ENTERPRISE-WIDE BSA/AML TRAINING PLAN
Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
Prepared for: Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
C&H Matter No.: 1045-00002
March 2025
ATTORNEY-CLIENT PRIVILEGED / WORK PRODUCT
Draft — Subject to Review and Approval by BRB Chief Compliance Officer and BSA Officer
Consent Order Reference: OCC Consent Order No. OCC-2025-003 (January 15, 2025)
PRIVILEGED AND CONFIDENTIAL
This document, including all appendices and attachments hereto, constitutes attorney-client privileged communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association ("BRB") and Belmont Ridge Financial Group, Inc. ("BRFG"), in connection with the BSA/AML and sanctions compliance-program uplift mandated by the Office of the Comptroller of the Currency ("OCC") Consent Order No. OCC-2025-003, issued January 15, 2025. This document is protected from disclosure by the attorney-client privilege, the work-product doctrine, and all other applicable privileges and protections under federal and state law. The information contained herein is strictly confidential and is intended solely for the use of the authorized recipients identified by BRB's General Counsel. No portion of this document may be disclosed, reproduced, distributed, or otherwise disseminated to any third party without the prior written approval of Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association. Inadvertent disclosure of this document or any portion thereof does not constitute a waiver of any privilege or protection. If you have received this document in error, please notify Calderwood & Harkness LLP immediately at (212) 555-7800 and return or destroy all copies.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This Enterprise-Wide BSA/AML Training Plan (the "Training Plan" or "Plan") is a core component of Workstream 5 (BSA/AML Program Governance & Training Enhancement) of the Comprehensive Remediation Action Plan (the "Remediation Plan") being prepared for submission to the Office of the Comptroller of the Currency (the "OCC") by Belmont Ridge Bank National Association ("BRB") on or before May 15, 2025. The Training Plan has been prepared by Calderwood & Harkness LLP ("C&H") at the direction of BRB's General Counsel, Gregory Nardone, in coordination with the Chief Compliance Officer, Patricia Langston, and the BSA Officer / AML Program Director, Thomas Ikeda.
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB (OCC Charter No. 48271; FDIC Certificate No. 31845), identifying significant deficiencies in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program. Among the deficiencies cited in the Consent Order, the OCC specifically found that BRB's board-level oversight of BSA/AML compliance was inadequate, that the institution lacked a dedicated Compliance Committee of the Board, that BSA/AML reporting to the Board was insufficiently frequent and lacked key risk metrics, and that enterprise-wide understanding of BSA/AML obligations across the organization — and particularly within the Banking-as-a-Service ("BaaS") division — was materially deficient. The Consent Order further identified failures in OFAC sanctions screening, suspicious activity reporting, customer due diligence, and transaction monitoring model validation that, taken together, reflect systemic shortcomings in BRB's compliance culture, training infrastructure, and governance mechanisms.
This Training Plan is designed to address these identified deficiencies comprehensively. It establishes a structured, risk-based, audience-segmented training program covering all approximately 5,800 BRB employees, the Belmont Ridge Financial Group, Inc. ("BRFG") Board of Directors, and the thirty (30) full-time equivalent ("FTE") temporary compliance staff deployed by Pinnacle Compliance Solutions LLC ("Pinnacle") to support remediation efforts. The Plan provides for a phased rollout of training activities commencing immediately and achieving full 100% completion across all required personnel by the February 15, 2026 full compliance implementation deadline established in the Consent Order.
The training program is funded through the $1,800,000 training and policy development budget allocated within the $42,500,000 board-approved remediation budget. This amount is exclusive of the $14,500,000 civil money penalty assessed under the Consent Order. The budget encompasses e-learning content development and learning management system customization, in-person instructor-led training delivery, system training for BRB's Veridian Transaction Monitoring System, external specialized content, compliance staff time and travel costs, and ongoing maintenance and annual recertification infrastructure.
A critical element of this Training Plan is its integration with the independent assessment being conducted by Thornfield Consulting Group LLC ("Thornfield"), engaged as the independent consultant pursuant to the Consent Order under engagement reference TCG-BRB-2025-001. The training curriculum will incorporate the preliminary gap assessment findings expected from Dr. Vivian Castellano's team by April 15, 2025. As Thornfield completes its assessment work, the curriculum will be iteratively updated to ensure full alignment with identified deficiencies and recommended corrective actions. Thornfield's final validation report, due February 15, 2026, will include an assessment of the training program's effectiveness as part of the overall program certification.
The overarching objective of this Training Plan is to establish and sustain a training program that ensures every individual within BRB who has responsibilities relating to BSA/AML compliance — from the Board of Directors to front-line staff, from permanent employees to temporary contractors — possesses the knowledge, skills, and awareness necessary to fulfill those responsibilities in compliance with applicable law, regulation, and OCC supervisory expectations. The Plan further aims to embed a sustainable culture of compliance throughout the enterprise, such that the training program continues to operate effectively well beyond the conclusion of the remediation period.
II. REGULATORY FRAMEWORK AND TRAINING OBLIGATIONS
A. Statutory and Regulatory Basis
The training program established under this Plan is grounded in a comprehensive statutory and regulatory framework that imposes training obligations on financial institutions, their boards of directors, officers, employees, and agents. This section sets forth the principal authorities relevant to the design and content of BRB's training program.
Bank Secrecy Act and Implementing Regulations. The Bank Secrecy Act of 1970, as amended (31 U.S.C. § 5311 et seq.) (the "BSA"), and its implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") at 31 C.F.R. Chapter X, require each financial institution to establish and maintain an effective anti-money laundering program. The five pillars of an effective BSA/AML program, as articulated by FinCEN and the federal banking agencies, include: (1) a system of internal controls to ensure ongoing compliance; (2) independent testing for compliance to be conducted by qualified personnel; (3) designation of a BSA compliance officer responsible for coordinating and monitoring day-to-day compliance; (4) training for appropriate personnel; and (5) risk-based procedures for conducting ongoing customer due diligence. Training is thus an explicit, standalone pillar of the required BSA/AML program, and its adequacy is subject to examination by the OCC.
USA PATRIOT Act, Title III. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 ("USA PATRIOT Act"), Title III — International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001 — significantly expanded BSA obligations, including enhanced customer identification program ("CIP") requirements under Section 326, enhanced due diligence for correspondent accounts and private banking accounts under Sections 312 and 313, and prohibitions on correspondent accounts for foreign shell banks under Section 313. Each of these expanded obligations carries corresponding training requirements to ensure that personnel responsible for implementation are adequately equipped.
OCC Regulations. The OCC's regulations at 12 C.F.R. Part 21, Subpart B (Procedures for Monitoring Bank Secrecy Act Compliance) and Subpart C (Procedures for Monitoring Suspicious Activities and Bank Secrecy Act Compliance) establish the OCC's supervisory expectations with respect to national banks' BSA/AML compliance programs, including the requirement that banks establish and maintain procedures reasonably designed to assure and monitor compliance with the BSA's recordkeeping and reporting requirements. The OCC assesses the adequacy of training as a key component of these procedures during its examination process.
FinCEN CDD and Beneficial Ownership Regulations. The Customer Due Diligence Requirements for Financial Institutions, codified at 31 C.F.R. § 1010.230 and 31 C.F.R. § 1020.220, impose specific obligations on covered financial institutions to identify and verify the identity of the beneficial owners of legal entity customers at the time of account opening, and to establish and maintain risk-based procedures for conducting ongoing customer due diligence. These requirements, which became effective May 11, 2018, necessitate training for account opening personnel, compliance staff, and management on beneficial ownership collection, verification, risk assessment, and ongoing monitoring procedures.
OFAC Sanctions Compliance Obligations. The Office of Foreign Assets Control ("OFAC") administers U.S. economic sanctions programs pursuant to the International Emergency Economic Powers Act ("IEEPA") (50 U.S.C. § 1701 et seq.), the Trading with the Enemy Act ("TWEA") (50 U.S.C. App. § 1 et seq.), and numerous Executive Orders. Although OFAC does not prescribe specific training requirements, OFAC's Framework for OFAC Compliance Commitments (May 2019) identifies training as one of the five essential components of a risk-based sanctions compliance program (together with management commitment, risk assessment, internal controls, and testing and auditing). The Framework emphasizes that training should be provided to all relevant personnel, including front-line staff, compliance personnel, senior management, and the board of directors, and should cover the sanctions risks specific to the institution's business activities, products, services, customers, and geographic footprint. Given that the Consent Order specifically identifies OFAC screening deficiencies as a principal area of concern, OFAC training is a critical component of this Plan.
OCC Bulletin 2023-17 — Third-Party Relationships. OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), issued jointly with the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation, establishes heightened supervisory expectations for banks' management of third-party relationships, including fintech partnerships and BaaS arrangements. The Bulletin requires banks to conduct due diligence, ongoing monitoring, and effective oversight of third-party relationships commensurate with the level of risk and complexity those relationships present. For BRB, whose BaaS division processed $74.3 billion in transaction volume in calendar year 2024 and generated $127.4 million in revenue, training on the bank's retained regulatory responsibilities in the BaaS model is essential to compliance with this guidance.
FFIEC BSA/AML Examination Manual. The Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual provides the examination procedures used by all federal banking agencies, including the OCC, to assess BSA/AML compliance. The Manual devotes specific attention to the training pillar, directing examiners to evaluate whether the bank's training program is tailored to the needs of specific personnel (i.e., role-based), is sufficiently comprehensive, is updated to reflect changes in regulations and the bank's risk profile, covers all required topics (including suspicious activity reporting, CDD, OFAC screening, and new products and services), and is subject to adequate tracking and documentation. The training program designed under this Plan has been structured to address each of these examination criteria.
B. Consent Order Requirements
Article V of OCC Consent Order No. OCC-2025-003 specifically requires BRB to "develop and implement a comprehensive, enterprise-wide training program addressing Bank Secrecy Act / Anti-Money Laundering compliance, customer due diligence and enhanced due diligence, OFAC sanctions screening, and suspicious activity identification and reporting, tailored to the specific roles, responsibilities, and risk exposure of all relevant personnel, including the Board of Directors, senior management, compliance department staff, business-line employees, and any temporary or contracted personnel engaged in BSA/AML-related activities."
The Consent Order's training requirement must be understood in the context of the broader findings of supervisory concern. In particular, the following findings have direct bearing on the design and content of this Training Plan:
Finding (v): Board Oversight Deficiency. The OCC found that the BRB Board of Directors did not maintain a dedicated Compliance Committee, and that BSA/AML reporting to the Board was limited to quarterly presentations that did not include key metrics such as SAR filing volumes and timeliness, OFAC screening hit rates and disposition outcomes, risk ratings by BaaS partner, or CDD/EDD remediation status. This finding necessitates targeted governance training for the Board and senior management (Tier 1) addressing their fiduciary and supervisory obligations under BSA/AML regulations and the Consent Order. The Board has since adopted a resolution, by the February 28, 2025 deadline established in the Consent Order, establishing a dedicated Compliance Committee chaired by James Rutherford. The training program will reinforce the Compliance Committee's charter, reporting framework, and monthly metrics review obligations.
Finding (ii): OFAC Screening Deficiencies. The Consent Order identified that BRB failed to screen approximately 3,800,000 transactions processed through its NovaPay Technologies BaaS channel in calendar year 2023 against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List"), representing approximately 12.0% of total NovaPay transaction volume (31.7 million transactions). This finding requires robust OFAC-specific training for compliance department staff, BaaS relationship managers, and relevant front-line personnel.
Finding (iii): SAR Filing Deficiencies. The Consent Order noted that BRB's average SAR filing time of 78 days materially exceeded the regulatory expectation of 30 days, and that a backlog of approximately 2,400 unreviewed alerts existed as of September 2024. Training on SAR investigation, narrative drafting, and timeliness standards is essential to support the backlog clearance effort and ongoing compliance.
Finding (iv): CDD/EDD Failures. The Consent Order identified that approximately 47,000 high-risk accounts, primarily originated through BaaS partner channels, lacked adequate CDD/EDD documentation. Training on CDD/EDD standards, documentation requirements, and the BaaS Partner CDD/EDD Responsibility Matrix is critical to remediating these deficiencies.
The training program must be fully operational no later than Phase 2 of the Consent Order's compliance timeline, with initial rollout commencing May 16, 2025, and must achieve 100% completion for all required personnel by the February 15, 2026 full compliance implementation deadline.
C. Prior Training Deficiencies Identified
The current Training Plan is informed by, and designed to remediate, a series of training deficiencies that have been identified through multiple independent channels over the preceding years.
Caldera & Pope LLP Independent Test (September 2024). The BSA/AML independent test conducted by Caldera & Pope LLP (Franklin Dorsey, Engagement Partner) and completed in September 2024 identified significant training gaps across multiple dimensions of BRB's BSA/AML program. The independent test report found that training completion records were incomplete, that role-specific training for transaction monitoring analysts and OFAC screening personnel was either nonexistent or insufficiently detailed, that BaaS relationship management staff had not received specialized training on their BSA/AML obligations in the BaaS operating model, and that the training curriculum had not been updated to reflect the 2018 CDD Rule beneficial ownership requirements or significant changes to BRB's BaaS partner roster.
OCC Targeted Examination (March 2024–September 2024). The OCC's targeted examination of BRB's BSA/AML program, conducted over approximately six months from March 2024 through September 2024 and culminating in the issuance of the Consent Order, found training inadequacies to be pervasive. The examination report noted with particular concern that BaaS relationship management staff in Warren Ashby's division demonstrated insufficient understanding of their obligations within the BSA/AML program, including the bank's retained regulatory responsibilities in BaaS arrangements, the CDD/EDD responsibility allocation between BRB and its fintech partners, and the escalation protocols for suspicious activity identified in BaaS transaction flows. The examination also found that compliance department staff lacked training on the specific parameters and thresholds of BRB's transaction monitoring system, contributing to inconsistent alert disposition decisions.
Prior Supervisory Actions. The training deficiencies identified in the Consent Order are not novel findings. The OCC issued a Matter Requiring Attention ("MRA") in June 2022 that specifically referenced the lack of role-specific training for transaction monitoring and OFAC screening personnel. This MRA was subsequently elevated to a Matter Requiring Immediate Attention ("MRIA") in November 2023, reflecting BRB's failure to take adequate corrective action. Despite these supervisory warnings, BRB's prior training program remained largely unchanged through the period of the targeted examination.
Prior Outside Counsel Engagement. It is noted that BRB's former outside counsel, Drayton Mercer LLP (Helen Frazier, relationship partner), which served as BRB's primary external regulatory counsel during the period from 2019 through 2024, did not advise BRB on a training program overhaul during its engagement period, notwithstanding the issuance of the June 2022 MRA and November 2023 MRIA. Calderwood & Harkness was engaged as replacement regulatory counsel in January 2025 and has prioritized the development of this Training Plan as a critical remediation deliverable.
III. TRAINING GOVERNANCE AND ACCOUNTABILITY
A. Program Ownership
Effective governance of the training program requires clearly defined ownership, accountability, and oversight mechanisms. The following individuals and bodies constitute the program's governance structure:
Program Sponsor: Patricia Langston, Chief Compliance Officer. As the Chief Compliance Officer of Belmont Ridge Bank NA, Ms. Langston bears ultimate management-level accountability for the BSA/AML training program. In her capacity as Program Sponsor, Ms. Langston is responsible for approving the final curriculum content for all training modules, ensuring that the training program is aligned with BRB's revised BSA/AML policies and procedures and with the specific requirements of the Consent Order, and escalating program-level risks or resource constraints to the General Counsel and, as appropriate, to the Compliance Committee of the Board.
Program Director: Thomas Ikeda, BSA Officer / AML Program Director. As the designated BSA Officer and AML Program Director, Mr. Ikeda serves as the day-to-day director of training delivery operations. Mr. Ikeda is responsible for overseeing the training schedule, coordinating with department heads across BRB to ensure personnel availability and participation, managing the learning management system reporting and escalation protocols, and liaising with Pinnacle Compliance Solutions LLC, Veridian Analytics, and other external parties involved in training delivery or content development.
Executive Oversight: Gregory Nardone, General Counsel & Corporate Secretary. Mr. Nardone, as General Counsel & Corporate Secretary of BRB and BRFG, exercises executive oversight of the training program in his capacity as the senior executive responsible for managing BRB's response to the Consent Order. Mr. Nardone has directed the development of this Training Plan by Calderwood & Harkness and reviews all curriculum content for legal sufficiency prior to deployment. Mr. Nardone serves as the final escalation point for training compliance matters and reports on training program status to the Board as part of the broader remediation update.
Board Oversight: Compliance Committee and Audit Committee. The newly established Compliance Committee of the BRFG Board of Directors, chaired by James Rutherford, exercises board-level oversight of the training program. During the remediation period, the Compliance Committee will receive monthly reports on training completion rates, segmented by audience tier and department, along with analysis of any completion deficiencies and corrective actions taken. The Audit Committee, chaired by Margaret Dao, will receive a quarterly summary of training program status as part of its broader oversight of internal controls and independent testing activities, including training-related findings from Caldera & Pope LLP's annual BSA/AML independent test.
C&H Advisory Support: Philip Hartmann and Yuki Nakamura. Calderwood & Harkness provides ongoing advisory support to the training program through Philip Hartmann (Responsible Partner) and Yuki Nakamura (Lead Associate). C&H's role includes curriculum design and legal review, delivery of instructor-led training for Tier 1 (Board and Senior Management), and ongoing consultation with BRB's compliance leadership on training content updates, regulatory developments, and emerging risks.
B. Roles and Responsibilities
In addition to the governance roles identified above, the following individuals hold specific operational responsibilities within the training program:
Patricia Langston, Chief Compliance Officer. Approve final curriculum content for all training modules; ensure alignment between training content and the revised BSA/AML policy suite, including the Revised OFAC Compliance Policy, Revised SAR Policy & Procedures, Revised CDD/EDD Policy, and BaaS Compliance Oversight Framework; certify that training content addresses all Consent Order requirements; serve as escalation point for training non-compliance matters at the 60-day past-due threshold.
Thomas Ikeda, BSA Officer / AML Program Director. Oversee day-to-day training delivery, including scheduling, logistics, and instructor coordination; manage the training schedule and ensure adherence to the phased timeline; coordinate with department heads to minimize business disruption while maintaining training completion targets; review LMS completion reports weekly during Phase 1 and monthly during Phases 2 and 3; serve as escalation point for training non-compliance at the 45-day past-due threshold; coordinate with Andrea Solis of Pinnacle Compliance Solutions to ensure timely onboarding training for temporary staff.
Linda Petrosian, Chief Information Officer / Chief Technology Officer. Ensure that the e-learning platform infrastructure is fully operational and capable of supporting the enterprise-wide rollout; oversee the integration of training tracking functionality into BRB's learning management system; ensure system access and credentialing for all employees, including Pinnacle temporary staff; maintain system uptime, security, and data integrity for the LMS; provide technical support for hands-on system training environments (Veridian TMS v.8.3 and v.10.0 training instances).
Warren Ashby, Head of Fintech Partnerships / BaaS Division. Coordinate BaaS-specific training for relationship managers and other BaaS division personnel; ensure that BaaS division staff understand their roles within the BSA/AML program, including the CDD/EDD Responsibility Matrix and escalation protocols; facilitate the provision of informational materials to fintech partner personnel regarding BRB-specific compliance requirements; participate in BaaS Compliance Oversight Workshops as a presenter and resource.
Derek Ballard, Head of Internal Audit. Validate training completion records as part of independent internal audit testing; include training program compliance in the internal audit scope for the remediation period and on an ongoing basis thereafter; provide independent assurance to the Audit Committee regarding the accuracy and completeness of training completion data.
Melissa Chu, Chief Risk Officer. Provide risk assessment inputs to inform training content prioritization, including enterprise risk assessment findings, BaaS partner risk ratings, and emerging risk indicators; ensure that the training program reflects the institution's current risk profile and any material changes thereto.
Andrea Solis, Director of Managed Services, Pinnacle Compliance Solutions LLC. Ensure that all thirty (30) temporary FTE analysts deployed under the Pinnacle engagement complete all required Tier 5 training modules within ten (10) business days of onboarding; coordinate with Thomas Ikeda on Pinnacle staff training schedules and completion tracking; provide Pinnacle-internal training records to BRB for integration into the LMS.
C. Coordination with Independent Consultant
The engagement of Thornfield Consulting Group LLC as the independent consultant under the Consent Order creates both an obligation and an opportunity to leverage Thornfield's expertise in the development and validation of BRB's training program. The coordination framework between BRB, C&H, and Thornfield with respect to the training program is as follows:
Review and Validation of Training Plan and Curriculum. Thornfield Consulting Group LLC, through its engagement team led by Dr. Vivian Castellano (Project Director), Robert Eastman (AML Transaction Monitoring), Jennifer Hwang (OFAC Sanctions), and Nathaniel Burgess (Fintech & Payments Compliance), will review and provide written comments on this Training Plan and the associated curriculum content prior to deployment. Thornfield's review will assess whether the training program is appropriately scoped to address the deficiencies identified in the Consent Order, whether the curriculum content is substantively accurate and reflects current regulatory expectations, and whether the audience segmentation and delivery methods are reasonably designed to achieve the program's objectives.
Incorporation of Gap Assessment Findings. Thornfield's preliminary gap assessment of BRB's BSA/AML compliance program is due April 15, 2025. This Training Plan has been designed with sufficient flexibility to incorporate the gap assessment findings into the training curriculum prior to the commencement of Phase 2 enterprise rollout activities. C&H and BRB's compliance team will work with Thornfield to identify any additional training topics, content modifications, or audience adjustments warranted by the gap assessment findings and will revise the curriculum accordingly.
Final Validation Report. Thornfield's final validation report, due February 15, 2026, will include an independent assessment of the training program's effectiveness. This assessment is expected to evaluate training completion rates, assessment pass rates, correlations between training completion and improvements in key compliance metrics (e.g., SAR filing timeliness, OFAC screening accuracy, CDD/EDD documentation quality), and the adequacy of ongoing training governance and maintenance procedures. BRB will cooperate fully with Thornfield's validation activities, including providing access to LMS data, training materials, assessment results, and relevant personnel.
IV. AUDIENCE SEGMENTATION
The training program employs a risk-based audience segmentation model that assigns each individual within the scope of the program to one of five tiers based on their role, responsibilities, and exposure to BSA/AML risk. This tiered approach ensures that training is appropriately tailored — both in depth and content — to the specific needs of each audience segment, consistent with the FFIEC BSA/AML Examination Manual's expectation that training be "specific to each individual's job responsibilities and accountability."
A. Audience Tier 1: Board of Directors and Senior Management
Population. Tier 1 encompasses the members of the BRFG Board of Directors and BRB's C-suite executive leadership. The Board members included in this tier are: Diane Whitford (Chair of the Board and Chief Executive Officer), Arthur Connelly (Lead Independent Director and Risk Committee Chair), Margaret Dao (Audit Committee Chair), James Rutherford (Compliance Committee Chair), Sandra Villarreal (Independent Director), and Keith Yamamoto (Independent Director). The C-suite executives included are: Raymond Okoye (President and Chief Operating Officer), Samantha Reeves (Chief Financial Officer), Gregory Nardone (General Counsel & Corporate Secretary), Patricia Langston (Chief Compliance Officer), Thomas Ikeda (BSA Officer / AML Program Director), Melissa Chu (Chief Risk Officer), Warren Ashby (Head of Fintech Partnerships / BaaS Division), Linda Petrosian (Chief Information Officer / Chief Technology Officer), and Derek Ballard (Head of Internal Audit). This tier comprises approximately fifteen (15) individuals.
Training Delivery. Training for Tier 1 participants will be delivered through in-person, instructor-led sessions at BRB headquarters or, where scheduling requires, via secure videoconference. Sessions will be led by C&H attorneys Philip Hartmann (Responsible Partner) and Yuki Nakamura (Lead Associate), supplemented by Thornfield Consulting Group subject-matter experts as appropriate. The in-person format is designed to facilitate robust discussion, question-and-answer engagement, and the interactive exploration of governance scenarios, which are critical to achieving the desired learning outcomes for this audience.
Content Focus. Tier 1 training addresses the governance and fiduciary dimensions of BSA/AML compliance. Topics include: the specific requirements of the Consent Order and the Board's obligations thereunder; personal liability exposure under 12 U.S.C. § 1818 (civil money penalty provisions and institution-affiliated party removal proceedings); an overview of the BSA/AML regulatory framework and OFAC sanctions obligations as they apply to BRB; the Compliance Committee's charter, reporting framework, and monthly metrics review obligations (including SAR volumes, OFAC screening hit rates, CDD/EDD remediation progress, and BaaS partner risk ratings); the role of the Board in establishing and maintaining an effective compliance culture; identification of key red flags and risk indicators; and directors' and officers' insurance ("D&O") exposure considerations in the context of regulatory enforcement. A detailed description of the Tier 1 curriculum is set forth in a separate companion document, the Board & Senior Management BSA/AML Training Outline, prepared by C&H.
B. Audience Tier 2: BSA/AML and Compliance Department Staff
Population. Tier 2 encompasses the professional staff of BRB's BSA/AML and Compliance Department. As of the date of this Plan, the BSA/AML Department has sixty-two (62) existing full-time equivalent employees. The Remediation Plan calls for the addition of fifteen (15) new permanent FTE hires, bringing the planned post-remediation headcount to seventy-seven (77) FTEs. During the remediation period, the department will be supplemented by thirty (30) temporary FTE analysts provided by Pinnacle Compliance Solutions LLC. Accordingly, the total population of individuals performing BSA/AML compliance functions during the remediation period is approximately one hundred seven (107) individuals. (Pinnacle temporary staff are also classified as Tier 5 for purposes of onboarding-specific training requirements, as described below.)
Content Focus. Training for Tier 2 participants is the most intensive and specialized of any audience tier. The curriculum provides a deep-dive treatment of all substantive BSA/AML compliance topics, including: SAR filing requirements and the regulatory expectation of 30-day filing timeliness (as compared to BRB's current average of 78 days, which must be reduced); alert investigation and disposition procedures, including evidentiary standards, documentation requirements, and escalation protocols; CDD and EDD collection and documentation standards, including the revised risk-rating methodology; operation of the Veridian Transaction Monitoring System (currently version 8.3, transitioning to version 10.0 following the August 1, 2025 user acceptance testing milestone); OFAC screening procedures, including real-time and batch screening workflows, hit review and disposition, and blocking and rejection requirements; BaaS channel-specific risks and the unique compliance challenges presented by fintech-originated transaction flows; and quality assurance standards, including QA sampling methodology, error tracking, and root cause analysis.
Tier 2 training includes specialized sub-modules differentiated by role within the compliance department. Investigators receive advanced training in case development and SAR narrative drafting. Analysts receive focused training on alert triage, initial review protocols, and system-based research techniques. Quality assurance reviewers receive training on QA standards, feedback methodology, and trend identification. Team leads receive management-level training on workflow oversight, resource allocation, and performance metrics.
C. Audience Tier 3: BaaS Relationship Managers and Fintech Partnership Staff
Population. Tier 3 encompasses the staff of Warren Ashby's BaaS Division who are responsible for managing BRB's fourteen (14) active BaaS partner relationships. This includes relationship managers, partnership analysts, and BaaS operations staff. The estimated population is approximately forty to fifty (40–50) employees.
Content Focus. Tier 3 training addresses the specific BSA/AML compliance obligations that arise in the BaaS operating model, with particular emphasis on BRB's retained regulatory responsibilities as the chartered national bank. Topics include: an overview of the BaaS model and BRB's regulatory obligations thereunder; the CDD/EDD Responsibility Matrix, which delineates the respective responsibilities of BRB and each fintech partner with respect to customer identification, due diligence, and ongoing monitoring (with particular attention to the top three partners by volume: NovaPay Technologies, FairLend Digital, and VaultEdge); OFAC screening requirements for BaaS transaction flows, including the integration requirements for all fourteen fintech partner channels; escalation protocols for suspicious activity identified in BaaS-originated transactions; SAR reporting for BaaS-originated activity, including the statistical context that BaaS-related SARs constituted 2,108 of 3,847 total SARs filed in calendar year 2024, representing 54.8% of total filings; and the BaaS Compliance Oversight Framework, including risk-based partner tiering, ongoing monitoring requirements, compliance testing, and escalation and termination triggers.
Tier 3 training directly addresses the specific risk exposures highlighted in the Consent Order. The NovaPay OFAC screening gap — approximately 3,800,000 unscreened transactions in calendar year 2023 out of 31.7 million total NovaPay transactions, representing a 12.0% screening gap — is examined as a case study to illustrate the consequences of inadequate BaaS oversight and the importance of ensuring continuous, complete OFAC screening across all partner transaction flows. The training also places BRB's BaaS operations in appropriate context by reference to the scale of BaaS activity: $74.3 billion in aggregate BaaS transaction volume in calendar year 2024 and $127.4 million in BaaS-related revenue, underscoring both the commercial significance and the compliance risk inherent in this business line.
D. Audience Tier 4: Front-Line Staff (Retail Banking, Commercial Lending, Wealth Management)
Population. Tier 4 encompasses the remaining BRB employees across the institution's retail banking branch network, commercial lending division, and wealth management division who are not otherwise classified in Tiers 1 through 3. With BRB's total employee population of approximately 5,800 and approximately 200–300 employees accounted for in the preceding tiers, the Tier 4 population is estimated at approximately 5,500 or more employees.
Content Focus. Training for Tier 4 participants focuses on general BSA/AML awareness and the practical obligations that front-line employees encounter in their daily activities. Topics include: an overview of the BSA/AML regulatory framework, presented at an appropriate level of detail for non-specialist audiences; how to recognize indicators of potentially suspicious activity and the obligation to escalate such observations through established internal reporting channels; Currency Transaction Report ("CTR") filing obligations, including the $10,000 threshold, structuring prohibitions, and the context that BRB filed 28,612 CTRs in calendar year 2024; CDD and Know Your Customer ("KYC") obligations at account opening, including beneficial ownership collection; basic OFAC sanctions awareness, including the prohibition on conducting transactions with sanctioned persons or entities; the prohibition on "tipping off" a customer or third party that a SAR has been or will be filed; and whistleblower protections available to employees who report potential compliance violations.
Delivery. Tier 4 training is delivered primarily through e-learning modules hosted on BRB's learning management system, reflecting the large and geographically distributed nature of this population. Annual recertification is required for all Tier 4 personnel.
E. Audience Tier 5: Third-Party and Temporary Staff
Population. Tier 5 encompasses the thirty (30) temporary FTE analysts deployed by Pinnacle Compliance Solutions LLC under the direction of Andrea Solis, Director of Managed Services, as well as any other contracted or temporary staff who have been assigned responsibilities relating to BSA/AML compliance activities. (Pinnacle analysts are dually classified as both Tier 2, for purposes of substantive compliance training, and Tier 5, for purposes of onboarding-specific training requirements.)
Content Focus. Tier 5 training addresses the unique requirements of temporary and contracted personnel who are performing compliance functions within BRB's operations. Topics include: BRB-specific policies and procedures, which may differ from those of other institutions where Pinnacle analysts have previously worked; system training on the Veridian Transaction Monitoring System (initially v.8.3, with subsequent training on v.10.0 following deployment); SAR investigation and narrative drafting standards specific to BRB; confidentiality and privilege protocols, including the obligation to protect attorney-client privileged communications and the restrictions on disclosure of SAR-related information; and quality assurance benchmarks applicable to Pinnacle analysts' work product.
Onboarding Timeline. Onboarding training for Tier 5 personnel must be completed within ten (10) business days of deployment. No Pinnacle analyst may be assigned to alert review, SAR investigation, or CDD/EDD remediation tasks until all required onboarding training has been completed and documented in the LMS. Ongoing refresher training is required monthly for Tier 5 personnel throughout their deployment.
V. CURRICULUM OUTLINE
This section sets forth the substantive content of each training module that comprises BRB's enterprise-wide BSA/AML training curriculum. Each module is designed to address specific regulatory requirements, Consent Order findings, and operational needs. The modules are cross-referenced to the audience tiers identified in Section IV and to the specific articles and provisions of the Consent Order that they address.
A. Core BSA/AML Module (All Audiences — Tiers 1–5)
The Core BSA/AML Module serves as the foundation of the training program and is required for all personnel within the scope of this Plan. The module is delivered in a format and at a level of detail appropriate to each audience tier — a more condensed, governance-focused version for Tier 1 participants, a comprehensive version for Tiers 2 and 3, and a general awareness version for Tiers 4 and 5.
The Core Module covers the following topics:
Regulatory Framework Overview. An overview of the BSA/AML regulatory landscape, including the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), the USA PATRIOT Act (Title III), FinCEN regulations (31 C.F.R. Chapter X), OCC regulations (12 C.F.R. Part 21), and the FFIEC BSA/AML Examination Manual. The overview explains the purpose and objectives of BSA/AML regulation, the key obligations imposed on financial institutions, and the role of federal regulatory agencies in supervising compliance.
BRB's BSA/AML Compliance Program Structure. A description of BRB's BSA/AML compliance program organized around the five regulatory pillars: (1) internal controls designed to ensure ongoing compliance; (2) independent testing by qualified personnel (currently performed by Caldera & Pope LLP); (3) designation of a BSA Officer (Thomas Ikeda) responsible for coordinating and monitoring day-to-day compliance; (4) training for appropriate personnel (this Training Plan); and (5) risk-based procedures for conducting ongoing customer due diligence. The module explains how each pillar operates within BRB's organizational structure and the interdependencies among them.
Summary of OCC Consent Order Findings. A sanitized and audience-appropriate summary of the principal findings of OCC Consent Order No. OCC-2025-003, including OFAC screening deficiencies, SAR filing deficiencies, CDD/EDD failures, transaction monitoring model validation gaps, and board oversight deficiencies. The summary is calibrated to the audience — for example, Tier 1 receives a full and detailed discussion of the findings, whereas Tier 4 receives a high-level summary focused on the practical implications for front-line staff. The purpose of this component is to ensure that all BRB personnel understand the regulatory context in which the training program operates and the institution's commitment to remediation.
Roles and Responsibilities. A description of the roles and responsibilities of key personnel within BRB's compliance infrastructure, including the BSA Officer, CCO, General Counsel, Board and Compliance Committee, business-line managers, and front-line employees. The module emphasizes that BSA/AML compliance is an enterprise-wide responsibility and that each individual employee has an obligation to understand and fulfill the compliance requirements applicable to their role.
Reporting Obligations. An overview of BRB's principal regulatory reporting obligations, including Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), OFAC blocking reports, and reports of international transportation of currency or monetary instruments. The module covers the filing thresholds, timeframes, and procedural requirements for each report type, as well as the consequences of late or inaccurate filings.
Consequences of Non-Compliance. A discussion of the consequences of BSA/AML non-compliance at both the institutional and individual level, including civil money penalties, criminal liability, cease-and-desist orders, removal and prohibition orders for institution-affiliated parties, reputational harm, and loss of banking privileges. Real-world examples of enforcement actions are used to illustrate these consequences.
Whistleblower Protections and Internal Reporting Channels. An explanation of the protections available to employees who report suspected violations of BSA/AML laws or BRB policies, including the anti-retaliation provisions of the Sarbanes-Oxley Act and Dodd-Frank Act, and a description of BRB's internal reporting channels (ethics hotline, direct reporting to the BSA Officer or CCO, and the compliance department's dedicated reporting mailbox).
B. OFAC Sanctions Screening Module (Specialized — Tiers 2, 3, and Designated Tier 4 Personnel)
The OFAC Sanctions Screening Module provides in-depth training on BRB's sanctions compliance obligations and screening procedures. Given the centrality of OFAC screening deficiencies to the Consent Order's findings, this module is a critical component of the remediation training program.
OFAC Regulatory Framework. A comprehensive overview of the legal framework for U.S. economic sanctions, including the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA), applicable Executive Orders, and OFAC's administrative authorities. The module explains the structure of OFAC's sanctions programs, the various sanctions lists (SDN List, Consolidated Sanctions List, Sectoral Sanctions Identifications List, Non-SDN Menu-Based Sanctions List, and others), and the prohibition on unauthorized transactions involving sanctioned persons, entities, countries, and regions.
BRB's Revised OFAC Compliance Policy and Screening Procedures. A detailed walkthrough of BRB's Revised OFAC Compliance Policy and the OFAC Screening Procedures Manual, both of which are being updated as part of the remediation effort. The module covers the policy's scope, the roles and responsibilities of personnel involved in OFAC compliance, the institution's risk-based approach to sanctions screening, and the specific procedures for real-time and batch screening of all transaction types (wire transfers, ACH transactions, card transactions, and BaaS partner transaction flows).
Screening Workflows. The module provides detailed instruction on the screening workflows applicable to each transaction type and channel, including the distinction between real-time screening (which generates an immediate hold or pass decision) and batch screening (which reviews accumulated transactions on a periodic basis). The module covers the workflow for each step from transaction initiation through screening execution, alert generation, and alert disposition.
Hit Review and Disposition. Detailed instruction on the procedures for reviewing and dispositioning OFAC screening alerts, including the criteria for determining whether an alert constitutes a true match, a potential match requiring further investigation, or a false positive. The module addresses the management of BRB's false-positive rate, which stood at 99.9% on 14,320 alerts generated in calendar year 2024, with only twelve (12) true matches requiring blocking or rejection actions. The module discusses techniques for minimizing false-positive volumes while maintaining screening sensitivity and the documentation standards for all disposition decisions.
blocking and Rejection Requirements. Instruction on OFAC's blocking and rejection requirements, including the obligation to block property of sanctioned persons or entities, the requirement to file a blocking report with OFAC within ten (10) days of a blocking action, and the distinction between blocking and rejection for different transaction types.
BaaS Channel-Specific OFAC Screening. A detailed treatment of OFAC screening requirements for BaaS partner transaction flows, including the integration requirements for all fourteen (14) fintech partner channels. The module addresses the specific screening architecture for the top three BaaS partners by volume: NovaPay Technologies (representing 41% of BaaS transaction volume, or approximately $30.5 billion in calendar year 2024), FairLend Digital (28%), and VaultEdge (18%). The module covers the technical integration points, data feeds, screening timing, and escalation procedures specific to each partner channel.
Remediation Context. The module provides context on the historical NovaPay OFAC screening gap and the corrective actions being implemented, including the November 1, 2025 deadline for full OFAC screening operationalization across all BaaS channels. This remediation context serves both as a case study illustrating the consequences of screening failures and as practical instruction on the enhanced controls being implemented.
Escalation Procedures. The module covers the escalation procedures for OFAC screening matters, including the criteria for escalation, the escalation chain (to Thomas Ikeda as BSA Officer and Patricia Langston as CCO), the timeframes for escalation at each level, and the documentation requirements.
Hands-On System Training. Following the completion of user acceptance testing for Veridian TMS v.10.0 on August 1, 2025, this module will incorporate hands-on system training on the Veridian OFAC screening module. Participants will conduct screening exercises in a dedicated training environment, practice alert review and disposition using the new system interface, and generate system reports.
C. Suspicious Activity Monitoring and SAR Filing Module (Tiers 2, 3, and 5)
The SAR Filing Module provides comprehensive training on BRB's suspicious activity identification, investigation, and reporting obligations. This module directly supports the remediation of the SAR filing deficiencies identified in the Consent Order.
Regulatory Requirements. A review of SAR filing requirements under 31 C.F.R. § 1020.320, including the types of transactions and activities that must be reported, the monetary thresholds for mandatory SAR filings, the obligation to file SARs regardless of threshold when there is a known or suspected criminal violation, and the confidentiality provisions prohibiting disclosure of SAR filings.
Revised SAR Policy and Procedures. A detailed walkthrough of BRB's Revised SAR Policy & Procedures, covering all aspects of the SAR process from initial alert generation through investigation, decision-making, narrative drafting, quality assurance review, filing, and record retention. The revised policy incorporates the enhanced standards and controls necessitated by the Consent Order findings.
Timeliness Standards. Particular emphasis is placed on the regulatory expectation that SARs be filed within thirty (30) days of the initial detection of the facts constituting the basis for the filing (with an extension to sixty (60) days where no suspect is identified). BRB's prior average filing time of seventy-eight (78) days is discussed to illustrate the magnitude of the deficiency being remediated, and the specific process improvements designed to reduce filing time to within thirty (30) days are explained.
Alert Investigation and Disposition. Detailed instruction on the alert investigation and disposition workflow within the Veridian Transaction Monitoring System, including: initial alert review and triage; research techniques and data sources; case development and evidence gathering; disposition coding and documentation; escalation criteria and procedures; and supervisor review and approval processes.
SAR Narrative Drafting. Training on SAR narrative drafting standards and quality expectations, including: the elements of an effective SAR narrative (who, what, when, where, why, how); the level of detail and specificity expected by FinCEN; the documentation of the nexus between the identified activity and the suspected violation; and common drafting deficiencies to avoid. Practical exercises using anonymized case studies are incorporated to reinforce drafting skills.
Quality Assurance Framework. An overview of BRB's SAR quality assurance framework, including the QA sampling methodology, error tracking and categorization, root cause analysis procedures, and feedback mechanisms for continuous improvement. QA standards are presented with reference to the specific quality metrics that will be tracked and reported to the Compliance Committee.
Backlog Context and Lessons Learned. The module provides context on the alert backlog that existed as of September 2024 (approximately 2,400 unreviewed alerts) and the lessons learned from the lookback project (budgeted at $5,500,000; June 30, 2025 clearance target). This historical context serves to reinforce the importance of timely alert disposition and adequate staffing to prevent future backlogs.
BaaS-Related Suspicious Activity. A dedicated section addresses the heightened vigilance required for suspicious activity originating through BaaS partner channels. The training notes that BaaS-related SARs constituted 2,108 of 3,847 total SARs filed in calendar year 2024 (54.8% of total filings), reflecting the disproportionate risk associated with BaaS-originated activity relative to BaaS's share of total customer accounts. The module provides guidance on the unique indicators, typologies, and investigative considerations applicable to BaaS-related suspicious activity.
Transaction Monitoring Alert Volume. Additional context is provided regarding the volume of transaction monitoring alerts (41,500 alerts in calendar year 2024) and the SAR conversion rate (9.3%), to help participants understand the scale of the monitoring operation and the expected decision-making patterns.
D. Customer Due Diligence and Enhanced Due Diligence Module (Tiers 2, 3, 4, and 5)
The CDD/EDD Module provides training on BRB's customer due diligence obligations and the enhanced due diligence requirements applicable to high-risk customers. This module directly supports the remediation of the CDD/EDD deficiencies identified in the Consent Order.
CDD Regulatory Requirements. A review of the CDD Rule (31 C.F.R. § 1010.230 and 31 C.F.R. § 1020.220), covering: the four core elements of CDD (customer identification and verification, beneficial ownership identification and verification, understanding the nature and purpose of the customer relationship, and ongoing monitoring for reporting of suspicious transactions); the beneficial ownership threshold; the obligations triggered at account opening and at subsequent triggering events; and the recordkeeping and documentation requirements.
BRB's Revised CDD/EDD Policy. A detailed walkthrough of BRB's Revised CDD/EDD Policy, which incorporates the enhanced standards and controls required by the Consent Order. The module covers the policy's scope, the customer risk-rating methodology (including the risk factors and scoring criteria), the documentation standards for initial and ongoing due diligence, and the procedures for periodic reviews of high-risk customer relationships.
Customer Identification and Risk Rating. Instruction on BRB's customer identification program, including the acceptable forms of identification, verification procedures, and the assignment of initial risk ratings based on customer type, product, geography, and other relevant factors. The module explains the risk-rating tiers (low, medium, high, and prohibited/restricted) and the due diligence requirements associated with each tier.
Enhanced Due Diligence. Detailed instruction on the enhanced due diligence requirements applicable to high-risk customers, including: the criteria for designating a customer as high-risk; the additional documentation required (source of funds, source of wealth, purpose of account, expected activity profile); the ongoing monitoring and periodic review requirements; and the escalation procedures when EDD reveals information that triggers a SAR filing obligation.
BaaS Partner Onboarding Remediation. The module addresses the remediation of the approximately 47,000 high-risk accounts identified as lacking adequate CDD/EDD documentation, primarily originating through BaaS partner channels. The remediation milestones are reviewed: 23,500 accounts remediated by July 15, 2025 (50%), and all 47,000 accounts remediated by January 15, 2026 (100%). Participants involved in the remediation effort receive detailed instruction on the remediation procedures, documentation requirements, and quality standards.
BaaS Partner CDD/EDD Responsibility Matrix. A detailed explanation of the CDD/EDD Responsibility Matrix that delineates BRB's retained responsibilities as the chartered bank and the responsibilities delegated to each fintech partner. The module covers the specific allocations for customer identification, beneficial ownership collection, risk rating, ongoing monitoring, and periodic review, and emphasizes BRB's obligation to oversee and verify the adequacy of partners' performance of delegated functions.
Red Flags. Identification of red flags specific to fintech-onboarded customers, including indicators of identity fraud, synthetic identity, structuring, layering, rapid movement of funds, and other typologies commonly observed in the BaaS channel.
E. BaaS and Fintech Partnership Compliance Module (Tiers 2 and 3)
The BaaS Compliance Module provides specialized training on the regulatory and compliance dimensions of BRB's BaaS business model. Given that BaaS-related activity accounts for a substantial share of BRB's total transaction volume, SAR filings, and compliance risk, this module is essential to the remediation effort.
BRB's BaaS Business Model. An overview of BRB's BaaS operations, including the basic structure of a BaaS arrangement (fintech partner provides the technology and customer-facing interface; BRB provides the national bank charter, regulatory licenses, and FDIC insurance); the scope of BRB's BaaS program (fourteen active fintech partners); and the commercial significance of the BaaS business line ($74.3 billion in transaction volume and $127.4 million in revenue in calendar year 2024).
Regulatory Obligations of the Chartered Bank. A detailed discussion of BRB's retained regulatory obligations in BaaS arrangements, emphasizing that as the chartered institution, BRB bears ultimate responsibility for compliance with all applicable laws and regulations, regardless of any contractual delegation of functions to fintech partners. The module covers the OCC's supervisory expectations for bank-fintech relationships, including the principles set forth in OCC Bulletin 2023-17, and the potential supervisory consequences of inadequate BaaS oversight.
Top BaaS Partners. Profile-level information on BRB's top three BaaS partners by volume and risk significance: NovaPay Technologies Inc. (Ethan Garrison, CEO; approximately 2.1 million end-user accounts; onboarded 2021; 41% of BaaS transaction volume); FairLend Digital LLC (Aisha Okonkwo, CEO; $1.4 billion in loan originations in fiscal year 2024; onboarded 2022; 28% of BaaS transaction volume); and VaultEdge Inc. (Marcus Tan, CEO; approximately 870,000 deposit accounts; onboarded 2023; 18% of BaaS transaction volume). The remaining eleven BaaS partners are discussed at a summary level.
BaaS Compliance Oversight Framework. A comprehensive walkthrough of BRB's