represent an independent third-party confirmation of the compliance program deficiencies that was available to the Board prior to the formal issuance of the Consent Order.

January 15, 2025: OCC Consent Order No. OCC-2025-003 Issued. The OCC issued the Consent Order, which is the subject of this memorandum. The Consent Order assessed a civil money penalty of $14,500,000 against the institution and required comprehensive corrective actions across all five deficiency categories identified above. The Consent Order was directed at BRB as an institution; no individual directors or officers were named.

January 2025: Termination of Prior Outside Counsel Engagement. Following issuance of the Consent Order, BRB terminated its engagement with Drayton Mercer LLP, which had served as outside regulatory counsel during the 2023–2024 OCC examination cycle. The lead partner at Drayton Mercer was Helen Frazier. BRB subsequently engaged Calderwood & Harkness LLP (this firm) effective February 10, 2025.

In addition to the OCC, the Financial Crimes Enforcement Network ("FinCEN") is monitoring the Bank's BSA/AML compliance. Angela Drummond, Associate Director, Enforcement Division, FinCEN, has been identified as the FinCEN point of contact. FinCEN has reserved its enforcement rights pursuant to its coordination with the OCC; however, no separate FinCEN enforcement action has been initiated as of February 10, 2025. It should also be noted that, as of February 10, 2025, no criminal referral to the United States Department of Justice has been made. However, the Consent Order does not preclude such a referral in the future, and the possibility of a criminal referral — while currently assessed as remote — cannot be entirely excluded, particularly depending on the findings that may emerge from the SAR lookback exercise and the CDD/EDD remediation project.

C. Consent Order Deficiency Categories

The Consent Order identifies five core deficiency categories in the Bank's BSA/AML and OFAC sanctions compliance program. Each category is summarized below, as a detailed understanding of the specific deficiencies is essential to the individual liability analysis that follows.

1. OFAC Sanctions Screening Failures. The Consent Order found that BRB failed to screen a significant volume of transactions processed through its BaaS channel for compliance with OFAC sanctions requirements. Specifically, approximately 12% of NovaPay wire and ACH transactions — equating to approximately 3,800,000 out of 31,700,000 total NovaPay transactions processed during calendar year 2023 — were not screened against the OFAC Specially Designated Nationals and blocked Persons ("SDN") List or other applicable sanctions lists. The failure to screen these transactions created the risk that the Bank processed transactions involving sanctioned persons, countries, or entities without detection, constituting potential violations of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act ("TWEA"), and the regulations administered by OFAC. This deficiency is concentrated in the BaaS division under the operational oversight of Warren Ashby, Head of Fintech Partnerships and BaaS Division, and implicates the technology infrastructure maintained under the direction of Linda Petrosian, CIO/CTO.

2. SAR Filing Deficiencies. The Consent Order identified a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, the conclusion of the examination period. In addition, for SARs that were filed, the average time from alert generation to SAR filing was approximately 78 days, far exceeding the regulatory expectation of filing within 30 calendar days of the initial detection of a potentially reportable transaction (or within 60 days if no suspect is identified at the time of initial detection). The SAR filing deficiencies are directly within the operational responsibility of Thomas Ikeda, BSA Officer and AML Program Director, and reflect the combined effects of understaffing, inadequate transaction monitoring system calibration, and insufficient management oversight.

3. CDD/EDD Failures. The Consent Order found that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BaaS channels — lacked adequate CDD and EDD documentation. The FinCEN CDD Rule (31 C.F.R. § 1010.230) requires covered financial institutions to identify and verify the identity of the beneficial owners of legal entity customers at the time of account opening and to maintain updated customer profiles based on the institution's risk assessment. The failure to collect and maintain adequate documentation for 47,000 high-risk accounts represents a systemic breakdown in the Bank's customer onboarding and ongoing monitoring processes, concentrated in the BaaS division.

4. Model Validation Failures. As noted above, the Veridian TMS v.8.3 had not been independently validated since March 2021 — a gap of more than three years prior to the examination. The last tuning of the system's monitoring parameters occurred in October 2022. Given the significant growth in BaaS transaction volumes during the intervening period and the evolving nature of money laundering typologies, the absence of current model validation created a material risk that the transaction monitoring system was not effectively calibrated to detect suspicious activity. The Consent Order cites this deficiency as contributing to both the SAR backlog and the OFAC screening failures.

5. Board-Level Oversight Deficiencies. The Consent Order specifically criticizes the Bank's board-level governance and oversight of its BSA/AML compliance program. Key findings include: (a) the absence of a dedicated Compliance Committee at the Board level, requiring the Board to address BSA/AML matters through its existing committee structure, which proved inadequate; (b) Board-level BSA/AML reporting on a quarterly-only basis that lacked key performance metrics, including SAR volumes and filing timeliness, OFAC screening hit rates, BaaS partner risk ratings, and alert aging and disposition data; and (c) the failure of the Board to ensure adequate resources and management attention were devoted to BSA/AML compliance in light of the Bank's rapidly growing BaaS business line. These board oversight findings are of central importance to the individual liability analysis because they directly implicate the fiduciary duties of each director who served during the relevant period.

D. Financial Impact

The financial impact of the Consent Order and associated remediation is substantial by any measure. The civil money penalty assessed against the institution is $14,500,000, payable by March 16, 2025. The Board has approved a comprehensive remediation budget of $42,500,000, exclusive of the CMP. The total estimated outlay is therefore $57,000,000. Relative to BRB's fiscal year 2024 net income of $412 million, the total remediation outlay represents approximately 13.8% of annual earnings — a material figure that must be disclosed in the Bank's regulatory filings and BRFG's SEC filings.

The market reaction to the public disclosure of the Consent Order was swift and significant. On January 16, 2025 — the first trading day following the issuance of the Consent Order — BRFG's stock price declined from approximately $47.82 per share to $41.15 per share, a decline of $6.67 per share, or approximately 13.9%. With approximately 179.5 million shares of common stock outstanding, the aggregate market capitalization loss on the disclosure date was approximately $1.197 billion. This magnitude of stock price decline is a significant factor in assessing the likelihood of securities fraud class action litigation, as it represents the kind of "corrective disclosure" event that typically triggers investor lawsuits.

Among the Bank's significant shareholders, Brindoval Capital Partners LP is of particular note. Brindoval, whose Managing Partner is Julian Whitmore, holds approximately 8.3% of BRFG's outstanding common stock — approximately 14.9 million shares. Brindoval has expressed concern regarding remediation costs, potential additional enforcement fines, and the reputational impact of the Consent Order on the Bank's franchise value. Brindoval is represented by Amberly Knox LLP (Steven Briggs, Partner, 600 Third Avenue, New York, New York 10016). Given the size of its stake and its expressed concerns, Brindoval is a potential lead plaintiff in any securities class action and a potential catalyst for shareholder derivative litigation. The Bank and BRFG should expect continued engagement from Brindoval and its counsel.

Finally, the BaaS revenue contribution of $127.4 million during calendar year 2024 underscores the business model risk inherent in the deficiencies identified by the Consent Order. If BaaS partner relationships are curtailed — whether by regulatory mandate, partner attrition, or reputational concerns — the resulting revenue loss would compound the financial impact of the Consent Order and could give rise to additional claims regarding the Board's oversight of the BaaS growth strategy.

III. Legal Framework: Federal Banking Law Liability Exposure

This section analyzes the principal federal banking law and related statutory frameworks under which individual directors and officers of BRB and BRFG may face personal liability in connection with the matters identified in the Consent Order. The analysis addresses civil money penalties, removal and prohibition proceedings, cease-and-desist proceedings, and personal liability under the Bank Secrecy Act.

A. Civil Money Penalties Against Individuals — 12 U.S.C. § 1818(i)

The OCC possesses broad statutory authority under 12 U.S.C. § 1818(i) to assess civil money penalties ("CMPs") not only against depository institutions but also against "institution-affiliated parties" ("IAPs") individually. The term "institution-affiliated party" is defined in 12 U.S.C. § 1813(u) to include, among others: (1) any director, officer, employee, or controlling stockholder of, or agent for, an insured depository institution; (2) any other person who has filed or is required to file a change-in-bank-control notice under 12 U.S.C. § 1817(j); (3) any shareholder, consultant, joint venture partner, or other person who participates in the conduct of the affairs of the institution; and (4) any independent contractor who knowingly or recklessly participates in any violation of law, unsafe or unsound practice, or breach of fiduciary duty. All of the named directors and officers of BRB fall squarely within the definition of IAP, and each is therefore subject to the OCC's individual CMP authority.

The statute establishes a three-tiered penalty structure of escalating severity, corresponding to increasingly culpable conduct:

1. Tier 1 Penalties — 12 U.S.C. § 1818(i)(2)(A)

Tier 1 penalties are available for any violation of a law, rule, regulation, or any condition imposed in writing by the OCC, including any condition or requirement of a consent order. The statute authorizes the assessment of a CMP against any IAP for such a violation. The maximum Tier 1 penalty amount is currently approximately $11,000 per day for each day during which the violation continues, subject to annual inflation adjustments published in the Federal Register by the OCC.

The relevance of Tier 1 penalties to the current matter is primarily forward-looking. If any individual director or officer of BRB fails to comply with the specific provisions and requirements of the Consent Order — including the remediation timelines, reporting obligations, and governance mandates — personal Tier 1 penalties could attach to the responsible individual. The Consent Order imposes numerous specific obligations with defined deadlines (e.g., CMP payment by March 16, 2025; SAR backlog status report by March 31, 2025; Remediation Action Plan submission by May 15, 2025; completion of SAR lookback by August 15, 2025; full implementation by February 15, 2026, with self-certification). Each director and officer with responsibility for any aspect of compliance with these requirements is potentially subject to daily Tier 1 penalties for any failure to meet the specified deadlines.

2. Tier 2 Penalties — 12 U.S.C. § 1818(i)(2)(B)

Tier 2 penalties require a higher threshold of culpability. The OCC must demonstrate that the IAP's violation, reckless engagement in an unsafe or unsound practice, or breach of fiduciary duty meets one or more of the following conditions: (a) the violation, practice, or breach was part of a pattern of misconduct; (b) the violation, practice, or breach caused or is likely to cause more than a minimal loss to the institution; or (c) the violation, practice, or breach resulted in pecuniary gain or other benefit to the IAP. The maximum Tier 2 penalty is approximately $55,000 per day for each day during which the violation, practice, or breach continues or has not been corrected.

The applicability of Tier 2 penalties to BRB directors and officers warrants careful analysis. Several factors support the OCC's potential ability to establish the Tier 2 elements:

• Pattern of Misconduct. The escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) over a period of approximately two and a half years constitutes, on its face, a pattern of repeated and escalating supervisory findings related to BSA/AML compliance deficiencies. The fact that the same or similar deficiencies persisted across multiple supervisory interactions — and that the MRA was not satisfactorily remediated before the MRIA was issued — could support an argument that the directors and officers responsible for addressing these matters engaged in a "pattern of misconduct" within the meaning of the statute. This argument would be strongest as applied to individuals who served in relevant positions throughout the entire period.

• More Than Minimal Loss. The total remediation cost of $57.0 million (including the $14.5 million CMP) far exceeds the "more than minimal loss" threshold contemplated by the statute. The OCC and courts have interpreted this standard broadly, and there is no question that losses of this magnitude satisfy the element.

• Pecuniary Gain. We are not currently aware of any evidence suggesting that individual directors or officers derived personal pecuniary gain from the BSA/AML compliance deficiencies. However, this element could potentially be implicated if, for example, compensation decisions were influenced by the cost savings associated with underinvestment in compliance, or if bonuses were tied to BaaS revenue growth that was achieved in part through inadequate compliance controls. Compensation committee records should be reviewed to assess this risk.

The individual exposure of each named director and officer under Tier 2 varies based on their specific role, tenure during the relevant period, and the extent of their knowledge of unresolved MRA and MRIA findings. A director-by-director and officer-by-officer assessment is provided in Section VI below.

3. Tier 3 Penalties — 12 U.S.C. § 1818(i)(2)(C)

Tier 3 penalties represent the most severe tier of civil money penalties and are reserved for the most culpable conduct. The OCC must establish that the IAP committed a knowing violation or acted with reckless disregard for the applicable law, regulation, or condition, and that such knowing or reckless violation caused or is likely to cause a substantial loss to the institution or a substantial pecuniary gain to the IAP. The maximum Tier 3 penalty is approximately $2,200,000 per day — a figure that, if imposed for even a limited duration, would represent a devastating personal financial consequence.

Assessment. Tier 3 exposure for the named directors and officers is currently assessed as low. As of the date of this memorandum, we have not identified evidence of knowing misconduct by any individual — that is, evidence that a director or officer knew that specific BSA/AML program operations were in violation of law and deliberately chose to permit the violation to continue. However, we note that this assessment cannot be treated as final for several important reasons. First, the Thornfield Consulting Group LLC preliminary gap assessment, which is due by April 15, 2025, may reveal additional facts bearing on individual knowledge and intent. Second, and more significantly, the SAR lookback exercise (budgeted at $5.5 million) and the CDD/EDD remediation project (budgeted at $4.3 million) are likely to generate substantial volumes of documentation and data that could alter the analysis. If the SAR lookback reveals, for example, that transaction monitoring alerts were deliberately suppressed or that specific individuals directed the non-filing of SARs involving known suspicious activity, the Tier 3 exposure assessment would change materially. We will update this analysis as these projects progress.

B. Removal and Prohibition Proceedings — 12 U.S.C. § 1818(e)

The OCC has the authority under 12 U.S.C. § 1818(e) to remove any IAP from office or to prohibit any IAP from further participation in the conduct of the affairs of any insured depository institution, any company that controls an insured depository institution, or any institution-related entity. A removal or prohibition order under Section 1818(e) — commonly referred to as an "industry bar" — represents the most severe administrative sanction available to the OCC short of revoking an institution's charter, and effectively ends an individual's career in the banking industry.

Section 1818(e) requires the OCC to establish three elements:

(1) Misconduct Element: The IAP has (a) directly or indirectly violated any law, rule, regulation, consent order, condition imposed in writing, or written agreement; (b) engaged or participated in any unsafe or unsound practice in connection with the institution; or (c) committed or engaged in any act, omission, or practice constituting a breach of fiduciary duty.

(2) Culpability Element: The violation, practice, or breach involves (a) personal dishonesty on the part of the IAP, or (b) demonstrates willful or continuing disregard by such party for the safety and soundness of the institution.

(3) Effect Element: By reason of the violation, practice, or breach, the institution has suffered or will probably suffer financial loss or other damage, the interests of the institution's depositors have been or could be prejudiced, or the IAP received financial gain or other benefit.

All three elements must be satisfied for the OCC to sustain a removal or prohibition order. The misconduct and effect elements are relatively straightforward on the facts presented here. The critical analytical question, therefore, is whether the OCC can satisfy the culpability element — and specifically, whether the conduct of particular directors and officers demonstrates "willful or continuing disregard" for the safety and soundness of the institution.

Analysis of the "Continuing Disregard" Standard. The federal banking agencies and administrative law judges have interpreted "continuing disregard" to mean conduct that involves a conscious, voluntary disregard for the safety and soundness of the institution — something more than negligence but less than affirmative intent to harm. The standard may be satisfied by evidence that an individual was repeatedly informed of risks or deficiencies but failed to take reasonable corrective action over a sustained period. Notably, actual knowledge of the specific legal violation is not required; rather, the question is whether the individual was aware of circumstances that should have prompted action and chose, consciously or through deliberate indifference, not to act.

The three-year supervisory escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025), combined with the Consent Order's specific finding of board-level oversight deficiencies, provides a factual predicate that could support a "continuing disregard" argument against certain directors and officers who served throughout the relevant period. The fact that the MRA was not fully remediated before the MRIA was issued, and that the MRIA was not fully remediated before the examination culminated in the Consent Order, suggests a sustained failure to take corrective action in response to known regulatory concerns.

Identification of Individuals with Elevated Removal Risk. Based on the facts currently available, the following individuals are assessed as having the most elevated risk profile with respect to potential removal or prohibition proceedings:

• Diane Whitford (CEO & Board Chair): Ms. Whitford holds the highest-profile dual role at the institution and served throughout the entire MRA-MRIA-Consent Order sequence. As both CEO and Board Chair, she bears ultimate management and governance authority over the institution. The Consent Order's findings regarding board-level oversight failures — including the absence of a Compliance Committee and inadequate BSA/AML reporting — occurred under her leadership. Her dual role also eliminates the independent check that would exist where the Board Chair and CEO positions are separated, which may be viewed unfavorably by the OCC in assessing whether the Board's governance structure contributed to the oversight failures.

• Arthur Connelly (Lead Independent Director & Risk Committee Chair): Mr. Connelly has direct oversight responsibility for enterprise risk, which encompasses BSA/AML compliance risk. He served throughout the entire relevant period. The Consent Order's findings regarding inadequate board-level reporting of BSA/AML metrics fall directly within the purview of his committee responsibilities. The question of whether the Risk Committee received adequate information and, if so, whether it took sufficient action in response is central to Mr. Connelly's individual exposure.

• Margaret Dao (Audit Committee Chair): Ms. Dao bears oversight responsibility for the internal audit function (headed by Derek Ballard) and for the engagement and oversight of external auditors and independent testers, including Caldera & Pope LLP (Franklin Dorsey, engagement partner). The Caldera & Pope independent testing completed in September 2024 identified multiple deficiencies that subsequently appeared in the Consent Order. The critical question for Ms. Dao's exposure is whether the Audit Committee adequately acted on the Caldera & Pope findings or whether those findings were insufficiently escalated or addressed.

• Patricia Langston (Chief Compliance Officer): Ms. Langston was appointed in January 2024 specifically to address compliance deficiencies identified in the MRA and MRIA. Her tenure at the time of the Consent Order's issuance was approximately one year. While this shorter tenure is a mitigating factor, the Consent Order findings relate to deficiencies that persisted during her tenure, and she bears the title and functional responsibility for the compliance program. The OCC could view her as the officer specifically charged with remediating the identified issues and assess that insufficient progress was made during her first year.

• Thomas Ikeda (BSA Officer / AML Program Director): Mr. Ikeda was appointed in March 2023, approximately nine months after the MRA and approximately eight months before the MRIA. As the statutorily designated BSA officer under 31 U.S.C. § 5318, he bears primary operational responsibility for the SAR filing process (where the 78-day average and 2,400-alert backlog were identified), the transaction monitoring system (where the validation gap was found), and the OFAC screening operations. His role carries heightened personal liability under both OCC and FinCEN enforcement authorities (discussed further below in Section III.D). Mr. Ikeda's exposure is assessed as among the highest of all named individuals.

• Warren Ashby (Head of Fintech Partnerships / BaaS Division): Mr. Ashby has direct operational responsibility for the BaaS channel where the most significant OFAC screening failures (3.8 million unscreened NovaPay transactions) and CDD/EDD deficiencies (47,000 high-risk accounts, primarily BaaS-onboarded) were concentrated. The BaaS division processed approximately $74.3 billion in transaction volume during the relevant period. The concentration of the most severe deficiencies in Mr. Ashby's area of responsibility makes him a potential target for enforcement action.

Mitigating Factors. Several mitigating factors should be noted. Ms. Langston and Mr. Ikeda were brought into the institution specifically to address known deficiencies. Their relatively shorter tenures — one year and approximately twenty-two months, respectively, at the time of the Consent Order — should be considered in evaluating whether their conduct demonstrates "continuing disregard." Additionally, the establishment of the new Compliance Committee under the chairmanship of James Rutherford and the adoption of a comprehensive remediation program demonstrate that the Board has taken corrective action, which may reduce the likelihood that the OCC will pursue individual removal proceedings provided that remediation proceeds on schedule.

It is important to emphasize that no removal or prohibition proceedings have been initiated as of February 10, 2025. The Consent Order is directed at the institution, not at any individual. However, the OCC retains full discretion to pursue individual actions at any time, and the issuance of an institutional consent order does not preclude — and in some cases may precede — individual enforcement proceedings.

C. Cease-and-Desist Proceedings Against Individuals — 12 U.S.C. § 1818(b)

In addition to the CMP and removal authorities discussed above, the OCC has the authority under 12 U.S.C. § 1818(b) to issue cease-and-desist ("C&D") orders against individual IAPs for violations of law, regulation, or condition; unsafe or unsound practices; or breaches of fiduciary duty. The threshold for a cease-and-desist order directed at an individual is lower than for removal proceedings — it does not require a showing of personal dishonesty or willful or continuing disregard for safety and soundness. Rather, the OCC need only establish the underlying violation, practice, or breach, combined with a reasonable likelihood that the conduct will continue or recur absent an order.

The practical impact of an individual cease-and-desist order includes significant reputational harm, potential restrictions on the individual's duties and authority, and the creation of a public enforcement record that may serve as a stepping stone to further enforcement actions if the individual fails to comply with the terms of the C&D order. Violation of a cease-and-desist order can itself give rise to Tier 1 civil money penalties under Section 1818(i).

Assessment. The risk of individual cease-and-desist orders is assessed as moderate. The primary trigger for such proceedings would be a failure to meet the remediation timelines and requirements set forth in the Consent Order. If the Bank's remediation efforts fall behind schedule or are found to be inadequate during future OCC examinations, the OCC may determine that individual C&D orders are warranted to compel specific corrective actions by identified directors and officers. The risk increases materially if any individual continues to serve in a position where they bear responsibility for compliance functions that remain deficient.

D. Personal Liability Under Other Federal Statutes

Beyond the OCC's enforcement authorities under 12 U.S.C. § 1818, individual directors and officers face potential personal liability under additional federal statutes:

31 U.S.C. § 5321(a)(1): FinCEN Civil Penalty Authority. FinCEN possesses independent authority to impose civil penalties on individuals for willful violations of BSA reporting requirements, including the failure to file SARs and the failure to implement adequate BSA/AML programs. This authority is particularly relevant to Thomas Ikeda, as the designated BSA Officer, and potentially to any other officer who authorized or directed inadequate SAR filing practices. The word "willful" in this context has been interpreted by FinCEN and the courts to require only that the individual acted with knowledge that his or her conduct was unlawful, or with reckless disregard for whether the conduct was unlawful — a standard that may be met by evidence of sustained non-compliance with known regulatory expectations.

As noted above, FinCEN is actively monitoring the Bank's compliance through Angela Drummond, Associate Director, Enforcement Division, and has reserved its enforcement rights. The absence of a separate FinCEN enforcement action as of February 10, 2025 should not be interpreted as an indication that FinCEN will not pursue such action in the future. FinCEN's enforcement decisions are often informed by the findings that emerge from remediation activities, including SAR lookbacks and CDD/EDD remediation exercises.

31 U.S.C. § 5322: Criminal Liability. Willful violation of BSA requirements carries potential criminal penalties, including fines and imprisonment for up to five years (or up to ten years if the violation is committed while violating another federal law or as part of a pattern of criminal activity involving more than $100,000 in a twelve-month period). As of February 10, 2025, no criminal referral to the Department of Justice has been made. The Consent Order, however, does not preclude such a referral, and we note that the DOJ has demonstrated increased willingness in recent years to pursue criminal BSA/AML cases against individuals, particularly where the underlying facts involve sustained and systemic compliance failures.

We recommend maintaining vigilance regarding the possibility of a criminal referral. The SAR lookback exercise and the CDD/EDD remediation project may uncover evidence that, depending on its nature and severity, could prompt a referral. Any individual who learns of facts suggesting potential criminal exposure should be advised to retain personal criminal defense counsel immediately, and no such facts should be disclosed to third parties without prior coordination with counsel.

IV. Shareholder Derivative Litigation Risk

A. Breach of Fiduciary Duty Claims

BRFG is incorporated in the State of Delaware, and Delaware law therefore governs the fiduciary duties of the BRFG Board of Directors. Under Delaware law, directors owe the corporation and its stockholders two fundamental fiduciary duties: the duty of care and the duty of loyalty.

Duty of Care. The duty of care requires that directors exercise the level of care that an ordinarily careful and prudent person would use under similar circumstances. In the context of corporate governance, this duty requires directors to make informed business decisions by availing themselves of all material information reasonably available. The Consent Order's finding that Board-level BSA/AML reporting lacked key performance metrics — including SAR volumes and filing timeliness, OFAC screening hit rates, BaaS partner risk ratings, and alert aging data — and that no dedicated Compliance Committee existed to serve as a focused oversight body, directly implicates duty-of-care questions. If directors did not receive adequate information to monitor the Bank's BSA/AML compliance program, the question arises whether they fulfilled their duty to become reasonably informed about a material risk area. If they received such information but failed to act on it, the exposure may shift from a duty-of-care claim to a more severe oversight liability theory (discussed below).

Duty of Loyalty. The duty of loyalty requires that directors act in the best interests of the corporation and its stockholders, free from self-dealing, conflicts of interest, or bad faith. Absent evidence of personal financial interest or self-dealing transactions, standard duty-of-loyalty claims against the BRB/BRFG directors would be difficult to sustain on the facts currently known. However, duty-of-loyalty claims may be alleged in conjunction with Caremark oversight liability theories, as discussed immediately below, because Delaware courts have classified oversight liability as sounding in good faith — a subsidiary element of the duty of loyalty.

Caremark Oversight Liability. The most significant shareholder derivative litigation risk arises under the oversight liability framework established in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), as subsequently refined by the Delaware Supreme Court in Stone v. Ritter, 911 A.2d 362 (Del. 2006), and further developed in Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), and In re Harborview & Co. Derivative Litigation, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021).

Under Caremark, directors face potential personal liability for failure of oversight where the plaintiff establishes either: (a) that the directors utterly failed to implement any reporting or information system or controls (a "prong one" claim); or (b) that having implemented such a system or controls, the directors consciously failed to monitor or oversee the system's operations, thus disabling themselves from being informed of risks or problems requiring their attention (a "prong two" claim).

Caremark claims have historically been described as "possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment." However, in recent years — particularly following the Delaware Supreme Court's decision in Marchand v. Barnhill — courts have shown a greater willingness to allow Caremark claims to proceed past the motion-to-dismiss stage, especially in regulated industries where compliance is a "mission critical" function and where the company has experienced a compliance failure following identifiable "red flags" that were reported to the Board.

The facts of the present matter present a credible basis for Caremark claims under both prongs:

Prong One — Failure to Implement. The Consent Order's finding that BRB lacked a dedicated Board-level Compliance Committee and that the existing Board-level reporting on BSA/AML compliance was deficient in key metrics could support an argument that the Board failed to implement an adequate reporting and information system for monitoring BSA/AML compliance. While the Bank did have a BSA/AML compliance program and did report to the Board on a quarterly basis, the Consent Order's critique of the substance and scope of that reporting suggests that the system, as implemented, was materially deficient in design — a fact pattern that some courts have treated as sufficient to state a Prong One claim, particularly where the oversight gap relates to a "mission critical" compliance obligation for a financial institution.

Prong Two — Red Flags. Perhaps more significantly, the escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) constitutes a series of progressively severe "red flags" that were communicated to the Board. These are not subtle or ambiguous indicators — they are formal regulatory actions by the Bank's primary federal regulator. A plaintiff could argue that the Board received these red flags but failed to adequately respond to them, as evidenced by the fact that the deficiencies persisted and escalated over a two-and-a-half-year period. The Caldera & Pope independent testing results, reported to the Audit Committee in September 2024, represent an additional red flag from an independent third-party source that reinforced the OCC's findings.

The damages available in a derivative action for breach of fiduciary duty could be substantial. Potential measures of damages include the $57.0 million total remediation outlay (encompassing the $42.5 million remediation budget and the $14.5 million CMP), reputational harm to the institution, the cost of management distraction, and — depending on the theory of damages employed — some portion of the approximately $1.197 billion aggregate market capitalization decline on the date of disclosure.

The directors with the most elevated exposure to Caremark claims are those who served in relevant oversight capacities throughout the entire MRA-MRIA-Consent Order sequence. Specifically:

• Diane Whitford (Chair & CEO) bears the highest exposure as the individual with ultimate management and governance authority throughout the relevant period, particularly given the combined Chair/CEO role.

• Arthur Connelly (Risk Committee Chair) has elevated exposure because BSA/AML compliance risk is an enterprise risk that falls within the express purview of his committee.

• Margaret Dao (Audit Committee Chair) has elevated exposure because the Audit Committee had oversight of both internal audit and the independent testing function that identified deficiencies.

Directors with less historical involvement — such as James Rutherford, Sandra Villarreal, and Keith Yamamoto — face lower but not insignificant exposure. Their liability depends on the specific facts regarding their tenure on the Board, their committee assignments during the relevant period, and the nature and detail of BSA/AML information that was presented to the full Board at regular meetings.

B. Securities Fraud Claims (Federal)

BRFG is a publicly traded company on the New York Stock Exchange with approximately 179.5 million shares of common stock outstanding and significant institutional ownership, including Brindoval Capital Partners LP at approximately 8.3%. The profile of a publicly traded financial institution that has been the subject of a significant regulatory enforcement action accompanied by a material stock price decline is a classic predicate for securities fraud class action litigation.

Section 10(b) and Rule 10b-5 Claims. Potential plaintiffs could allege that BRFG and its officers made materially misleading statements or omissions regarding the adequacy of the Bank's BSA/AML compliance program in SEC filings — including Forms 10-K, 10-Q, and proxy statements — during the period preceding the public disclosure of the Consent Order. Specifically, plaintiffs would likely contend that BRFG's public filings contained positive descriptions of its compliance program, risk management frameworks, and internal controls that were rendered materially misleading by the failure to disclose the known BSA/AML deficiencies, the escalating supervisory concerns, and the growing risk of a formal enforcement action. The stock price decline of approximately 13.9% (from $47.82 to $41.15) on January 16, 2025, would be characterized as a "corrective disclosure" event demonstrating that the market was misled by prior statements and that the stock was trading at an inflated price during the relevant period.

The elements of a Section 10(b) and Rule 10b-5 claim are: (1) a material misrepresentation or omission; (2) scienter; (3) a connection with the purchase or sale of a security; (4) reliance; (5) economic loss; and (6) loss causation. The stock price decline and market capitalization loss satisfy several of these elements on their face. The central battleground in any such litigation would be the scienter element — whether the officers who signed and certified the relevant SEC filings knew, or recklessly disregarded, that the BSA/AML compliance disclosures were materially misleading.

Scienter may be supported by the following facts in the record: (a) the prior MRA (June 2022) put management on formal notice of BSA/AML deficiencies; (b) the MRIA (November 2023) escalated the regulatory concern and provided unambiguous notice that the prior deficiencies had not been adequately remediated; (c) the Caldera & Pope independent testing results (September 2024) provided an independent confirmation of systemic compliance failures; and (d) the certifying officers (CEO and CFO) are presumed to have knowledge of material risks to the institution as part of their Sarbanes-Oxley certification obligations. Taken together, these facts could support a strong inference of scienter — the standard required to survive a motion to dismiss under the Private Securities Litigation Reform Act of 1995 ("PSLRA").

Section 20(a) Controlling Person Liability. In addition to direct claims under Section 10(b) and Rule 10b-5, individual officers face potential liability under Section 20(a) of the Securities Exchange Act of 1934 as "controlling persons" of BRFG. Section 20(a) imposes joint and several liability on any person who controls a person liable under the Exchange Act, unless the controlling person acted in good faith and did not directly or indirectly induce the act constituting the violation. The officers most exposed to controlling person liability are:

• Diane Whitford (CEO) — as the chief executive officer and certifying officer, she is a classic controlling person defendant in a securities class action.

• Raymond Okoye (President & COO) — as the president and chief operating officer, he exercises operational control over the Bank and is commonly named as a controlling person.

• Samantha Reeves (CFO) — as the chief financial officer and SOX certifying officer, she is responsible for the accuracy of financial reporting and related disclosures. The materiality of the $57.0 million remediation outlay relative to the Bank's $412 million net income for fiscal year 2024 (approximately 13.8%) makes the adequacy of prior financial disclosure a central issue.

• Gregory Nardone (General Counsel) — as general counsel, he has legal oversight of the compliance program, managed the relationship with former outside counsel Drayton Mercer LLP, and was involved in the preparation of SEC filings. While general counsel are not always named in securities class actions, Mr. Nardone's direct involvement in compliance matters and regulatory interactions may increase his exposure.

Likely Plaintiff Class. Plaintiffs would seek to certify a class of all persons who purchased or otherwise acquired BRFG common stock during a defined "class period." The class period would likely begin on or before the date of the November 2023 MRIA (when a plaintiff would argue that management first had actionable knowledge that the BSA/AML program was materially deficient) and end on January 16, 2025 (the date of the corrective disclosure). Alternatively, plaintiffs might extend the beginning of the class period earlier, to the June 2022 MRA, depending on the specific misrepresentations identified.

As noted in Section II.D above, Brindoval Capital Partners LP, holding approximately 8.3% of BRFG common stock (approximately 14.9 million shares), has expressed concerns regarding remediation costs and reputational impact and is represented by sophisticated securities litigation counsel at Amberly Knox LLP (Steven Briggs, Partner). Brindoval is a likely candidate to serve as lead plaintiff in any securities class action, given the size of its stake and the resulting presumption of typicality and adequacy under the PSLRA.

Overall Assessment. Securities fraud class action risk is assessed as moderate-to-high. Academic and empirical research consistently demonstrates that securities class actions are more likely to be filed following regulatory enforcement actions at publicly traded financial institutions, particularly where the enforcement action is accompanied by a stock price decline of 10% or more. The 13.9% decline here, combined with an aggregate market capitalization loss of approximately $1.197 billion, places the present matter well within the statistical range associated with securities litigation filings.

C. Procedural Considerations

Demand Futility. In a shareholder derivative action, the plaintiff must either make a pre-suit demand on the Board to pursue the claims or demonstrate that demand would be futile. Under the test set forth in Rales v. Blasband, 634 A.2d 927 (Del. 1993), and refined in United Food and Commercial Workers Union v. Zuckerberg, 262 A.3d 1034 (Del. 2021), the court examines whether, at the time the complaint is filed, a majority of the directors face a substantial likelihood of personal liability for the underlying claims such that they cannot be expected to exercise disinterested and independent judgment in response to a demand.

Given that the Consent Order specifically criticizes Board-level oversight, plaintiffs may argue that demand is futile because a majority of the current Board — particularly Whitford, Connelly, and Dao, who collectively served throughout the relevant period and chaired or led the governance bodies most directly implicated by the Consent Order — face a substantial likelihood of Caremark liability. If three of the six current Board members are deemed conflicted for purposes of the demand futility analysis, the Board lacks a disinterested majority, and demand would be excused. This analysis will depend on the precise composition of the Board at the time any complaint is filed and the specific allegations made.

Exculpation Provisions. We recommend a prompt review of the BRFG certificate of incorporation to confirm the existence and scope of any exculpation clause adopted pursuant to 8 Del. C. § 102(b)(7). Section 102(b)(7) permits Delaware corporations to include in their certificates of incorporation a provision eliminating or limiting the personal monetary liability of directors for breaches of the duty of care. However, exculpation under Section 102(b)(7) does not extend to: (i) breaches of the duty of loyalty; (ii) acts or omissions not in good faith or involving intentional misconduct or a knowing violation of law; (iii) liability under Section 174 of the Delaware General Corporation Law (relating to unlawful dividends); or (iv) any transaction from which the director derived an improper personal benefit.

Critically, Caremark oversight liability sounds in good faith and, under Stone v. Ritter, is classified as a duty-of-loyalty claim. As such, Caremark claims are not exculpable under Section 102(b)(7). This means that even if BRFG's certificate of incorporation contains a 102(b)(7) exculpation provision, that provision will not bar damages claims against directors based on oversight failures.

Indemnification. We also recommend a review of the BRFG bylaws and any separate indemnification agreements entered into between the corporation and individual directors and officers. The scope of the indemnification provisions — including the obligation of the corporation to advance defense costs pending the final disposition of any proceeding — is critical to ensuring that directors and officers are adequately protected while the litigation risks identified herein remain pending. We note that under Delaware law, a corporation may not indemnify a director who is found to have acted in bad faith or in a manner the

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
MEMORANDUM
To: Board of Directors, Belmont Ridge Financial Group, Inc.; Gregory Nardone, Esq., General Counsel & Corporate Secretary, Belmont Ridge Bank National Association
From: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group; Yuki Nakamura, Lead Associate, Litigation (General) Practice Group
Date: February 14, 2025
Re: Analysis of Director and Officer Liability Exposure in Connection with OCC Consent Order No. OCC-2025-003 — BSA/AML and Sanctions Compliance Deficiencies
Matter No.: 1045-00002
Classification: Attorney-Client Privileged; Attorney Work Product — Prepared in Anticipation of Litigation
Right-click to update Table of Contents
I. Executive Summary
This memorandum has been prepared at the request of the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG") and Gregory Nardone, General Counsel and Corporate Secretary of Belmont Ridge Bank National Association ("BRB" or the "Bank"), to assess the individual liability exposure of directors and officers of BRB (OCC Charter No. 48271; FDIC Certificate No. 31845) and its holding company, BRFG (a Delaware corporation; NYSE: BRFG), arising from OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025.
The Consent Order identifies five core deficiency categories in BRB's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") sanctions compliance program: (i) OFAC sanctions screening failures in fintech Banking-as-a-Service ("BaaS") channels, specifically involving the NovaPay partnership; (ii) Suspicious Activity Report ("SAR") filing deficiencies, including an approximate 2,400-alert backlog; (iii) Customer Due Diligence/Enhanced Due Diligence ("CDD/EDD") failures across approximately 47,000 high-risk accounts; (iv) model validation failures with respect to the Veridian Transaction Monitoring System version 8.3 ("Veridian TMS v.8.3"); and (v) board-level oversight deficiencies, including the absence of a dedicated compliance committee and inadequate BSA/AML performance reporting to the Board. The OCC assessed a civil money penalty of $14,500,000 against the institution, due March 16, 2025. The total remediation outlay, inclusive of the Board-approved $42.5 million remediation budget and the $14.5 million CMP, is estimated at $57.0 million.
The key risk areas for individual directors and officers that are analyzed in this memorandum include: (a) personal civil money penalties under 12 U.S.C. § 1818(i); (b) removal and prohibition proceedings under 12 U.S.C. § 1818(e); (c) shareholder derivative litigation under Delaware law; and (d) potential securities fraud exposure under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934.
Summary Assessment. The risk of individual regulatory enforcement action by the OCC is currently assessed as moderate but elevated. While the Consent Order is directed at the institution and no individual enforcement proceedings have been initiated as of this date, the three-year escalation from an initial Matter Requiring Attention ("MRA") in June 2022 to a Matter Requiring Immediate Attention ("MRIA") in November 2023, and ultimately to the Consent Order in January 2025, creates a supervisory record that could support individual actions — particularly against the BSA Officer, the CEO, and directors who chaired relevant oversight committees during the entire relevant period. The risk of shareholder derivative litigation is assessed as significant, given the stock price decline of approximately 13.9% (from approximately $47.82 per share to $41.15 per share on January 16, 2025, the first trading day following public disclosure of the Consent Order) and the $57.0 million total remediation outlay. The aggregate market capitalization loss on the date of disclosure was approximately $1.197 billion. These figures, combined with the Consent Order's specific criticisms of board-level oversight, provide a factual foundation for Caremark-based fiduciary duty claims that could survive a motion to dismiss. Securities class action risk is assessed as moderate-to-high, consistent with historical patterns following significant enforcement actions against publicly traded financial institutions accompanied by material stock declines.
The named current Board members whose potential liability exposure is analyzed herein are:
•  Diane Whitford, Chair of the Board and Chief Executive Officer
•  Arthur Connelly, Lead Independent Director and Risk Committee Chair
•  Margaret Dao, Audit Committee Chair
•  James Rutherford, Compliance Committee Chair (newly created pursuant to the Consent Order)
•  Sandra Villarreal, Independent Director
•  Keith Yamamoto, Independent Director
The named current officers with potential exposure are:
•  Raymond Okoye, President and Chief Operating Officer
•  Samantha Reeves, Chief Financial Officer
•  Gregory Nardone, General Counsel and Corporate Secretary
•  Patricia Langston, Chief Compliance Officer (appointed January 2024)
•  Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023)
•  Melissa Chu, Chief Risk Officer
•  Warren Ashby, Head of Fintech Partnerships and BaaS Division
•  Linda Petrosian, Chief Information Officer and Chief Technology Officer
•  Derek Ballard, Head of Internal Audit
The D&O insurance adequacy for the institution and all named individuals requires immediate review, and this memorandum sets forth specific recommendations for coverage analysis, notice obligations, and potential supplemental coverage procurement. The sections that follow provide a detailed factual background, a comprehensive analysis of the applicable legal framework, an individual exposure assessment matrix for each director and officer, and prioritized recommendations for mitigating the risks identified herein.
II. Factual Background
A. Institutional Profile
Belmont Ridge Bank National Association is a national banking association chartered under 12 U.S.C. § 21 et seq., with OCC Charter No. 48271 and FDIC Certificate No. 31845. The Bank's RSSD ID is 1247893. BRB is a wholly-owned subsidiary of Belmont Ridge Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange under the ticker symbol "BRFG." The employer identification numbers are 83-2947561 (BRFG) and 13-6148320 (BRB), respectively.
The Bank is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. As of February 7, 2025, BRFG had approximately 179.5 million shares of common stock outstanding and an aggregate market capitalization of approximately $8.58 billion based on a closing share price of $47.82.
BRB operates four core business lines: retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service ("BaaS") partnerships. As of the date of this memorandum, BRB maintains active BaaS relationships with fourteen fintech sponsor companies. The BaaS business line generated revenue of approximately $127.4 million during calendar year 2024, representing a material and growing component of the Bank's overall revenue base. The significance of this revenue stream underscores the business model risk attendant to any curtailment of BaaS partner relationships resulting from the Consent Order or associated remediation activities.
The Bank employs approximately 5,800 individuals across all business lines and functions. Prior to the commencement of remediation activities, the BSA/AML department comprised sixty-two full-time equivalent employees ("FTEs"). As discussed in greater detail in Section VII below, the Bank's remediation plan contemplates a substantial increase in BSA/AML staffing through both permanent hires and temporary contractor engagements.
B. Supervisory History and Escalation
The supervisory history leading to the Consent Order reflects a pattern of escalating regulatory concern over a period of approximately three years. A comprehensive understanding of this timeline is critical to the individual liability analysis because the duration and progression of unresolved supervisory findings bear directly on whether particular directors and officers demonstrated "continuing disregard" for the safety and soundness of the institution — the standard applicable to removal and prohibition proceedings under 12 U.S.C. § 1818(e) — and whether "red flags" were sufficiently addressed for purposes of Caremark oversight liability analysis.
The key supervisory events are set forth in chronological order below:
March 2021: Last Independent Model Validation of Veridian TMS v.8.3. The last independent validation of the Veridian Transaction Monitoring System version 8.3, the Bank's primary automated transaction monitoring platform, was completed in March 2021 — more than three years before the commencement of the OCC's targeted examination. This gap significantly exceeds the OCC's supervisory expectations for model validation frequency, which generally call for independent validation at least annually for high-risk models and no less frequently than every two years for all models used in BSA/AML compliance. The absence of a current validation during the period of rapid growth in BaaS transaction volumes is a central focus of the Consent Order's findings.
June 2022: OCC Issues Matter Requiring Attention (MRA). The OCC issued an MRA directed at BSA/AML transaction monitoring deficiencies. The MRA identified concerns with the calibration and effectiveness of transaction monitoring scenarios and recommended that the Bank conduct a comprehensive review of its transaction monitoring system parameters. At this time, the Board was informed of the MRA through existing reporting channels. The MRA represented the initial formal supervisory finding and the first clear "red flag" in the supervisory record.
October 2022: Last Tuning of Veridian TMS v.8.3 Parameters. The last adjustment to the Veridian TMS v.8.3 monitoring parameters was completed in October 2022, approximately four months after the MRA was issued. It does not appear that this tuning exercise was performed as a comprehensive response to the MRA's findings; rather, available documentation suggests it was a routine periodic adjustment. No independent validation accompanied this tuning exercise.
November 2023: OCC Issues Matter Requiring Immediate Attention (MRIA). Approximately seventeen months after the initial MRA, and following a determination that the MRA had not been satisfactorily addressed, the OCC escalated its concerns by issuing an MRIA regarding OFAC sanctions screening gaps. The MRIA specifically identified deficiencies in the Bank's screening of transactions processed through BaaS channels — the same deficiency category that features prominently in the Consent Order. The escalation from MRA to MRIA is significant because it reflects the OCC's determination that the prior concerns had not been adequately remediated and that the matter required immediate corrective action. The MRIA was communicated to the Board.
January 2024: Appointment of Patricia Langston as Chief Compliance Officer. In response to the MRIA and the growing supervisory pressure, BRB appointed Patricia Langston as Chief Compliance Officer. Ms. Langston was brought in specifically to strengthen the compliance function and address the deficiencies identified by the OCC. Her relatively short tenure — approximately one year prior to the issuance of the Consent Order — is a relevant mitigating factor in assessing her individual liability exposure, though it does not eliminate such exposure entirely.
March 2024 – September 2024: OCC Targeted BSA/AML Examination. The OCC commenced a targeted BSA/AML examination of BRB in March 2024. The examination was conducted under the direction of Jonathan Frey, National Bank Examiner, from the OCC Northeastern District Office located at 340 Madison Avenue, New York, New York 10017. The examination extended through September 2024 — a duration of approximately six months, reflecting the breadth and severity of the issues identified.
September 2024: Caldera & Pope LLP Independent BSA/AML Testing Completed. In September 2024, concurrently with the conclusion of the OCC's targeted examination, BRB's independent testing firm, Caldera & Pope LLP (Franklin Dorsey, engagement partner), completed its independent BSA/AML testing. The Caldera & Pope report identified multiple deficiencies that echoed the findings subsequently included in the Consent Order. The Caldera & Pope findings were reported to the Audit Committee (chaired by Margaret Dao). The timing and substance of these findings are relevant to the liability analysis because they represent an independent third-party confirmation of the compliance program deficiencies that was available to the Board prior to the formal issuance of the Consent Order.
January 15, 2025: OCC Consent Order No. OCC-2025-003 Issued. The OCC issued the Consent Order, which is the subject of this memorandum. The Consent Order assessed a civil money penalty of $14,500,000 against the institution and required comprehensive corrective actions across all five deficiency categories identified above. The Consent Order was directed at BRB as an institution; no individual directors or officers were named.
January 2025: Termination of Prior Outside Counsel Engagement. Following issuance of the Consent Order, BRB terminated its engagement with Drayton Mercer LLP, which had served as outside regulatory counsel during the 2023–2024 OCC examination cycle. The lead partner at Drayton Mercer was Helen Frazier. BRB subsequently engaged Calderwood & Harkness LLP (this firm) effective February 10, 2025.
In addition to the OCC, the Financial Crimes Enforcement Network ("FinCEN") is monitoring the Bank's BSA/AML compliance. Angela Drummond, Associate Director, Enforcement Division, FinCEN, has been identified as the FinCEN point of contact. FinCEN has reserved its enforcement rights pursuant to its coordination with the OCC; however, no separate FinCEN enforcement action has been initiated as of February 10, 2025. It should also be noted that, as of February 10, 2025, no criminal referral to the United States Department of Justice has been made. However, the Consent Order does not preclude such a referral in the future, and the possibility of a criminal referral — while currently assessed as remote — cannot be entirely excluded, particularly depending on the findings that may emerge from the SAR lookback exercise and the CDD/EDD remediation project.
C. Consent Order Deficiency Categories
The Consent Order identifies five core deficiency categories in the Bank's BSA/AML and OFAC sanctions compliance program. Each category is summarized below, as a detailed understanding of the specific deficiencies is essential to the individual liability analysis that follows.
1. OFAC Sanctions Screening Failures. The Consent Order found that BRB failed to screen a significant volume of transactions processed through its BaaS channel for compliance with OFAC sanctions requirements. Specifically, approximately 12% of NovaPay wire and ACH transactions — equating to approximately 3,800,000 out of 31,700,000 total NovaPay transactions processed during calendar year 2023 — were not screened against the OFAC Specially Designated Nationals and blocked Persons ("SDN") List or other applicable sanctions lists. The failure to screen these transactions created the risk that the Bank processed transactions involving sanctioned persons, countries, or entities without detection, constituting potential violations of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act ("TWEA"), and the regulations administered by OFAC. This deficiency is concentrated in the BaaS division under the operational oversight of Warren Ashby, Head of Fintech Partnerships and BaaS Division, and implicates the technology infrastructure maintained under the direction of Linda Petrosian, CIO/CTO.
2. SAR Filing Deficiencies. The Consent Order identified a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, the conclusion of the examination period. In addition, for SARs that were filed, the average time from alert generation to SAR filing was approximately 78 days, far exceeding the regulatory expectation of filing within 30 calendar days of the initial detection of a potentially reportable transaction (or within 60 days if no suspect is identified at the time of initial detection). The SAR filing deficiencies are directly within the operational responsibility of Thomas Ikeda, BSA Officer and AML Program Director, and reflect the combined effects of understaffing, inadequate transaction monitoring system calibration, and insufficient management oversight.
3. CDD/EDD Failures. The Consent Order found that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BaaS channels — lacked adequate CDD and EDD documentation. The FinCEN CDD Rule (31 C.F.R. § 1010.230) requires covered financial institutions to identify and verify the identity of the beneficial owners of legal entity customers at the time of account opening and to maintain updated customer profiles based on the institution's risk assessment. The failure to collect and maintain adequate documentation for 47,000 high-risk accounts represents a systemic breakdown in the Bank's customer onboarding and ongoing monitoring processes, concentrated in the BaaS division.
4. Model Validation Failures. As noted above, the Veridian TMS v.8.3 had not been independently validated since March 2021 — a gap of more than three years prior to the examination. The last tuning of the system's monitoring parameters occurred in October 2022. Given the significant growth in BaaS transaction volumes during the intervening period and the evolving nature of money laundering typologies, the absence of current model validation created a material risk that the transaction monitoring system was not effectively calibrated to detect suspicious activity. The Consent Order cites this deficiency as contributing to both the SAR backlog and the OFAC screening failures.
5. Board-Level Oversight Deficiencies. The Consent Order specifically criticizes the Bank's board-level governance and oversight of its BSA/AML compliance program. Key findings include: (a) the absence of a dedicated Compliance Committee at the Board level, requiring the Board to address BSA/AML matters through its existing committee structure, which proved inadequate; (b) Board-level BSA/AML reporting on a quarterly-only basis that lacked key performance metrics, including SAR volumes and filing timeliness, OFAC screening hit rates, BaaS partner risk ratings, and alert aging and disposition data; and (c) the failure of the Board to ensure adequate resources and management attention were devoted to BSA/AML compliance in light of the Bank's rapidly growing BaaS business line. These board oversight findings are of central importance to the individual liability analysis because they directly implicate the fiduciary duties of each director who served during the relevant period.
D. Financial Impact
The financial impact of the Consent Order and associated remediation is substantial by any measure. The civil money penalty assessed against the institution is $14,500,000, payable by March 16, 2025. The Board has approved a comprehensive remediation budget of $42,500,000, exclusive of the CMP. The total estimated outlay is therefore $57,000,000. Relative to BRB's fiscal year 2024 net income of $412 million, the total remediation outlay represents approximately 13.8% of annual earnings — a material figure that must be disclosed in the Bank's regulatory filings and BRFG's SEC filings.
The market reaction to the public disclosure of the Consent Order was swift and significant. On January 16, 2025 — the first trading day following the issuance of the Consent Order — BRFG's stock price declined from approximately $47.82 per share to $41.15 per share, a decline of $6.67 per share, or approximately 13.9%. With approximately 179.5 million shares of common stock outstanding, the aggregate market capitalization loss on the disclosure date was approximately $1.197 billion. This magnitude of stock price decline is a significant factor in assessing the likelihood of securities fraud class action litigation, as it represents the kind of "corrective disclosure" event that typically triggers investor lawsuits.
Among the Bank's significant shareholders, Brindoval Capital Partners LP is of particular note. Brindoval, whose Managing Partner is Julian Whitmore, holds approximately 8.3% of BRFG's outstanding common stock — approximately 14.9 million shares. Brindoval has expressed concern regarding remediation costs, potential additional enforcement fines, and the reputational impact of the Consent Order on the Bank's franchise value. Brindoval is represented by Amberly Knox LLP (Steven Briggs, Partner, 600 Third Avenue, New York, New York 10016). Given the size of its stake and its expressed concerns, Brindoval is a potential lead plaintiff in any securities class action and a potential catalyst for shareholder derivative litigation. The Bank and BRFG should expect continued engagement from Brindoval and its counsel.
Finally, the BaaS revenue contribution of $127.4 million during calendar year 2024 underscores the business model risk inherent in the deficiencies identified by the Consent Order. If BaaS partner relationships are curtailed — whether by regulatory mandate, partner attrition, or reputational concerns — the resulting revenue loss would compound the financial impact of the Consent Order and could give rise to additional claims regarding the Board's oversight of the BaaS growth strategy.
III. Legal Framework: Federal Banking Law Liability Exposure
This section analyzes the principal federal banking law and related statutory frameworks under which individual directors and officers of BRB and BRFG may face personal liability in connection with the matters identified in the Consent Order. The analysis addresses civil money penalties, removal and prohibition proceedings, cease-and-desist proceedings, and personal liability under the Bank Secrecy Act.
A. Civil Money Penalties Against Individuals — 12 U.S.C. § 1818(i)
The OCC possesses broad statutory authority under 12 U.S.C. § 1818(i) to assess civil money penalties ("CMPs") not only against depository institutions but also against "institution-affiliated parties" ("IAPs") individually. The term "institution-affiliated party" is defined in 12 U.S.C. § 1813(u) to include, among others: (1) any director, officer, employee, or controlling stockholder of, or agent for, an insured depository institution; (2) any other person who has filed or is required to file a change-in-bank-control notice under 12 U.S.C. § 1817(j); (3) any shareholder, consultant, joint venture partner, or other person who participates in the conduct of the affairs of the institution; and (4) any independent contractor who knowingly or recklessly participates in any violation of law, unsafe or unsound practice, or breach of fiduciary duty. All of the named directors and officers of BRB fall squarely within the definition of IAP, and each is therefore subject to the OCC's individual CMP authority.
The statute establishes a three-tiered penalty structure of escalating severity, corresponding to increasingly culpable conduct:
1. Tier 1 Penalties — 12 U.S.C. § 1818(i)(2)(A)
Tier 1 penalties are available for any violation of a law, rule, regulation, or any condition imposed in writing by the OCC, including any condition or requirement of a consent order. The statute authorizes the assessment of a CMP against any IAP for such a violation. The maximum Tier 1 penalty amount is currently approximately $11,000 per day for each day during which the violation continues, subject to annual inflation adjustments published in the Federal Register by the OCC.
The relevance of Tier 1 penalties to the current matter is primarily forward-looking. If any individual director or officer of BRB fails to comply with the specific provisions and requirements of the Consent Order — including the remediation timelines, reporting obligations, and governance mandates — personal Tier 1 penalties could attach to the responsible individual. The Consent Order imposes numerous specific obligations with defined deadlines (e.g., CMP payment by March 16, 2025; SAR backlog status report by March 31, 2025; Remediation Action Plan submission by May 15, 2025; completion of SAR lookback by August 15, 2025; full implementation by February 15, 2026, with self-certification). Each director and officer with responsibility for any aspect of compliance with these requirements is potentially subject to daily Tier 1 penalties for any failure to meet the specified deadlines.
2. Tier 2 Penalties — 12 U.S.C. § 1818(i)(2)(B)
Tier 2 penalties require a higher threshold of culpability. The OCC must demonstrate that the IAP's violation, reckless engagement in an unsafe or unsound practice, or breach of fiduciary duty meets one or more of the following conditions: (a) the violation, practice, or breach was part of a pattern of misconduct; (b) the violation, practice, or breach caused or is likely to cause more than a minimal loss to the institution; or (c) the violation, practice, or breach resulted in pecuniary gain or other benefit to the IAP. The maximum Tier 2 penalty is approximately $55,000 per day for each day during which the violation, practice, or breach continues or has not been corrected.
The applicability of Tier 2 penalties to BRB directors and officers warrants careful analysis. Several factors support the OCC's potential ability to establish the Tier 2 elements:
•  Pattern of Misconduct. The escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) over a period of approximately two and a half years constitutes, on its face, a pattern of repeated and escalating supervisory findings related to BSA/AML compliance deficiencies. The fact that the same or similar deficiencies persisted across multiple supervisory interactions — and that the MRA was not satisfactorily remediated before the MRIA was issued — could support an argument that the directors and officers responsible for addressing these matters engaged in a "pattern of misconduct" within the meaning of the statute. This argument would be strongest as applied to individuals who served in relevant positions throughout the entire period.
•  More Than Minimal Loss. The total remediation cost of $57.0 million (including the $14.5 million CMP) far exceeds the "more than minimal loss" threshold contemplated by the statute. The OCC and courts have interpreted this standard broadly, and there is no question that losses of this magnitude satisfy the element.
•  Pecuniary Gain. We are not currently aware of any evidence suggesting that individual directors or officers derived personal pecuniary gain from the BSA/AML compliance deficiencies. However, this element could potentially be implicated if, for example, compensation decisions were influenced by the cost savings associated with underinvestment in compliance, or if bonuses were tied to BaaS revenue growth that was achieved in part through inadequate compliance controls. Compensation committee records should be reviewed to assess this risk.
The individual exposure of each named director and officer under Tier 2 varies based on their specific role, tenure during the relevant period, and the extent of their knowledge of unresolved MRA and MRIA findings. A director-by-director and officer-by-officer assessment is provided in Section VI below.
3. Tier 3 Penalties — 12 U.S.C. § 1818(i)(2)(C)
Tier 3 penalties represent the most severe tier of civil money penalties and are reserved for the most culpable conduct. The OCC must establish that the IAP committed a knowing violation or acted with reckless disregard for the applicable law, regulation, or condition, and that such knowing or reckless violation caused or is likely to cause a substantial loss to the institution or a substantial pecuniary gain to the IAP. The maximum Tier 3 penalty is approximately $2,200,000 per day — a figure that, if imposed for even a limited duration, would represent a devastating personal financial consequence.
Assessment. Tier 3 exposure for the named directors and officers is currently assessed as low. As of the date of this memorandum, we have not identified evidence of knowing misconduct by any individual — that is, evidence that a director or officer knew that specific BSA/AML program operations were in violation of law and deliberately chose to permit the violation to continue. However, we note that this assessment cannot be treated as final for several important reasons. First, the Thornfield Consulting Group LLC preliminary gap assessment, which is due by April 15, 2025, may reveal additional facts bearing on individual knowledge and intent. Second, and more significantly, the SAR lookback exercise (budgeted at $5.5 million) and the CDD/EDD remediation project (budgeted at $4.3 million) are likely to generate substantial volumes of documentation and data that could alter the analysis. If the SAR lookback reveals, for example, that transaction monitoring alerts were deliberately suppressed or that specific individuals directed the non-filing of SARs involving known suspicious activity, the Tier 3 exposure assessment would change materially. We will update this analysis as these projects progress.
B. Removal and Prohibition Proceedings — 12 U.S.C. § 1818(e)
The OCC has the authority under 12 U.S.C. § 1818(e) to remove any IAP from office or to prohibit any IAP from further participation in the conduct of the affairs of any insured depository institution, any company that controls an insured depository institution, or any institution-related entity. A removal or prohibition order under Section 1818(e) — commonly referred to as an "industry bar" — represents the most severe administrative sanction available to the OCC short of revoking an institution's charter, and effectively ends an individual's career in the banking industry.
Section 1818(e) requires the OCC to establish three elements:
(1) Misconduct Element: The IAP has (a) directly or indirectly violated any law, rule, regulation, consent order, condition imposed in writing, or written agreement; (b) engaged or participated in any unsafe or unsound practice in connection with the institution; or (c) committed or engaged in any act, omission, or practice constituting a breach of fiduciary duty.
(2) Culpability Element: The violation, practice, or breach involves (a) personal dishonesty on the part of the IAP, or (b) demonstrates willful or continuing disregard by such party for the safety and soundness of the institution.
(3) Effect Element: By reason of the violation, practice, or breach, the institution has suffered or will probably suffer financial loss or other damage, the interests of the institution's depositors have been or could be prejudiced, or the IAP received financial gain or other benefit.
All three elements must be satisfied for the OCC to sustain a removal or prohibition order. The misconduct and effect elements are relatively straightforward on the facts presented here. The critical analytical question, therefore, is whether the OCC can satisfy the culpability element — and specifically, whether the conduct of particular directors and officers demonstrates "willful or continuing disregard" for the safety and soundness of the institution.
Analysis of the "Continuing Disregard" Standard. The federal banking agencies and administrative law judges have interpreted "continuing disregard" to mean conduct that involves a conscious, voluntary disregard for the safety and soundness of the institution — something more than negligence but less than affirmative intent to harm. The standard may be satisfied by evidence that an individual was repeatedly informed of risks or deficiencies but failed to take reasonable corrective action over a sustained period. Notably, actual knowledge of the specific legal violation is not required; rather, the question is whether the individual was aware of circumstances that should have prompted action and chose, consciously or through deliberate indifference, not to act.
The three-year supervisory escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025), combined with the Consent Order's specific finding of board-level oversight deficiencies, provides a factual predicate that could support a "continuing disregard" argument against certain directors and officers who served throughout the relevant period. The fact that the MRA was not fully remediated before the MRIA was issued, and that the MRIA was not fully remediated before the examination culminated in the Consent Order, suggests a sustained failure to take corrective action in response to known regulatory concerns.
Identification of Individuals with Elevated Removal Risk. Based on the facts currently available, the following individuals are assessed as having the most elevated risk profile with respect to potential removal or prohibition proceedings:
•  Diane Whitford (CEO & Board Chair): Ms. Whitford holds the highest-profile dual role at the institution and served throughout the entire MRA-MRIA-Consent Order sequence. As both CEO and Board Chair, she bears ultimate management and governance authority over the institution. The Consent Order's findings regarding board-level oversight failures — including the absence of a Compliance Committee and inadequate BSA/AML reporting — occurred under her leadership. Her dual role also eliminates the independent check that would exist where the Board Chair and CEO positions are separated, which may be viewed unfavorably by the OCC in assessing whether the Board's governance structure contributed to the oversight failures.
•  Arthur Connelly (Lead Independent Director & Risk Committee Chair): Mr. Connelly has direct oversight responsibility for enterprise risk, which encompasses BSA/AML compliance risk. He served throughout the entire relevant period. The Consent Order's findings regarding inadequate board-level reporting of BSA/AML metrics fall directly within the purview of his committee responsibilities. The question of whether the Risk Committee received adequate information and, if so, whether it took sufficient action in response is central to Mr. Connelly's individual exposure.
•  Margaret Dao (Audit Committee Chair): Ms. Dao bears oversight responsibility for the internal audit function (headed by Derek Ballard) and for the engagement and oversight of external auditors and independent testers, including Caldera & Pope LLP (Franklin Dorsey, engagement partner). The Caldera & Pope independent testing completed in September 2024 identified multiple deficiencies that subsequently appeared in the Consent Order. The critical question for Ms. Dao's exposure is whether the Audit Committee adequately acted on the Caldera & Pope findings or whether those findings were insufficiently escalated or addressed.
•  Patricia Langston (Chief Compliance Officer): Ms. Langston was appointed in January 2024 specifically to address compliance deficiencies identified in the MRA and MRIA. Her tenure at the time of the Consent Order's issuance was approximately one year. While this shorter tenure is a mitigating factor, the Consent Order findings relate to deficiencies that persisted during her tenure, and she bears the title and functional responsibility for the compliance program. The OCC could view her as the officer specifically charged with remediating the identified issues and assess that insufficient progress was made during her first year.
•  Thomas Ikeda (BSA Officer / AML Program Director): Mr. Ikeda was appointed in March 2023, approximately nine months after the MRA and approximately eight months before the MRIA. As the statutorily designated BSA officer under 31 U.S.C. § 5318, he bears primary operational responsibility for the SAR filing process (where the 78-day average and 2,400-alert backlog were identified), the transaction monitoring system (where the validation gap was found), and the OFAC screening operations. His role carries heightened personal liability under both OCC and FinCEN enforcement authorities (discussed further below in Section III.D). Mr. Ikeda's exposure is assessed as among the highest of all named individuals.
•  Warren Ashby (Head of Fintech Partnerships / BaaS Division): Mr. Ashby has direct operational responsibility for the BaaS channel where the most significant OFAC screening failures (3.8 million unscreened NovaPay transactions) and CDD/EDD deficiencies (47,000 high-risk accounts, primarily BaaS-onboarded) were concentrated. The BaaS division processed approximately $74.3 billion in transaction volume during the relevant period. The concentration of the most severe deficiencies in Mr. Ashby's area of responsibility makes him a potential target for enforcement action.
Mitigating Factors. Several mitigating factors should be noted. Ms. Langston and Mr. Ikeda were brought into the institution specifically to address known deficiencies. Their relatively shorter tenures — one year and approximately twenty-two months, respectively, at the time of the Consent Order — should be considered in evaluating whether their conduct demonstrates "continuing disregard." Additionally, the establishment of the new Compliance Committee under the chairmanship of James Rutherford and the adoption of a comprehensive remediation program demonstrate that the Board has taken corrective action, which may reduce the likelihood that the OCC will pursue individual removal proceedings provided that remediation proceeds on schedule.
It is important to emphasize that no removal or prohibition proceedings have been initiated as of February 10, 2025. The Consent Order is directed at the institution, not at any individual. However, the OCC retains full discretion to pursue individual actions at any time, and the issuance of an institutional consent order does not preclude — and in some cases may precede — individual enforcement proceedings.
C. Cease-and-Desist Proceedings Against Individuals — 12 U.S.C. § 1818(b)
In addition to the CMP and removal authorities discussed above, the OCC has the authority under 12 U.S.C. § 1818(b) to issue cease-and-desist ("C&D") orders against individual IAPs for violations of law, regulation, or condition; unsafe or unsound practices; or breaches of fiduciary duty. The threshold for a cease-and-desist order directed at an individual is lower than for removal proceedings — it does not require a showing of personal dishonesty or willful or continuing disregard for safety and soundness. Rather, the OCC need only establish the underlying violation, practice, or breach, combined with a reasonable likelihood that the conduct will continue or recur absent an order.
The practical impact of an individual cease-and-desist order includes significant reputational harm, potential restrictions on the individual's duties and authority, and the creation of a public enforcement record that may serve as a stepping stone to further enforcement actions if the individual fails to comply with the terms of the C&D order. Violation of a cease-and-desist order can itself give rise to Tier 1 civil money penalties under Section 1818(i).
Assessment. The risk of individual cease-and-desist orders is assessed as moderate. The primary trigger for such proceedings would be a failure to meet the remediation timelines and requirements set forth in the Consent Order. If the Bank's remediation efforts fall behind schedule or are found to be inadequate during future OCC examinations, the OCC may determine that individual C&D orders are warranted to compel specific corrective actions by identified directors and officers. The risk increases materially if any individual continues to serve in a position where they bear responsibility for compliance functions that remain deficient.
D. Personal Liability Under Other Federal Statutes
Beyond the OCC's enforcement authorities under 12 U.S.C. § 1818, individual directors and officers face potential personal liability under additional federal statutes:
31 U.S.C. § 5321(a)(1): FinCEN Civil Penalty Authority. FinCEN possesses independent authority to impose civil penalties on individuals for willful violations of BSA reporting requirements, including the failure to file SARs and the failure to implement adequate BSA/AML programs. This authority is particularly relevant to Thomas Ikeda, as the designated BSA Officer, and potentially to any other officer who authorized or directed inadequate SAR filing practices. The word "willful" in this context has been interpreted by FinCEN and the courts to require only that the individual acted with knowledge that his or her conduct was unlawful, or with reckless disregard for whether the conduct was unlawful — a standard that may be met by evidence of sustained non-compliance with known regulatory expectations.
As noted above, FinCEN is actively monitoring the Bank's compliance through Angela Drummond, Associate Director, Enforcement Division, and has reserved its enforcement rights. The absence of a separate FinCEN enforcement action as of February 10, 2025 should not be interpreted as an indication that FinCEN will not pursue such action in the future. FinCEN's enforcement decisions are often informed by the findings that emerge from remediation activities, including SAR lookbacks and CDD/EDD remediation exercises.
31 U.S.C. § 5322: Criminal Liability. Willful violation of BSA requirements carries potential criminal penalties, including fines and imprisonment for up to five years (or up to ten years if the violation is committed while violating another federal law or as part of a pattern of criminal activity involving more than $100,000 in a twelve-month period). As of February 10, 2025, no criminal referral to the Department of Justice has been made. The Consent Order, however, does not preclude such a referral, and we note that the DOJ has demonstrated increased willingness in recent years to pursue criminal BSA/AML cases against individuals, particularly where the underlying facts involve sustained and systemic compliance failures.
We recommend maintaining vigilance regarding the possibility of a criminal referral. The SAR lookback exercise and the CDD/EDD remediation project may uncover evidence that, depending on its nature and severity, could prompt a referral. Any individual who learns of facts suggesting potential criminal exposure should be advised to retain personal criminal defense counsel immediately, and no such facts should be disclosed to third parties without prior coordination with counsel.
IV. Shareholder Derivative Litigation Risk
A. Breach of Fiduciary Duty Claims
BRFG is incorporated in the State of Delaware, and Delaware law therefore governs the fiduciary duties of the BRFG Board of Directors. Under Delaware law, directors owe the corporation and its stockholders two fundamental fiduciary duties: the duty of care and the duty of loyalty.
Duty of Care. The duty of care requires that directors exercise the level of care that an ordinarily careful and prudent person would use under similar circumstances. In the context of corporate governance, this duty requires directors to make informed business decisions by availing themselves of all material information reasonably available. The Consent Order's finding that Board-level BSA/AML reporting lacked key performance metrics — including SAR volumes and filing timeliness, OFAC screening hit rates, BaaS partner risk ratings, and alert aging data — and that no dedicated Compliance Committee existed to serve as a focused oversight body, directly implicates duty-of-care questions. If directors did not receive adequate information to monitor the Bank's BSA/AML compliance program, the question arises whether they fulfilled their duty to become reasonably informed about a material risk area. If they received such information but failed to act on it, the exposure may shift from a duty-of-care claim to a more severe oversight liability theory (discussed below).
Duty of Loyalty. The duty of loyalty requires that directors act in the best interests of the corporation and its stockholders, free from self-dealing, conflicts of interest, or bad faith. Absent evidence of personal financial interest or self-dealing transactions, standard duty-of-loyalty claims against the BRB/BRFG directors would be difficult to sustain on the facts currently known. However, duty-of-loyalty claims may be alleged in conjunction with Caremark oversight liability theories, as discussed immediately below, because Delaware courts have classified oversight liability as sounding in good faith — a subsidiary element of the duty of loyalty.
Caremark Oversight Liability. The most significant shareholder derivative litigation risk arises under the oversight liability framework established in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), as subsequently refined by the Delaware Supreme Court in Stone v. Ritter, 911 A.2d 362 (Del. 2006), and further developed in Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), and In re Harborview & Co. Derivative Litigation, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021).
Under Caremark, directors face potential personal liability for failure of oversight where the plaintiff establishes either: (a) that the directors utterly failed to implement any reporting or information system or controls (a "prong one" claim); or (b) that having implemented such a system or controls, the directors consciously failed to monitor or oversee the system's operations, thus disabling themselves from being informed of risks or problems requiring their attention (a "prong two" claim).
Caremark claims have historically been described as "possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment." However, in recent years — particularly following the Delaware Supreme Court's decision in Marchand v. Barnhill — courts have shown a greater willingness to allow Caremark claims to proceed past the motion-to-dismiss stage, especially in regulated industries where compliance is a "mission critical" function and where the company has experienced a compliance failure following identifiable "red flags" that were reported to the Board.
The facts of the present matter present a credible basis for Caremark claims under both prongs:
Prong One — Failure to Implement. The Consent Order's finding that BRB lacked a dedicated Board-level Compliance Committee and that the existing Board-level reporting on BSA/AML compliance was deficient in key metrics could support an argument that the Board failed to implement an adequate reporting and information system for monitoring BSA/AML compliance. While the Bank did have a BSA/AML compliance program and did report to the Board on a quarterly basis, the Consent Order's critique of the substance and scope of that reporting suggests that the system, as implemented, was materially deficient in design — a fact pattern that some courts have treated as sufficient to state a Prong One claim, particularly where the oversight gap relates to a "mission critical" compliance obligation for a financial institution.
Prong Two — Red Flags. Perhaps more significantly, the escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) constitutes a series of progressively severe "red flags" that were communicated to the Board. These are not subtle or ambiguous indicators — they are formal regulatory actions by the Bank's primary federal regulator. A plaintiff could argue that the Board received these red flags but failed to adequately respond to them, as evidenced by the fact that the deficiencies persisted and escalated over a two-and-a-half-year period. The Caldera & Pope independent testing results, reported to the Audit Committee in September 2024, represent an additional red flag from an independent third-party source that reinforced the OCC's findings.
The damages available in a derivative action for breach of fiduciary duty could be substantial. Potential measures of damages include the $57.0 million total remediation outlay (encompassing the $42.5 million remediation budget and the $14.5 million CMP), reputational harm to the institution, the cost of management distraction, and — depending on the theory of damages employed — some portion of the approximately $1.197 billion aggregate market capitalization decline on the date of disclosure.
The directors with the most elevated exposure to Caremark claims are those who served in relevant oversight capacities throughout the entire MRA-MRIA-Consent Order sequence. Specifically:
•  Diane Whitford (Chair & CEO) bears the highest exposure as the individual with ultimate management and governance authority throughout the relevant period, particularly given the combined Chair/CEO role.
•  Arthur Connelly (Risk Committee Chair) has elevated exposure because BSA/AML compliance risk is an enterprise risk that falls within the express purview of his committee.
•  Margaret Dao (Audit Committee Chair) has elevated exposure because the Audit Committee had oversight of both internal audit and the independent testing function that identified deficiencies.
Directors with less historical involvement — such as James Rutherford, Sandra Villarreal, and Keith Yamamoto — face lower but not insignificant exposure. Their liability depends on the specific facts regarding their tenure on the Board, their committee assignments during the relevant period, and the nature and detail of BSA/AML information that was presented to the full Board at regular meetings.
B. Securities Fraud Claims (Federal)
BRFG is a publicly traded company on the New York Stock Exchange with approximately 179.5 million shares of common stock outstanding and significant institutional ownership, including Brindoval Capital Partners LP at approximately 8.3%. The profile of a publicly traded financial institution that has been the subject of a significant regulatory enforcement action accompanied by a material stock price decline is a classic predicate for securities fraud class action litigation.
Section 10(b) and Rule 10b-5 Claims. Potential plaintiffs could allege that BRFG and its officers made materially misleading statements or omissions regarding the adequacy of the Bank's BSA/AML compliance program in SEC filings — including Forms 10-K, 10-Q, and proxy statements — during the period preceding the public disclosure of the Consent Order. Specifically, plaintiffs would likely contend that BRFG's public filings contained positive descriptions of its compliance program, risk management frameworks, and internal controls that were rendered materially misleading by the failure to disclose the known BSA/AML deficiencies, the escalating supervisory concerns, and the growing risk of a formal enforcement action. The stock price decline of approximately 13.9% (from $47.82 to $41.15) on January 16, 2025, would be characterized as a "corrective disclosure" event demonstrating that the market was misled by prior statements and that the stock was trading at an inflated price during the relevant period.
The elements of a Section 10(b) and Rule 10b-5 claim are: (1) a material misrepresentation or omission; (2) scienter; (3) a connection with the purchase or sale of a security; (4) reliance; (5) economic loss; and (6) loss causation. The stock price decline and market capitalization loss satisfy several of these elements on their face. The central battleground in any such litigation would be the scienter element — whether the officers who signed and certified the relevant SEC filings knew, or recklessly disregarded, that the BSA/AML compliance disclosures were materially misleading.
Scienter may be supported by the following facts in the record: (a) the prior MRA (June 2022) put management on formal notice of BSA/AML deficiencies; (b) the MRIA (November 2023) escalated the regulatory concern and provided unambiguous notice that the prior deficiencies had not been adequately remediated; (c) the Caldera & Pope independent testing results (September 2024) provided an independent confirmation of systemic compliance failures; and (d) the certifying officers (CEO and CFO) are presumed to have knowledge of material risks to the institution as part of their Sarbanes-Oxley certification obligations. Taken together, these facts could support a strong inference of scienter — the standard required to survive a motion to dismiss under the Private Securities Litigation Reform Act of 1995 ("PSLRA").
Section 20(a) Controlling Person Liability. In addition to direct claims under Section 10(b) and Rule 10b-5, individual officers face potential liability under Section 20(a) of the Securities Exchange Act of 1934 as "controlling persons" of BRFG. Section 20(a) imposes joint and several liability on any person who controls a person liable under the Exchange Act, unless the controlling person acted in good faith and did not directly or indirectly induce the act constituting the violation. The officers most exposed to controlling person liability are:
•  Diane Whitford (CEO) — as the chief executive officer and certifying officer, she is a classic controlling person defendant in a securities class action.
•  Raymond Okoye (President & COO) — as the president and chief operating officer, he exercises operational control over the Bank and is commonly named as a controlling person.
•  Samantha Reeves (CFO) — as the chief financial officer and SOX certifying officer, she is responsible for the accuracy of financial reporting and related disclosures. The materiality of the $57.0 million remediation outlay relative to the Bank's $412 million net income for fiscal year 2024 (approximately 13.8%) makes the adequacy of prior financial disclosure a central issue.
•  Gregory Nardone (General Counsel) — as general counsel, he has legal oversight of the compliance program, managed the relationship with former outside counsel Drayton Mercer LLP, and was involved in the preparation of SEC filings. While general counsel are not always named in securities class actions, Mr. Nardone's direct involvement in compliance matters and regulatory interactions may increase his exposure.
Likely Plaintiff Class. Plaintiffs would seek to certify a class of all persons who purchased or otherwise acquired BRFG common stock during a defined "class period." The class period would likely begin on or before the date of the November 2023 MRIA (when a plaintiff would argue that management first had actionable knowledge that the BSA/AML program was materially deficient) and end on January 16, 2025 (the date of the corrective disclosure). Alternatively, plaintiffs might extend the beginning of the class period earlier, to the June 2022 MRA, depending on the specific misrepresentations identified.
As noted in Section II.D above, Brindoval Capital Partners LP, holding approximately 8.3% of BRFG common stock (approximately 14.9 million shares), has expressed concerns regarding remediation costs and reputational impact and is represented by sophisticated securities litigation counsel at Amberly Knox LLP (Steven Briggs, Partner). Brindoval is a likely candidate to serve as lead plaintiff in any securities class action, given the size of its stake and the resulting presumption of typicality and adequacy under the PSLRA.
Overall Assessment. Securities fraud class action risk is assessed as moderate-to-high. Academic and empirical research consistently demonstrates that securities class actions are more likely to be filed following regulatory enforcement actions at publicly traded financial institutions, particularly where the enforcement action is accompanied by a stock price decline of 10% or more. The 13.9% decline here, combined with an aggregate market capitalization loss of approximately $1.197 billion, places the present matter well within the statistical range associated with securities litigation filings.
C. Procedural Considerations
Demand Futility. In a shareholder derivative action, the plaintiff must either make a pre-suit demand on the Board to pursue the claims or demonstrate that demand would be futile. Under the test set forth in Rales v. Blasband, 634 A.2d 927 (Del. 1993), and refined in United Food and Commercial Workers Union v. Zuckerberg, 262 A.3d 1034 (Del. 2021), the court examines whether, at the time the complaint is filed, a majority of the directors face a substantial likelihood of personal liability for the underlying claims such that they cannot be expected to exercise disinterested and independent judgment in response to a demand.
Given that the Consent Order specifically criticizes Board-level oversight, plaintiffs may argue that demand is futile because a majority of the current Board — particularly Whitford, Connelly, and Dao, who collectively served throughout the relevant period and chaired or led the governance bodies most directly implicated by the Consent Order — face a substantial likelihood of Caremark liability. If three of the six current Board members are deemed conflicted for purposes of the demand futility analysis, the Board lacks a disinterested majority, and demand would be excused. This analysis will depend on the precise composition of the Board at the time any complaint is filed and the specific allegations made.
Exculpation Provisions. We recommend a prompt review of the BRFG certificate of incorporation to confirm the existence and scope of any exculpation clause adopted pursuant to 8 Del. C. § 102(b)(7). Section 102(b)(7) permits Delaware corporations to include in their certificates of incorporation a provision eliminating or limiting the personal monetary liability of directors for breaches of the duty of care. However, exculpation under Section 102(b)(7) does not extend to: (i) breaches of the duty of loyalty; (ii) acts or omissions not in good faith or involving intentional misconduct or a knowing violation of law; (iii) liability under Section 174 of the Delaware General Corporation Law (relating to unlawful dividends); or (iv) any transaction from which the director derived an improper personal benefit.
Critically, Caremark oversight liability sounds in good faith and, under Stone v. Ritter, is classified as a duty-of-loyalty claim. As such, Caremark claims are not exculpable under Section 102(b)(7). This means that even if BRFG's certificate of incorporation contains a 102(b)(7) exculpation provision, that provision will not bar damages claims against directors based on oversight failures.
Indemnification. We also recommend a review of the BRFG bylaws and any separate indemnification agreements entered into between the corporation and individual directors and officers. The scope of the indemnification provisions — including the obligation of the corporation to advance defense costs pending the final disposition of any proceeding — is critical to ensuring that directors and officers are adequately protected while the litigation risks identified herein remain pending. We note that under Delaware law, a corporation may not indemnify a director who is found to have acted in bad faith or in a manner the

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts