ATTORNEY-CLIENT PRIVILEGED / WORK PRODUCT DOCTRINE / CONFIDENTIAL
CALDERWOOD & HARKNESS LLP
MEMORANDUM
FROM: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group, Calderwood & Harkness LLP
CONTRIBUTING AUTHORS: Yuki Nakamura, Lead Associate, Litigation (General); Carlos Espinoza, Working Associate, Litigation (General)
TO: Internal — Calderwood & Harkness LLP Engagement Team (C&H Matter No. 1045-00002)
DATE: February 18, 2025
RE: FinCEN Parallel Monitoring of Belmont Ridge Bank NA SAR Filing Remediation — Coordination Strategy and Risk Mitigation
Client: Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845; EIN 13-6148320)
Holding Company: Belmont Ridge Financial Group, Inc. ("BRFG"; NYSE: BRFG; EIN 83-2947561)
Client Address: 680 Lexington Avenue, 22nd Floor, New York, NY 10022
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared in connection with the provision of legal advice to Belmont Ridge Bank National Association ("BRB" or the "Bank"). It is intended solely for use by members of the Calderwood & Harkness LLP engagement team on Matter No. 1045-00002 and, where specifically authorized, designated client personnel. This memorandum should not be disclosed to any third party without the prior written authorization of the undersigned. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
I. PURPOSE AND EXECUTIVE SUMMARY
This memorandum has been prepared to analyze the Financial Crimes Enforcement Network's ("FinCEN") parallel monitoring role in the ongoing Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") remediation effort at Belmont Ridge Bank National Association ("BRB" or the "Bank"), and to develop a proactive coordination strategy designed to mitigate the risk of separate FinCEN enforcement action. The memorandum sets forth our assessment of the enforcement risk landscape, identifies the key regulatory touchpoints, and recommends a detailed engagement protocol to be followed by both Calderwood & Harkness LLP ("C&H") counsel and Bank personnel in all dealings with FinCEN for the duration of the remediation period.
As of the date of this memorandum, FinCEN has not filed a separate enforcement action against BRB. However, FinCEN has expressly reserved its enforcement rights in coordination with the Office of the Comptroller of the Currency ("OCC"), which means that FinCEN retains independent statutory authority to bring an enforcement action under the BSA at any time. This reservation of rights is a material factor that must inform every element of our regulatory engagement strategy going forward. The FinCEN liaison for this matter has been identified as Angela Drummond, Associate Director, Enforcement Division, FinCEN.
The triggering event for this engagement is OCC Consent Order No. OCC-2025-003, issued January 15, 2025, against BRB. The Consent Order identifies five core categories of BSA/AML deficiency, with SAR filing deficiencies — including a backlog of approximately 2,400 unreviewed suspicious activity alerts and an average SAR filing time of 78 days — being the primary area of FinCEN interest. These deficiencies, taken together with the Bank's substantial Banking-as-a-Service ("BaaS") portfolio and related Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD") failures, present a profile that FinCEN has historically found to be indicative of systemic compliance breakdown warranting independent enforcement attention.
Calderwood & Harkness was engaged by BRB on February 10, 2025, to advise the Bank on the comprehensive compliance-program uplift mandated by the Consent Order, including regulatory engagement with both the OCC and FinCEN. This memorandum is one of the initial work product documents prepared by C&H in furtherance of that engagement and is designed to provide a strategic framework for the team.
Key Strategic Recommendation: Our overarching recommendation is that BRB adopt a posture of proactive, transparent engagement with FinCEN through carefully controlled communications. The goal is to demonstrate BRB's genuine commitment to remediating the identified BSA/AML deficiencies — particularly in the area of SAR filing timeliness and quality — without creating unnecessary exposure or making representations that could be used adversely in any subsequent enforcement proceeding by FinCEN, the Department of Justice ("DOJ"), or any other regulatory body. This approach requires rigorous coordination between C&H and BRB personnel, strict adherence to privilege protocols, and meticulous documentation of all regulatory communications. The detailed elements of this strategy are set forth in the sections that follow.
II. BACKGROUND
A. OCC Consent Order and SAR-Related Findings
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order was the culmination of a targeted BSA/AML examination conducted by the OCC from March 2024 through September 2024, during which OCC examiners identified pervasive deficiencies in BRB's BSA/AML compliance program across multiple dimensions.
The Consent Order must be understood in the context of an escalating supervisory history that is likely to be of significant concern to FinCEN. Specifically:
• June 2022 — Matter Requiring Attention ("MRA"): The OCC issued an MRA focused on deficiencies in BSA/AML transaction monitoring. The MRA identified weaknesses in the Bank's use of the Veridian Transaction Monitoring System ("Veridian TMS") and directed the Bank to enhance its alert review and disposition processes.
• November 2023 — Matter Requiring Immediate Attention ("MRIA"): The OCC escalated its supervisory posture by issuing an MRIA targeting OFAC sanctions screening gaps. The MRIA identified material failures in the Bank's screening of transactions processed through its BaaS channel partners, particularly NovaPay Technologies.
• January 2025 — Consent Order No. OCC-2025-003: The Consent Order expressly cites BRB's failure to adequately remediate the deficiencies identified in the prior MRA and MRIA as an aggravating factor. This pattern of escalating supervisory action — from MRA to MRIA to Consent Order over a period of approximately 30 months — is precisely the type of trajectory that FinCEN views as evidence of systemic noncompliance rather than isolated operational failures.
The Consent Order assesses a civil money penalty ("CMP") of $14,500,000 against BRB, payable within 60 days of the effective date (i.e., by March 16, 2025). The CMP reflects the OCC's assessment of the severity and duration of the violations, as well as the Bank's failure to timely remediate prior supervisory findings.
The Consent Order identifies five core categories of deficiency. While all five categories are relevant to the broader remediation effort, three are of particular relevance to FinCEN's enforcement focus:
1. SAR Filing Deficiencies. The Consent Order identifies a backlog of approximately 2,400 potentially suspicious activity alerts generated by the Veridian TMS that remained unreviewed and undispositioned as of September 2024, the close of the OCC examination period. Additionally, the OCC found that BRB's average SAR filing time — measured from the date of initial alert generation to the date of SAR filing with FinCEN — was approximately 78 days. This is materially in excess of the regulatory expectation of timely filing, which FinCEN and the federal banking agencies have consistently interpreted to mean filing within approximately 30 days of the initial detection of facts that may constitute a basis for the filing of a SAR, with a hard statutory deadline of 60 days from initial detection in most circumstances. The 78-day average suggests systemic bottlenecks in the alert-to-SAR pipeline, including insufficient investigator staffing, inadequate workflow management, and deficient quality assurance processes.
2. CDD/EDD Failures. The Consent Order identifies approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BRB's BaaS fintech partners — that lacked adequate CDD/EDD documentation as of the examination date. These accounts were concentrated in BRB's BaaS channels, with NovaPay Technologies, FairLend Digital, and VaultEdge accounting for the vast majority. The CDD/EDD failures have a direct downstream impact on the quality of suspicious activity identification and reporting: without adequate customer information, the Bank's ability to distinguish legitimate from suspicious activity is fundamentally compromised, and the resulting SARs — if filed at all — may lack the contextual information necessary for FinCEN and law enforcement to act on the filings.
3. Model Validation Deficiencies. The Consent Order identifies that BRB's primary transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — nearly four years before the Consent Order date. Furthermore, the tuning parameters governing the system's alert-generation thresholds and detection scenarios had not been updated since October 2022. These deficiencies raise fundamental questions about whether the transaction monitoring system was generating appropriate and comprehensive alerts during the intervening period, and whether the SARs filed by BRB during that period captured all reportable activity. This issue is of acute concern to FinCEN because it suggests that the Bank's SAR filing numbers may materially understate the actual volume of suspicious activity that should have been reported — a gap that can only be assessed through the SAR lookback project discussed in Section V.B below.
In addition to the three categories above, the Consent Order identifies deficiencies in OFAC sanctions screening processes and in BSA/AML governance and oversight. While these categories are addressed in separate C&H work product memoranda, they have cross-cutting implications for the FinCEN engagement strategy that are noted where relevant throughout this document.
B. BRB's SAR Filing Profile
To contextualize the SAR filing deficiencies and assess the scope of potential FinCEN enforcement exposure, it is necessary to understand BRB's SAR filing profile in quantitative terms. The following data has been compiled from information provided by Thomas Ikeda, BSA Officer, and verified against FinCEN's BSA E-Filing system records to the extent accessible:
• SARs Filed in Calendar Year 2024: 3,847
• SARs Filed in Calendar Year 2023: 2,914
• Currency Transaction Reports ("CTRs") Filed in Calendar Year 2024: 28,612
• Transaction Monitoring Alerts Generated in Calendar Year 2024: 41,500
• SAR Conversion Rate (CY 2024): Approximately 9.3% (3,847 SARs filed ÷ 41,500 alerts generated)
• BaaS-Related SARs Filed in Calendar Year 2024: 2,108, representing approximately 54.8% of all SARs (2,108 ÷ 3,847)
Several aspects of this profile merit close attention from a FinCEN risk perspective.
First, the 32% year-over-year increase in SAR filings from CY 2023 to CY 2024 (2,914 to 3,847) is notable. While an increase in SAR filings can reflect improved detection, it can also reflect a belated effort to address previously identified deficiencies — and in the context of a concurrent OCC examination, FinCEN may question whether the increase was driven by genuine process improvements or by reactive filings prompted by the examination itself.
Second, the SAR conversion rate of approximately 9.3% is within the broadly observed range for community and mid-size banks but may be viewed as low in the context of BRB's BaaS-heavy business model, which typically involves higher-risk transaction profiles and customer populations. FinCEN may scrutinize whether the low conversion rate reflects the inadequacy of the Veridian TMS detection scenarios — consistent with the model validation and tuning deficiencies — rather than a genuinely low incidence of suspicious activity.
Third, and most significantly, the high concentration of SARs attributable to BaaS channels is a critical risk factor. BaaS-related SARs constituted approximately 54.8% of all SARs filed by BRB in CY 2024, yet BaaS-related transactions account for a disproportionate share of total transaction volume. BRB currently operates 14 active BaaS fintech partnerships. The total BaaS transaction volume in CY 2024 was approximately $74.3 billion. Of that total, NovaPay Technologies alone accounted for approximately $30.5 billion, or 41% of total BaaS volume. The remaining 13 BaaS partners collectively accounted for approximately $43.8 billion. The concentration of both SAR filings and transaction volume in the BaaS channel — particularly NovaPay — suggests systemic gaps in fintech partnership oversight that FinCEN would find deeply concerning, especially in light of FinCEN's recent enforcement actions and advisories emphasizing the obligations of banks serving as the chartered institution in BaaS arrangements.
C. FinCEN's Posture and Reserved Rights
Based on information obtained from BRB General Counsel Gregory Nardone, prior counsel at Drayton Mercer LLP, and public sources, we understand the following regarding FinCEN's current posture with respect to BRB:
FinCEN has been coordinating with the OCC throughout the 2023–2024 examination cycle and the enforcement process that culminated in the issuance of Consent Order No. OCC-2025-003. This coordination is consistent with established interagency protocols under which the OCC, as the primary federal banking regulator, typically takes the lead in BSA/AML examination and enforcement matters while keeping FinCEN informed and coordinated. FinCEN's involvement during the examination period is understood to have included, at minimum, receipt of examination findings and participation in interagency consultations regarding the enforcement posture.
As of February 10, 2025, no separate FinCEN enforcement action has been filed against BRB. FinCEN has not issued a Notice of Finding, Assessment of Civil Money Penalty, or other formal enforcement instrument. However, and critically, FinCEN has expressly reserved its enforcement rights in connection with the OCC's Consent Order. This reservation means that FinCEN retains independent authority to bring a civil enforcement action against BRB under 31 U.S.C. § 5321 at any time, based on the same or related BSA violations identified in the Consent Order or discovered through subsequent monitoring.
The FinCEN liaison for this matter has been identified as Angela Drummond, Associate Director, Enforcement Division. Ms. Drummond's involvement at the Associate Director level suggests that FinCEN views this matter as significant, and her participation in ongoing monitoring should be treated as a meaningful indicator of FinCEN's continued interest in the matter.
FinCEN's primary areas of monitoring focus are understood to include the following, based on the nature of the deficiencies identified in the Consent Order and FinCEN's known enforcement priorities:
(i) The timeliness and quality of SAR filings, both on a going-forward basis and with respect to the resolution of the existing 2,400-alert backlog;
(ii) The SAR lookback and backlog clearance process, including the methodology employed, the volume and nature of retrospective SARs filed as a result of the lookback, and the adequacy of the Bank's resources devoted to the lookback effort;
(iii) The adequacy of the Bank's transaction monitoring system tuning and independent validation, including the upgrade from Veridian TMS v.8.3 to v.10.0 and the implementation of new detection scenarios calibrated to the Bank's BaaS risk profile.
These areas of focus are consistent with FinCEN's established enforcement priorities and with the specific deficiencies identified in the Consent Order. Our engagement strategy is designed to address each of these areas proactively.
D. Prior Counsel and Prior Engagement with FinCEN
BRB's prior outside regulatory counsel, Drayton Mercer LLP, with Helen Frazier serving as lead partner, represented BRB during the 2023–2024 OCC examination cycle. The Drayton Mercer engagement encompassed the Bank's response to the OCC's targeted BSA/AML examination, including the production of documents, the preparation of management responses, and participation in supervisory communications. The Drayton Mercer engagement was terminated in January 2025, following the issuance of the Consent Order. We understand that the termination was mutual and reflected BRB's determination that a fresh perspective and enhanced expertise were needed for the comprehensive remediation effort.
A critical early action item for this engagement is to ascertain from BRB General Counsel Gregory Nardone the full extent of any prior communications between Drayton Mercer LLP (or BRB directly) and FinCEN regarding the SAR filing deficiencies or any other BSA/AML matters. This includes any formal correspondence, informal telephone calls or meetings, email exchanges, or any other form of communication during the OCC examination period or at any other time. It is essential that we have a complete understanding of the history of FinCEN interactions before initiating any new contact on BRB's behalf. Any prior representations made to FinCEN — whether by prior counsel or by Bank personnel — will constrain the universe of statements we can make in future communications and may create exposure if those representations were inaccurate or incomplete. The team should also request from Gregory Nardone any engagement letters, correspondence files, or communication logs maintained by Drayton Mercer relating to FinCEN contacts, and should review these materials promptly upon receipt.
Additionally, we should determine whether any BRB personnel — particularly Thomas Ikeda (BSA Officer) or Patricia Langston (CCO) — had direct contact with FinCEN representatives at any point during or after the OCC examination, either in their capacity as Bank officers or in connection with routine BSA E-Filing system inquiries. Even seemingly routine interactions can become significant in the context of an enforcement investigation, and we must have a complete picture before proceeding.
III. FINCEN ENFORCEMENT RISK ASSESSMENT
A. Statutory and Regulatory Framework
FinCEN's enforcement authority in this matter derives from the Bank Secrecy Act, as amended, and its implementing regulations. A clear understanding of this framework is essential to assessing the risk of separate FinCEN enforcement action and to designing an effective engagement strategy.
SAR Filing Requirements. The obligation to file SARs is established by 31 U.S.C. § 5318(g), which requires financial institutions to report any suspicious transaction relevant to a possible violation of law or regulation. The implementing regulation for national banks is 31 CFR § 1020.320, which sets forth the specific circumstances under which a SAR must be filed, the content requirements for SAR filings, and the timing requirements. Under 31 CFR § 1020.320(b)(3), a bank is required to file a SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing, with an extension to 60 days if no suspect has been identified at the time of initial detection. The "initial detection" standard has been the subject of significant FinCEN guidance and enforcement action, and FinCEN has consistently taken the position that the filing clock begins when the institution first identifies potentially suspicious activity — which, in the context of automated transaction monitoring, typically means when an alert is generated and assigned for review.
CDD Requirements. The CDD Rule, codified at 31 CFR § 1010.230, requires covered financial institutions, including national banks, to establish and maintain written procedures reasonably designed to identify and verify the identity of beneficial owners of legal entity customers. The CDD Rule also requires ongoing monitoring of customer relationships to identify and report suspicious transactions. BRB's failure to maintain adequate CDD/EDD documentation for approximately 47,000 high-risk accounts has direct implications for the quality and completeness of its SAR filings, as the absence of adequate customer information compromises the Bank's ability to identify, investigate, and report suspicious activity.
FinCEN Civil Money Penalty Authority. FinCEN's authority to assess civil money penalties for BSA violations is established by 31 U.S.C. § 5321. Under § 5321(a)(1), FinCEN may assess a penalty against any domestic financial institution or any partner, director, officer, or employee of such institution for willful violations of BSA requirements. The term "willful" in this context has been interpreted by FinCEN and the courts to encompass not only intentional violations but also conduct that reflects reckless disregard or willful blindness to BSA requirements — a standard that BRB's escalating supervisory history and prolonged failure to remediate known deficiencies may be found to satisfy. The maximum penalty per willful violation can be significant, and FinCEN has the authority to impose penalties on a per-violation basis, meaning that each unfiled or untimely SAR could theoretically constitute a separate violation.
Independence of FinCEN Enforcement Authority. It is critical to understand that FinCEN's enforcement authority under the BSA is independent of and separate from the OCC's prudential supervisory authority. While the OCC exercises BSA/AML examination and enforcement authority as the primary federal regulator of national banks, FinCEN retains its own independent enforcement authority as the Treasury bureau charged with administering the BSA. This means that the OCC's Consent Order does not preclude, preempt, or limit FinCEN's ability to bring a separate enforcement action based on the same underlying conduct. The $14.5 million CMP assessed by the OCC does not "credit" against any potential FinCEN penalty, although FinCEN may consider the OCC penalty as a factor in exercising its enforcement discretion. The distinction between the OCC's prudential supervisory role and FinCEN's independent BSA enforcement role is fundamental to our strategy: the fact that BRB is subject to an OCC Consent Order and is implementing a comprehensive remediation program is relevant to FinCEN's enforcement calculus, but it does not eliminate the risk of separate FinCEN action.
B. Likelihood of Separate FinCEN Enforcement Action
Overall Assessment: Moderate risk. Based on our analysis of the factual record, the applicable legal framework, FinCEN's known enforcement priorities and recent enforcement activity, and the interagency coordination dynamics, we assess the likelihood of a separate FinCEN enforcement action against BRB as moderate. This assessment reflects a balance of significant aggravating factors that weigh in favor of FinCEN action and meaningful mitigating factors that counsel against it. The assessment is subject to revision as additional facts develop, particularly as the SAR lookback project progresses and the nature and volume of previously unreported activity becomes clearer.
Aggravating Factors:
1. Severity and Duration of SAR Filing Deficiencies. The combination of a 78-day average SAR filing time and a backlog of 2,400 unreviewed alerts represents a material and prolonged failure to meet one of the most fundamental obligations under the BSA. FinCEN's enforcement division views timely SAR filing as a core requirement whose breach directly undermines law enforcement's ability to detect and prevent financial crime. The duration of the deficiency — which, based on the model validation and tuning timeline, appears to extend back to at least late 2022 — compounds the severity.
2. Escalating Supervisory History. The trajectory from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) demonstrates a pattern of identified deficiencies that were not adequately addressed, despite progressively more urgent supervisory direction. FinCEN is likely to view this pattern as evidence that BRB's noncompliance was not the result of isolated operational failures but rather reflected a systemic and persistent failure of the Bank's BSA/AML compliance program — a characterization that strengthens the case for willfulness under 31 U.S.C. § 5321.
3. Volume and Nature of Potentially Unreported Suspicious Activity. Given the 47,000 high-risk accounts lacking adequate CDD/EDD, the model validation and tuning gaps dating to late 2022, and the high volume of BaaS-related transactions ($74.3 billion in CY 2024), there is a meaningful probability that the SAR lookback will reveal a significant volume of previously unreported suspicious activity. If the lookback identifies activity involving high-risk typologies — such as structuring, fraud, money laundering, or transactions involving sanctioned jurisdictions — the aggravating effect on FinCEN's enforcement calculus would be substantial.
4. FinCEN's Increased Focus on BaaS/Fintech Compliance. FinCEN has made clear through recent enforcement actions, guidance, and public statements that banks providing BaaS services bear the same BSA/AML compliance obligations with respect to accounts and transactions processed through their fintech partners as they do with respect to their directly-onboarded customers. BRB's BaaS concentration — 14 active fintech partners, $74.3 billion in transaction volume, and 54.8% of SARs attributable to BaaS channels — places the Bank squarely within FinCEN's enforcement focus area. A FinCEN enforcement action against BRB would serve as a visible and impactful signal to the broader banking industry regarding the compliance obligations of BaaS banks.
5. Potential discovery of Significant Unreported Activity in the SAR Lookback. The SAR lookback project, while necessary and appropriate, carries inherent risk: it may reveal previously unreported suspicious activity of a nature or scale that independently triggers FinCEN enforcement interest. The lookback period covers the timeframe during which the Veridian TMS was operating with stale tuning parameters and without independent validation, meaning that the system may have failed to generate alerts for entire categories of suspicious activity. If the lookback reveals material gaps — particularly gaps involving high-risk customers, large-value transactions, or activity indicative of money laundering or terrorist financing — FinCEN may conclude that the deficiencies warrant independent enforcement action regardless of the Bank's remediation efforts.
Mitigating Factors:
1. Existing OCC Penalty. BRB has already been assessed a $14.5 million CMP by the OCC. While this penalty does not legally preclude a separate FinCEN action, it is a factor that FinCEN's enforcement division may weigh in exercising its discretion. FinCEN has historically shown some degree of sensitivity to the cumulative financial burden imposed on an institution by multiple regulatory actions, particularly where the institution is actively remediating.
2. Prompt Engagement of New Counsel and Independent Consultant. BRB's decision to engage C&H on February 10, 2025 — within approximately four weeks of the Consent Order's issuance — and its retention of the Thornfield Consulting Group as the independent consultant required under the Consent Order, both within the prescribed deadlines, demonstrate a level of responsiveness and seriousness of purpose that FinCEN is likely to view favorably.
3. Comprehensive Remediation Program with Substantial Budget. The Bank has committed a $42.5 million budget (exclusive of the $14.5 million CMP) to the remediation effort, for a total outlay of $57.0 million. This budget encompasses SAR backlog clearance, the SAR lookback project, transaction monitoring system upgrades, CDD/EDD remediation, staffing enhancements, and other compliance program improvements. The scale of the investment — which is material relative to BRB's earnings — Signals a genuine commitment to remediation rather than a cosmetic response.
4. Proactive Engagement with FinCEN. Our recommended strategy of voluntary, proactive engagement with FinCEN — as detailed in Section IV below — is designed to demonstrate good faith and a cooperative posture. FinCEN's enforcement division has, in multiple prior matters, credited institutions that engaged proactively and transparently with reduced penalties or declinations of enforcement action.
5. Absence of DOJ Criminal Referral. As of February 10, 2025, no criminal referral has been made to the DOJ. While this fact does not preclude future referral, the absence of a concurrent criminal investigation reduces the immediate severity of the enforcement landscape and suggests that the OCC and FinCEN do not currently view the violations as involving conduct that rises to the level of criminal culpability.
Assessment of Penalty Exposure. If FinCEN were to bring a separate enforcement action, the potential CMP exposure is difficult to quantify with precision at this stage, as it would depend on the scope and nature of the violations ultimately identified — particularly the volume and character of any previously unreported suspicious activity revealed by the SAR lookback. However, based on precedent FinCEN enforcement actions involving SAR filing deficiencies of comparable severity and duration, potential CMPs could range from several million dollars to tens of millions of dollars. In particularly egregious cases involving large volumes of unreported suspicious activity and evidence of willfulness, FinCEN has assessed penalties in excess of $100 million. We do not believe BRB's fact pattern is in that most severe category at present, but this assessment is subject to revision as the lookback progresses. The maximum statutory penalty per willful violation under 31 U.S.C. § 5321 is adjusted periodically for inflation and can be substantial on a per-violation basis, making aggregate exposure highly dependent on the number of individual violations that FinCEN elects to charge.
C. Interaction with Potential DOJ Referral
The OCC Consent Order does not preclude a future criminal referral to the DOJ. While no such referral has been made as of the engagement date, the possibility cannot be excluded, particularly if the SAR lookback reveals evidence of suspicious activity that may involve criminal conduct by Bank employees or customers, or if the facts are viewed as suggesting that Bank officers or employees knowingly or recklessly failed to file SARs in order to facilitate illegal activity or to avoid regulatory scrutiny.
The relationship between FinCEN enforcement and potential DOJ action is a critical consideration in designing our communication strategy. FinCEN enforcement proceedings are civil in nature, and the standards of proof and procedural protections differ from those applicable in criminal proceedings. However, information sharing between FinCEN and DOJ is routine and well-established. FinCEN may share information obtained in the course of its enforcement activities with DOJ, and DOJ may rely on FinCEN findings in initiating or pursuing criminal investigations. Accordingly, any statements made by BRB or its counsel to FinCEN — whether in formal submissions, informal conversations, or voluntary disclosures — must be crafted with the awareness that they may become available to DOJ prosecutors and may be used in a criminal proceeding.
This consideration has several practical implications for our strategy:
(i) All communications with FinCEN should be carefully vetted by C&H before transmission, with particular attention to any characterizations of past conduct, statements regarding the knowledge or intent of Bank personnel, or descriptions of the Bank's decision-making processes.
(ii) Communications should be factual and forward-looking, emphasizing the remediation steps being undertaken, the resources committed, and the progress achieved. They should avoid retrospective characterizations that could be construed as admissions of willfulness, knowledge, or recklessness.
(iii) The engagement team should maintain awareness of the DOJ referral possibility at all times, and should escalate immediately if any developments — including FinCEN communications or SAR lookback findings — suggest that a criminal referral is under consideration or has been made.
(iv) The litigation team (Yuki Nakamura and Carlos Espinoza) should maintain a watching brief on DOJ activity in the BSA/AML enforcement space, including any public indictments, plea agreements, or deferred prosecution agreements involving bank personnel or institutions with fact patterns similar to BRB's.
IV. RECOMMENDED FINCEN ENGAGEMENT STRATEGY
A. Overarching Principles
The FinCEN engagement strategy for BRB is built upon four overarching principles, each of which is essential to achieving the strategic objective of reducing the risk of separate FinCEN enforcement action while protecting the Bank's legal interests:
1. Proactive but Controlled Communication. BRB should adopt a posture of proactive engagement with FinCEN that demonstrates the Bank's cooperative spirit and genuine commitment to remediating the identified BSA/AML deficiencies. At the same time, all communications must be carefully controlled to avoid volunteering information beyond what is necessary to achieve the strategic objective and to avoid creating admissions of liability or statements that could be used adversely in any subsequent enforcement or litigation proceeding. The line between "proactive and transparent" and "undisciplined and overinclusive" is critical, and all communications must be reviewed and approved by C&H before transmission.
2. Alignment with OCC Communications. All FinCEN communications must be consistent with, and must not contradict, representations made to the OCC in connection with the Consent Order remediation. Given that FinCEN and the OCC are coordinating in this matter, any inconsistency between the Bank's representations to the two agencies would be immediately apparent and would undermine credibility with both. The team should maintain a cross-reference matrix tracking all material representations made to each agency to ensure consistency.
3. Privilege Preservation. All substantive FinCEN engagement is to be coordinated through C&H. Internal BRB discussions regarding FinCEN strategy, risk assessment, and communication planning remain privileged attorney-client communications and attorney work product. Bank personnel should be clearly instructed that discussions about FinCEN strategy are privileged and should not be disclosed to third parties, including the independent consultant (Thornfield Consulting Group), without C&H's express authorization. To the extent that Thornfield's work product touches on FinCEN-related matters, the applicability of the Privilege & Confidentiality Side Letter should be carefully assessed.
4. Documentation Discipline. The engagement team will maintain contemporaneous records of all FinCEN communications — whether initiated by BRB/C&H or by FinCEN — in the OCC Correspondence Log & Tracking Memorandum maintained by C&H. These records will include the date, participants, medium (telephone, in-person meeting, email, letter), a summary of topics discussed, any commitments or representations made, and any follow-up action items. This documentation discipline serves multiple purposes: it ensures institutional memory, facilitates consistency in subsequent communications, and creates a contemporaneous record that can be used to demonstrate BRB's cooperative posture if FinCEN's enforcement disposition is ever contested.
B. Initial Outreach to FinCEN
We recommend that C&H — specifically, Philip Hartmann as the responsible partner — initiate a voluntary courtesy call or meeting with Angela Drummond, Associate Director, Enforcement Division, FinCEN, within the first 30 days of the engagement (i.e., by approximately mid-March 2025). This initial outreach should be voluntary, informal in tone, and designed to establish a constructive working relationship.
The purpose of the initial outreach is fourfold:
(i) To introduce Calderwood & Harkness as BRB's new outside counsel for the BSA/AML remediation engagement, replacing Drayton Mercer LLP;
(ii) To acknowledge FinCEN's monitoring role in the remediation process and to convey BRB's understanding of and respect for FinCEN's independent enforcement authority;
(iii) To provide a high-level overview of BRB's remediation plan and timeline, emphasizing the scope of the commitment (including the $42.5 million budget, the engagement of Thornfield Consulting Group, and the immediate commencement of SAR backlog clearance activities);
(iv) To invite ongoing dialogue and to establish a communication channel through which BRB can provide voluntary updates on SAR-specific remediation progress.
Timing Considerations. The timing of the initial outreach should be coordinated with two milestone events:
• The March 16, 2025 CMP payment deadline: BRB's timely payment of the $14.5 million CMP to the OCC will demonstrate compliance with the Consent Order's financial obligations and can be referenced in the FinCEN outreach as concrete evidence of the Bank's commitment to accountability.
• The March 31, 2025 interim SAR backlog status report: The submission of this report to the OCC will provide the first documented evidence of progress on the SAR backlog clearance, which is FinCEN's primary area of interest. Initiating FinCEN outreach in the timeframe between the CMP payment and the backlog status report filing — or shortly thereafter — allows C&H to present FinCEN with tangible evidence of forward momentum.
We recommend that the initial outreach occur during the week of March 17, 2025, following confirmation of the CMP payment, with the understanding that the specific date may be adjusted based on scheduling considerations and the pace of preparatory work.
Preparation. Before the initial outreach, C&H will prepare a set of talking points addressing each of the four purposes identified above. The talking points will be reviewed and approved by BRB General Counsel Gregory Nardone. The talking points will be calibrated to convey the appropriate information without overcommitting to specific remediation outcomes or timelines that may prove difficult to achieve, and without making statements that could be construed as admissions.
Participants. We recommend that the initial outreach be conducted by Philip Hartmann (C&H) with the participation of Patricia Langston (CCO). The CCO's participation signals that BRB's senior compliance leadership is personally engaged in the remediation effort and is knowledgeable about the details of the SAR filing program. We do not recommend that BRB CEO Diane Whitford participate in the initial outreach; CEO-level participation should be reserved for escalation scenarios in which FinCEN signals an intent to pursue formal enforcement action, at which point a CEO-level engagement may be strategically valuable to demonstrate Board-level commitment. Similarly, Gregory Nardone's participation should be considered but may not be necessary for the initial meeting; his role as the primary approver of all FinCEN communications provides sufficient involvement at this stage.
C. Ongoing Communication Protocol
Following the initial outreach, we recommend establishing a regular cadence of voluntary updates to FinCEN. The recommended frequency is quarterly, aligned with BRB's OCC quarterly progress reports, which are due on September 15, 2025 and December 15, 2025, with additional interim milestones as specified in the Consent Order.
Tailored FinCEN Updates. Each FinCEN update should be a purposefully tailored summary of SAR-specific remediation progress. It should not be a copy of the OCC quarterly progress report. While the underlying facts reported will be consistent, the FinCEN update should be framed to address FinCEN's specific monitoring concerns — SAR filing timeliness and quality, backlog clearance, the lookback project, and transaction monitoring system adequacy — rather than the broader range of prudential compliance issues addressed in the OCC report. This tailored approach demonstrates to FinCEN that BRB understands and is specifically addressing FinCEN's concerns, and avoids the appearance of treating FinCEN as an afterthought or secondary audience.
Key Metrics to Report. Each FinCEN update should include the following metrics and information:
• SAR Backlog Clearance Progress: Reported against the baseline of 2,400 unreviewed alerts as of September 2024 and the June 30, 2025 full clearance target. The update should specify the number of alerts reviewed, dispositioned, and — where applicable — converted to SAR filings during the reporting period.
• Current SAR Filing Timeliness: Reported as the average time from alert generation to SAR filing, showing progress from the 78-day baseline toward the 30-day target. The update should break out timeliness for new alerts (generated during the reporting period) separately from backlog alerts being cleared retrospectively.
• SAR Lookback Status and Findings: Reported in summary form, including the number of transactions and accounts re-reviewed, the number of retrospective SARs filed, and a high-level description of the types of suspicious activity identified. This reporting should be carefully calibrated; see Section V.B for discussion of the risks associated with lookback findings.
• Transaction Monitoring Model Validation Status: Progress on the Veridian TMS v.10.0 upgrade, including milestones achieved (e.g., system configuration, user acceptance testing, production deployment, independent model validation). Any interim compensating controls implemented pending the upgrade should be described.
• CDD/EDD Remediation Progress: Reported in terms of the number of high-risk accounts remediated (against the 47,000-account baseline) and the impact of improved CDD/EDD on SAR identification quality.
• Staffing Enhancements: Reported in terms of headcount changes (progress from 62 FTE toward the 77 FTE permanent staffing target), the deployment and performance of 30 Pinnacle Compliance Solutions temporary analysts, and any changes to organizational structure or reporting lines.
Approval and Transmission Protocols. All written communications to FinCEN — including update letters, presentation materials, and data summaries — are to be drafted by C&H (with Yuki Nakamura as the primary drafter and Philip Hartmann as the approving partner) before transmission. No written communication may be sent to FinCEN without Philip Hartmann's express approval.
Verbal communications with FinCEN — including telephone calls and in-person or virtual meetings — are to be conducted with C&H counsel present at all times. Philip Hartmann will serve as the primary C&H spokesperson in FinCEN interactions, with Yuki Nakamura attending in a supporting role. Following each verbal communication, C&H will prepare contemporaneous notes summarizing the discussion, any representations made, any questions posed by FinCEN, and any follow-up action items. These notes will be retained in the C&H matter file and a copy will be provided to Gregory Nardone under privilege.
D. Handling FinCEN Inquiries and Requests
In the event that FinCEN initiates contact with BRB — whether through formal correspondence, informal telephone inquiries, document requests, or any other medium — all inquiries should be directed immediately to Philip Hartmann at C&H. BRB personnel should be instructed to respond to any direct FinCEN contact with a courteous acknowledgment and a statement that the matter will be referred to outside counsel, who will respond promptly.
Personnel Instructions. The following BRB personnel, who are most likely to receive direct FinCEN contacts given their roles, should be specifically instructed not to respond to substantive FinCEN inquiries without C&H involvement:
• Thomas Ikeda, BSA Officer: As the Bank's designated BSA/AML compliance officer, Mr. Ikeda is the most likely point of initial contact for FinCEN. He should be instructed that any FinCEN contact — whether initiated by FinCEN or received in connection with routine BSA E-Filing matters — should be immediately reported to Gregory Nardone and C&H.
• Patricia Langston, CCO: Ms. Langston's role as CCO may lead FinCEN to direct inquiries to her, particularly regarding governance and oversight matters. She should be instructed to defer to C&H on all substantive FinCEN communications.
• Warren Ashby, Head of BaaS Division: Given the concentration of FinCEN's concerns in the BaaS channel, Mr. Ashby may be contacted regarding fintech partner oversight, transaction volumes, or CDD/EDD issues. He should be instructed to refer all FinCEN inquiries to C&H.
Formal Document Requests and Subpoenas. If FinCEN issues a formal document request, administrative subpoena, or other compulsory process, the matter should be handled exclusively through C&H. C&H will conduct a privilege review of all responsive documents before production, will assert all applicable privileges and protections, and will negotiate the scope of production as appropriate. C&H will maintain a detailed production log documenting all documents produced and all privilege assertions.
Escalation Protocol. If FinCEN issues a formal investigative demand — such as a Notice of Investigation or a formal request for testimony — this should be treated as a material escalation of FinCEN's enforcement posture. In such event, the engagement team should immediately reassess the FinCEN strategy, consider whether to request a meeting with senior FinCEN leadership (potentially including the Director or Deputy Director), and evaluate whether modifications to the remediation timeline or communication approach are warranted. Philip Hartmann should also consult with the C&H white-collar practice regarding the potential for DOJ involvement and the implications for BRB's Fifth Amendment and self-incrimination considerations.
V. SAR FILING QUALITY IMPROVEMENTS TO MITIGATE FINCEN RISK
The substantive remediation of SAR filing deficiencies is the single most important factor in mitigating FinCEN enforcement risk. While the engagement strategy and communication protocol described in Section IV are critical, they are ultimately supportive of the core imperative: demonstrating to FinCEN, through concrete and verifiable improvements, that BRB is achieving timely, complete, and high-quality SAR filings. This section addresses the key SAR-related workstreams and their implications for the FinCEN engagement.
A. Immediate SAR Backlog Remediation
The SAR Backlog Triage Protocol, developed as part of Workstream 2 of the Remediation Action Plan, governs the clearance of the approximately 2,400 unreviewed suspicious activity alerts that were outstanding as of September 2024. The full clearance target date is June 30, 2025, representing approximately four and a half months from the date of this memorandum. Achieving this target is the single highest-priority workstream from the perspective of FinCEN risk mitigation, as the existence of a large unreviewed alert backlog is the most visible and easily quantifiable metric of BRB's SAR filing failures.
To support the backlog clearance effort, BRB has contracted with Pinnacle Compliance Solutions to provide 30 temporary FTE analysts dedicated to alert review and disposition. The Pinnacle contract has a total value of $3,600,000, with Andrea Solis serving as the Pinnacle engagement lead. These analysts will be deployed in addition to BRB's permanent BSA/AML compliance staff, which is being increased from 62 FTE to 77 FTE as part of the remediation staffing plan.
Risk-Based Triage Prioritization. The backlog clearance effort will employ a risk-based triage methodology to ensure that the highest-risk alerts are reviewed and dispositioned first. Given that BaaS-related SARs constituted approximately 54.8% of all CY 2024 SARs, BaaS-related alerts should be prioritized within the backlog queue. Within the BaaS category, alerts related to NovaPay Technologies and FairLend Digital — the two largest BaaS partners by transaction volume and SAR count — should receive the highest priority. This risk-based prioritization ensures that the alerts most likely to involve reportable suspicious activity are addressed earliest in the clearance process, and it demonstrates to FinCEN that BRB is applying sound risk management principles to the remediation effort rather than simply processing alerts in chronological order.
FinCEN Communication. In our communications with FinCEN, we should emphasize that SAR backlog clearance is the first-priority workstream, that substantial resources have been committed to the effort, and that BRB is employing a risk-based approach. We should report backlog clearance progress in each FinCEN update, using clear and quantifiable metrics (alerts reviewed, alerts dispositioned, SARs filed from backlog alerts, remaining backlog count).
B. SAR Lookback Project
BRB has budgeted $5,500,000 for the SAR lookback project, which is designed to identify and remediate any suspicious activity that should have been reported but was not, as a result of the transaction monitoring system validation and tuning deficiencies identified in the Consent Order.
Scope. The lookback will encompass a re-review of transaction monitoring alerts and account activity during the period affected by the model validation and tuning deficiencies. Because the Veridian TMS tuning parameters were last updated in October 2022, the lookback period should extend from approximately October 2022 to the present. The scope should include:
(i) A re-review of alerts that were generated during the lookback period and closed without SAR filing, to determine whether any should have resulted in SAR filings under a properly calibrated alert review methodology;
(ii) A re-analysis of transaction patterns and account activity using updated detection scenarios (to be developed as part of the Veridian TMS v.10.0 upgrade) to identify activity that may not have triggered alerts under the outdated parameters but that would be considered suspicious under appropriately tuned scenarios;
(iii) A focused review of high-risk customer segments — particularly the 47,000 accounts lacking adequate CDD/EDD — to assess whether the CDD/EDD deficiencies resulted in failures to identify and report suspicious activity.
Retrospective SAR Filing. It is anticipated that the lookback will identify activity requiring the filing of retrospective SARs. The filing of retrospective SARs is both an obligation and an opportunity: it demonstrates BRB's commitment to full and complete reporting, and it provides FinCEN with information that may be valuable for law enforcement purposes. However, retrospective SAR filings will also attract close FinCEN scrutiny, as the volume and nature of previously unreported activity will inform FinCEN's assessment of the severity of the underlying deficiencies.
Strategy for Retrospective SARs. We recommend the following approach:
• File retrospective SARs promptly upon identification of reportable activity. Delays in filing retrospective SARs — particularly once the lookback is underway and the Bank is on notice of the potential for unreported activity — would be viewed extremely negatively by FinCEN.
• Ensure that all retrospective SARs are filed with high-quality narratives that clearly describe the suspicious activity, the circumstances that led to the failure to file a timely original SAR, and the lookback process through which the activity was identified.
• Voluntarily flag to FinCEN, in our periodic updates, the volume and general nature of retrospective SARs being filed as a result of the lookback. This proactive transparency demonstrates good faith and positions BRB as forthcoming rather than reactive. The updates should characterize the retrospective filings as evidence of BRB's commitment to comprehensive remediation and full compliance with BSA reporting requirements.
Risk of Escalation. The lookback carries inherent risk: it may reveal previously unreported activity of a nature or scale that triggers heightened FinCEN enforcement interest. For example, if the lookback identifies significant volumes of unreported activity involving potential money laundering, structuring, fraud proceeds, or transactions with nexus to sanctioned jurisdictions or individuals, FinCEN may conclude that the scope of the violations warrants separate enforcement action regardless of the Bank's remediation efforts. The litigation team — Yuki Nakamura and Carlos Espinoza — should monitor lookback findings on a real-time basis, with particular attention to potential escalation indicators including:
• discovery of unreported activity involving aggregate values exceeding defined thresholds;
• discovery of activity involving known or suspected criminal actors or organizations;
• discovery of activity with nexus to OFAC-sanctioned jurisdictions, entities, or individuals;
• discovery of patterns suggesting that Bank personnel were aware of suspicious activity and failed to escalate or report it;
• discovery of any evidence suggesting that the failure to report was motivated by a desire to retain customer relationships or avoid regulatory scrutiny.
If any of these indicators are identified, the team should immediately escalate to Philip Hartmann for reassessment of the FinCEN engagement strategy and potential DOJ exposure.
C. Filing Timeliness Improvements
The current average SAR filing time of 78 days from alert generation is materially in excess of the regulatory expectation of timely filing, which FinCEN and the federal banking agencies have consistently interpreted to mean filing within 30 calendar days of initial detection in most circumstances, with a hard statutory maximum of 60 days where no suspect has been identified.
Revised SAR Policy & Procedures. BRB is in the process of revising its SAR Policy & Procedures to establish a 30-day filing target measured from the date of alert generation to the date of SAR filing with FinCEN. The revised policy will establish defined timelines for each stage of the alert-to-SAR workflow:
• Alert Triage and Assignment: Within 2 business days of alert generation.
• Investigation and Documentation: Within 15 calendar days of assignment.
• SAR Drafting: Within 5 calendar days of investigation completion.
• Quality Review and Approval: Within 5 calendar days of draft completion.
• Filing: Within 3 calendar days of approval.
The revised policy will include an escalation mechanism for cases in which the 30-day target cannot be met, requiring documented justification and approval by the BSA Officer or his designee for any extension. Extensions beyond 60 days from initial detection will require CCO approval and will be tracked as exceptions.
Automated Tracking and Reporting. As part of the Veridian TMS v.10.0 upgrade, BRB will implement automated tracking and reporting of SAR filing timelines. The system will generate real-time dashboards showing the status of each alert in the pipeline, aging reports identifying alerts approaching or exceeding timeline targets, and periodic management reports summarizing filing timeliness metrics. User acceptance testing ("UAT") for the upgraded system is targeted for completion by August 1, 2025. Pending the system upgrade, interim manual tracking processes will be maintained by Thomas Ikeda's team.
FinCEN Benchmarking. FinCEN will almost certainly benchmark BRB's filing timeliness against the 30-day standard in evaluating whether separate enforcement is warranted. Our FinCEN communications should report timeliness improvements in quantitative terms, showing the trajectory from the 78-day baseline toward the 30-day target. We should avoid making absolute commitments to achieve the 30-day target by a specific date, as this creates a benchmark against which any shortfall could be viewed as a compliance failure. Instead, we should describe the target as BRB's objective and report progress honestly and transparently.
D. SAR Quality Enhancement
In addition to timeliness, FinCEN will closely scrutinize the quality of BRB's SAR filings — particularly during the remediation period, when BRB's filing practices are under heightened regulatory attention. The SAR Quality Assurance Framework Memorandum, prepared separately, provides detailed guidance on SAR quality standards. Key elements relevant to the FinCEN strategy include:
Quality Assurance Sampling. BRB will implement a QA sampling program covering all SARs filed during the remediation period. The program will include both random sampling (to assess overall quality) and risk-based sampling (targeted at BaaS-related SARs, high-value SARs, and SARs filed by Pinnacle temporary analysts). The QA program will assess each sampled SAR against defined quality criteria, including completeness of the narrative, accuracy of factual descriptions, proper identification of subjects, appropriate characterization of suspicious activity types, and compliance with FinCEN filing instructions.
Narrative Quality. FinCEN has consistently emphasized the importance of SAR narrative quality. A SAR narrative that is vague, conclusory, or lacking in factual detail is of limited value to law enforcement and may be viewed by FinCEN as evidence of a deficient filing process. Particular attention should be paid to BaaS-related SARs, which present unique narrative challenges. BaaS-related SAR narratives should adequately describe:
• The fintech partner channel through which the account was onboarded and through which the transactions were processed;
• The account onboarding context, including the identity verification and CDD/EDD procedures applied (or, where relevant, the absence of adequate CDD/EDD);
• The nature and pattern of the suspicious activity, with sufficient specificity to enable law enforcement to assess and act on the filing;
• Any relevant information regarding the fintech partner's own monitoring or reporting of the activity, if available.
Training. BRB will conduct training for all SAR drafters — both permanent staff and Pinnacle temporary analysts — on FinCEN's expectations for SAR narrative quality. The training curriculum should reference FinCEN's SAR Activity Review publications and related guidance, which provide examples of both effective and deficient SAR narratives. Training records should be maintained and available for FinCEN review upon request.
E. Transaction Monitoring Enhancements
The model validation deficiency — specifically, the failure to independently validate Veridian TMS v.8.3 since March 2021 — is a foundational issue that directly affects the quality of alerts feeding the SAR process. If the transaction monitoring system is not generating appropriate and comprehensive alerts, the entire SAR filing process is compromised regardless of how efficiently the Bank reviews and dispositions the alerts it does receive. FinCEN understands this relationship well and will view the TMS upgrade and validation as a critical element of the remediation.
Veridian TMS v.10.0 Upgrade. BRB has committed to upgrading from Veridian TMS v.8.3 to v.10.0. The implementation cost is $2,800,000, with incremental annual licensing costs of $1,900,000 bringing the new annual contract value to $6,000,000 per year under Veridian Contract No. VA-BRB-2023-0044, which will be amended to reflect the upgrade terms. The upgrade timeline includes:
• System configuration and data migration: Spring 2025
• User acceptance test