Attachment: Access & Cooperation Protocol — Thornfield Consulting Group (access-cooperation-protocol.docx)
Dear Dr. Castellano,
I hope this finds you well. I want to thank you and the entire Thornfield team for the productive planning discussions we have had since the engagement agreement (TCG-BRB-2025-001) was executed on February 10, 2025. The efficiency and professionalism your team has brought to the mobilization process has been much appreciated by all parties.
I am writing to confirm logistics and coordination arrangements for the commencement of Thornfield's on-site assessment at Belmont Ridge Bank NA ("BRB") headquarters on March 1, 2025, as contemplated by the engagement agreement and required under Consent Order No. OCC-2025-003. As you know, the OCC's non-objection to Thornfield's engagement was received on February 5, 2025, and the engagement agreement was executed five days later. We are now well positioned to begin the substantive assessment work on schedule.
**I. On-Site Assessment Logistics**
The on-site assessment will commence on Saturday, March 1, 2025, consistent with the contractual commencement date set forth in the engagement agreement. On-site work will take place at:
Belmont Ridge Bank NA Headquarters 680 Lexington Avenue, 22nd Floor New York, NY 10022
BRB will provide dedicated workspace and conference room facilities for the Thornfield team throughout the on-site assessment period. Patricia Langston and her team are coordinating the physical setup and will ensure that the space is ready and fully equipped in advance of your arrival.
I would appreciate your confirming the names and expected arrival details of the on-site team members at your earliest convenience. Based on our prior discussions, we understand the core on-site team will include:
- **Dr. Vivian Castellano**, Managing Director, Financial Crimes Advisory (Engagement Lead) - **Robert Eastman**, Senior Director, AML Transaction Monitoring - **Jennifer Hwang**, Director, Sanctions & OFAC Compliance - **Nathaniel Burgess**, Director, Fintech & Payments Compliance
Please advise if additional Thornfield personnel will be on-site or if any team members will participate on a remote or hybrid basis so that we can coordinate building access credentials and IT provisioning accordingly.
**II. Access & Cooperation Protocol**
Attached to this email is the Access & Cooperation Protocol (access-cooperation-protocol.docx), which was drafted by Calderwood & Harkness and will govern Thornfield's access to BRB systems, personnel, records, and facilities during the engagement. I would ask that you and your team review the protocol carefully in advance of the on-site commencement. The protocol addresses the following key areas:
- **Document Request Procedures** — including standardized request forms and expected turnaround times for document production by BRB departments; - **Interview Scheduling** — the process for scheduling and conducting interviews of BRB personnel, including advance notice requirements and coordination with department heads; - **System Access and Information Security** — procedures for obtaining system access credentials, data handling requirements, and information security protocols, to be coordinated directly with Linda Petrosian, CIO/CTO; and - **Cooperation Obligations** — the specific cooperation expectations for key BRB departments and personnel throughout the assessment period.
For your reference, the primary BRB points of contact for Thornfield's on-site work are as follows:
| Contact
Additionally, Gregory Nardone, General Counsel and Corporate Secretary, will be available for any privilege-related questions that may arise during the course of the assessment. As a reminder, all requests for attorney-client privileged or work-product protected materials must be routed through Calderwood & Harkness, consistent with the Privilege & Confidentiality Side Letter executed among BRB, Calderwood & Harkness, and Thornfield.
**III. Scope of Work Reminders**
As set forth in Appendix A to the engagement agreement, Thornfield's assessment covers all five deficiency categories identified in the Consent Order:
1. **OFAC Sanctions Screening** — including the identified gap in BaaS channel transaction screening; 2. **SAR Filing Deficiencies** — including the backlog of approximately 2,400 unreviewed alerts and the 78-day average filing time; 3. **CDD/EDD Failures** — including the approximately 47,000 high-risk accounts lacking adequate enhanced due diligence documentation; 4. **Transaction Monitoring Model Validation** — with particular focus on the Veridian TMS v.8.3 system, which was last independently validated in March 2021 and last tuned in October 2022; and 5. **Board-Level Oversight Deficiencies** — including governance structures, reporting cadences, and management information adequacy.
As a reminder, the **preliminary gap assessment** is due from Thornfield by **April 15, 2025**, and the **final validation report** is due by **February 15, 2026**. The April 15 deliverable is particularly critical, as it will directly inform BRB's Comprehensive Remediation Action Plan (discussed further below).
I also want to note that the Board is on track to adopt its Resolution acknowledging the Consent Order and establishing a dedicated Compliance Committee, to be chaired by James Rutherford. The draft resolution is being finalized, and we expect formal adoption in advance of the **February 28, 2025** deadline. We will circulate the executed resolution to you and your team promptly upon adoption.
**IV. Proposed Bi-Weekly Status Call Schedule**
To ensure coordinated communication among all parties throughout the assessment and remediation process, I propose that we establish a regular bi-weekly status call involving Calderwood & Harkness, Thornfield, and key BRB personnel. I would suggest scheduling the first call for the week of March 10, 2025, following the first week of on-site work, and adopting a recurring schedule of every other Wednesday at 2:00 PM ET thereafter.
The proposed standing participants would be:
- Philip Hartmann (Calderwood & Harkness, Responsible Partner) - Yuki Nakamura (Calderwood & Harkness, Lead Associate) - Dr. Vivian Castellano (Thornfield, Engagement Lead) - Patricia Langston (BRB, Chief Compliance Officer) - Thomas Ikeda (BRB, BSA Officer)
Additional participants — including Gregory Nardone, other Thornfield team members, or BRB personnel — may join as needed depending on the topics under discussion for a given call. We will circulate an agenda and brief status summary in advance of each call to ensure productive use of everyone's time. Please let me know if the proposed day and time work for your team, or if you have an alternative preference.
**V. Reporting to the OCC**
As a reminder, Thornfield's assessment work will ultimately support BRB's **Comprehensive Remediation Action Plan**, which is due to the OCC by **May 15, 2025**. The timely completion of Thornfield's preliminary gap assessment by the April 15 deadline is essential to informing and finalizing that plan.
I also want to reiterate, consistent with the Oversight & Communication Protocol Memorandum, that all external communications with the OCC — including with Jonathan Frey, National Bank Examiner, Examiner-in-Charge at the OCC Northeastern District Office — must be coordinated through Calderwood & Harkness. Should any member of the Thornfield team receive a direct inquiry from the OCC or its examiners, please route that communication to me or Yuki Nakamura immediately so that we can respond in a coordinated manner.
**VI. Near-Term Milestones**
For ease of reference, the immediately upcoming deadlines are as follows:
- **February 28, 2025** — Board Resolution (acknowledging Consent Order; establishing Compliance Committee) - **March 1, 2025** — Thornfield on-site assessment commencement - **March 16, 2025** — $14.5 million civil money penalty payment due to U.S. Treasury - **March 31, 2025** — Interim SAR backlog status report due to OCC - **April 15, 2025** — Thornfield preliminary gap assessment due
**VII. Closing**
We are grateful for Thornfield's prompt mobilization and the depth of expertise your team brings to this engagement. I am confident that the collaborative working relationship we have established will serve BRB well as we move through the assessment and remediation process.
At your convenience, I would appreciate your confirming the following:
1. Receipt of this email and the attached Access & Cooperation Protocol; 2. The finalized on-site team roster, including arrival details and any remote participation arrangements; and 3. Your preferred day and time for the bi-weekly status calls.
For day-to-day scheduling, document coordination, and logistical matters, please feel free to reach out directly to **Yuki Nakamura** (ynakamura@calderwoodharkness.com), who will serve as the primary Calderwood & Harkness contact for those purposes.
Finally, if it would be helpful for your team, I am happy to arrange a brief introductory call before March 1 to address any remaining questions or logistical needs. Please do not hesitate to let me know.
I look forward to working with you and the Thornfield team.
With best regards,
**Philip Hartmann** Partner, Banking & Finance Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Tel: (212) 506-4100 (direct) Email: phartmann@calderwoodharkness.com C&H Matter No. 1045-00002
---
*CONFIDENTIALITY NOTICE: This email message and any attachments are for the sole use of the intended recipients and contain information that is privileged, confidential, and/or exempt from disclosure under applicable law, including attorney-client privilege and attorney work-product doctrine. If you are not an intended recipient, you are hereby notified that any review, disclosure, copying, distribution, or use of this email or any attachment is strictly prohibited. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete all copies of this message and any attachments. Thank you.*