Dear Patricia,
I hope this finds you well. I am writing in coordination with Philip Hartmann regarding the CDD/EDD remediation workstream in connection with Belmont Ridge Bank's BSA/AML and sanctions compliance-program uplift under OCC Consent Order No. OCC-2025-003 (C&H Matter No. 1045-00002).
We are now approximately two months into the engagement (since our formal kickoff on February 10, 2025) and approaching the midpoint of Phase 1, which runs through the May 15, 2025 deadline for submission of the Remediation Action Plan to the OCC. As you know, Thornfield Consulting Group's preliminary gap assessment is due next Tuesday, April 15. Before that deliverable arrives, we would like to ensure that the CDD/EDD workstream status is current and fully aligned across all parties so that we are well-positioned to respond to any findings or recommendations Thornfield may raise. With that context in mind, I have several questions and discussion points below.
**1. Current Status of CDD/EDD Remediation (Workstream 3)**
As outlined in Workstream 3 of the draft Comprehensive Remediation Action Plan, BRB identified approximately 47,000 high-risk customer accounts—primarily onboarded through BRB's fintech BaaS partner channels—that lack adequate Customer Due Diligence or Enhanced Due Diligence documentation. We would appreciate a current status update addressing the following:
- **Accounts remediated to date:** How many of the 47,000 accounts have been remediated to an acceptable CDD/EDD documentation standard as of today? - **Current run-rate:** What is the current weekly and/or monthly pace of account remediation? - **blockers or resource constraints:** Have you encountered any significant obstacles—whether operational, technological, or related to data quality—that are slowing progress? - **BaaS partner data collection:** What is the status of data collection from BRB's BaaS partners? We are particularly focused on NovaPay Technologies, FairLend Digital, and VaultEdge, which represent approximately 41%, 28%, and 18% of BaaS transaction volume, respectively, and therefore account for the vast majority of the affected accounts.
**2. Prioritization Discussion**
The CDD/EDD Remediation Methodology & Prioritization Memorandum we previously circulated established a risk-based triage approach that prioritizes accounts by risk score, transaction volume, and BaaS partner. As a reminder, the two key remediation milestones are:
- **July 15, 2025:** 50% completion—23,500 of 47,000 accounts must have adequate CDD/EDD documentation. - **January 15, 2026:** 100% completion—all 47,000 accounts remediated.
The July 15 milestone is approximately 96 days away. Given that timeline, we want to confirm that the current remediation pace is sufficient to meet the target, and we would like to discuss whether any adjustments to the initial prioritization tiers are warranted based on your team's experience over the past two months. In particular, we would like to understand whether NovaPay-onboarded accounts—given NovaPay's scale (approximately 2.1 million end-user accounts and $30.5 billion in CY 2024 BaaS transaction volume)—are proving more complex or time-consuming to remediate than originally anticipated.
We would also appreciate your assessment of how the BaaS Partner CDD/EDD Responsibility Matrix is functioning in practice. Specifically, are the fintech partners fulfilling their delegated duties for providing customer documentation within the agreed timelines? Have any partners been unresponsive or materially slower than expected?
**3. Resource and Staffing Considerations**
A few questions on the resource side:
- **Pinnacle Compliance Solutions temporary staff:** Of the 30 FTEs deployed under SOW Ref PCS-BRB-2025-0012, how many analysts are currently allocated to CDD/EDD remediation versus SAR backlog clearance work? As the SAR backlog clearance target date of June 30, 2025 approaches and that workstream progresses, there may be an opportunity to begin reallocating some Pinnacle analysts to CDD/EDD remediation to accelerate pace toward the July 15 milestone. We would like to discuss the feasibility and timing of such a reallocation. - **Permanent FTE hiring:** We understand that BRB has planned 15 permanent FTE hires for the BSA/AML department, bringing headcount from 62 to 77. What is the current status of that hiring process, and are any of the new or incoming hires being onboarded with CDD/EDD remediation skills or assigned to this workstream? - **Budget:** The CDD/EDD remediation project has a $4,300,000 allocated budget. Is spending tracking to plan, or are there any areas where costs are running ahead of or behind projections?
**4. CDD/EDD Progress Tracking Dashboard**
Per the CDD/EDD Progress Tracking Dashboard Specifications Memorandum we provided, we would like to know whether the dashboard has been implemented, is currently in development, or has not yet been initiated—and when you anticipate it will be fully operational. As you know, the dashboard will be essential for reporting to the Compliance Committee chaired by James Rutherford and for inclusion in the quarterly progress reports to the OCC, the first of which is due September 15, 2025. We want to ensure adequate lead time for testing and validation before those reporting obligations begin.
**5. Coordination with Thornfield Consulting**
Dr. Vivian Castellano and her team—including Nathaniel Burgess, Director, Fintech & Payments Compliance—have been conducting their on-site assessment since March 1 and will likely have substantive observations regarding the CDD/EDD remediation approach in their preliminary gap assessment due April 15. Having a current internal status snapshot in hand before that assessment is delivered will allow BRB and C&H to respond constructively and promptly to any recommendations or concerns Thornfield raises regarding this workstream, rather than needing additional time to gather baseline information.
**6. Compliance Committee Reporting**
The Compliance Committee reporting framework calls for monthly reporting on CDD/EDD remediation progress, including accounts remediated, accounts remaining, completion percentage against milestones, and issues/escalations. Could you confirm what reporting cadence and format you are currently using internally and whether it aligns with the framework we recommended? If there are any gaps, we would like to address them before the first formal Committee report is due.
**7. Next Steps and Action Items**
To keep this moving efficiently, I would propose the following:
- **Written status update by COB Wednesday, April 16, 2025:** This would allow your team to incorporate any immediate takeaways from the Thornfield preliminary gap assessment delivered on April 15. - **Call the week of April 21:** I would like to schedule a working call to discuss your status update, Thornfield's preliminary findings as they relate to CDD/EDD, and any necessary adjustments to the remediation approach or prioritization. I would suggest including Thomas, Warren Ashby (given the BaaS partner cooperation dimension), and Carlos Espinoza on the call. Philip Hartmann will join if his schedule permits.
Please let me know if the April 16 deadline for the written update works for your team, and I will circulate calendar options for the call during the week of April 21.
Patricia, I want to express my sincere appreciation for the effort that you and Thomas have been putting into this workstream. The volume and complexity of this remediation are significant, and we recognize the operational demands it places on your team. That said, maintaining momentum on CDD/EDD remediation is critical—not only for meeting the Consent Order milestones, but also for demonstrating good faith and sustained commitment to the OCC, which will be important in mitigating the risk of further regulatory action.
Thank you, and please do not hesitate to reach out if you would like to discuss any of this in advance of the written update.
Best regards,
**Yuki Nakamura** Lead Associate, Litigation (General) Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 ynakamura@calderwoodharkness.com
---
*CONFIDENTIALITY NOTICE: This email message and any attachments are intended solely for the use of the individual or entity to whom they are addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privileged communications and attorney work product. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by reply email and permanently delete the original message and all copies. Thank you.*