CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED AND WORK PRODUCT — SUBJECT TO SUPERVISORY CONFIDENTIALITY (12 C.F.R. PART 4)
DRAFT — FOR INTERNAL REVIEW AND FINALIZATION PRIOR TO FILING
FIRST QUARTERLY PROGRESS REPORT
BELMONT RIDGE BANK NATIONAL ASSOCIATION
Submitted Pursuant to Consent Order No. OCC-2025-003 (Effective January 15, 2025)
Filed with:
Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, NY 10017
Attention:
Jonathan Frey National Bank Examiner / Examiner-in-Charge
Submitted by:
Belmont Ridge Bank National Association OCC Charter No. 48271 FDIC Certificate No. 31845 680 Lexington Avenue, 22nd Floor New York, NY 10022
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Outside Regulatory Counsel to Belmont Ridge Bank NA C&H Matter No. 1045-00002
Responsible Attorney:
Philip Hartmann Responsible Partner Banking & Finance Practice Group Calderwood & Harkness LLP
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This First Quarterly Progress Report (this "Report") is submitted by Belmont Ridge Bank National Association ("BRB" or the "Bank") pursuant to the reporting requirements set forth in Article XII of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025 (the "Consent Order"). This Report covers remediation progress across all five workstreams identified in the Consent Order for the period from February 10, 2025 (the date on which the Bank's outside regulatory counsel and independent consultant engagements were formalized) through September 1, 2025 (the "Reporting Period").
In response to the Consent Order, BRB has engaged Calderwood & Harkness LLP ("C&H") as outside regulatory counsel, with the engagement becoming effective on February 10, 2025. Additionally, in accordance with Article VII of the Consent Order, BRB has engaged Thornfield Consulting Group LLC ("Thornfield" or "TCG") as the OCC-mandated independent consultant under engagement reference TCG-BRB-2025-001. The OCC's written non-objection to Thornfield's appointment was received on February 5, 2025, and the engagement agreement was fully executed on February 10, 2025.
BRB respectfully reports that, as of the close of the Reporting Period, all major milestones through September 1, 2025, have been either met or are substantially on track. The Bank's Board of Directors (the "Board") adopted a formal Board Resolution on February 28, 2025, acknowledging the Consent Order and establishing a dedicated Compliance Committee of the Board, chaired by independent director James Rutherford. The civil money penalty ("CMP") of $14,500,000 was paid in full via wire transfer to the United States Treasury on or before March 16, 2025, satisfying the sixty-day payment deadline specified in the Consent Order. The Board approved a comprehensive remediation budget of $42,500,000, exclusive of the CMP, bringing the Bank's total expected outlay in connection with the Consent Order to $57,000,000.
The Bank's remediation efforts are organized around five principal workstreams, each corresponding to a core deficiency category identified in the Consent Order:
1. Workstream 1 — OFAC Sanctions Screening Remediation: Addressing the failure to screen 100% of transactions processed through fintech Banking-as-a-Service ("BaaS") channels, with particular focus on the approximately 3,800,000 unscreened NovaPay Technologies Inc. transactions identified in Calendar Year 2023.
2. Workstream 2 — SAR Backlog Clearance & Process Improvement: Clearing the backlog of approximately 2,400 potentially suspicious activity alerts that were unreviewed as of September 2024, and implementing sustainable process improvements to ensure timely SAR filing going forward.
3. Workstream 3 — CDD/EDD Remediation: Remediating approximately 47,000 high-risk customer accounts—primarily those onboarded through fintech BaaS partners—that lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation.
4. Workstream 4 — Transaction Monitoring Model Validation & Tuning: Upgrading the Bank's transaction monitoring system from Veridian TMS v.8.3 to Veridian TMS v.10.0, and completing an independent model validation to address the OCC's finding that the system had not been independently validated since March 2021.
5. Workstream 5 — BSA/AML Program Governance & Training Enhancement: Restructuring Board-level governance of BSA/AML compliance, expanding staffing, enhancing training, and updating the Bank's policy suite.
Thornfield Consulting Group delivered its preliminary gap assessment on April 15, 2025, confirming and elaborating upon the five deficiency categories identified in the Consent Order. Informed by Thornfield's assessment, BRB's Comprehensive Remediation Action Plan (the "CRAP" or "Remediation Plan") was submitted to the OCC on May 15, 2025, within the deadline established by Article VIII of the Consent Order.
The following BRB executives are principally responsible for overseeing the remediation program and have been designated as key contacts for purposes of OCC engagement:
BRB notes that the second quarterly progress report is due to the OCC on December 15, 2025, and that the Bank's full compliance self-certification, together with Thornfield's final validation report, is due on February 15, 2026. The Bank remains committed to meeting all remaining milestones and achieving full compliance with the Consent Order within the prescribed timeline.
II. BACKGROUND AND CONSENT ORDER OVERVIEW
A. Regulatory History and Examination Findings
BRB's current regulatory posture is informed by a supervisory history that includes escalating concern by the OCC over the Bank's BSA/AML compliance infrastructure, particularly as it pertains to the Bank's growing fintech BaaS business. The key supervisory events preceding the Consent Order are summarized below.
In June 2022, the OCC issued a Matter Requiring Attention ("MRA") directed at deficiencies in BRB's BSA/AML transaction monitoring program. The MRA identified weaknesses in the calibration and tuning of the Bank's transaction monitoring scenarios, inadequate coverage of certain payment channels, and gaps in the documentation supporting alert disposition decisions. BRB's management acknowledged the MRA and undertook certain remedial steps during the subsequent twelve-month period; however, the OCC determined that those steps were insufficient to fully address the identified concerns.
In November 2023, the OCC escalated its supervisory posture by issuing a Matter Requiring Immediate Attention ("MRIA") specifically targeting gaps in BRB's OFAC sanctions screening processes. The MRIA identified that certain transaction flows originating from BaaS partner channels were not being routed through the Bank's OFAC screening module, creating a material risk that sanctioned parties or sanctioned jurisdictions could process transactions through BRB's infrastructure without detection. The MRIA required immediate corrective action and enhanced reporting to the Board.
Following the issuance of the MRIA, the OCC initiated a targeted BSA/AML examination of BRB, which was conducted over an extended six-month cycle from March 2024 through September 2024. The examination encompassed a comprehensive review of the Bank's BSA/AML compliance program, including its OFAC screening processes, SAR filing practices, CDD/EDD documentation, transaction monitoring system, and Board-level governance. The OCC examination team, led by National Bank Examiner Jonathan Frey as Examiner-in-Charge, identified systemic deficiencies across all five areas that ultimately formed the basis for the Consent Order.
Concurrent with the OCC examination, BRB's external auditor and independent BSA/AML testing firm, Caldera & Pope LLP (engagement partner Franklin Dorsey, CPA), completed an independent BSA/AML test in September 2024. The Caldera & Pope report identified multiple deficiencies that substantially echoed the findings of the OCC examination, including gaps in OFAC screening coverage for BaaS channels, SAR backlog accumulation, inadequate CDD/EDD documentation for high-risk accounts, outdated transaction monitoring model validation, and insufficient Board reporting.
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003, effective immediately, citing five core deficiency categories that required comprehensive remediation within a defined timeline.
B. Core Deficiency Categories Identified
The Consent Order identifies the following five core deficiency categories, each of which corresponds to a remediation workstream addressed in this Report:
1. OFAC Sanctions Screening Deficiencies. The OCC found that BRB failed to screen 100% of transactions processed through its fintech BaaS channels against applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and applicable sectoral sanctions programs. The examination determined that approximately 12% of transactions processed through NovaPay Technologies Inc.—BRB's largest BaaS partner by transaction volume—were not screened during Calendar Year 2023. This represented approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay wire and ACH transactions processed during that period. The screening gap was attributable to inadequate integration between BaaS partner transaction flows and the Veridian OFAC screening module, resulting in certain transaction types bypassing the screening queue.
2. SAR Filing Deficiencies. The OCC identified a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the September 2024 examination date. Furthermore, the OCC found that BRB's average SAR filing time—measured from the date of initial alert generation to the date of FinCEN filing—was approximately 78 days, far exceeding the regulatory expectation of timely filing within 30 days of the initial detection of facts that may constitute a basis for filing a SAR. The backlog and filing delays were attributed to insufficient staffing levels, inadequate triage and prioritization protocols, and the increasing volume of alerts generated by the Bank's expanding BaaS operations.
3. CDD/EDD Failures. The OCC determined that approximately 47,000 high-risk customer accounts—the substantial majority of which had been onboarded through BRB's fintech BaaS partners—lacked adequate CDD or EDD documentation as required by the Bank Secrecy Act, its implementing regulations, and BRB's own policies. The deficiencies encompassed missing or incomplete customer identification information, inadequate beneficial ownership documentation, insufficient risk rating justification, and the absence of required periodic reviews for high-risk accounts.
4. Model Validation Deficiencies. The OCC cited BRB's failure to maintain a current independent validation of its transaction monitoring system, Veridian TMS v.8.3, provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044. The system had not been independently validated since March 2021—a period of more than three years prior to the examination—and the tuning parameters governing alert generation scenarios and thresholds had last been updated in October 2022. The OCC found that the absence of current validation and tuning created a material risk that the system was not effectively detecting potentially suspicious activity, particularly with respect to transaction patterns associated with BaaS channels.
5. Board Oversight Deficiencies. The OCC found that BRB's Board of Directors did not maintain a dedicated Compliance Committee, and that BSA/AML reporting to the Board was limited to quarterly presentations that lacked key metrics essential for effective oversight. Specifically, Board reporting did not include SAR volumes and filing timeliness data, OFAC screening hit rates, risk ratings by BaaS partner, CDD/EDD compliance status, or transaction monitoring alert volumes and SAR conversion rates. The OCC concluded that these governance deficiencies impaired the Board's ability to exercise adequate oversight of the Bank's BSA/AML compliance program.
C. Prior Counsel and Transition
From 2019 through 2024, BRB was represented by Drayton Mercer LLP as its outside regulatory counsel. The engagement was led by Helen Frazier, a partner in Drayton Mercer's financial institutions regulatory practice. Drayton Mercer represented BRB throughout the 2023–2024 OCC examination cycle, including in connection with the Bank's responses to the June 2022 MRA and the November 2023 MRIA, as well as during the targeted BSA/AML examination conducted from March through September 2024.
Following the issuance of the Consent Order on January 15, 2025, BRB's Board and senior management determined that a change in outside regulatory counsel was warranted in light of the severity of the examination findings and the scope of the required remediation program. BRB terminated its engagement with Drayton Mercer LLP in January 2025. Calderwood & Harkness LLP was retained as BRB's new outside regulatory counsel, with the engagement becoming effective on February 10, 2025. C&H's Banking & Finance Practice Group, under the direction of Philip Hartmann, Responsible Partner, has since assumed full responsibility for advising BRB on all aspects of Consent Order compliance and remediation.
D. Key Milestones and Deadlines Summary Table
The following table summarizes the key milestones and deadlines established by the Consent Order, together with BRB's status as of the date of this Report:
III. ORGANIZATIONAL AND GOVERNANCE ACTIONS
A. Board Resolution and Compliance Committee Establishment
On February 28, 2025, the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned subsidiary, Belmont Ridge Bank National Association, adopted a formal Board Resolution (the "Resolution") in compliance with Article IV of the Consent Order, which required Board acknowledgment of the Consent Order within forty-five (45) days of its effective date. The Resolution was unanimously adopted by the full Board and encompasses the following key provisions:
(a) Acknowledgment of the Consent Order. The Board formally acknowledged receipt and acceptance of Consent Order No. OCC-2025-003, recognized the seriousness of the OCC's findings, and committed the Bank to full and timely compliance with all provisions thereof.
(b) Establishment of the Compliance Committee. The Board established a dedicated Compliance Committee as a standing committee of the Board, effective immediately. The Compliance Committee is chaired by James Rutherford, an independent director with extensive experience in financial services regulation, and includes additional independent and non-management directors to ensure objectivity and independent oversight.
(c) Authorization of the Remediation Budget. The Board authorized a comprehensive remediation budget of $42,500,000, exclusive of the $14,500,000 CMP, to fund the Bank's remediation program across all five workstreams. The total financial commitment, including the CMP, amounts to $57,000,000.
(d) Direction to Management. The Board directed BRB's senior management to cooperate fully with Calderwood & Harkness LLP and Thornfield Consulting Group LLC in all aspects of the remediation program, and to provide all information, access, and resources reasonably necessary to achieve timely compliance with the Consent Order.
The Compliance Committee adopted a formal Compliance Committee Charter (the "Charter") that defines the Committee's authority, responsibilities, meeting frequency, reporting obligations, and relationship to the Board's other standing committees. Under the Charter, the Compliance Committee is required to meet no less than monthly during the active remediation period and may convene special sessions as circumstances warrant. The Charter delineates the Committee's oversight responsibilities with respect to each of the five Consent Order workstreams and establishes the Committee's authority to receive reports directly from BRB's CCO, BSA Officer, CRO, General Counsel, and outside counsel.
The Charter further defines the Compliance Committee's relationship to the Audit Committee (chaired by Margaret Dao) and the Risk Committee (chaired by Arthur Connelly), establishing protocols for information sharing and coordination to avoid duplication of effort while ensuring comprehensive oversight. Matters of internal audit assurance related to remediation activities are coordinated between the Compliance Committee and the Audit Committee, while enterprise risk management integration is coordinated with the Risk Committee.
In connection with the establishment of the Compliance Committee, BRB amended its Corporate Bylaws to incorporate provisions governing the Committee's composition, authority, and operating procedures. The Bylaw amendments were adopted by the Board on February 28, 2025, concurrently with the Resolution.
As a result of these governance enhancements, the Board now receives enhanced monthly reporting that includes the following key metrics and data points:
• SAR volumes (total filed, by BaaS partner, and by alert type)
• SAR filing timeliness (average days from alert generation to FinCEN filing)
• OFAC screening hit rates (total hits, true matches, false-positive rate)
• CDD/EDD remediation progress (accounts remediated against 47,000 account target)
• Transaction monitoring alert volumes and SAR conversion rates
• BaaS partner risk ratings (current tier and trend)
• Budget utilization and variance from approved remediation budget
B. Senior Management Accountability
BRB has clearly defined senior management accountability for the remediation program, with designated executives responsible for each aspect of the Bank's compliance with the Consent Order:
Patricia Langston, Chief Compliance Officer, has been designated as the executive sponsor for the remediation program. Ms. Langston, who was appointed CCO in January 2024, has direct reporting responsibility to the Compliance Committee and the full Board on all matters related to remediation progress, and serves as the Bank's primary compliance liaison with the OCC. Ms. Langston oversees the day-to-day operations of the compliance function and has authority to escalate resource requests and risk issues directly to the Board.
Thomas Ikeda, BSA Officer / AML Program Director, serves as the day-to-day remediation program director, responsible for coordinating activities across all five workstreams, managing the engagement with Pinnacle Compliance Solutions LLC (the temporary staffing provider), overseeing the SAR backlog clearance effort, and ensuring that remediation activities remain aligned with the Comprehensive Remediation Action Plan. Mr. Ikeda, appointed as BSA Officer in March 2023, reports to Ms. Langston and has direct communication channels with the Compliance Committee.
Diane Whitford, Chief Executive Officer & Board Chair, and Raymond Okoye, President & Chief Operating Officer, provide executive oversight of the remediation program at the enterprise level. Ms. Whitford and Mr. Okoye participate in monthly Compliance Committee sessions and receive weekly status briefings from Ms. Langston.
Gregory Nardone, General Counsel & Corporate Secretary, coordinates with C&H on all regulatory engagement and reporting matters, including the preparation of this Report and all communications with the OCC, FinCEN, and other regulatory agencies. Mr. Nardone also oversees the legal aspects of BaaS partner remediation engagements and the negotiation of compliance addenda to existing BaaS program agreements.
Melissa Chu, Chief Risk Officer, is responsible for integrating remediation activities and outcomes into BRB's enterprise risk management framework, ensuring that BSA/AML and sanctions compliance risks are appropriately reflected in the Bank's risk appetite statement, risk register, and capital planning processes.
Warren Ashby, Head of Fintech Partnerships / BaaS Division, leads the Bank's engagement with its fourteen BaaS partners on all compliance matters arising from the Consent Order, including the negotiation and execution of compliance addenda, the implementation of enhanced data sharing requirements, and the development of the BaaS Compliance Oversight Framework.
Linda Petrosian, Chief Information Officer / Chief Technology Officer, oversees the technology remediation workstreams, including the Veridian TMS v.10.0 upgrade, the OFAC screening module enhancement, and the integration of upgraded systems with BaaS partner transaction flows.
Derek Ballard, Head of Internal Audit, provides independent assurance testing of remediation activities, ensuring that implemented controls are operating effectively and that remediation outcomes are sustainable. Mr. Ballard's team conducts periodic testing in coordination with, but independent from, Thornfield's ongoing monitoring activities.
C. Civil Money Penalty Payment
In accordance with Article III of the Consent Order, which required payment of the $14,500,000 CMP within sixty (60) days of the Consent Order's effective date, BRB remitted payment in full via wire transfer to the United States Treasury on or before March 16, 2025. The wire transfer was originated from BRB's Federal Reserve account and directed to the account designated by the OCC for receipt of civil money penalty payments.
Confirmation of receipt of the CMP payment was received from the OCC's Northeastern District Office. A copy of the wire transfer confirmation and the OCC acknowledgment letter are maintained in BRB's Consent Order compliance files and are available for review upon request.
The CMP payment was reflected in BRB's first quarter 2025 financial statements as an extraordinary regulatory expense and was disclosed in BRFG's Form 10-Q filed with the Securities and Exchange Commission for the quarter ended March 31, 2025.
IV. INDEPENDENT CONSULTANT ENGAGEMENT AND ACTIVITIES
A. Engagement of Thornfield Consulting Group LLC
Pursuant to Article VII of the Consent Order, which requires BRB to engage an independent consultant acceptable to the OCC, the Bank selected Thornfield Consulting Group LLC as its independent consultant for purposes of assessing, monitoring, and validating the Bank's remediation activities. Thornfield's principal offices are located at 200 Park Avenue South, 15th Floor, New York, NY 10003.
The OCC provided its written non-objection to the appointment of Thornfield on February 5, 2025, following submission of Thornfield's qualifications, proposed scope of work, and disclosures regarding potential conflicts of interest. The formal engagement agreement between BRB and Thornfield was executed on February 10, 2025, under engagement reference TCG-BRB-2025-001.
The engagement is structured as follows:
Term: Twelve months, from February 2025 through February 2026, coinciding with the Consent Order's compliance self-certification deadline.
Fees: Fixed engagement fee of $6,500,000 for the twelve-month term, payable in monthly installments of $541,666.67.
Expenses: Expenses are capped at $400,000 for the engagement term, covering travel, document production, and incidental costs.
Total Engagement Cost: $6,900,000 ($6,500,000 fees plus $400,000 expenses).
Thornfield is represented by Hargrove & Stein PC (7 Times Square, 34th Floor, New York, NY 10036) as its outside counsel for purposes of the engagement.
B. Thornfield Team and Activities
The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, who brings more than twenty years of experience in BSA/AML compliance, regulatory enforcement, and financial crimes advisory services. Dr. Castellano's team includes the following senior professionals:
• Robert Eastman, Senior Director, AML Transaction Monitoring: Responsible for assessing and validating remediation activities related to transaction monitoring model validation, tuning, and the Veridian TMS v.10.0 upgrade.
• Jennifer Hwang, Director, Sanctions & OFAC Compliance: Responsible for assessing and validating OFAC sanctions screening remediation across all BaaS partner channels.
• Nathaniel Burgess, Director, Fintech & Payments Compliance: Responsible for assessing BaaS partner compliance oversight, CDD/EDD remediation, and the integration of compliance controls within BaaS operational workflows.
Thornfield commenced its on-site assessment at BRB's principal offices on March 1, 2025, in accordance with the Consent Order's timeline. The on-site phase encompassed an extensive review of BRB's existing BSA/AML policies, procedures, and controls; interviews with key personnel across the compliance, risk, technology, internal audit, and BaaS divisions; system walkthroughs and data analysis; and a review of the Bank's documentation and records related to each of the five deficiency categories.
On April 15, 2025, Thornfield delivered its preliminary gap assessment (the "Gap Assessment"), which confirmed and elaborated upon the five core deficiency categories identified in the Consent Order. The Gap Assessment provided granular detail regarding the root causes of each deficiency, the scope of remediation required, and Thornfield's preliminary recommendations for remediation strategies and priorities. The Gap Assessment served as a foundational document informing BRB's development of the Comprehensive Remediation Action Plan, which was submitted to the OCC on May 15, 2025.
Since the delivery of the Gap Assessment, Thornfield has maintained an active monitoring and validation presence. Specific ongoing activities include:
• Bi-weekly status calls with C&H (Philip Hartmann), BRB CCO (Patricia Langston), and BRB General Counsel (Gregory Nardone) to review remediation progress, discuss emerging issues, and coordinate reporting.
• Ongoing monitoring and validation of remediation activities across all five workstreams, including periodic on-site reviews, documentation testing, and system configuration assessments.
• Review and comment on revised policies, procedures, and frameworks developed by BRB as part of the remediation program.
• Independent assessment of BaaS partner compliance engagement activities and the adequacy of enhanced oversight controls.
In connection with the engagement, BRB, C&H, and Thornfield executed a Privilege & Confidentiality Side Letter establishing a common-interest privilege framework. This framework preserves the attorney-client privilege and work product protections applicable to communications among the parties while ensuring that Thornfield has access to the information necessary to fulfill its mandate. Additionally, an Access & Cooperation Protocol has been established governing Thornfield's access to BRB systems, personnel, documents, and records. The Protocol requires BRB personnel to cooperate fully with Thornfield's requests and provides for expedited resolution of any access disputes.
C. Thornfield Interim Findings and Observations
As of the date of this Report, Thornfield has provided interim observations regarding BRB's remediation progress. A more detailed summary of Thornfield's observations is attached as Appendix C to this Report. The key observations are summarized as follows:
Areas of Satisfactory Progress. Thornfield has observed that BRB has demonstrated strong organizational commitment to the remediation program, as evidenced by the timely establishment of the Compliance Committee, the prompt payment of the CMP, the rapid engagement of outside counsel and the independent consultant, and the timely submission of the Comprehensive Remediation Action Plan. Thornfield has noted that the SAR backlog clearance effort has achieved significant throughput, that the CDD/EDD remediation program is well-organized and appropriately prioritized, and that the governance enhancements implemented to date represent meaningful improvement in Board-level oversight.
Areas Requiring Continued Attention or Acceleration. Thornfield has identified certain areas where the pace of remediation warrants continued focus, including the integration of the upgraded OFAC screening module across all fourteen BaaS partner transaction flows, the completion of the Veridian TMS v.10.0 deployment and post-deployment validation, and the execution of compliance addenda by certain BaaS partners that have been slower to engage. Thornfield has also recommended that BRB accelerate its permanent hiring efforts to reduce reliance on temporary staffing from Pinnacle Compliance Solutions.
Thornfield's final validation report remains on track for delivery on February 15, 2026, consistent with the Consent Order timeline.
V. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION
A. Deficiency Summary
The OCC's examination determined that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through the Bank's fintech BaaS channels. The deficiency was most acute with respect to transactions originated by NovaPay Technologies Inc., BRB's largest BaaS partner, where approximately 12% of wire and ACH transactions were not routed through the Bank's OFAC screening module during Calendar Year 2023. This represented approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed during that period.
The root cause of the screening gap was traced to inadequate integration between the transaction flow architectures employed by BaaS partners and the Veridian OFAC screening module. Certain transaction types—particularly high-volume, low-value ACH transactions and certain micro-payment flows—were processed through pathways that bypassed the screening queue due to misconfigured routing rules and incomplete API integration. The gaps existed not only for NovaPay but also, to varying degrees, across other BaaS partner channels, though the NovaPay volume represented the most significant exposure.
The severity of this deficiency cannot be understated. The failure to screen transactions against OFAC sanctions lists creates a risk that BRB may have processed transactions involving sanctioned parties, sanctioned countries, or sanctioned programs in violation of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act ("TWEA"), and the regulations administered by the Office of Foreign Assets Control. The Consent Order requires BRB to achieve 100% screening coverage across all transaction channels, including all BaaS partner flows, and to implement and validate controls that ensure sustained compliance.
B. Remediation Actions Taken
BRB has undertaken the following remediation actions with respect to OFAC sanctions screening:
Veridian OFAC Module Enhancement. BRB has engaged Veridian Analytics Inc. (1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303) for an OFAC module enhancement under the Bank's existing amended Master Services Agreement (Contract No. VA-BRB-2023-0044). The engagement is managed by Priya Subramanian, Veridian's Vice President of Client Solutions. A detailed Statement of Work has been executed covering the following components:
(i) Real-time screening integration for all fourteen BaaS partner transaction flows, encompassing wire transfers, ACH originations and receipts, card-present and card-not-present transactions, peer-to-peer transfers, and loan disbursements;
(ii) Enhanced batch processing capabilities for retrospective and end-of-day screening runs;
(iii) Comprehensive list management functionality covering the SDN List, the Consolidated Sanctions List, sectoral sanctions identifications, the Non-SDN Menu-Based Sanctions List, and other OFAC-administered lists, with automated daily list updates;
(iv) An upgraded hit disposition workflow with configurable escalation rules, documentation requirements, audit trail functionality, and integration with the Bank's case management system.
Interim Manual Screening Procedures. Pending completion of the automated system remediation, BRB has implemented interim manual screening procedures for NovaPay and other BaaS partner transaction flows. These procedures involve the daily extraction of transaction data from BaaS partner feeds, manual screening against current OFAC lists using a combination of the existing Veridian screening tool (for supported transaction types) and supplementary name-matching software, and escalation of potential hits to the OFAC compliance team for investigation and disposition. While the interim procedures impose significant operational burden, they ensure that BRB maintains screening coverage during the system upgrade period.
OFAC Compliance Gap Analysis. With the assistance of C&H and Thornfield, BRB completed a privileged OFAC Compliance Gap Analysis that mapped the Bank's existing screening coverage against the full universe of transaction types and channels, identified all gaps and their root causes, and provided the analytical foundation for the remediation plan. The Gap Analysis is maintained as privileged attorney-client communication and work product.
Revised OFAC Compliance Policy. A comprehensive revised OFAC Compliance Policy has been drafted and approved by the Compliance Committee. The revised policy sets forth BRB's commitment to screening 100% of transactions across all channels, establishes clear accountability for OFAC compliance at the management and Board levels, defines the Bank's obligations with respect to list management, screening, hit disposition, and reporting, and addresses the specific requirements applicable to BaaS partner transaction flows.
OFAC Screening Procedures Manual. A revised OFAC Screening Procedures Manual has been drafted covering real-time and batch processing screening workflows, hit review and disposition procedures, false-positive management and suppression controls, escalation protocols to the BSA Officer and senior management, reporting obligations to OFAC (including blocked property reports and rejected transaction reports), recordkeeping requirements, and quality assurance testing procedures.
Voluntary Self-Disclosure Analysis. In consultation with C&H, BRB has completed an analysis of whether a voluntary self-disclosure ("VSD") to OFAC is warranted with respect to the NovaPay screening gaps identified during the examination period. The analysis considered the nature, extent, and duration of the screening failures, the results of a review of the unscreened transactions for potential sanctions matches, the Bank's remedial actions, and the legal and strategic implications of a VSD filing. The conclusions of this analysis are subject to attorney-client privilege; however, BRB is prepared to discuss the status of its VSD considerations with the OCC in the context of supervisory communications.
C. Progress Against Milestones
Veridian TMS v.10.0 Upgrade. The OFAC module enhancements are being delivered as a component of the broader Veridian TMS v.10.0 upgrade. The status of the system deployment and User Acceptance Testing ("UAT") is reported in detail under Workstream 4 (Section VIII.C of this Report). The TMS v.10.0 upgrade includes enhanced OFAC screening capabilities that are integral to achieving full remediation of the sanctions screening deficiency. The target for UAT completion and deployment was August 1, 2025.
OFAC Screening for BaaS Channels. Interim manual screening controls remain in place for all BaaS partner transaction flows. Full automated operationalization of the upgraded OFAC screening module across all fourteen BaaS partner channels is targeted for November 1, 2025. As of the end of the Reporting Period, integration testing has been completed for seven of the fourteen BaaS partner transaction flows, with the remaining seven in various stages of configuration and testing. The integration work requires partner-by-partner API configuration, data mapping, and end-to-end testing to ensure that all transaction types originated by each partner are captured by the screening module.
OFAC Screening Hit Statistics (CY 2024 Baseline). For reference, BRB's OFAC screening hit statistics for Calendar Year 2024 are as follows:
The upgraded OFAC module in Veridian TMS v.10.0 is expected to improve hit accuracy through enhanced fuzzy matching algorithms, more granular list-matching criteria, and improved suppression of known false-positive patterns. BRB anticipates a reduction in false-positive rates while maintaining—and potentially improving—detection of true matches.
OFAC Remediation Testing Plan. An OFAC Remediation Testing Plan has been developed in consultation with Thornfield, defining the testing methodology, sample sizes, frequency, and acceptance criteria that will be used to validate that 100% of BaaS transactions are screened post-remediation. The testing plan employs a combination of automated coverage verification (confirming that all transaction records in the core banking system are matched to corresponding screening records), statistical sampling of screened transactions for quality review, and end-to-end testing using synthetic sanctioned-party data to verify detection capability.
D. Remaining Actions and Timeline
The following key actions remain for completion of OFAC sanctions screening remediation:
• November 1, 2025: Full automated OFAC screening operationalization for all fourteen BaaS partner channels. This is the Consent Order milestone for achieving 100% automated screening coverage.
• Ongoing post-implementation: Execution of the OFAC Remediation Testing Plan to validate screening coverage and effectiveness across all channels.
• Ongoing: Monitoring of false-positive rates and hit disposition accuracy, with periodic adjustments to screening parameters as warranted by performance data.
• February 15, 2026: Thornfield validation of OFAC screening remediation as part of the final validation report.
BRB is confident that the November 1, 2025 milestone remains achievable based on current progress. The Bank will continue to maintain interim manual screening procedures for any BaaS partner channels that have not been fully integrated into the automated system until such integration is complete and validated.
VI. WORKSTREAM 2: SAR BACKLOG CLEARANCE & PROCESS IMPROVEMENT
A. Deficiency Summary
As of September 2024, the date of the OCC examination, BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts that had been generated by the Bank's transaction monitoring system but remained unreviewed. These alerts had accumulated over a period of months as alert volumes—driven in significant part by the Bank's expanding BaaS operations—outpaced the capacity of BRB's BSA/AML compliance team to conduct timely investigation and disposition.
The OCC further found that BRB's average SAR filing time was approximately 78 days from the date of initial alert generation to the date of FinCEN filing. This exceeded the regulatory expectation of timely filing within 30 days by a substantial margin, creating a risk that potentially suspicious activity was not being reported to law enforcement in a timely manner.
BaaS-related SARs constituted a significant and growing proportion of BRB's total SAR filings. In Calendar Year 2024, BaaS-related SARs accounted for 2,108 of the Bank's 3,847 total SARs filed, representing 54.8% of all filings. This concentration reflected the volume and complexity of transaction activity flowing through BRB's BaaS partner channels and underscored the need for enhanced staffing, processes, and technology to manage the Bank's SAR obligations.
B. Remediation Actions Taken
Engagement of Pinnacle Compliance Solutions LLC. To provide the staffing capacity necessary to clear the backlog and sustain ongoing SAR operations during the remediation period, BRB engaged Pinnacle Compliance Solutions LLC ("Pinnacle"), located at 90 Broad Street, 20th Floor, New York, NY 10004. The engagement is managed by Andrea Solis, Pinnacle's Director of Managed Services, under a Managed Services Agreement (SOW Reference PCS-BRB-2025-0012). The key terms of the engagement are as follows:
• Staffing Level: 30 full-time-equivalent BSA/AML analysts
• Monthly Cost per FTE: $10,000
• Monthly Total: $300,000
• Engagement Term: 12 months
• Total Engagement Cost: $3,600,000
Pinnacle analysts have been deployed for SAR backlog triage, alert review, investigation, SAR narrative drafting, and quality review, all under the direct supervision of Thomas Ikeda, BSA Officer. Pinnacle analysts operate within BRB's systems and are subject to the Bank's policies, procedures, and quality standards. Each Pinnacle analyst received orientation training on BRB's specific risk profile, BaaS partner ecosystem, alert typologies, and SAR drafting standards prior to commencing substantive work.
SAR Backlog Triage Protocol. BRB implemented a SAR Backlog Triage Protocol establishing risk-based criteria for prioritizing the review of the approximately 2,400 unreviewed alerts. The Triage Protocol employs the following risk-ranking factors:
(i) Transaction amount and aggregate volume associated with the alert;
(ii) Customer risk rating at the time of alert generation;
(iii) Alert type and scenario (e.g., structuring, rapid movement of funds, high-risk geography, unusual pattern);
(iv) BaaS partner association and the risk rating of the applicable partner;
(v) Duration of time the alert has remained unreviewed.
Alerts were categorized into three triage tiers—Critical, Elevated, and Standard—with corresponding disposition timelines and escalation thresholds. Critical-tier alerts, which encompassed the highest-risk and oldest unreviewed items, were prioritized for immediate review and disposition.
SAR Lookback Project. In addition to clearing the existing backlog, BRB has initiated a SAR Lookback project with an allocated budget of $5,500,000. The SAR Lookback is designed to identify and remediate any potentially suspicious activity that may have gone undetected or unreported during the period preceding the Consent Order. The lookback scope encompasses a defined historical period, applicable transaction types, relevant customer populations, and a statistically valid sampling methodology. The lookback is being conducted under the direction of C&H and with Thornfield's oversight and validation.
Interim SAR Backlog Status Report. In accordance with the Consent Order, BRB submitted an Interim SAR Backlog Status Report to the OCC on March 31, 2025. The report detailed the Bank's triage methodology, staffing plan, projected clearance timeline, and initial backlog reduction progress.
C. Progress Against June 30, 2025 Backlog Clearance Target
The Consent Order established June 30, 2025, as the target date for clearance of the approximately 2,400 unreviewed alerts that constituted the SAR backlog. As of June 30, 2025, BRB reports the following progress:
Of the original 2,400 unreviewed alerts, 2,276 alerts (94.8%) had been fully dispositioned by the June 30, 2025 target date. The remaining 124 alerts were in advanced stages of investigation and were expected to be fully dispositioned within thirty days of the target date. The slight shortfall was attributable to the complexity of certain multi-party, cross-border investigation files that required additional documentation gathering and analysis.
The disposition breakdown of the 2,276 fully dispositioned alerts is as follows:
The remaining 124 alerts that were pending as of June 30, 2025, were categorized as follows: 78 alerts in final SAR narrative drafting and quality review, 31 alerts awaiting additional information from BaaS partners, and 15 alerts subject to enhanced investigation involving coordination with law enforcement.
The deployment of 30 Pinnacle FTEs significantly enhanced BRB's throughput capacity. Prior to the Pinnacle engagement, BRB's existing team was processing an average of approximately 120 alerts per month. With the addition of Pinnacle staff and the implementation of the Triage Protocol, monthly throughput increased to an average of approximately 410 alerts per month during the Reporting Period.
SAR Filing Timeliness. BRB's average SAR filing time has improved substantially during the Reporting Period. As of the end of the Reporting Period, the Bank's average filing time for new alerts (those generated during the Reporting Period, as distinct from backlog items) was approximately 38 days from alert generation to FinCEN filing. While this represents a significant improvement from the 78-day baseline identified in the Consent Order, it remains above the 30-day target. BRB is implementing additional process efficiencies and expects to achieve the 30-day target on a sustained basis by the fourth quarter of 2025.
Quality Review Results. Quality assurance reviews of Pinnacle analyst work product have been conducted on an ongoing basis, using both random and risk-based sampling. The quality review program evaluates the accuracy and completeness of alert triage decisions, investigation documentation, SAR narrative quality, and filing accuracy. As of the end of the Reporting Period, quality review sampling encompassed approximately 15% of all Pinnacle-dispositioned alerts. The error rate identified through quality review was approximately 3.2%, consisting primarily of documentation deficiencies (e.g., incomplete investigative memoranda) rather than substantive errors in SAR filing decisions. All identified errors have been remediated, and feedback has been incorporated into Pinnacle analyst training.
D. Process Improvement and Sustainability
Beyond the immediate backlog clearance effort, BRB has implemented structural process improvements designed to prevent the recurrence of SAR backlogs and ensure sustainable compliance:
Revised SAR Policy & Procedures. BRB has implemented revised SAR Policy & Procedures that establish a 30-day filing target for all SARs from the date of initial alert generation, define escalation protocols for alerts exceeding defined age thresholds, specify quality review requirements for all SAR narratives prior to filing, and set narrative drafting standards to ensure consistency and completeness.
SAR Quality Assurance Framework. A formal SAR Quality Assurance ("QA") Framework has been established, incorporating the following elements:
(a) QA Sampling Methodology: A combination of random sampling (minimum 10% of all filed SARs) and risk-based sampling (targeted review of SARs involving high-risk customers, high-value transactions, and BaaS partner channels).
(b) Error Tracking: Systematic tracking of errors identified through QA reviews, categorized by type, severity, and analyst.
(c) Root Cause Analysis: Investigation of recurring error patterns to identify systemic issues requiring process or training remediation.
(d) Corrective Action Procedures: Defined procedures for remediating identified errors, including refiling of deficient SARs, analyst retraining, and process modifications.
SAR Filing Statistics. The following table presents SAR filing statistics for the Reporting Period in comparison to Calendar Year 2024 and Calendar Year 2023 baselines:
CTR Filing. For reference, BRB filed 28,612 Currency Transaction Reports ("CTRs") in Calendar Year 2024. CTR filing volumes during the Reporting Period remain consistent with prior trends. BRB's CTR processes were not identified as a specific deficiency in the Consent Order, but are subject to ongoing monitoring as part of the enhanced BSA/AML program.
Transaction Monitoring Alerts. In Calendar Year 2024, BRB's transaction monitoring system generated 41,500 total alerts, with a SAR conversion rate of 9.3% (3,847 SARs filed ÷ 41,500 alerts). BRB anticipates that the upgrade to Veridian TMS v.10.0, with retuned parameters and enhanced detection scenarios, will produce changes in both alert volumes and SAR conversion rates. The Bank is preparing for potential increases in alert generation during the initial post-deployment period as the upgraded system detects activity that may have been below prior detection thresholds.
E. Remaining Actions and Timeline
• Completion of SAR Lookback Project: The SAR Lookback is expected to be substantially complete by November 2025, with final reporting to the Compliance Committee and submission to the OCC as part of the second quarterly progress report.
• Ongoing Monitoring of SAR Filing Timeliness: BRB will continue to track and report filing timeliness, with a target of achieving sustained 30-day or better filing times by the fourth quarter of 2025.
• Transition from Pinnacle to Permanent Staffing: As BRB completes its permanent hiring of 15 additional FTEs (discussed in Section IX.C), the Bank will begin transitioning responsibilities from Pinnacle temporary staff to permanent BRB employees. The transition is planned to occur on a phased basis beginning in the fourth quarter of 2025, with full transition targeted for the first quarter of 2026.
• Continued QA Monitoring: The SAR Quality Assurance Framework will remain in effect as a permanent component of BRB's BSA/AML compliance program.
VII. WORKSTREAM 3: CDD/EDD REMEDIATION
A. Deficiency Summary
The OCC found that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation as required by the Bank Secrecy Act, FinCEN's CDD Rule (31 C.F.R. § 1010.230), and BRB's internal policies. The substantial majority of these accounts were onboarded through BRB's fintech BaaS partners, where the division of responsibility for customer onboarding, identification, verification, and due diligence had been inadequately defined and inconsistently implemented.
The Consent Order established a phased remediation approach: BRB is required to remediate 50% of the affected accounts (23,500 accounts) by July 15, 2025, and to achieve 100% remediation (all 47,000 accounts) by January 15, 2026. A dedicated budget of $4,300,000 has been allocated to the CDD/EDD remediation workstream.
B. Remediation Actions Taken
CDD/EDD Remediation Methodology & Prioritization. BRB developed and implemented a CDD/EDD Remediation Methodology & Prioritization Memorandum (the "Remediation Methodology") establishing a risk-based approach to triaging and remediating the 47,000 affected accounts. The Remediation Methodology prioritizes accounts based on the following criteria:
(i) Risk Score: Accounts with higher customer risk scores are prioritized for earlier remediation, as they present the greatest compliance and reputational risk.
(ii) Transaction Volume: Accounts with higher transaction volumes are prioritized to reduce the Bank's exposure to potentially unmonitored high-risk activity.
(iii) BaaS Partner Association: Accounts onboarded through BRB's highest-volume BaaS partners—NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.—are prioritized given the concentration of BaaS-related compliance risk in these relationships.
(iv) Documentation Gap Severity: Accounts with the most significant documentation gaps (e.g., missing beneficial ownership information, unverified identity documentation) are prioritized over accounts with less critical deficiencies (e.g., outdated periodic review documentation).
Revised CDD/EDD Policy. BRB has drafted and obtained Compliance Committee approval for a comprehensive revised CDD/EDD Policy. The revised policy covers:
• Customer identification program ("CIP") procedures for all account types and channels
• Risk rating methodology, including BaaS-specific risk factors
• Beneficial ownership requirements in accordance with the CDD Rule
• Ongoing monitoring standards and trigger events requiring refreshed due diligence