1045-00002 · Calderwood & Harkness LLP · documents

engagement-letter-sc-to-brb.docx DOCUMENT Antitrust

29 / 84 ← → ✕

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Counselors at Law 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 555-7400 Facsimile: (212) 555-7401 www.calderwoodharkness.com

February 10, 2025

Via Hand Delivery and Electronic Mail

Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022

Re: Engagement of Calderwood & Harkness LLP — BSA/AML and Sanctions Compliance-Program Uplift in Response to OCC Consent Order No. OCC-2025-003

Our Matter No.: 1045-00002

Dear Mr. Nardone:

We appreciate the confidence that Belmont Ridge Bank National Association places in Calderwood & Harkness LLP ("C&H" or the "Firm"), and we are pleased to have the opportunity to serve as your outside regulatory counsel in this important matter. This letter (the "Engagement Letter") sets forth the terms and conditions on which C&H will represent Belmont Ridge Bank National Association ("Belmont Ridge," "BRB," or the "Bank"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), in connection with the comprehensive compliance-program uplift required by Consent Order No. OCC-2025-003 (the "Consent Order") issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025. As you are aware, BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company listed on the New York Stock Exchange under the ticker symbol BRFG. The scope of this engagement, however, is limited to the representation of BRB, as more fully described in Section 5 below.

This Engagement Letter supersedes any prior discussions, proposals, or understandings between C&H and BRB, and constitutes the entire agreement between C&H and BRB regarding the scope, terms, and conditions of this representation. We ask that you review the terms set forth herein carefully and, if acceptable, confirm your agreement by countersigning this letter in the space provided below and returning a fully executed copy to our offices.

1. SCOPE OF REPRESENTATION

1.1 General Scope

C&H is being engaged to serve as outside regulatory counsel to BRB in connection with the Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift necessitated by OCC Consent Order No. OCC-2025-003, dated January 15, 2025. The Consent Order requires BRB to undertake a comprehensive remediation of its BSA/AML compliance program and its Office of Foreign Assets Control ("OFAC") sanctions compliance program, within prescribed deadlines and subject to ongoing OCC supervisory oversight.

This engagement encompasses the following broad categories of legal services: (a) regulatory advisory services with respect to the Bank's obligations under the Consent Order and applicable law; (b) development and execution of a comprehensive remediation strategy; (c) regulatory engagement and correspondence with the OCC and the Financial Crimes Enforcement Network ("FinCEN"); (d) oversight of the OCC-mandated independent consultant engagement; and (e) restructuring of BRB's compliance infrastructure — including governance, policies, procedures, staffing, technology, and training — to satisfy all Consent Order requirements within the deadlines specified therein. The representation specifically covers BSA/AML compliance matters and OFAC sanctions compliance matters as they arise in connection with the Consent Order remediation.

1.2 Specific Services

Without limiting the generality of Section 1.1, C&H will provide the following specific services in connection with this engagement:

(a) Consent Order Analysis. Analysis and interpretation of Consent Order No. OCC-2025-003, including all articles, paragraphs, and associated deadlines, and preparation of a comprehensive compliance-deadline tracker for use by BRB's Board of Directors, senior management, and compliance personnel.

(b) BSA/AML and OFAC Compliance Program Assessment. Assessment of BRB's current BSA/AML and OFAC sanctions compliance program, with particular emphasis on the deficiencies identified in the Consent Order, including but not limited to:

(i) OFAC sanctions screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows, including the adequacy of interdiction logic, fuzzy-matching thresholds, and real-time screening capabilities for transactions processed through BRB's fintech partner platforms;

(ii) Suspicious Activity Report ("SAR") filing timeliness and quality, including remediation of the backlog of approximately 1,247 unfiled or deficient SARs identified in the OCC's examination findings;

(iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for high-risk customers onboarded through fintech partners, including the adequacy of know-your-customer ("KYC") data collection, beneficial ownership identification, and ongoing monitoring procedures;

(iv) Model validation for BRB's transaction monitoring system, including the adequacy of tuning, scenario coverage, below-the-line testing, and model risk management governance; and

(v) Board-level oversight of the BSA/AML program, including the adequacy of management reporting, Board training, and the role and authority of the Chief Compliance Officer.

(c) Comprehensive Remediation Action Plan. Preparation and submission to the OCC of the Comprehensive Remediation Action Plan required under Article IV of the Consent Order, by the deadline of May 15, 2025, including the identification of remedial actions, responsible parties, milestones, and completion dates for each Consent Order requirement.

(d) Independent Consultant Oversight. Drafting and negotiation of the independent consultant engagement agreement with Thornfield Consulting Group LLC ("Thornfield"), the OCC-approved independent consultant, and ongoing oversight and coordination of the independent consultant engagement throughout the remediation period, including review of Thornfield deliverables, management of privilege issues, and coordination of BRB responses to Thornfield findings and recommendations.

(e) Governance Documents. Preparation of Board resolutions, committee charters, and governance documents required under the Consent Order, including the establishment of a dedicated Compliance Committee of BRB's Board of Directors with the composition, authority, and reporting obligations specified in the Consent Order.

(f) Policy and Procedure Drafting. Drafting and revision of BSA/AML and OFAC compliance policies, procedures, and manuals, including the Bank's BSA/AML Compliance Policy, OFAC Sanctions Compliance Policy, Customer Identification Program ("CIP") procedures, CDD/EDD procedures, SAR filing procedures, Currency Transaction Report ("CTR") filing procedures, and 314(a) and 314(b) information-sharing procedures.

(g) Technology Vendor Agreements. Drafting and negotiation of technology vendor agreements in connection with BRB's compliance-technology remediation, including amendments to existing agreements with Veridian Analytics Inc. ("Veridian") relating to the Bank's transaction monitoring system, and evaluation and contracting with alternative or supplementary vendors as may be required to address the Consent Order deficiencies.

(h) Staffing and Managed Services Agreements. Drafting and negotiation of staffing and managed services agreements for remediation support, including agreements with compliance staffing firms and managed services providers retained to support the SAR backlog remediation, CDD/EDD look-back, and other remediation work streams.

(i) Quarterly Progress Reports and Self-Certification. Preparation of quarterly progress reports for submission to the OCC as required under Article VIII of the Consent Order, and preparation of the compliance self-certification required under Article IX of the Consent Order.

(j) Parallel Enforcement Risk Assessment. Regulatory risk assessment, including analysis of potential parallel enforcement actions by FinCEN and OFAC, assessment of the risk of a criminal referral by the OCC to the Department of Justice ("DOJ"), and development of risk mitigation strategies.

(k) Securities Disclosure Obligations. Assessment of the securities disclosure obligations of BRFG related to the Consent Order and the remediation program, including advice regarding the materiality of the Consent Order and related costs for purposes of BRFG's periodic filings with the Securities and Exchange Commission ("SEC") under the Securities Exchange Act of 1934.

(l) Privilege Protocols. Preparation of privilege protocols and confidentiality frameworks for remediation-related communications, including protocols governing communications with the independent consultant, common-interest arrangements, and procedures for regulatory submissions.

(m) Regulatory Correspondence. Preparation of correspondence with the OCC, including the acknowledgment of the Consent Order required under Article II, the transmittal of the Remediation Action Plan, and quarterly progress reports, as well as any other correspondence with the OCC, FinCEN, or OFAC that may be necessary during the engagement.

(n) Civil Money Penalty Payment. Advice regarding the logistics of the civil money penalty payment of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) due to the United States Treasury on March 16, 2025, as required under Article X of the Consent Order, including wire transfer procedures, applicable Treasury account information, and confirmation documentation.

(o) Other Related Services. Such other related regulatory advisory services as may be mutually agreed upon by C&H and BRB during the course of the engagement.

1.3 Limitations on Scope

The scope of this engagement is subject to the following limitations:

(a) This engagement does not include representation of BRB or BRFG in any criminal proceeding, shareholder litigation, securities enforcement action, or other proceeding beyond the scope of the BSA/AML and sanctions compliance-program uplift described herein, unless such representation is separately agreed to in writing by the parties.

(b) This engagement does not include representation of any individual officer, director, or employee of BRB or BRFG in his or her personal capacity. Should any such individual require personal legal representation in connection with the matters addressed by the Consent Order or any related investigation or proceeding, C&H will advise such individual to retain separate counsel.

(c) C&H's representation is limited to Belmont Ridge Bank National Association. C&H does not represent BRFG, any subsidiary or affiliate of BRB or BRFG, or any fintech partner of BRB (including, without limitation, NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., or Ridgeline Data Systems LLC), unless such representation is separately agreed to in writing.

(d) This engagement does not include the provision of accounting, auditing, or financial advisory services. To the extent BRB requires such services in connection with the remediation, C&H will coordinate with BRB's independent auditors and financial advisors as appropriate.

2. ENGAGEMENT PHASES AND TIMELINE

The engagement is organized into two principal phases, as described below. The phases are intended to align with the key milestones and deadlines established by the Consent Order. C&H and BRB will work together to develop detailed work plans for each phase and to adjust the timeline as necessary in response to regulatory developments or changes in scope.

2.1 Phase 1: Assessment & Remediation Plan

Period: February 10, 2025 through May 15, 2025

Key Deliverables and Milestones:

• Comprehensive analysis and interpretation of Consent Order No. OCC-2025-003, including preparation of a deadline tracker and obligation matrix.

• Regulatory risk assessment addressing potential parallel enforcement by FinCEN, OFAC, and DOJ.

• Board Resolution and Compliance Committee Charter, to be adopted by BRB's Board of Directors no later than February 28, 2025, as required under Article III of the Consent Order.

• Civil money penalty payment advice and coordination, to be completed in advance of the March 16, 2025 payment deadline.

• Initiation of independent consultant oversight, including negotiation and execution of the engagement agreement with Thornfield Consulting Group LLC and preparation of ancillary documents (e.g., nondisclosure agreements, access protocols, data-sharing agreements).

• Interim SAR backlog status report, to be submitted to the OCC no later than March 31, 2025, as required under Article V of the Consent Order.

• Comprehensive Remediation Action Plan, to be submitted to the OCC no later than May 15, 2025, as required under Article IV of the Consent Order.

• Preparation of privilege protocols and confidentiality frameworks for remediation-related communications.

• Initial drafts of revised BSA/AML and OFAC compliance policies and procedures.

• Commencement of technology vendor agreement negotiations, including amendments to the existing Veridian Analytics agreement.

Estimated Fees for Phase 1: $4,800,000 (see Section 4 below for additional detail regarding fees and billing).

2.2 Phase 2: Implementation & Monitoring

Period: May 16, 2025 through February 15, 2026

Key Deliverables and Milestones:

• Ongoing remediation implementation support across all work streams identified in the Remediation Action Plan.

• Finalization and execution of technology vendor agreements, and oversight of technology implementation, including transaction monitoring system re-tuning, OFAC screening system upgrades, and integration testing for BaaS transaction flows.

• Oversight of compliance staffing augmentation and managed services arrangements.

• Finalization of all revised BSA/AML and OFAC compliance policies, procedures, and manuals.

• Preparation and submission of the first quarterly progress report to the OCC, due September 15, 2025.

• Preparation and submission of the second quarterly progress report to the OCC, due December 15, 2025.

• Ongoing coordination with Thornfield Consulting Group LLC, including review of independent consultant reports, management of privilege issues, and preparation of BRB responses to findings and recommendations.

• Oversight of transaction monitoring model validation, including review of model validation reports and coordination with Veridian Analytics and any third-party model validation firms.

• Validation of remediated OFAC sanctions screening protocols across all BaaS transaction flows.

• CDD/EDD remediation support, including oversight of the customer look-back program and implementation of enhanced due diligence procedures for high-risk customer segments.

• Development and rollout of a comprehensive BSA/AML and OFAC compliance training program for BRB personnel at all levels, including Board-level training.

• Preparation and submission of the compliance self-certification required under Article IX of the Consent Order, due February 15, 2026.

Estimated Fees for Phase 2: $3,200,000 (see Section 4 below for additional detail regarding fees and billing).

3. ENGAGEMENT TEAM

3.1 Responsible Partner

Philip Hartmann, Partner, Banking & Finance Practice Group, will serve as the Responsible Partner for this engagement. Mr. Hartmann will be BRB's primary point of contact at C&H and will have overall responsibility for the quality, direction, and supervision of all legal services provided in connection with this matter. Mr. Hartmann brings over twenty-two years of experience advising national banks and bank holding companies on BSA/AML compliance, OCC enforcement matters, and regulatory remediation programs. He can be reached directly at (212) 555-7412 or phartmann@calderwoodharkness.com.

3.2 Billing Partner

Marcus Delgado, Partner, intellectual Property Practice Group, will serve as the Billing Partner for this engagement. Mr. Delgado is cross-staffed on this engagement due to fintech patent and licensing compliance overlap in BRB's Banking-as-a-Service arrangements. Specifically, BRB's BaaS partner agreements with NovaPay Technologies Inc. and FairLend Digital LLC incorporate intellectual property licensing provisions that intersect with the compliance-technology remediation required under the Consent Order. Mr. Delgado will provide substantive advice on related intellectual property matters arising within the scope of the remediation, including issues relating to technology vendor agreements, data licensing, and proprietary algorithm ownership. He can be reached at (212) 555-7438 or mdelgado@calderwoodharkness.com.

3.3 Associates. Yuki Nakamura, Lead Associate, Litigation (General) Practice Group, will serve as the lead associate on this engagement. Ms. Nakamura will manage day-to-day work streams, coordinate with BRB's internal compliance and legal teams, and serve as the primary associate responsible for drafting, research, and project management across all engagement phases. Ms. Nakamura has significant experience in financial-institution regulatory matters, including BSA/AML compliance assessments and consent order remediation. She can be reached at (212) 555-7455 or ynakamura@calderwoodharkness.com.

Carlos Espinoza, Working Associate, Litigation (General) Practice Group, will support Ms. Nakamura across all work streams under the supervision of Mr. Hartmann and Ms. Nakamura. Mr. Espinoza will contribute to research, drafting, document review, and regulatory correspondence throughout the engagement. He can be reached at (212) 555-7461 or cespinoza@calderwoodharkness.com.

3.4 Additional Personnel

C&H reserves the right to assign additional attorneys, paralegals, and support staff as may be reasonably necessary to fulfill the requirements of this engagement in a timely and effective manner. BRB will receive prior notice of any additional personnel assigned to the engagement, together with such personnel's billing rates, before any time is recorded to the matter. Any change in the Responsible Partner for this engagement requires the prior written consent of BRB's General Counsel. Changes in other engagement team personnel do not require BRB's prior consent, but C&H will endeavor to maintain continuity of staffing to the extent practicable.

4. FEES AND BILLING

4.1 Hourly Rates

Professional services rendered in connection with this engagement will be billed at the following hourly rates, which are effective for the 2025 calendar year:

Hourly rates for any additional attorneys, paralegals, or other timekeepers assigned to the engagement will be communicated to BRB at the time of their assignment, prior to the commencement of any work by such personnel on the matter.

C&H's standard rate schedule is subject to annual adjustment, typically effective January 1 of each calendar year. Notwithstanding the foregoing, the rates set forth in this Section 4.1 shall remain in effect through the term of this engagement (i.e., through February 15, 2026), and shall not be subject to annual adjustment, absent a written agreement between the parties to the contrary.

4.2 Fee Estimates

Based on the scope of services described in Sections 1 and 2, C&H estimates the following professional fees for this engagement:

These estimates are provided in good faith and are based on currently available information regarding the scope, complexity, and anticipated duration of the engagement. Actual fees will be determined based on the time expended by C&H attorneys and other timekeepers at the hourly rates set forth in Section 4.1 above. The fee estimates set forth herein are not caps on fees. Actual fees may be higher or lower than the estimates depending on range factors, including changes in scope, unanticipated regulatory requirements, the pace and complexity of Thornfield's independent consultant review, and other unforeseen circumstances. C&H will use commercially reasonable efforts to keep BRB informed of actual fees relative to the estimates on an ongoing basis.

4.3 Fee Collar

Fees for this engagement are subject to a variance collar of plus or minus fifteen percent (±15%) of the total estimated fees, without the requirement for re-approval by BRB. Should C&H reasonably anticipate that total fees for the engagement may exceed fifteen percent (15%) above the total estimated fees — that is, should C&H reasonably anticipate that total fees may exceed Nine Million Two Hundred Thousand Dollars ($9,200,000) ($8,000,000 × 1.15) — C&H will provide BRB's General Counsel with advance written notice of the anticipated overrun. Such notice will include a detailed explanation of the factors contributing to the anticipated fee overrun, the work streams or phases most significantly affected, and a revised fee estimate for the remainder of the engagement. Any fees in excess of the fee collar threshold require the prior written approval of BRB's General Counsel, currently Gregory Nardone, Esq. The fee collar mechanism is intended to provide BRB with budgetary predictability while acknowledging the inherent uncertainty in the scope and duration of a regulatory remediation engagement of this nature.

4.4 Retainer. Upon execution of this Engagement Letter, BRB shall deposit an evergreen retainer in the amount of Five Hundred Thousand Dollars ($500,000) with C&H (the "Retainer"). The Retainer will be held in C&H's client trust account maintained in accordance with Rule 1.15 of the New York Rules of Professional Conduct and all other applicable rules governing the safekeeping of client funds.

C&H may apply the Retainer against outstanding invoices that remain unpaid beyond the payment terms set forth in Section 4.5 below. In the event of any such application, BRB shall replenish the Retainer to the full amount of Five Hundred Thousand Dollars ($500,000) within ten (10) business days following written notice from C&H of the draw-down. Upon conclusion of the engagement, whether by completion or termination, any unused balance of the Retainer will be returned to BRB promptly, and in no event later than thirty (30) days following the conclusion of the engagement.

4.5 Billing and Payment

C&H will submit monthly invoices to BRB for professional services rendered during the preceding calendar month. Invoices will be delivered in electronic format to such address or addresses as BRB may designate, with copies to BRB's General Counsel and such other individuals as BRB may specify from time to time.

All invoices are due and payable net thirty (30) days from the date of the invoice. Each invoice will include reasonable detail regarding the nature of services performed, the identity of the timekeeper who performed such services, the number of hours expended by each timekeeper, and the applicable hourly rate for each timekeeper. Time will be recorded in increments of one-tenth (0.1) of an hour.

C&H reserves the right to charge interest on past-due amounts at a rate of one percent (1.0%) per month, or the maximum rate permitted by applicable law, whichever is less. C&H will provide BRB with written notice prior to the imposition of any interest charges, and BRB shall have an opportunity to cure any delinquency within ten (10) business days of such notice before interest begins to accrue.

4.6 Expenses. BRB will reimburse C&H for reasonable out-of-pocket expenses incurred in connection with this engagement. Reimbursable expenses include, but are not limited to, travel expenses (airfare, lodging, ground transportation, and meals), document reproduction and printing costs, messenger and delivery service charges, court and filing fees, database and research service charges, and similar disbursements directly attributable to the engagement.

Expenses are subject to an aggregate cap of Two Hundred Fifty Thousand Dollars ($250,000) over the term of the engagement. This expense cap is exclusive of expert and consultant costs that are billed directly to BRB as BRB's direct obligations, including, without limitation, fees and expenses of Thornfield Consulting Group LLC, Pinnacle Compliance Solutions LLC, Veridian Analytics Inc., and any other third-party consultants, technology vendors, or service providers engaged directly by BRB in connection with the remediation program. Such third-party costs are not included in the expense cap and are not the billing responsibility of C&H.

Any expenses in excess of the $250,000 cap require the prior written approval of BRB's General Counsel before they are incurred. C&H will use commercially reasonable efforts to manage expenses prudently and will provide BRB with itemized expense detail on each monthly invoice.

4.7 Quarterly Budget Reconciliation

C&H and BRB will conduct quarterly budget reconciliations to compare actual fees and expenses incurred against the Phase 1 and Phase 2 estimates set forth in Section 4.2 above. These reconciliations will take place at the conclusion of each calendar quarter during the term of the engagement, or at such other intervals as the parties may agree. The reconciliation process is intended to provide transparency into the financial progress of the engagement and to permit timely adjustment of work plans, staffing levels, or engagement scope as may be needed to manage costs effectively while meeting Consent Order deadlines. C&H will prepare and deliver a written budget reconciliation summary in connection with each quarterly reconciliation meeting.

5. CLIENT IDENTIFICATION

The client in this engagement is Belmont Ridge Bank National Association, and no other entity or person. C&H does not represent Belmont Ridge Financial Group, Inc. (the holding company), any other subsidiary or affiliate of BRB or BRFG, or any individual officer, director, or employee of BRB or BRFG in connection with this engagement. All communications and legal advice provided by C&H in connection with this engagement are for the sole benefit of BRB and are not intended for, and may not be relied upon by, any other party. In the event that BRFG, any affiliate, or any individual associated with BRB seeks legal representation from C&H in connection with any matter related to or arising from the Consent Order, such representation would be subject to a separate engagement agreement and a separate conflicts analysis.

6. CONFLICTS OF INTEREST

C&H has conducted a comprehensive conflicts check in connection with this engagement (Conflicts Check No. CC-2025-01124). Based on the results of that check, C&H has identified no disqualifying conflicts of interest that would preclude this engagement under applicable rules of professional conduct.

The parties checked in connection with the conflicts review include: Belmont Ridge Bank National Association; Belmont Ridge Financial Group, Inc.; Thornfield Consulting Group LLC; Veridian Analytics Inc.; Ridgeline Data Systems LLC; NovaPay Technologies Inc.; FairLend Digital LLC; VaultEdge Inc.; Brindoval Capital Partners LP; Drayton Mercer LLP; Caldera & Pope LLP; Pinnacle Compliance Solutions LLC; Hargrove & Stein PC; and Amberly Knox LLP, as well as key individuals associated with those entities, to the extent such individuals were identified by BRB or are otherwise known to C&H.

BRB acknowledges that C&H is a large, multi-practice law firm that represents many clients across a wide range of industries and practice areas. Subject to applicable rules of professional conduct and C&H's ethical obligations, C&H may continue to represent other clients whose interests may differ from those of BRB in matters that are unrelated to this engagement. C&H will not, without BRB's informed written consent, undertake any representation that is directly adverse to BRB in a matter that is substantially related to this engagement.

Should a conflict of interest arise during the course of this engagement, C&H will promptly notify BRB and, if appropriate, seek an informed written waiver from BRB and any other affected client. If the conflict cannot be resolved through a waiver that is consistent with applicable professional responsibility rules, C&H will take such steps as may be required, which may include withdrawal from this engagement or from the conflicting representation, as the circumstances warrant and as the applicable rules require.

7. CONFIDENTIALITY AND PRIVILEGE

7.1 Attorney-Client Privilege

All communications between C&H and BRB in connection with this engagement are intended to be confidential and protected by the attorney-client privilege and/or the work-product doctrine to the fullest extent permitted by applicable law. BRB should take care to maintain the confidentiality of privileged communications and should not disclose such communications to third parties — including, without limitation, fintech partners, vendors, consultants, or other persons outside of BRB's legal and compliance departments — without first consulting with C&H, as inadvertent or unauthorized disclosure of privileged communications may result in a waiver of the attorney-client privilege or work-product protection, potentially on a subject-matter-wide basis. C&H will provide BRB's personnel with guidance regarding the proper handling of privileged communications as part of the Privilege Protocol described in Section 7.2 below.

7.2 Privilege Protocol

Given the complexity of this engagement and the number of parties involved — including the OCC, FinCEN, the independent consultant (Thornfield Consulting Group LLC), technology vendors, and compliance staffing firms — C&H will prepare a detailed Privilege Protocol Memorandum establishing comprehensive guidelines for the handling of privileged and work-product materials during the remediation. The Privilege Protocol will address, at a minimum, the following matters:

(a) Document labeling conventions, including the use of privilege legends on attorney-client and work-product materials;

(b) Privilege log maintenance procedures, including protocols for logging privileged documents that are identified during document review or production processes;

(c) Common-interest frameworks, including the evaluation and, if appropriate, establishment of common-interest agreements with BRFG or other entities that may share a common legal interest with BRB in connection with the remediation;

(d) Protocols for communications with the OCC-mandated independent consultant (Thornfield Consulting Group LLC), including the delineation between factual information sharing (which is required under the Consent Order) and privileged legal analysis (which should be protected); and

(e) Protocols for sharing information with regulators — including the OCC, FinCEN, and OFAC — in connection with Consent Order compliance obligations, including selective waiver considerations and the use of confidentiality agreements where appropriate to minimize the risk of broad privilege waiver.

C&H will circulate the Privilege Protocol to BRB's General Counsel, Chief Compliance Officer, and other designated personnel for review and approval, and will conduct a training session on the protocol for BRB's compliance and legal teams.

7.3 Regulatory Disclosures

BRB understands that certain materials and communications will need to be shared with the OCC, FinCEN, or other regulators in connection with BRB's obligations under the Consent Order. Such disclosures may include, without limitation, the Remediation Action Plan, quarterly progress reports, compliance self-certifications, and supporting documentation. C&H will advise BRB on the manner and form of such disclosures to minimize the risk of privilege waiver to the extent practicable, including through the use of appropriate cover letters, confidentiality markings, and, where available, statutory or regulatory protections against waiver. BRB acknowledges, however, that disclosure to regulators may, in certain circumstances, result in a waiver of privilege with respect to the disclosed materials, and that the scope and effect of any such waiver will depend on the specific facts and applicable law.

8. DOCUMENT RETENTION

C&H will maintain files related to this engagement in accordance with C&H's standard document retention policies, as amended from time to time. Engagement files will be maintained for a minimum period following the conclusion of the engagement, as set forth in C&H's firm-wide retention schedule, and may thereafter be destroyed in the ordinary course without further notice to BRB, except to the extent that BRB has requested the return of original documents or C&H has agreed to extended retention.

Upon termination of the engagement, whether by completion or otherwise, BRB may request the return of its original documents by providing written notice to the Responsible Partner. C&H may retain copies of work product, engagement correspondence, and engagement files as permitted by applicable rules of professional conduct and C&H's firm policies, and as may be necessary for C&H's own records, conflict-checking, and professional-responsibility purposes.

9. TERMINATION

9.1 Termination by BRB

BRB may terminate this engagement at any time and for any reason by providing written notice to C&H at the address set forth in Section 12.4 below. Termination shall be effective upon C&H's receipt of such written notice, or on such later date as may be specified in the notice. Upon termination, BRB shall be responsible for payment of all fees earned and expenses incurred by C&H through the effective date of termination, in accordance with the billing and payment terms set forth in Section 4.

9.2 Termination by C&H

C&H may withdraw from this engagement in accordance with applicable rules of professional conduct, including Rule 1.16 of the New York Rules of Professional Conduct. C&H will provide BRB with reasonable advance written notice of any proposed withdrawal to permit BRB to make alternative arrangements for legal representation. If the withdrawal requires leave of any tribunal or regulatory body, C&H will seek such leave in accordance with applicable procedures. Grounds for withdrawal may include, without limitation: (a) nonpayment of invoices after notice and a reasonable opportunity to cure; (b) BRB's failure to cooperate with C&H in the representation or to follow C&H's advice on material matters within the scope of the engagement; (c) the emergence of an irreconcilable conflict of interest; or (d) other circumstances that would permit or require withdrawal under applicable professional responsibility rules.

9.3 Transition Assistance

In the event of termination of this engagement by either party, C&H will provide reasonable transition assistance to facilitate the engagement of successor counsel by BRB. Such transition assistance will include, at a minimum, the orderly transfer of engagement files and work product to BRB or its successor counsel, and cooperation with successor counsel during a reasonable transition period to ensure continuity of representation. C&H's obligation to provide transition assistance is subject to C&H's retention of copies of work product and engagement files as described in Section 8 above, and to any applicable lien rights of C&H for unpaid fees and expenses.

10. LIMITATION OF LIABILITY

To the fullest extent permitted by applicable law and the rules of professional conduct governing C&H's practice, C&H's aggregate liability to BRB in connection with this engagement — whether arising in contract, tort, or otherwise — shall not exceed the total amount of professional fees actually paid by BRB to C&H under this Engagement Letter. This limitation of liability shall not apply to the extent it is prohibited by applicable law or rules of professional conduct, or to the extent it would limit C&H's liability for its own willful misconduct or fraud.

In no event shall C&H be liable to BRB for any indirect, consequential, incidental, special, or punitive damages arising out of or relating to this engagement, regardless of the form of action or the theory of liability, and regardless of whether C&H has been advised of the possibility of such damages.

11. GOVERNING LAW AND DISPUTE RESOLUTION

This Engagement Letter shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict of laws principles. The parties consent to the personal jurisdiction of the state and federal courts located in the Borough of Manhattan, City of New York, for any action or proceeding arising out of or relating to this Engagement Letter, except as provided below with respect to arbitration.

Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the engagement contemplated hereby, including any dispute regarding the interpretation, performance, breach, or termination of this letter, and including any claim relating to the quality or adequacy of C&H's legal services, shall be resolved by binding arbitration administered in New York, New York, in accordance with the Commercial Arbitration Rules of the American Arbitration Association then in effect. The arbitration shall be conducted before a panel of one (1) arbitrator selected in accordance with such rules. The arbitrator's award shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. Notwithstanding the foregoing, the parties may mutually agree in writing to resolve any dispute through an alternative dispute resolution mechanism, including mediation, in lieu of or prior to arbitration.

12. MISCELLANEOUS PROVISIONS

12.1 Entire Agreement

This Engagement Letter constitutes the entire agreement between C&H and BRB with respect to the subject matter hereof and supersedes all prior and contemporaneous discussions, proposals, negotiations, understandings, representations, and agreements, whether written or oral, relating to the terms and conditions of this engagement. There are no oral or written agreements, representations, or warranties between the parties that are not expressly set forth in this letter.

12.2 Amendments. No amendment, modification, or waiver of any provision of this Engagement Letter shall be effective unless set forth in a writing signed by both C&H (through the Responsible Partner or another authorized partner) and BRB (through its General Counsel or another authorized officer). No course of dealing or failure to exercise any right or remedy shall constitute a waiver of any provision of this letter.

12.3 Counterparts. This Engagement Letter may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Counterparts may be delivered by facsimile, electronic mail (including PDF), or other electronic transmission, and any counterpart so delivered shall be deemed to have been duly and validly delivered and shall be valid and effective for all purposes.

12.4 Notices. All notices, requests, consents, and other communications under this Engagement Letter shall be in writing and shall be deemed duly given when delivered personally, sent by nationally recognized overnight courier service, or transmitted by electronic mail (with confirmation of receipt) to the following addresses:

If to C&H:

Philip Hartmann, Esq. Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019

Email: phartmann@calderwoodharkness.com

If to BRB:

Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022

Email: gnardone@belmontridgebank.com

Either party may change its address for notices by providing written notice to the other party in accordance with this Section 12.4.

We are grateful for the opportunity to represent Belmont Ridge Bank National Association in this critical remediation effort, and we are committed to providing the Bank with the highest quality legal services throughout the engagement. We understand the urgency and importance of the work ahead, and we stand ready to begin immediately upon execution of this letter.

Please confirm your agreement to the terms and conditions set forth in this Engagement Letter by countersigning this letter in the space provided below and returning a fully executed copy to our offices, together with the Five Hundred Thousand Dollar ($500,000) evergreen retainer described in Section 4.4. We look forward to working with you, Ms. Whitford, Ms. Langston, and the entire BRB team.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Name: Philip Hartmann

Title: Partner, Banking & Finance Practice Group

Date: February 10, 2025

ACCEPTED AND AGREED

The undersigned, on behalf of Belmont Ridge Bank National Association, hereby accepts and agrees to the terms and conditions of this Engagement Letter, effective as of the date set forth below.

BELMONT RIDGE BANK NATIONAL ASSOCIATION

By: ________

Name: Gregory Nardone

Title: General Counsel & Corporate Secretary

Date: ________

cc: (via electronic mail)

Marcus Delgado, Esq., Calderwood & Harkness LLP Yuki Nakamura, Esq., Calderwood & Harkness LLP Carlos Espinoza, Esq., Calderwood & Harkness LLP Diane Whitford, Chief Executive Officer, Belmont Ridge Bank NA Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA

Timekeeper	Position	Hourly Rate
Philip Hartmann	Partner	$1,450
Marcus Delgado	Partner	$1,350
Yuki Nakamura	Associate	$895
Carlos Espinoza	Associate	$725
Phase	Period	Estimated Fees
Phase 1: Assessment & Remediation Plan	February 10, 2025 – May 15, 2025	$4,800,000
Phase 2: Implementation & Monitoring	May 16, 2025 – February 15, 2026	$3,200,000
Total Estimated Fees	$8,000,000

PRIVILEGED & CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Counselors at Law 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 555-7400 Facsimile: (212) 555-7401 www.calderwoodharkness.com
February 10, 2025
Via Hand Delivery and Electronic Mail
Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022
Re: Engagement of Calderwood & Harkness LLP — BSA/AML and Sanctions Compliance-Program Uplift in Response to OCC Consent Order No. OCC-2025-003
Our Matter No.: 1045-00002
Dear Mr. Nardone:
We appreciate the confidence that Belmont Ridge Bank National Association places in Calderwood & Harkness LLP ("C&H" or the "Firm"), and we are pleased to have the opportunity to serve as your outside regulatory counsel in this important matter. This letter (the "Engagement Letter") sets forth the terms and conditions on which C&H will represent Belmont Ridge Bank National Association ("Belmont Ridge," "BRB," or the "Bank"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), in connection with the comprehensive compliance-program uplift required by Consent Order No. OCC-2025-003 (the "Consent Order") issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025. As you are aware, BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company listed on the New York Stock Exchange under the ticker symbol BRFG. The scope of this engagement, however, is limited to the representation of BRB, as more fully described in Section 5 below.
This Engagement Letter supersedes any prior discussions, proposals, or understandings between C&H and BRB, and constitutes the entire agreement between C&H and BRB regarding the scope, terms, and conditions of this representation. We ask that you review the terms set forth herein carefully and, if acceptable, confirm your agreement by countersigning this letter in the space provided below and returning a fully executed copy to our offices.
1. SCOPE OF REPRESENTATION
1.1 General Scope
C&H is being engaged to serve as outside regulatory counsel to BRB in connection with the Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift necessitated by OCC Consent Order No. OCC-2025-003, dated January 15, 2025. The Consent Order requires BRB to undertake a comprehensive remediation of its BSA/AML compliance program and its Office of Foreign Assets Control ("OFAC") sanctions compliance program, within prescribed deadlines and subject to ongoing OCC supervisory oversight.
This engagement encompasses the following broad categories of legal services: (a) regulatory advisory services with respect to the Bank's obligations under the Consent Order and applicable law; (b) development and execution of a comprehensive remediation strategy; (c) regulatory engagement and correspondence with the OCC and the Financial Crimes Enforcement Network ("FinCEN"); (d) oversight of the OCC-mandated independent consultant engagement; and (e) restructuring of BRB's compliance infrastructure — including governance, policies, procedures, staffing, technology, and training — to satisfy all Consent Order requirements within the deadlines specified therein. The representation specifically covers BSA/AML compliance matters and OFAC sanctions compliance matters as they arise in connection with the Consent Order remediation.
1.2 Specific Services
Without limiting the generality of Section 1.1, C&H will provide the following specific services in connection with this engagement:
(a) Consent Order Analysis. Analysis and interpretation of Consent Order No. OCC-2025-003, including all articles, paragraphs, and associated deadlines, and preparation of a comprehensive compliance-deadline tracker for use by BRB's Board of Directors, senior management, and compliance personnel.
(b) BSA/AML and OFAC Compliance Program Assessment. Assessment of BRB's current BSA/AML and OFAC sanctions compliance program, with particular emphasis on the deficiencies identified in the Consent Order, including but not limited to:
(i) OFAC sanctions screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows, including the adequacy of interdiction logic, fuzzy-matching thresholds, and real-time screening capabilities for transactions processed through BRB's fintech partner platforms;
(ii) Suspicious Activity Report ("SAR") filing timeliness and quality, including remediation of the backlog of approximately 1,247 unfiled or deficient SARs identified in the OCC's examination findings;
(iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for high-risk customers onboarded through fintech partners, including the adequacy of know-your-customer ("KYC") data collection, beneficial ownership identification, and ongoing monitoring procedures;
(iv) Model validation for BRB's transaction monitoring system, including the adequacy of tuning, scenario coverage, below-the-line testing, and model risk management governance; and
(v) Board-level oversight of the BSA/AML program, including the adequacy of management reporting, Board training, and the role and authority of the Chief Compliance Officer.
(c) Comprehensive Remediation Action Plan. Preparation and submission to the OCC of the Comprehensive Remediation Action Plan required under Article IV of the Consent Order, by the deadline of May 15, 2025, including the identification of remedial actions, responsible parties, milestones, and completion dates for each Consent Order requirement.
(d) Independent Consultant Oversight. Drafting and negotiation of the independent consultant engagement agreement with Thornfield Consulting Group LLC ("Thornfield"), the OCC-approved independent consultant, and ongoing oversight and coordination of the independent consultant engagement throughout the remediation period, including review of Thornfield deliverables, management of privilege issues, and coordination of BRB responses to Thornfield findings and recommendations.
(e) Governance Documents. Preparation of Board resolutions, committee charters, and governance documents required under the Consent Order, including the establishment of a dedicated Compliance Committee of BRB's Board of Directors with the composition, authority, and reporting obligations specified in the Consent Order.
(f) Policy and Procedure Drafting. Drafting and revision of BSA/AML and OFAC compliance policies, procedures, and manuals, including the Bank's BSA/AML Compliance Policy, OFAC Sanctions Compliance Policy, Customer Identification Program ("CIP") procedures, CDD/EDD procedures, SAR filing procedures, Currency Transaction Report ("CTR") filing procedures, and 314(a) and 314(b) information-sharing procedures.
(g) Technology Vendor Agreements. Drafting and negotiation of technology vendor agreements in connection with BRB's compliance-technology remediation, including amendments to existing agreements with Veridian Analytics Inc. ("Veridian") relating to the Bank's transaction monitoring system, and evaluation and contracting with alternative or supplementary vendors as may be required to address the Consent Order deficiencies.
(h) Staffing and Managed Services Agreements. Drafting and negotiation of staffing and managed services agreements for remediation support, including agreements with compliance staffing firms and managed services providers retained to support the SAR backlog remediation, CDD/EDD look-back, and other remediation work streams.
(i) Quarterly Progress Reports and Self-Certification. Preparation of quarterly progress reports for submission to the OCC as required under Article VIII of the Consent Order, and preparation of the compliance self-certification required under Article IX of the Consent Order.
(j) Parallel Enforcement Risk Assessment. Regulatory risk assessment, including analysis of potential parallel enforcement actions by FinCEN and OFAC, assessment of the risk of a criminal referral by the OCC to the Department of Justice ("DOJ"), and development of risk mitigation strategies.
(k) Securities Disclosure Obligations. Assessment of the securities disclosure obligations of BRFG related to the Consent Order and the remediation program, including advice regarding the materiality of the Consent Order and related costs for purposes of BRFG's periodic filings with the Securities and Exchange Commission ("SEC") under the Securities Exchange Act of 1934.
(l) Privilege Protocols. Preparation of privilege protocols and confidentiality frameworks for remediation-related communications, including protocols governing communications with the independent consultant, common-interest arrangements, and procedures for regulatory submissions.
(m) Regulatory Correspondence. Preparation of correspondence with the OCC, including the acknowledgment of the Consent Order required under Article II, the transmittal of the Remediation Action Plan, and quarterly progress reports, as well as any other correspondence with the OCC, FinCEN, or OFAC that may be necessary during the engagement.
(n) Civil Money Penalty Payment. Advice regarding the logistics of the civil money penalty payment of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) due to the United States Treasury on March 16, 2025, as required under Article X of the Consent Order, including wire transfer procedures, applicable Treasury account information, and confirmation documentation.
(o) Other Related Services. Such other related regulatory advisory services as may be mutually agreed upon by C&H and BRB during the course of the engagement.
1.3 Limitations on Scope
The scope of this engagement is subject to the following limitations:
(a) This engagement does not include representation of BRB or BRFG in any criminal proceeding, shareholder litigation, securities enforcement action, or other proceeding beyond the scope of the BSA/AML and sanctions compliance-program uplift described herein, unless such representation is separately agreed to in writing by the parties.
(b) This engagement does not include representation of any individual officer, director, or employee of BRB or BRFG in his or her personal capacity. Should any such individual require personal legal representation in connection with the matters addressed by the Consent Order or any related investigation or proceeding, C&H will advise such individual to retain separate counsel.
(c) C&H's representation is limited to Belmont Ridge Bank National Association. C&H does not represent BRFG, any subsidiary or affiliate of BRB or BRFG, or any fintech partner of BRB (including, without limitation, NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., or Ridgeline Data Systems LLC), unless such representation is separately agreed to in writing.
(d) This engagement does not include the provision of accounting, auditing, or financial advisory services. To the extent BRB requires such services in connection with the remediation, C&H will coordinate with BRB's independent auditors and financial advisors as appropriate.
2. ENGAGEMENT PHASES AND TIMELINE
The engagement is organized into two principal phases, as described below. The phases are intended to align with the key milestones and deadlines established by the Consent Order. C&H and BRB will work together to develop detailed work plans for each phase and to adjust the timeline as necessary in response to regulatory developments or changes in scope.
2.1 Phase 1: Assessment & Remediation Plan
Period: February 10, 2025 through May 15, 2025
Key Deliverables and Milestones:
•  Comprehensive analysis and interpretation of Consent Order No. OCC-2025-003, including preparation of a deadline tracker and obligation matrix.
•  Regulatory risk assessment addressing potential parallel enforcement by FinCEN, OFAC, and DOJ.
•  Board Resolution and Compliance Committee Charter, to be adopted by BRB's Board of Directors no later than February 28, 2025, as required under Article III of the Consent Order.
•  Civil money penalty payment advice and coordination, to be completed in advance of the March 16, 2025 payment deadline.
•  Initiation of independent consultant oversight, including negotiation and execution of the engagement agreement with Thornfield Consulting Group LLC and preparation of ancillary documents (e.g., nondisclosure agreements, access protocols, data-sharing agreements).
•  Interim SAR backlog status report, to be submitted to the OCC no later than March 31, 2025, as required under Article V of the Consent Order.
•  Comprehensive Remediation Action Plan, to be submitted to the OCC no later than May 15, 2025, as required under Article IV of the Consent Order.
•  Preparation of privilege protocols and confidentiality frameworks for remediation-related communications.
•  Initial drafts of revised BSA/AML and OFAC compliance policies and procedures.
•  Commencement of technology vendor agreement negotiations, including amendments to the existing Veridian Analytics agreement.
Estimated Fees for Phase 1: $4,800,000 (see Section 4 below for additional detail regarding fees and billing).
2.2 Phase 2: Implementation & Monitoring
Period: May 16, 2025 through February 15, 2026
Key Deliverables and Milestones:
•  Ongoing remediation implementation support across all work streams identified in the Remediation Action Plan.
•  Finalization and execution of technology vendor agreements, and oversight of technology implementation, including transaction monitoring system re-tuning, OFAC screening system upgrades, and integration testing for BaaS transaction flows.
•  Oversight of compliance staffing augmentation and managed services arrangements.
•  Finalization of all revised BSA/AML and OFAC compliance policies, procedures, and manuals.
•  Preparation and submission of the first quarterly progress report to the OCC, due September 15, 2025.
•  Preparation and submission of the second quarterly progress report to the OCC, due December 15, 2025.
•  Ongoing coordination with Thornfield Consulting Group LLC, including review of independent consultant reports, management of privilege issues, and preparation of BRB responses to findings and recommendations.
•  Oversight of transaction monitoring model validation, including review of model validation reports and coordination with Veridian Analytics and any third-party model validation firms.
•  Validation of remediated OFAC sanctions screening protocols across all BaaS transaction flows.
•  CDD/EDD remediation support, including oversight of the customer look-back program and implementation of enhanced due diligence procedures for high-risk customer segments.
•  Development and rollout of a comprehensive BSA/AML and OFAC compliance training program for BRB personnel at all levels, including Board-level training.
•  Preparation and submission of the compliance self-certification required under Article IX of the Consent Order, due February 15, 2026.
Estimated Fees for Phase 2: $3,200,000 (see Section 4 below for additional detail regarding fees and billing).
3. ENGAGEMENT TEAM
3.1 Responsible Partner
Philip Hartmann, Partner, Banking & Finance Practice Group, will serve as the Responsible Partner for this engagement. Mr. Hartmann will be BRB's primary point of contact at C&H and will have overall responsibility for the quality, direction, and supervision of all legal services provided in connection with this matter. Mr. Hartmann brings over twenty-two years of experience advising national banks and bank holding companies on BSA/AML compliance, OCC enforcement matters, and regulatory remediation programs. He can be reached directly at (212) 555-7412 or phartmann@calderwoodharkness.com.
3.2 Billing Partner
Marcus Delgado, Partner, intellectual Property Practice Group, will serve as the Billing Partner for this engagement. Mr. Delgado is cross-staffed on this engagement due to fintech patent and licensing compliance overlap in BRB's Banking-as-a-Service arrangements. Specifically, BRB's BaaS partner agreements with NovaPay Technologies Inc. and FairLend Digital LLC incorporate intellectual property licensing provisions that intersect with the compliance-technology remediation required under the Consent Order. Mr. Delgado will provide substantive advice on related intellectual property matters arising within the scope of the remediation, including issues relating to technology vendor agreements, data licensing, and proprietary algorithm ownership. He can be reached at (212) 555-7438 or mdelgado@calderwoodharkness.com.
3.3 Associates.  Yuki Nakamura, Lead Associate, Litigation (General) Practice Group, will serve as the lead associate on this engagement. Ms. Nakamura will manage day-to-day work streams, coordinate with BRB's internal compliance and legal teams, and serve as the primary associate responsible for drafting, research, and project management across all engagement phases. Ms. Nakamura has significant experience in financial-institution regulatory matters, including BSA/AML compliance assessments and consent order remediation. She can be reached at (212) 555-7455 or ynakamura@calderwoodharkness.com.
Carlos Espinoza, Working Associate, Litigation (General) Practice Group, will support Ms. Nakamura across all work streams under the supervision of Mr. Hartmann and Ms. Nakamura. Mr. Espinoza will contribute to research, drafting, document review, and regulatory correspondence throughout the engagement. He can be reached at (212) 555-7461 or cespinoza@calderwoodharkness.com.
3.4 Additional Personnel
C&H reserves the right to assign additional attorneys, paralegals, and support staff as may be reasonably necessary to fulfill the requirements of this engagement in a timely and effective manner. BRB will receive prior notice of any additional personnel assigned to the engagement, together with such personnel's billing rates, before any time is recorded to the matter. Any change in the Responsible Partner for this engagement requires the prior written consent of BRB's General Counsel. Changes in other engagement team personnel do not require BRB's prior consent, but C&H will endeavor to maintain continuity of staffing to the extent practicable.
4. FEES AND BILLING
4.1 Hourly Rates
Professional services rendered in connection with this engagement will be billed at the following hourly rates, which are effective for the 2025 calendar year:
Hourly rates for any additional attorneys, paralegals, or other timekeepers assigned to the engagement will be communicated to BRB at the time of their assignment, prior to the commencement of any work by such personnel on the matter.
C&H's standard rate schedule is subject to annual adjustment, typically effective January 1 of each calendar year. Notwithstanding the foregoing, the rates set forth in this Section 4.1 shall remain in effect through the term of this engagement (i.e., through February 15, 2026), and shall not be subject to annual adjustment, absent a written agreement between the parties to the contrary.
4.2 Fee Estimates
Based on the scope of services described in Sections 1 and 2, C&H estimates the following professional fees for this engagement:
These estimates are provided in good faith and are based on currently available information regarding the scope, complexity, and anticipated duration of the engagement. Actual fees will be determined based on the time expended by C&H attorneys and other timekeepers at the hourly rates set forth in Section 4.1 above. The fee estimates set forth herein are not caps on fees. Actual fees may be higher or lower than the estimates depending on range factors, including changes in scope, unanticipated regulatory requirements, the pace and complexity of Thornfield's independent consultant review, and other unforeseen circumstances. C&H will use commercially reasonable efforts to keep BRB informed of actual fees relative to the estimates on an ongoing basis.
4.3 Fee Collar
Fees for this engagement are subject to a variance collar of plus or minus fifteen percent (±15%) of the total estimated fees, without the requirement for re-approval by BRB. Should C&H reasonably anticipate that total fees for the engagement may exceed fifteen percent (15%) above the total estimated fees — that is, should C&H reasonably anticipate that total fees may exceed Nine Million Two Hundred Thousand Dollars ($9,200,000) ($8,000,000 × 1.15) — C&H will provide BRB's General Counsel with advance written notice of the anticipated overrun. Such notice will include a detailed explanation of the factors contributing to the anticipated fee overrun, the work streams or phases most significantly affected, and a revised fee estimate for the remainder of the engagement. Any fees in excess of the fee collar threshold require the prior written approval of BRB's General Counsel, currently Gregory Nardone, Esq. The fee collar mechanism is intended to provide BRB with budgetary predictability while acknowledging the inherent uncertainty in the scope and duration of a regulatory remediation engagement of this nature.
4.4 Retainer.  Upon execution of this Engagement Letter, BRB shall deposit an evergreen retainer in the amount of Five Hundred Thousand Dollars ($500,000) with C&H (the "Retainer"). The Retainer will be held in C&H's client trust account maintained in accordance with Rule 1.15 of the New York Rules of Professional Conduct and all other applicable rules governing the safekeeping of client funds.
C&H may apply the Retainer against outstanding invoices that remain unpaid beyond the payment terms set forth in Section 4.5 below. In the event of any such application, BRB shall replenish the Retainer to the full amount of Five Hundred Thousand Dollars ($500,000) within ten (10) business days following written notice from C&H of the draw-down. Upon conclusion of the engagement, whether by completion or termination, any unused balance of the Retainer will be returned to BRB promptly, and in no event later than thirty (30) days following the conclusion of the engagement.
4.5 Billing and Payment
C&H will submit monthly invoices to BRB for professional services rendered during the preceding calendar month. Invoices will be delivered in electronic format to such address or addresses as BRB may designate, with copies to BRB's General Counsel and such other individuals as BRB may specify from time to time.
All invoices are due and payable net thirty (30) days from the date of the invoice. Each invoice will include reasonable detail regarding the nature of services performed, the identity of the timekeeper who performed such services, the number of hours expended by each timekeeper, and the applicable hourly rate for each timekeeper. Time will be recorded in increments of one-tenth (0.1) of an hour.
C&H reserves the right to charge interest on past-due amounts at a rate of one percent (1.0%) per month, or the maximum rate permitted by applicable law, whichever is less. C&H will provide BRB with written notice prior to the imposition of any interest charges, and BRB shall have an opportunity to cure any delinquency within ten (10) business days of such notice before interest begins to accrue.
4.6 Expenses.  BRB will reimburse C&H for reasonable out-of-pocket expenses incurred in connection with this engagement. Reimbursable expenses include, but are not limited to, travel expenses (airfare, lodging, ground transportation, and meals), document reproduction and printing costs, messenger and delivery service charges, court and filing fees, database and research service charges, and similar disbursements directly attributable to the engagement.
Expenses are subject to an aggregate cap of Two Hundred Fifty Thousand Dollars ($250,000) over the term of the engagement. This expense cap is exclusive of expert and consultant costs that are billed directly to BRB as BRB's direct obligations, including, without limitation, fees and expenses of Thornfield Consulting Group LLC, Pinnacle Compliance Solutions LLC, Veridian Analytics Inc., and any other third-party consultants, technology vendors, or service providers engaged directly by BRB in connection with the remediation program. Such third-party costs are not included in the expense cap and are not the billing responsibility of C&H.
Any expenses in excess of the $250,000 cap require the prior written approval of BRB's General Counsel before they are incurred. C&H will use commercially reasonable efforts to manage expenses prudently and will provide BRB with itemized expense detail on each monthly invoice.
4.7 Quarterly Budget Reconciliation
C&H and BRB will conduct quarterly budget reconciliations to compare actual fees and expenses incurred against the Phase 1 and Phase 2 estimates set forth in Section 4.2 above. These reconciliations will take place at the conclusion of each calendar quarter during the term of the engagement, or at such other intervals as the parties may agree. The reconciliation process is intended to provide transparency into the financial progress of the engagement and to permit timely adjustment of work plans, staffing levels, or engagement scope as may be needed to manage costs effectively while meeting Consent Order deadlines. C&H will prepare and deliver a written budget reconciliation summary in connection with each quarterly reconciliation meeting.
5. CLIENT IDENTIFICATION
The client in this engagement is Belmont Ridge Bank National Association, and no other entity or person. C&H does not represent Belmont Ridge Financial Group, Inc. (the holding company), any other subsidiary or affiliate of BRB or BRFG, or any individual officer, director, or employee of BRB or BRFG in connection with this engagement. All communications and legal advice provided by C&H in connection with this engagement are for the sole benefit of BRB and are not intended for, and may not be relied upon by, any other party. In the event that BRFG, any affiliate, or any individual associated with BRB seeks legal representation from C&H in connection with any matter related to or arising from the Consent Order, such representation would be subject to a separate engagement agreement and a separate conflicts analysis.
6. CONFLICTS OF INTEREST
C&H has conducted a comprehensive conflicts check in connection with this engagement (Conflicts Check No. CC-2025-01124). Based on the results of that check, C&H has identified no disqualifying conflicts of interest that would preclude this engagement under applicable rules of professional conduct.
The parties checked in connection with the conflicts review include: Belmont Ridge Bank National Association; Belmont Ridge Financial Group, Inc.; Thornfield Consulting Group LLC; Veridian Analytics Inc.; Ridgeline Data Systems LLC; NovaPay Technologies Inc.; FairLend Digital LLC; VaultEdge Inc.; Brindoval Capital Partners LP; Drayton Mercer LLP; Caldera & Pope LLP; Pinnacle Compliance Solutions LLC; Hargrove & Stein PC; and Amberly Knox LLP, as well as key individuals associated with those entities, to the extent such individuals were identified by BRB or are otherwise known to C&H.
BRB acknowledges that C&H is a large, multi-practice law firm that represents many clients across a wide range of industries and practice areas. Subject to applicable rules of professional conduct and C&H's ethical obligations, C&H may continue to represent other clients whose interests may differ from those of BRB in matters that are unrelated to this engagement. C&H will not, without BRB's informed written consent, undertake any representation that is directly adverse to BRB in a matter that is substantially related to this engagement.
Should a conflict of interest arise during the course of this engagement, C&H will promptly notify BRB and, if appropriate, seek an informed written waiver from BRB and any other affected client. If the conflict cannot be resolved through a waiver that is consistent with applicable professional responsibility rules, C&H will take such steps as may be required, which may include withdrawal from this engagement or from the conflicting representation, as the circumstances warrant and as the applicable rules require.
7. CONFIDENTIALITY AND PRIVILEGE
7.1 Attorney-Client Privilege
All communications between C&H and BRB in connection with this engagement are intended to be confidential and protected by the attorney-client privilege and/or the work-product doctrine to the fullest extent permitted by applicable law. BRB should take care to maintain the confidentiality of privileged communications and should not disclose such communications to third parties — including, without limitation, fintech partners, vendors, consultants, or other persons outside of BRB's legal and compliance departments — without first consulting with C&H, as inadvertent or unauthorized disclosure of privileged communications may result in a waiver of the attorney-client privilege or work-product protection, potentially on a subject-matter-wide basis. C&H will provide BRB's personnel with guidance regarding the proper handling of privileged communications as part of the Privilege Protocol described in Section 7.2 below.
7.2 Privilege Protocol
Given the complexity of this engagement and the number of parties involved — including the OCC, FinCEN, the independent consultant (Thornfield Consulting Group LLC), technology vendors, and compliance staffing firms — C&H will prepare a detailed Privilege Protocol Memorandum establishing comprehensive guidelines for the handling of privileged and work-product materials during the remediation. The Privilege Protocol will address, at a minimum, the following matters:
(a) Document labeling conventions, including the use of privilege legends on attorney-client and work-product materials;
(b) Privilege log maintenance procedures, including protocols for logging privileged documents that are identified during document review or production processes;
(c) Common-interest frameworks, including the evaluation and, if appropriate, establishment of common-interest agreements with BRFG or other entities that may share a common legal interest with BRB in connection with the remediation;
(d) Protocols for communications with the OCC-mandated independent consultant (Thornfield Consulting Group LLC), including the delineation between factual information sharing (which is required under the Consent Order) and privileged legal analysis (which should be protected); and
(e) Protocols for sharing information with regulators — including the OCC, FinCEN, and OFAC — in connection with Consent Order compliance obligations, including selective waiver considerations and the use of confidentiality agreements where appropriate to minimize the risk of broad privilege waiver.
C&H will circulate the Privilege Protocol to BRB's General Counsel, Chief Compliance Officer, and other designated personnel for review and approval, and will conduct a training session on the protocol for BRB's compliance and legal teams.
7.3 Regulatory Disclosures
BRB understands that certain materials and communications will need to be shared with the OCC, FinCEN, or other regulators in connection with BRB's obligations under the Consent Order. Such disclosures may include, without limitation, the Remediation Action Plan, quarterly progress reports, compliance self-certifications, and supporting documentation. C&H will advise BRB on the manner and form of such disclosures to minimize the risk of privilege waiver to the extent practicable, including through the use of appropriate cover letters, confidentiality markings, and, where available, statutory or regulatory protections against waiver. BRB acknowledges, however, that disclosure to regulators may, in certain circumstances, result in a waiver of privilege with respect to the disclosed materials, and that the scope and effect of any such waiver will depend on the specific facts and applicable law.
8. DOCUMENT RETENTION
C&H will maintain files related to this engagement in accordance with C&H's standard document retention policies, as amended from time to time. Engagement files will be maintained for a minimum period following the conclusion of the engagement, as set forth in C&H's firm-wide retention schedule, and may thereafter be destroyed in the ordinary course without further notice to BRB, except to the extent that BRB has requested the return of original documents or C&H has agreed to extended retention.
Upon termination of the engagement, whether by completion or otherwise, BRB may request the return of its original documents by providing written notice to the Responsible Partner. C&H may retain copies of work product, engagement correspondence, and engagement files as permitted by applicable rules of professional conduct and C&H's firm policies, and as may be necessary for C&H's own records, conflict-checking, and professional-responsibility purposes.
9. TERMINATION
9.1 Termination by BRB
BRB may terminate this engagement at any time and for any reason by providing written notice to C&H at the address set forth in Section 12.4 below. Termination shall be effective upon C&H's receipt of such written notice, or on such later date as may be specified in the notice. Upon termination, BRB shall be responsible for payment of all fees earned and expenses incurred by C&H through the effective date of termination, in accordance with the billing and payment terms set forth in Section 4.
9.2 Termination by C&H
C&H may withdraw from this engagement in accordance with applicable rules of professional conduct, including Rule 1.16 of the New York Rules of Professional Conduct. C&H will provide BRB with reasonable advance written notice of any proposed withdrawal to permit BRB to make alternative arrangements for legal representation. If the withdrawal requires leave of any tribunal or regulatory body, C&H will seek such leave in accordance with applicable procedures. Grounds for withdrawal may include, without limitation: (a) nonpayment of invoices after notice and a reasonable opportunity to cure; (b) BRB's failure to cooperate with C&H in the representation or to follow C&H's advice on material matters within the scope of the engagement; (c) the emergence of an irreconcilable conflict of interest; or (d) other circumstances that would permit or require withdrawal under applicable professional responsibility rules.
9.3 Transition Assistance
In the event of termination of this engagement by either party, C&H will provide reasonable transition assistance to facilitate the engagement of successor counsel by BRB. Such transition assistance will include, at a minimum, the orderly transfer of engagement files and work product to BRB or its successor counsel, and cooperation with successor counsel during a reasonable transition period to ensure continuity of representation. C&H's obligation to provide transition assistance is subject to C&H's retention of copies of work product and engagement files as described in Section 8 above, and to any applicable lien rights of C&H for unpaid fees and expenses.
10. LIMITATION OF LIABILITY
To the fullest extent permitted by applicable law and the rules of professional conduct governing C&H's practice, C&H's aggregate liability to BRB in connection with this engagement — whether arising in contract, tort, or otherwise — shall not exceed the total amount of professional fees actually paid by BRB to C&H under this Engagement Letter. This limitation of liability shall not apply to the extent it is prohibited by applicable law or rules of professional conduct, or to the extent it would limit C&H's liability for its own willful misconduct or fraud.
In no event shall C&H be liable to BRB for any indirect, consequential, incidental, special, or punitive damages arising out of or relating to this engagement, regardless of the form of action or the theory of liability, and regardless of whether C&H has been advised of the possibility of such damages.
11. GOVERNING LAW AND DISPUTE RESOLUTION
This Engagement Letter shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict of laws principles. The parties consent to the personal jurisdiction of the state and federal courts located in the Borough of Manhattan, City of New York, for any action or proceeding arising out of or relating to this Engagement Letter, except as provided below with respect to arbitration.
Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the engagement contemplated hereby, including any dispute regarding the interpretation, performance, breach, or termination of this letter, and including any claim relating to the quality or adequacy of C&H's legal services, shall be resolved by binding arbitration administered in New York, New York, in accordance with the Commercial Arbitration Rules of the American Arbitration Association then in effect. The arbitration shall be conducted before a panel of one (1) arbitrator selected in accordance with such rules. The arbitrator's award shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. Notwithstanding the foregoing, the parties may mutually agree in writing to resolve any dispute through an alternative dispute resolution mechanism, including mediation, in lieu of or prior to arbitration.
12. MISCELLANEOUS PROVISIONS
12.1 Entire Agreement
This Engagement Letter constitutes the entire agreement between C&H and BRB with respect to the subject matter hereof and supersedes all prior and contemporaneous discussions, proposals, negotiations, understandings, representations, and agreements, whether written or oral, relating to the terms and conditions of this engagement. There are no oral or written agreements, representations, or warranties between the parties that are not expressly set forth in this letter.
12.2 Amendments.  No amendment, modification, or waiver of any provision of this Engagement Letter shall be effective unless set forth in a writing signed by both C&H (through the Responsible Partner or another authorized partner) and BRB (through its General Counsel or another authorized officer). No course of dealing or failure to exercise any right or remedy shall constitute a waiver of any provision of this letter.
12.3 Counterparts.  This Engagement Letter may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Counterparts may be delivered by facsimile, electronic mail (including PDF), or other electronic transmission, and any counterpart so delivered shall be deemed to have been duly and validly delivered and shall be valid and effective for all purposes.
12.4 Notices.  All notices, requests, consents, and other communications under this Engagement Letter shall be in writing and shall be deemed duly given when delivered personally, sent by nationally recognized overnight courier service, or transmitted by electronic mail (with confirmation of receipt) to the following addresses:
If to C&H:
Philip Hartmann, Esq. Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
Email: phartmann@calderwoodharkness.com
If to BRB:
Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022
Email: gnardone@belmontridgebank.com
Either party may change its address for notices by providing written notice to the other party in accordance with this Section 12.4.
We are grateful for the opportunity to represent Belmont Ridge Bank National Association in this critical remediation effort, and we are committed to providing the Bank with the highest quality legal services throughout the engagement. We understand the urgency and importance of the work ahead, and we stand ready to begin immediately upon execution of this letter.
Please confirm your agreement to the terms and conditions set forth in this Engagement Letter by countersigning this letter in the space provided below and returning a fully executed copy to our offices, together with the Five Hundred Thousand Dollar ($500,000) evergreen retainer described in Section 4.4. We look forward to working with you, Ms. Whitford, Ms. Langston, and the entire BRB team.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Philip Hartmann
Title: Partner, Banking & Finance Practice Group
Date: February 10, 2025
ACCEPTED AND AGREED
The undersigned, on behalf of Belmont Ridge Bank National Association, hereby accepts and agrees to the terms and conditions of this Engagement Letter, effective as of the date set forth below.
BELMONT RIDGE BANK NATIONAL ASSOCIATION
By: ________
Name: Gregory Nardone
Title: General Counsel & Corporate Secretary
Date: ________
cc: (via electronic mail)
Marcus Delgado, Esq., Calderwood & Harkness LLP Yuki Nakamura, Esq., Calderwood & Harkness LLP Carlos Espinoza, Esq., Calderwood & Harkness LLP Diane Whitford, Chief Executive Officer, Belmont Ridge Bank NA Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA
Timekeeper | Position | Hourly Rate
Philip Hartmann | Partner | $1,450
Marcus Delgado | Partner | $1,350
Yuki Nakamura | Associate | $895
Carlos Espinoza | Associate | $725
Phase | Period | Estimated Fees
Phase 1: Assessment & Remediation Plan | February 10, 2025 – May 15, 2025 | $4,800,000
Phase 2: Implementation & Monitoring | May 16, 2025 – February 15, 2026 | $3,200,000
Total Estimated Fees | $8,000,000

PRIVILEGED & CONFIDENTIAL

CALDERWOOD & HARKNESS LLP

ACCEPTED AND AGREED

BELMONT RIDGE BANK NATIONAL ASSOCIATION

Record

Parties

Dates

Amounts