1045-00002 · Calderwood & Harkness LLP · documents

fairlend-compliance-remediation-letter.docx DOCUMENT Antitrust

31 / 84 ← → ✕

Contract analysis Extract to table

CONFIDENTIAL — NOT FOR FURTHER DISTRIBUTION

BELMONT RIDGE BANK NATIONAL ASSOCIATION 680 Lexington Avenue, 22nd Floor New York, NY 10022

February 19, 2025

VIA OVERNIGHT COURIER AND EMAIL

FairLend Digital LLC

Attention: Aisha Okonkwo, Chief Executive Officer

100 Summer Street, Suite 800 Boston, MA 02110

Re: Required BSA/AML and Sanctions Compliance Remediation — Enhanced Cooperation, Data Sharing, and Compliance Commitments Under BaaS Program Agreement

Dear Ms. Okonkwo:

I. Introduction and Purpose of Letter

This letter is sent by Belmont Ridge Bank National Association ("BRB"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), to FairLend Digital LLC ("FairLend"), a Delaware limited liability company and Banking-as-a-Service ("BaaS") partner of BRB since FairLend's onboarding onto BRB's BaaS platform in 2022.

This letter constitutes a formal compliance remediation demand issued in connection with BRB's comprehensive Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance program uplift, which BRB has undertaken in response to recent regulatory action by the Office of the Comptroller of the Currency (the "OCC"), as described in greater detail below.

The purpose of this letter is threefold: (1) to notify FairLend of certain significant regulatory developments affecting BRB that bear directly on the BaaS partnership between BRB and FairLend; (2) to outline the enhanced cooperation, data sharing, and compliance commitments that BRB requires of FairLend as a BaaS partner operating under BRB's national bank charter; and (3) to set forth the timeline within which FairLend must demonstrate compliance with these requirements and provide formal written acknowledgment of its commitments. BRB expects FairLend's full, prompt, and good-faith cooperation with all of the demands set forth herein.

BRB is represented in this matter by Calderwood & Harkness LLP, 1285 Avenue of the Americas, 40th Floor, New York, NY 10019 (C&H Matter No. 1045-00002). References in this letter to communications with BRB's "outside counsel" or "outside regulatory counsel" refer to Calderwood & Harkness LLP.

II. Background: Regulatory Action and Consent Order

BRB writes to inform FairLend that on January 15, 2025, the Office of the Comptroller of the Currency issued Consent Order No. OCC-2025-003 (the "Consent Order") against BRB. The Consent Order identifies significant deficiencies in BRB's BSA/AML compliance program. Specifically, the OCC found that BRB maintained:

(a) inadequate Office of Foreign Assets Control ("OFAC") sanctions screening processes, including failures to achieve complete screening coverage across all transaction channels;

(b) deficient suspicious activity monitoring and Suspicious Activity Report ("SAR") filing practices, including untimely review of alerts and a substantial backlog of unresolved alerts;

(c) insufficient customer due diligence ("CDD") and enhanced due diligence ("EDD") procedures for high-risk customers, with particular reference to customers onboarded through BRB's fintech BaaS partner channels; and

(d) inadequate oversight and governance of third-party BaaS partner relationships with respect to BSA/AML and sanctions compliance responsibilities.

The Consent Order requires BRB to undertake a comprehensive remediation of its BSA/AML and sanctions compliance program across all business lines and partner channels, with full implementation of all required corrective measures to be completed and validated no later than February 15, 2026.

In furtherance of the Consent Order, BRB has engaged Thornfield Consulting Group LLC ("Thornfield"), an OCC-approved independent consultant, to conduct a comprehensive assessment of BRB's BSA/AML and sanctions compliance program and to validate the effectiveness of BRB's remediation efforts on an ongoing basis. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, and will encompass all aspects of BRB's compliance infrastructure, including the controls and processes applicable to BaaS partner-originated transactions and customer accounts.

FairLend should be aware that the Consent Order's findings relate in significant part to transactions and customer accounts originating through BRB's BaaS partnerships. The OCC specifically identified BRB's BaaS partner channels as presenting heightened BSA/AML risk, and the Consent Order requires BRB to implement enhanced controls, oversight, and data sharing mechanisms with respect to each of its BaaS partners. The cooperation of each BaaS partner, including FairLend, is therefore critical to BRB's ability to satisfy the requirements of the Consent Order within the prescribed timeframes.

III. FairLend's Role and Significance Within BRB's BaaS Program

FairLend operates as an online small-business lending platform through BRB's national bank charter under the existing BaaS Program Agreement between the parties, dated as of June 14, 2022, as amended (the "BaaS Program Agreement"). Under that agreement, FairLend originates loans and processes transactions utilizing BRB's charter authority, banking infrastructure, and regulatory framework, with BRB serving as the issuing bank and bank of record for all FairLend-originated products and services.

FairLend is one of BRB's most significant BaaS partners by transaction volume and lending activity. In calendar year 2024, BRB's total BaaS transaction volume across all partner channels was approximately $74.3 billion. FairLend's share of that volume was approximately $20.8 billion, representing approximately 28% of BRB's total BaaS transaction volume. In fiscal year 2024, FairLend originated approximately $1.4 billion in loans through BRB's charter. FairLend is one of BRB's top three BaaS partners by volume, alongside NovaPay Technologies Inc. and VaultEdge Inc.

Given FairLend's significant transaction volumes and lending activity, the adequacy of BSA/AML and sanctions compliance for FairLend-originated accounts and transactions is of critical importance to BRB's overall compliance program and its ability to satisfy the requirements of the Consent Order. Any deficiencies in the compliance processes applicable to FairLend's customer base and transaction flows have a direct and material impact on BRB's regulatory standing and its obligations to the OCC. For these reasons, FairLend's full cooperation with the remediation efforts described in this letter is not merely requested—it is required.

IV. Identified Deficiency Areas Relevant to BaaS Partners Including FairLend

Set forth below is a summary of the principal deficiency areas identified in the Consent Order that are relevant to BRB's BaaS partnerships, including its partnership with FairLend. Each of these areas requires FairLend's active cooperation and participation in remediation.

A. Customer Due Diligence and Enhanced Due Diligence Failures

The Consent Order identified approximately 47,000 high-risk customer accounts across BRB's portfolio that lack adequate CDD or EDD documentation. A substantial portion of these accounts were onboarded through BRB's fintech BaaS partner channels, including FairLend. The OCC found that BRB's CDD and EDD processes were insufficient to identify, assess, and document the risk profiles of these customers at the time of onboarding and on an ongoing basis, in contravention of the requirements set forth in 31 C.F.R. § 1020.210 and the OCC's guidance on CDD and beneficial ownership.

BRB is required under the Consent Order to complete remediation of 50% of these deficient accounts—approximately 23,500 accounts—by July 15, 2025, and to achieve 100% remediation of all 47,000 accounts by January 15, 2026. Remediation will entail the collection, review, and verification of customer identification information, beneficial ownership documentation, source-of-funds and source-of-wealth information, and risk assessments for each affected account.

FairLend's cooperation in providing customer information, documentation, and access to FairLend's onboarding records, customer-facing portals, and internal systems is essential to this remediation effort. BRB cannot fulfill its obligations under the Consent Order without timely and complete access to the records and data maintained by FairLend with respect to the customers FairLend has onboarded through BRB's charter.

B. SAR Filing Deficiencies

The Consent Order further identified significant deficiencies in BRB's suspicious activity monitoring and SAR filing practices. As of September 2024, BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned. The OCC found that BRB's average SAR filing time was approximately 78 days from initial alert generation—well in excess of the regulatory expectation of timely filing, typically within 30 days of initial detection of facts that may constitute a basis for filing, as set forth in 31 C.F.R. § 1020.320(b)(3) and applicable FinCEN guidance.

The outsized role of BaaS partner transaction activity in BRB's suspicious activity monitoring obligations is underscored by the composition of BRB's SAR filings: in calendar year 2024, BaaS-related SARs accounted for approximately 2,108 of the 3,847 total SARs filed by BRB, representing approximately 54.8% of all SARs filed. This proportion reflects the volume and nature of transaction activity processed through BRB's BaaS channels and the corresponding need for robust and timely cooperation from BaaS partners in connection with alert investigation and SAR filing.

BRB requires FairLend's timely cooperation in responding to investigative inquiries, providing transaction data and supporting documentation, and furnishing customer information in connection with alert disposition and SAR filing. Delays in FairLend's responses to such inquiries directly impair BRB's ability to meet its SAR filing obligations and expose BRB to further regulatory risk.

C. OFAC Sanctions Screening Gaps

The Consent Order cited BRB's OFAC screening system as having failed to screen 100% of transactions processed through certain BaaS channels. The OCC found that gaps in BRB's sanctions screening infrastructure resulted in a population of transactions that were not screened against the Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC-administered sanctions lists prior to processing. This constitutes a serious compliance deficiency with potentially significant legal and regulatory consequences under 31 C.F.R. Part 501 and the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1705.

BRB is required under the Consent Order to have its OFAC screening fully operational for all BaaS channels by November 1, 2025. Achieving this milestone will require enhancements to BRB's screening infrastructure, including integration of all BaaS partner data feeds into BRB's centralized sanctions screening platform. FairLend must cooperate with any technical integration, data-feed modifications, API changes, or workflow adjustments necessary to achieve full sanctions screening coverage across all FairLend-originated transactions. No FairLend-initiated transaction may bypass or circumvent BRB's sanctions screening infrastructure.

D. Transaction Monitoring Model Deficiencies

The Consent Order also identified deficiencies in BRB's transaction monitoring system. Specifically, BRB's transaction monitoring system, Veridian TMS v.8.3, was found not to have been independently validated since March 2021, and its tuning parameters were last updated in October 2022. The OCC determined that the failure to conduct timely independent model validation and periodic tuning constitutes a deficiency in BRB's BSA/AML program under the OCC's Comptroller's Handbook and applicable interagency guidance on model risk management (OCC Bulletin 2011-12).

BRB is in the process of upgrading its transaction monitoring system to Veridian TMS v.10.0, with a target deployment date of August 1, 2025. Following deployment, BRB will engage an independent model validation firm to complete validation of the upgraded system by October 1, 2025. The upgrade to Veridian TMS v.10.0 will require changes to data feeds, transaction coding, reporting formats, and data mapping protocols for all BaaS partner channels. FairLend must cooperate with any and all such changes necessary to support the upgraded system, including providing updated technical specifications, testing resources, and implementation support as reasonably requested by BRB or its technology vendors.

V. Specific Demands and Required Commitments

In light of the foregoing, BRB hereby makes the following specific demands and sets forth the following required commitments with which FairLend must comply. These demands are issued pursuant to BRB's rights under the BaaS Program Agreement, its obligations under the Consent Order, and its responsibilities as the chartered national bank of record for all FairLend-originated products, services, accounts, and transactions.

A. Enhanced Data Sharing Obligations

BRB demands that FairLend provide BRB with complete and timely access to all customer onboarding data, customer identification program ("CIP") documentation, beneficial ownership information, and transaction records for all accounts and loans originated through BRB's charter. This obligation encompasses, without limitation, all records collected or maintained by FairLend in connection with its onboarding processes, customer identity verification, know-your-customer ("KYC") procedures, ongoing monitoring, and transaction processing.

FairLend is required to respond to all BRB data requests related to the CDD/EDD remediation effort within five (5) business days of receipt of each such request. BRB expects that FairLend will designate internal resources and establish internal workflows sufficient to meet this response time requirement consistently. Any request from BRB's BSA/AML team, compliance department, or outside advisors for data or documentation in connection with the remediation shall be treated by FairLend as a priority matter requiring prompt attention.

In addition, FairLend is required to provide BRB with ongoing access to its customer-facing systems and databases to the extent necessary for BRB to perform its compliance obligations under the BSA, applicable regulations, and the Consent Order. This may include, but is not limited to, read-only access to FairLend's customer onboarding platform, loan origination system, customer relationship management databases, and any other systems containing information relevant to BRB's BSA/AML and sanctions compliance obligations.

B. CDD/EDD Cooperation

BRB demands that FairLend cooperate fully with BRB's CDD/EDD remediation project. This cooperation shall include, without limitation, the re-collection and supplementation of customer identification and due diligence documentation for all accounts identified by BRB as deficient. Where BRB determines that additional information or documentation is required for a particular customer account, FairLend shall use its best efforts to obtain such information or documentation from the customer in a timely manner, and shall promptly transmit all collected materials to BRB.

Going forward, FairLend is required to implement any enhanced onboarding procedures specified by BRB. These enhanced procedures may include, among other things, the collection of additional forms of identification documentation, the collection and verification of beneficial ownership certifications in compliance with 31 C.F.R. § 1010.230, the administration of risk questionnaires designed by BRB, and the implementation of enhanced screening at the point of onboarding for customers presenting higher-risk characteristics. BRB will provide FairLend with detailed specifications for any such enhanced procedures and expects FairLend to implement them within the timeframes specified by BRB.

BRB is currently developing a BaaS Partner CDD/EDD Responsibility Matrix (the "Responsibility Matrix") that will delineate the respective obligations of BRB and each of its BaaS partners with respect to CDD, EDD, beneficial ownership verification, ongoing customer monitoring, and related compliance functions. The Responsibility Matrix is expected to be finalized and distributed to BaaS partners during the second quarter of 2025. FairLend will be expected to comply with all obligations assigned to it under the Responsibility Matrix promptly upon receipt, and to incorporate the requirements of the Responsibility Matrix into its internal policies, procedures, and operational workflows.

C. Suspicious Activity Monitoring and Reporting Cooperation

FairLend is required to cooperate fully and promptly with BRB's SAR investigation process. FairLend shall provide responsive information within three (3) business days of receipt of any inquiry from BRB's BSA/AML team, BRB's BSA Officer (Thomas Ikeda, BSA Officer and AML Program Director), or BRB's outside advisors in connection with the investigation, escalation, or disposition of suspicious activity alerts or the preparation and filing of SARs.

FairLend's cooperation obligations in this regard extend to, without limitation, providing transaction-level detail, customer communications, account activity histories, loan documentation, payment records, and any other information or documentation requested by BRB in connection with a suspicious activity investigation. FairLend shall treat all such requests as time-sensitive and shall ensure that designated personnel are available to respond within the required timeframes.

In addition, FairLend is required to report to BRB any suspicious activity of which FairLend becomes aware relating to accounts or transactions processed through BRB's charter. FairLend shall make such reports promptly and in accordance with reporting protocols to be specified by BRB. For the avoidance of doubt, the obligation to file SARs with FinCEN remains with BRB as the bank of record; however, FairLend's obligation to identify and escalate potentially suspicious activity to BRB is a critical component of BRB's overall compliance program.

D. OFAC Sanctions Screening Cooperation

FairLend is required to cooperate with BRB's implementation of enhanced OFAC sanctions screening for all FairLend-originated transactions. This cooperation shall include, without limitation, any necessary technical integrations, API modifications, data-feed changes, system-to-system connectivity adjustments, or workflow modifications required by the Veridian TMS v.10.0 upgrade and associated OFAC module enhancement. FairLend shall make its technology personnel and resources available to BRB and BRB's technology vendors as reasonably necessary to facilitate the timely implementation of these changes.

FairLend is further required to confirm, in writing, that no FairLend-initiated transaction bypasses BRB's sanctions screening infrastructure. FairLend shall conduct an internal review of its transaction processing workflows to verify that all transactions—including real-time payments, batch-processed transactions, wire transfers, ACH originations, and any other payment flows—are routed through BRB's centralized sanctions screening platform prior to execution. FairLend shall provide BRB with the results of this review within thirty (30) days of the date of this letter.

E. Transaction Monitoring System Upgrade Cooperation

FairLend is required to cooperate with BRB's upgrade of its transaction monitoring system from Veridian TMS v.8.3 to Veridian TMS v.10.0. This cooperation shall include, without limitation, providing updated data mappings, transaction type codes, product codes, customer segment identifiers, and any other technical information or documentation needed for the Veridian TMS v.10.0 implementation. FairLend shall participate in user acceptance testing, data validation exercises, and parallel-run activities as reasonably requested by BRB in connection with the system upgrade.

FairLend shall designate a technical point of contact to coordinate with BRB's technology and compliance teams on all matters related to the transaction monitoring system upgrade. BRB anticipates that the data integration and testing process will require active FairLend participation during the period from May through August 2025, and FairLend should plan its resources accordingly.

F. Audit and Examination Access

FairLend is required to grant BRB, its independent consultant (Thornfield Consulting Group LLC), its external auditor (Caldera & Pope LLP), and applicable regulators (including the OCC and the Financial Crimes Enforcement Network ("FinCEN")) full access to FairLend's books, records, systems, and personnel as necessary for compliance testing, audit, examination, or regulatory inquiry purposes related to BRB's BSA/AML and sanctions compliance program. This access right shall be exercisable upon reasonable notice and shall not be subject to limitations or conditions imposed by FairLend that would impede or delay BRB's compliance or regulatory examination activities.

FairLend is further required to cooperate with any on-site or virtual reviews conducted by Thornfield or Caldera & Pope in connection with the BSA/AML program assessment and remediation validation. Such cooperation shall include making FairLend personnel available for interviews, providing responsive documentation within the timeframes requested, and facilitating access to FairLend's technology platforms and data repositories. BRB anticipates that Thornfield will conduct its initial on-site assessment beginning March 1, 2025, and FairLend should be prepared to receive and accommodate Thornfield's requests for access and information beginning on or about that date.

G. Compliance Program Enhancements at FairLend

BRB demands that FairLend review and, as necessary, enhance its own internal BSA/AML and sanctions compliance procedures to ensure alignment with BRB's revised policies and the requirements of the Consent Order. FairLend's internal compliance program must be sufficient to support BRB's BSA/AML obligations with respect to FairLend-originated accounts and transactions, and must not create gaps, inconsistencies, or conflicts with BRB's enterprise-wide compliance framework.

FairLend is required to designate a senior compliance contact to serve as the primary liaison with BRB's compliance team during the remediation period. This individual should be at the level of Chief Compliance Officer, General Counsel, or equivalent, and should have the authority to commit FairLend resources and make decisions on behalf of FairLend in connection with the remediation. FairLend shall provide the name, title, and contact information of this designated liaison to BRB within five (5) business days of receipt of this letter.

FairLend is further required to ensure that its personnel who are involved in customer onboarding, transaction processing, compliance, or risk management functions complete BSA/AML and OFAC training as directed by BRB. BRB will provide FairLend with training materials and curricula, and FairLend shall certify to BRB that all relevant personnel have completed the required training within the timeframes specified by BRB.

VI. Amended BaaS Program Agreement — Compliance Addendum

BRB hereby informs FairLend that BRB is preparing a model Compliance Addendum (the "Compliance Addendum") to be incorporated into all BaaS partner program agreements. BRB will transmit the Compliance Addendum to FairLend for review and execution in the near term, which BRB anticipates will occur during March 2025.

The Compliance Addendum will formalize and memorialize the enhanced BSA/AML and OFAC compliance obligations, data sharing requirements, audit and examination access rights, SAR cooperation requirements, CDD/EDD responsibilities, transaction monitoring cooperation obligations, and remediation cooperation commitments described in this letter. The Compliance Addendum will also include representations, warranties, and covenants by FairLend regarding its compliance program, its cooperation obligations, and its understanding of and commitment to BRB's regulatory requirements.

Execution of the Compliance Addendum by FairLend will be a condition of FairLend's continued participation in BRB's BaaS program. BRB expects FairLend to review, negotiate in good faith, and execute the Compliance Addendum within thirty (30) days of its transmittal. Failure to execute the Compliance Addendum within the required timeframe may result in the exercise of BRB's rights and remedies as described in Section VIII below.

VII. Timeline for Compliance

BRB requires FairLend to provide written acknowledgment of this letter and formal confirmation of its commitment to comply with the demands set forth herein within ten (10) business days of receipt. Such acknowledgment shall be signed by FairLend's Chief Executive Officer or General Counsel and shall be delivered to the contacts identified in Section X below.

FairLend is further required to designate its senior compliance liaison contact, as described in Section V.G above, within five (5) business days of receipt of this letter.

The following key remediation milestones are relevant to FairLend's cooperation obligations and are provided for FairLend's reference and planning purposes:

FairLend is expected to maintain ongoing awareness of these milestones and to ensure that its cooperation is provided sufficiently in advance of each milestone date to enable BRB to meet its obligations to the OCC. BRB's compliance team will provide FairLend with more detailed project plans and specific requests on a rolling basis as the remediation progresses.

VIII. Consequences of Non-Compliance

BRB wishes to be direct and transparent regarding the consequences of non-compliance. FairLend's failure to cooperate fully, promptly, and in good faith with BRB's remediation demands as set forth in this letter may result in BRB exercising its rights under the existing BaaS Program Agreement, applicable law, and regulation. Such actions may include, but are not limited to:

(a) Suspension of New Account Originations. BRB may immediately suspend FairLend's ability to originate new accounts, loans, or other products through BRB's charter.

(b) Restriction or Suspension of Transaction Processing. BRB may restrict or suspend the processing of transactions through FairLend's platform, including the imposition of transaction volume limits, enhanced manual review requirements, or temporary processing holds.

(c) Termination of the BaaS Program Agreement. BRB may terminate the BaaS Program Agreement in accordance with its terms, including upon a determination by BRB that FairLend's failure to cooperate constitutes a material breach of the agreement or poses an unacceptable regulatory risk to BRB.

BRB's obligations under the Consent Order are non-negotiable. The Consent Order carries the full force and effect of a binding regulatory order issued by BRB's primary federal regulator, and non-compliance by BRB could result in further enforcement action, civil money penalties, or other adverse regulatory consequences. BRB will not hesitate to take all necessary steps, including the termination of partner relationships, to satisfy its regulatory obligations and protect the safety and soundness of its operations.

BRB expressly reserves all rights and remedies available to it under the BaaS Program Agreement, applicable law, and regulation, including any rights to indemnification, reimbursement of remediation costs, or other relief as may be provided under the agreement or at law or in equity. Nothing in this letter shall be construed as a waiver of any right or remedy available to BRB.

IX. Confidentiality

FairLend is hereby instructed that while the existence and general terms of the Consent Order are public, the contents of this letter, the details of BRB's remediation plan, all internal communications between BRB and FairLend relating to the remediation, and any information shared between the parties in connection with the remediation are confidential and proprietary. FairLend may not disclose this letter, its contents, or any related information to any third party without BRB's prior written consent, except as may be required by applicable law, regulation, or valid legal process. In the event FairLend receives any request, subpoena, or demand from any third party for information relating to this letter or the remediation, FairLend shall promptly notify BRB before making any disclosure, to the extent permitted by law.

FairLend's confidentiality obligations under this Section IX are in addition to, and not in limitation of, any confidentiality obligations set forth in the BaaS Program Agreement or any other agreement between the parties.

X. Contact Information and Next Steps

FairLend shall direct its written acknowledgment of this letter and all related communications to the following individuals:

Gregory Nardone General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022

Email: gnardone@belmontridgebank.com

With a copy to:

Patricia Langston Chief Compliance Officer Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022

Email: plangston@belmontridgebank.com

And a copy to BRB's outside counsel:

Philip Hartmann Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

Email: phartmann@calderwoodharkness.com

BRB looks forward to FairLend's prompt cooperation and to working together constructively and in good faith to achieve the remediation objectives required by the Consent Order. BRB recognizes that the demands set forth in this letter will require significant effort and resource commitment from FairLend, and BRB is prepared to engage collaboratively with FairLend to facilitate a smooth and efficient remediation process. However, the urgency and seriousness of BRB's regulatory obligations require that FairLend treat this matter with the highest priority.

Please do not hesitate to contact me or Ms. Langston should you have any questions regarding the contents of this letter or the next steps required.

XI. Closing

Very truly yours,

BELMONT RIDGE BANK NATIONAL ASSOCIATION

By: ________

Name: Gregory Nardone

Title: General Counsel & Corporate Secretary

Date: ________

cc (via email):

Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA

Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA

Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA

Philip Hartmann, Calderwood & Harkness LLP

Yuki Nakamura, Calderwood & Harkness LLP

Prepared by Calderwood & Harkness LLP as outside regulatory counsel to Belmont Ridge Bank National Association. C&H Matter No. 1045-00002. CONFIDENTIAL — NOT FOR FURTHER DISTRIBUTION.

Milestone	Target Date	FairLend Cooperation Required
Thornfield on-site assessment commences	March 1, 2025	Access to records, systems, and personnel
Interim SAR backlog status report due to OCC	March 31, 2025	Timely response to SAR investigation inquiries
50% CDD/EDD remediation milestone (approx. 23,500 accounts)	July 15, 2025	Customer documentation re-collection; data sharing
Veridian TMS v.10.0 deployment	August 1, 2025	Data-feed cooperation; data mapping; testing
Veridian TMS v.10.0 independent model validation	October 1, 2025	Continued technical cooperation
OFAC screening fully operational for all BaaS channels	November 1, 2025	Technical integration; transaction routing confirmation
100% CDD/EDD remediation milestone (all 47,000 accounts)	January 15, 2026	Completion of all outstanding documentation re-collection
Full compliance program implementation; self-certification to OCC	February 15, 2026	Full cooperation and program alignment

CONFIDENTIAL — NOT FOR FURTHER DISTRIBUTION
BELMONT RIDGE BANK NATIONAL ASSOCIATION 680 Lexington Avenue, 22nd Floor New York, NY 10022
February 19, 2025
VIA OVERNIGHT COURIER AND EMAIL
FairLend Digital LLC
Attention: Aisha Okonkwo, Chief Executive Officer
100 Summer Street, Suite 800 Boston, MA 02110
Re: Required BSA/AML and Sanctions Compliance Remediation — Enhanced Cooperation, Data Sharing, and Compliance Commitments Under BaaS Program Agreement
Dear Ms. Okonkwo:
I. Introduction and Purpose of Letter
This letter is sent by Belmont Ridge Bank National Association ("BRB"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), to FairLend Digital LLC ("FairLend"), a Delaware limited liability company and Banking-as-a-Service ("BaaS") partner of BRB since FairLend's onboarding onto BRB's BaaS platform in 2022.
This letter constitutes a formal compliance remediation demand issued in connection with BRB's comprehensive Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance program uplift, which BRB has undertaken in response to recent regulatory action by the Office of the Comptroller of the Currency (the "OCC"), as described in greater detail below.
The purpose of this letter is threefold: (1) to notify FairLend of certain significant regulatory developments affecting BRB that bear directly on the BaaS partnership between BRB and FairLend; (2) to outline the enhanced cooperation, data sharing, and compliance commitments that BRB requires of FairLend as a BaaS partner operating under BRB's national bank charter; and (3) to set forth the timeline within which FairLend must demonstrate compliance with these requirements and provide formal written acknowledgment of its commitments. BRB expects FairLend's full, prompt, and good-faith cooperation with all of the demands set forth herein.
BRB is represented in this matter by Calderwood & Harkness LLP, 1285 Avenue of the Americas, 40th Floor, New York, NY 10019 (C&H Matter No. 1045-00002). References in this letter to communications with BRB's "outside counsel" or "outside regulatory counsel" refer to Calderwood & Harkness LLP.
II. Background: Regulatory Action and Consent Order
BRB writes to inform FairLend that on January 15, 2025, the Office of the Comptroller of the Currency issued Consent Order No. OCC-2025-003 (the "Consent Order") against BRB. The Consent Order identifies significant deficiencies in BRB's BSA/AML compliance program. Specifically, the OCC found that BRB maintained:
(a) inadequate Office of Foreign Assets Control ("OFAC") sanctions screening processes, including failures to achieve complete screening coverage across all transaction channels;
(b) deficient suspicious activity monitoring and Suspicious Activity Report ("SAR") filing practices, including untimely review of alerts and a substantial backlog of unresolved alerts;
(c) insufficient customer due diligence ("CDD") and enhanced due diligence ("EDD") procedures for high-risk customers, with particular reference to customers onboarded through BRB's fintech BaaS partner channels; and
(d) inadequate oversight and governance of third-party BaaS partner relationships with respect to BSA/AML and sanctions compliance responsibilities.
The Consent Order requires BRB to undertake a comprehensive remediation of its BSA/AML and sanctions compliance program across all business lines and partner channels, with full implementation of all required corrective measures to be completed and validated no later than February 15, 2026.
In furtherance of the Consent Order, BRB has engaged Thornfield Consulting Group LLC ("Thornfield"), an OCC-approved independent consultant, to conduct a comprehensive assessment of BRB's BSA/AML and sanctions compliance program and to validate the effectiveness of BRB's remediation efforts on an ongoing basis. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, and will encompass all aspects of BRB's compliance infrastructure, including the controls and processes applicable to BaaS partner-originated transactions and customer accounts.
FairLend should be aware that the Consent Order's findings relate in significant part to transactions and customer accounts originating through BRB's BaaS partnerships. The OCC specifically identified BRB's BaaS partner channels as presenting heightened BSA/AML risk, and the Consent Order requires BRB to implement enhanced controls, oversight, and data sharing mechanisms with respect to each of its BaaS partners. The cooperation of each BaaS partner, including FairLend, is therefore critical to BRB's ability to satisfy the requirements of the Consent Order within the prescribed timeframes.
III. FairLend's Role and Significance Within BRB's BaaS Program
FairLend operates as an online small-business lending platform through BRB's national bank charter under the existing BaaS Program Agreement between the parties, dated as of June 14, 2022, as amended (the "BaaS Program Agreement"). Under that agreement, FairLend originates loans and processes transactions utilizing BRB's charter authority, banking infrastructure, and regulatory framework, with BRB serving as the issuing bank and bank of record for all FairLend-originated products and services.
FairLend is one of BRB's most significant BaaS partners by transaction volume and lending activity. In calendar year 2024, BRB's total BaaS transaction volume across all partner channels was approximately $74.3 billion. FairLend's share of that volume was approximately $20.8 billion, representing approximately 28% of BRB's total BaaS transaction volume. In fiscal year 2024, FairLend originated approximately $1.4 billion in loans through BRB's charter. FairLend is one of BRB's top three BaaS partners by volume, alongside NovaPay Technologies Inc. and VaultEdge Inc.
Given FairLend's significant transaction volumes and lending activity, the adequacy of BSA/AML and sanctions compliance for FairLend-originated accounts and transactions is of critical importance to BRB's overall compliance program and its ability to satisfy the requirements of the Consent Order. Any deficiencies in the compliance processes applicable to FairLend's customer base and transaction flows have a direct and material impact on BRB's regulatory standing and its obligations to the OCC. For these reasons, FairLend's full cooperation with the remediation efforts described in this letter is not merely requested—it is required.
IV. Identified Deficiency Areas Relevant to BaaS Partners Including FairLend
Set forth below is a summary of the principal deficiency areas identified in the Consent Order that are relevant to BRB's BaaS partnerships, including its partnership with FairLend. Each of these areas requires FairLend's active cooperation and participation in remediation.
A. Customer Due Diligence and Enhanced Due Diligence Failures
The Consent Order identified approximately 47,000 high-risk customer accounts across BRB's portfolio that lack adequate CDD or EDD documentation. A substantial portion of these accounts were onboarded through BRB's fintech BaaS partner channels, including FairLend. The OCC found that BRB's CDD and EDD processes were insufficient to identify, assess, and document the risk profiles of these customers at the time of onboarding and on an ongoing basis, in contravention of the requirements set forth in 31 C.F.R. § 1020.210 and the OCC's guidance on CDD and beneficial ownership.
BRB is required under the Consent Order to complete remediation of 50% of these deficient accounts—approximately 23,500 accounts—by July 15, 2025, and to achieve 100% remediation of all 47,000 accounts by January 15, 2026. Remediation will entail the collection, review, and verification of customer identification information, beneficial ownership documentation, source-of-funds and source-of-wealth information, and risk assessments for each affected account.
FairLend's cooperation in providing customer information, documentation, and access to FairLend's onboarding records, customer-facing portals, and internal systems is essential to this remediation effort. BRB cannot fulfill its obligations under the Consent Order without timely and complete access to the records and data maintained by FairLend with respect to the customers FairLend has onboarded through BRB's charter.
B. SAR Filing Deficiencies
The Consent Order further identified significant deficiencies in BRB's suspicious activity monitoring and SAR filing practices. As of September 2024, BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned. The OCC found that BRB's average SAR filing time was approximately 78 days from initial alert generation—well in excess of the regulatory expectation of timely filing, typically within 30 days of initial detection of facts that may constitute a basis for filing, as set forth in 31 C.F.R. § 1020.320(b)(3) and applicable FinCEN guidance.
The outsized role of BaaS partner transaction activity in BRB's suspicious activity monitoring obligations is underscored by the composition of BRB's SAR filings: in calendar year 2024, BaaS-related SARs accounted for approximately 2,108 of the 3,847 total SARs filed by BRB, representing approximately 54.8% of all SARs filed. This proportion reflects the volume and nature of transaction activity processed through BRB's BaaS channels and the corresponding need for robust and timely cooperation from BaaS partners in connection with alert investigation and SAR filing.
BRB requires FairLend's timely cooperation in responding to investigative inquiries, providing transaction data and supporting documentation, and furnishing customer information in connection with alert disposition and SAR filing. Delays in FairLend's responses to such inquiries directly impair BRB's ability to meet its SAR filing obligations and expose BRB to further regulatory risk.
C. OFAC Sanctions Screening Gaps
The Consent Order cited BRB's OFAC screening system as having failed to screen 100% of transactions processed through certain BaaS channels. The OCC found that gaps in BRB's sanctions screening infrastructure resulted in a population of transactions that were not screened against the Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC-administered sanctions lists prior to processing. This constitutes a serious compliance deficiency with potentially significant legal and regulatory consequences under 31 C.F.R. Part 501 and the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1705.
BRB is required under the Consent Order to have its OFAC screening fully operational for all BaaS channels by November 1, 2025. Achieving this milestone will require enhancements to BRB's screening infrastructure, including integration of all BaaS partner data feeds into BRB's centralized sanctions screening platform. FairLend must cooperate with any technical integration, data-feed modifications, API changes, or workflow adjustments necessary to achieve full sanctions screening coverage across all FairLend-originated transactions. No FairLend-initiated transaction may bypass or circumvent BRB's sanctions screening infrastructure.
D. Transaction Monitoring Model Deficiencies
The Consent Order also identified deficiencies in BRB's transaction monitoring system. Specifically, BRB's transaction monitoring system, Veridian TMS v.8.3, was found not to have been independently validated since March 2021, and its tuning parameters were last updated in October 2022. The OCC determined that the failure to conduct timely independent model validation and periodic tuning constitutes a deficiency in BRB's BSA/AML program under the OCC's Comptroller's Handbook and applicable interagency guidance on model risk management (OCC Bulletin 2011-12).
BRB is in the process of upgrading its transaction monitoring system to Veridian TMS v.10.0, with a target deployment date of August 1, 2025. Following deployment, BRB will engage an independent model validation firm to complete validation of the upgraded system by October 1, 2025. The upgrade to Veridian TMS v.10.0 will require changes to data feeds, transaction coding, reporting formats, and data mapping protocols for all BaaS partner channels. FairLend must cooperate with any and all such changes necessary to support the upgraded system, including providing updated technical specifications, testing resources, and implementation support as reasonably requested by BRB or its technology vendors.
V. Specific Demands and Required Commitments
In light of the foregoing, BRB hereby makes the following specific demands and sets forth the following required commitments with which FairLend must comply. These demands are issued pursuant to BRB's rights under the BaaS Program Agreement, its obligations under the Consent Order, and its responsibilities as the chartered national bank of record for all FairLend-originated products, services, accounts, and transactions.
A. Enhanced Data Sharing Obligations
BRB demands that FairLend provide BRB with complete and timely access to all customer onboarding data, customer identification program ("CIP") documentation, beneficial ownership information, and transaction records for all accounts and loans originated through BRB's charter. This obligation encompasses, without limitation, all records collected or maintained by FairLend in connection with its onboarding processes, customer identity verification, know-your-customer ("KYC") procedures, ongoing monitoring, and transaction processing.
FairLend is required to respond to all BRB data requests related to the CDD/EDD remediation effort within five (5) business days of receipt of each such request. BRB expects that FairLend will designate internal resources and establish internal workflows sufficient to meet this response time requirement consistently. Any request from BRB's BSA/AML team, compliance department, or outside advisors for data or documentation in connection with the remediation shall be treated by FairLend as a priority matter requiring prompt attention.
In addition, FairLend is required to provide BRB with ongoing access to its customer-facing systems and databases to the extent necessary for BRB to perform its compliance obligations under the BSA, applicable regulations, and the Consent Order. This may include, but is not limited to, read-only access to FairLend's customer onboarding platform, loan origination system, customer relationship management databases, and any other systems containing information relevant to BRB's BSA/AML and sanctions compliance obligations.
B. CDD/EDD Cooperation
BRB demands that FairLend cooperate fully with BRB's CDD/EDD remediation project. This cooperation shall include, without limitation, the re-collection and supplementation of customer identification and due diligence documentation for all accounts identified by BRB as deficient. Where BRB determines that additional information or documentation is required for a particular customer account, FairLend shall use its best efforts to obtain such information or documentation from the customer in a timely manner, and shall promptly transmit all collected materials to BRB.
Going forward, FairLend is required to implement any enhanced onboarding procedures specified by BRB. These enhanced procedures may include, among other things, the collection of additional forms of identification documentation, the collection and verification of beneficial ownership certifications in compliance with 31 C.F.R. § 1010.230, the administration of risk questionnaires designed by BRB, and the implementation of enhanced screening at the point of onboarding for customers presenting higher-risk characteristics. BRB will provide FairLend with detailed specifications for any such enhanced procedures and expects FairLend to implement them within the timeframes specified by BRB.
BRB is currently developing a BaaS Partner CDD/EDD Responsibility Matrix (the "Responsibility Matrix") that will delineate the respective obligations of BRB and each of its BaaS partners with respect to CDD, EDD, beneficial ownership verification, ongoing customer monitoring, and related compliance functions. The Responsibility Matrix is expected to be finalized and distributed to BaaS partners during the second quarter of 2025. FairLend will be expected to comply with all obligations assigned to it under the Responsibility Matrix promptly upon receipt, and to incorporate the requirements of the Responsibility Matrix into its internal policies, procedures, and operational workflows.
C. Suspicious Activity Monitoring and Reporting Cooperation
FairLend is required to cooperate fully and promptly with BRB's SAR investigation process. FairLend shall provide responsive information within three (3) business days of receipt of any inquiry from BRB's BSA/AML team, BRB's BSA Officer (Thomas Ikeda, BSA Officer and AML Program Director), or BRB's outside advisors in connection with the investigation, escalation, or disposition of suspicious activity alerts or the preparation and filing of SARs.
FairLend's cooperation obligations in this regard extend to, without limitation, providing transaction-level detail, customer communications, account activity histories, loan documentation, payment records, and any other information or documentation requested by BRB in connection with a suspicious activity investigation. FairLend shall treat all such requests as time-sensitive and shall ensure that designated personnel are available to respond within the required timeframes.
In addition, FairLend is required to report to BRB any suspicious activity of which FairLend becomes aware relating to accounts or transactions processed through BRB's charter. FairLend shall make such reports promptly and in accordance with reporting protocols to be specified by BRB. For the avoidance of doubt, the obligation to file SARs with FinCEN remains with BRB as the bank of record; however, FairLend's obligation to identify and escalate potentially suspicious activity to BRB is a critical component of BRB's overall compliance program.
D. OFAC Sanctions Screening Cooperation
FairLend is required to cooperate with BRB's implementation of enhanced OFAC sanctions screening for all FairLend-originated transactions. This cooperation shall include, without limitation, any necessary technical integrations, API modifications, data-feed changes, system-to-system connectivity adjustments, or workflow modifications required by the Veridian TMS v.10.0 upgrade and associated OFAC module enhancement. FairLend shall make its technology personnel and resources available to BRB and BRB's technology vendors as reasonably necessary to facilitate the timely implementation of these changes.
FairLend is further required to confirm, in writing, that no FairLend-initiated transaction bypasses BRB's sanctions screening infrastructure. FairLend shall conduct an internal review of its transaction processing workflows to verify that all transactions—including real-time payments, batch-processed transactions, wire transfers, ACH originations, and any other payment flows—are routed through BRB's centralized sanctions screening platform prior to execution. FairLend shall provide BRB with the results of this review within thirty (30) days of the date of this letter.
E. Transaction Monitoring System Upgrade Cooperation
FairLend is required to cooperate with BRB's upgrade of its transaction monitoring system from Veridian TMS v.8.3 to Veridian TMS v.10.0. This cooperation shall include, without limitation, providing updated data mappings, transaction type codes, product codes, customer segment identifiers, and any other technical information or documentation needed for the Veridian TMS v.10.0 implementation. FairLend shall participate in user acceptance testing, data validation exercises, and parallel-run activities as reasonably requested by BRB in connection with the system upgrade.
FairLend shall designate a technical point of contact to coordinate with BRB's technology and compliance teams on all matters related to the transaction monitoring system upgrade. BRB anticipates that the data integration and testing process will require active FairLend participation during the period from May through August 2025, and FairLend should plan its resources accordingly.
F. Audit and Examination Access
FairLend is required to grant BRB, its independent consultant (Thornfield Consulting Group LLC), its external auditor (Caldera & Pope LLP), and applicable regulators (including the OCC and the Financial Crimes Enforcement Network ("FinCEN")) full access to FairLend's books, records, systems, and personnel as necessary for compliance testing, audit, examination, or regulatory inquiry purposes related to BRB's BSA/AML and sanctions compliance program. This access right shall be exercisable upon reasonable notice and shall not be subject to limitations or conditions imposed by FairLend that would impede or delay BRB's compliance or regulatory examination activities.
FairLend is further required to cooperate with any on-site or virtual reviews conducted by Thornfield or Caldera & Pope in connection with the BSA/AML program assessment and remediation validation. Such cooperation shall include making FairLend personnel available for interviews, providing responsive documentation within the timeframes requested, and facilitating access to FairLend's technology platforms and data repositories. BRB anticipates that Thornfield will conduct its initial on-site assessment beginning March 1, 2025, and FairLend should be prepared to receive and accommodate Thornfield's requests for access and information beginning on or about that date.
G. Compliance Program Enhancements at FairLend
BRB demands that FairLend review and, as necessary, enhance its own internal BSA/AML and sanctions compliance procedures to ensure alignment with BRB's revised policies and the requirements of the Consent Order. FairLend's internal compliance program must be sufficient to support BRB's BSA/AML obligations with respect to FairLend-originated accounts and transactions, and must not create gaps, inconsistencies, or conflicts with BRB's enterprise-wide compliance framework.
FairLend is required to designate a senior compliance contact to serve as the primary liaison with BRB's compliance team during the remediation period. This individual should be at the level of Chief Compliance Officer, General Counsel, or equivalent, and should have the authority to commit FairLend resources and make decisions on behalf of FairLend in connection with the remediation. FairLend shall provide the name, title, and contact information of this designated liaison to BRB within five (5) business days of receipt of this letter.
FairLend is further required to ensure that its personnel who are involved in customer onboarding, transaction processing, compliance, or risk management functions complete BSA/AML and OFAC training as directed by BRB. BRB will provide FairLend with training materials and curricula, and FairLend shall certify to BRB that all relevant personnel have completed the required training within the timeframes specified by BRB.
VI. Amended BaaS Program Agreement — Compliance Addendum
BRB hereby informs FairLend that BRB is preparing a model Compliance Addendum (the "Compliance Addendum") to be incorporated into all BaaS partner program agreements. BRB will transmit the Compliance Addendum to FairLend for review and execution in the near term, which BRB anticipates will occur during March 2025.
The Compliance Addendum will formalize and memorialize the enhanced BSA/AML and OFAC compliance obligations, data sharing requirements, audit and examination access rights, SAR cooperation requirements, CDD/EDD responsibilities, transaction monitoring cooperation obligations, and remediation cooperation commitments described in this letter. The Compliance Addendum will also include representations, warranties, and covenants by FairLend regarding its compliance program, its cooperation obligations, and its understanding of and commitment to BRB's regulatory requirements.
Execution of the Compliance Addendum by FairLend will be a condition of FairLend's continued participation in BRB's BaaS program. BRB expects FairLend to review, negotiate in good faith, and execute the Compliance Addendum within thirty (30) days of its transmittal. Failure to execute the Compliance Addendum within the required timeframe may result in the exercise of BRB's rights and remedies as described in Section VIII below.
VII. Timeline for Compliance
BRB requires FairLend to provide written acknowledgment of this letter and formal confirmation of its commitment to comply with the demands set forth herein within ten (10) business days of receipt. Such acknowledgment shall be signed by FairLend's Chief Executive Officer or General Counsel and shall be delivered to the contacts identified in Section X below.
FairLend is further required to designate its senior compliance liaison contact, as described in Section V.G above, within five (5) business days of receipt of this letter.
The following key remediation milestones are relevant to FairLend's cooperation obligations and are provided for FairLend's reference and planning purposes:
FairLend is expected to maintain ongoing awareness of these milestones and to ensure that its cooperation is provided sufficiently in advance of each milestone date to enable BRB to meet its obligations to the OCC. BRB's compliance team will provide FairLend with more detailed project plans and specific requests on a rolling basis as the remediation progresses.
VIII. Consequences of Non-Compliance
BRB wishes to be direct and transparent regarding the consequences of non-compliance. FairLend's failure to cooperate fully, promptly, and in good faith with BRB's remediation demands as set forth in this letter may result in BRB exercising its rights under the existing BaaS Program Agreement, applicable law, and regulation. Such actions may include, but are not limited to:
(a) Suspension of New Account Originations. BRB may immediately suspend FairLend's ability to originate new accounts, loans, or other products through BRB's charter.
(b) Restriction or Suspension of Transaction Processing. BRB may restrict or suspend the processing of transactions through FairLend's platform, including the imposition of transaction volume limits, enhanced manual review requirements, or temporary processing holds.
(c) Termination of the BaaS Program Agreement. BRB may terminate the BaaS Program Agreement in accordance with its terms, including upon a determination by BRB that FairLend's failure to cooperate constitutes a material breach of the agreement or poses an unacceptable regulatory risk to BRB.
BRB's obligations under the Consent Order are non-negotiable. The Consent Order carries the full force and effect of a binding regulatory order issued by BRB's primary federal regulator, and non-compliance by BRB could result in further enforcement action, civil money penalties, or other adverse regulatory consequences. BRB will not hesitate to take all necessary steps, including the termination of partner relationships, to satisfy its regulatory obligations and protect the safety and soundness of its operations.
BRB expressly reserves all rights and remedies available to it under the BaaS Program Agreement, applicable law, and regulation, including any rights to indemnification, reimbursement of remediation costs, or other relief as may be provided under the agreement or at law or in equity. Nothing in this letter shall be construed as a waiver of any right or remedy available to BRB.
IX. Confidentiality
FairLend is hereby instructed that while the existence and general terms of the Consent Order are public, the contents of this letter, the details of BRB's remediation plan, all internal communications between BRB and FairLend relating to the remediation, and any information shared between the parties in connection with the remediation are confidential and proprietary. FairLend may not disclose this letter, its contents, or any related information to any third party without BRB's prior written consent, except as may be required by applicable law, regulation, or valid legal process. In the event FairLend receives any request, subpoena, or demand from any third party for information relating to this letter or the remediation, FairLend shall promptly notify BRB before making any disclosure, to the extent permitted by law.
FairLend's confidentiality obligations under this Section IX are in addition to, and not in limitation of, any confidentiality obligations set forth in the BaaS Program Agreement or any other agreement between the parties.
X. Contact Information and Next Steps
FairLend shall direct its written acknowledgment of this letter and all related communications to the following individuals:
Gregory Nardone General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Email: gnardone@belmontridgebank.com
With a copy to:
Patricia Langston Chief Compliance Officer Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Email: plangston@belmontridgebank.com
And a copy to BRB's outside counsel:
Philip Hartmann Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
Email: phartmann@calderwoodharkness.com
BRB looks forward to FairLend's prompt cooperation and to working together constructively and in good faith to achieve the remediation objectives required by the Consent Order. BRB recognizes that the demands set forth in this letter will require significant effort and resource commitment from FairLend, and BRB is prepared to engage collaboratively with FairLend to facilitate a smooth and efficient remediation process. However, the urgency and seriousness of BRB's regulatory obligations require that FairLend treat this matter with the highest priority.
Please do not hesitate to contact me or Ms. Langston should you have any questions regarding the contents of this letter or the next steps required.
XI. Closing
Very truly yours,
BELMONT RIDGE BANK NATIONAL ASSOCIATION
By: ________
Name: Gregory Nardone
Title: General Counsel & Corporate Secretary
Date: ________
cc (via email):
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA
Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA
Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA
Philip Hartmann, Calderwood & Harkness LLP
Yuki Nakamura, Calderwood & Harkness LLP
Prepared by Calderwood & Harkness LLP as outside regulatory counsel to Belmont Ridge Bank National Association. C&H Matter No. 1045-00002. CONFIDENTIAL — NOT FOR FURTHER DISTRIBUTION.
Milestone | Target Date | FairLend Cooperation Required
Thornfield on-site assessment commences | March 1, 2025 | Access to records, systems, and personnel
Interim SAR backlog status report due to OCC | March 31, 2025 | Timely response to SAR investigation inquiries
50% CDD/EDD remediation milestone (approx. 23,500 accounts) | July 15, 2025 | Customer documentation re-collection; data sharing
Veridian TMS v.10.0 deployment | August 1, 2025 | Data-feed cooperation; data mapping; testing
Veridian TMS v.10.0 independent model validation | October 1, 2025 | Continued technical cooperation
OFAC screening fully operational for all BaaS channels | November 1, 2025 | Technical integration; transaction routing confirmation
100% CDD/EDD remediation milestone (all 47,000 accounts) | January 15, 2026 | Completion of all outstanding documentation re-collection
Full compliance program implementation; self-certification to OCC | February 15, 2026 | Full cooperation and program alignment

CONFIDENTIAL — NOT FOR FURTHER DISTRIBUTION

VIA OVERNIGHT COURIER AND EMAIL

BELMONT RIDGE BANK NATIONAL ASSOCIATION

Record

Parties

Dates

Amounts