ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL
MEMORANDUM
FROM: Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
TO: Gregory Nardone, General Counsel & Corporate Secretary Patricia Langston, Chief Compliance Officer Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
DATE: March 10, 2025
RE: Recommended Permanent FTE Additions — BSA/AML Compliance Department Hiring Plan
MATTER NO.: 1045-00002
This memorandum is a confidential attorney-client privileged communication prepared by Calderwood & Harkness LLP at the direction of the General Counsel of Belmont Ridge Bank National Association. It is intended solely for the use of the addressees and authorized recipients. This memorandum contains legal advice and analysis and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the General Counsel. Disclosure to regulators, including the OCC, should be made only upon advice of counsel and with appropriate privilege considerations.
Right-click to update Table of Contents
I. Purpose and Executive Summary
This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommendations for fifteen (15) permanent full-time equivalent ("FTE") additions to the Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance department of Belmont Ridge Bank National Association ("BRB" or the "Bank"). The recommendations contained herein are the product of C&H's comprehensive assessment of the Bank's current compliance infrastructure, the specific requirements of the Consent Order described below, and the staffing levels necessary to establish and maintain a sustainable compliance program that satisfies applicable regulatory expectations.
The hiring plan detailed in this memorandum is required as a central component of the comprehensive remediation program being undertaken by BRB in response to Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025 (the "Consent Order"). The Consent Order identified multiple structural deficiencies in the Bank's BSA/AML and OFAC compliance programs, several of which are directly attributable to inadequate staffing levels within the compliance department. Addressing these deficiencies on a permanent basis—rather than through temporary measures alone—is essential to satisfying the OCC's expectations and demonstrating the Bank's institutional commitment to long-term compliance.
As of January 2025, BRB's BSA/AML compliance department maintains a headcount of sixty-two (62) FTEs. Upon completion of the hiring plan recommended herein, the department will comprise seventy-seven (77) permanent FTEs, representing a net increase of fifteen (15) positions, or approximately 24.2% growth in permanent headcount. The estimated fully loaded annual cost of the fifteen new positions is approximately $2,250,000, based on an average fully loaded cost per FTE of approximately $150,000. This figure includes base salary, employee benefits, payroll taxes, and allocated departmental overhead.
It is critical to emphasize that these fifteen permanent hires are distinct from, and supplementary to, the thirty (30) temporary FTEs currently being provided by Pinnacle Compliance Solutions LLC ("Pinnacle") under the managed services agreement executed in connection with the remediation (SOW Ref: PCS-BRB-2025-0012; total contract value of $3,600,000 for a twelve-month engagement period). The Pinnacle temporary staff are engaged to address the acute remediation workload—including SAR backlog clearance, lookback investigations, and the CDD/EDD remediation project—and are expected to phase out upon completion of those defined project scopes. The permanent headcount expansion recommended herein is designed to ensure that BRB maintains adequate compliance staffing on an ongoing basis after the Pinnacle engagement concludes.
The permanent headcount expansion addresses the following structural deficiencies identified in the Consent Order:
• SAR Filing Timeliness: The OCC found that BRB's average SAR filing turnaround was approximately seventy-eight (78) days, far exceeding the thirty (30)-day regulatory expectation. A backlog of approximately 2,400 unreviewed transaction monitoring alerts existed as of September 2024. Additional investigative and analytical capacity is required to sustain timely filing on an ongoing basis.
• CDD/EDD Program Capacity: Approximately 47,000 high-risk customer accounts were identified as lacking adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") documentation, with the majority of these accounts having been onboarded through the Bank's fintech partner channels. Dedicated KYC/CDD analysts are needed for ongoing monitoring following remediation of the backlog.
• OFAC Sanctions Screening Oversight: The Bank operates fourteen (14) active Banking-as-a-Service ("BaaS") partner relationships, through which substantial transaction volumes flow. The Consent Order found that the Bank failed to screen 100% of BaaS channel transactions against applicable OFAC sanctions lists. Dedicated sanctions compliance analysts are required for ongoing BaaS screening oversight.
• Transaction Monitoring Model Governance: The Bank's transaction monitoring system—Veridian TMS v.8.3—had not been independently validated since March 2021 and had not been tuned since October 2022. Dedicated model risk and governance personnel are needed to support the planned upgrade to TMS v.10.0 and ensure ongoing model integrity.
The Board of Directors of BRB has approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty imposed under the Consent Order). The $2,250,000 allocation for internal headcount additions is included within this Board-approved budget and is reflected in the Board Resolution adopted on February 28, 2025.
II. Consent Order Requirements Driving Headcount Expansion
A. Core Deficiency Categories Requiring Additional Staff
The Consent Order identifies multiple categories of deficiency across BRB's BSA/AML and OFAC compliance programs. Each of these categories implicates the need for additional permanent compliance personnel. Below, we summarize the key deficiency findings and their staffing implications.
1. OFAC Sanctions Screening (Consent Order, Article III)
Article III of the Consent Order addresses BRB's failure to maintain an effective sanctions compliance program, with particular emphasis on the Bank's failure to screen 100% of transactions processed through its BaaS channels against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and applicable sectoral sanctions lists.
The OCC's examination findings revealed that approximately 12% of all transactions processed through BRB's largest BaaS partner, NovaPay, were not subjected to OFAC screening during calendar year 2023. In absolute terms, this represents approximately 3,800,000 unscreened transactions out of a total of 31,700,000 NovaPay transactions processed during that period. The unscreened transactions included both wire transfers and Automated Clearing House ("ACH") transactions, categories that present elevated sanctions risk given their cross-border and high-volume nature.
The root cause of this screening gap was identified as a combination of technological limitations in the integration between NovaPay's transaction processing platform and BRB's Veridian OFAC screening module, as well as insufficient staffing to identify and remediate the gap on a timely basis. The OFAC/sanctions team of six (6) FTEs was inadequate to provide the level of oversight required across fourteen active BaaS partner relationships.
Going forward, BRB requires dedicated sanctions compliance analysts to maintain ongoing oversight of BaaS screening processes, review and adjudicate screening hits, monitor screening effectiveness metrics, and ensure that any future integration issues are identified and escalated promptly. The hiring plan recommends two (2) additional OFAC/Sanctions Compliance Analysts (Positions 7–8) to expand the team from six to eight FTEs.
2. SAR Filing Deficiencies (Consent Order, Article IV)
Article IV of the Consent Order addresses BRB's failure to file Suspicious Activity Reports ("SARs") in a timely and complete manner. The examination found that the Bank maintained a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, and that the average time from alert generation to SAR filing was approximately seventy-eight (78) days. This significantly exceeds the thirty (30)-day standard that the OCC expects for SAR filing following the identification of known or suspected violations.
The Bank's SAR filing volumes have increased substantially in recent years, driven in significant part by the growth of the Bank's BaaS program and the corresponding increase in transaction monitoring alert volumes. BRB filed 3,847 SARs in calendar year 2024, up from 2,914 in calendar year 2023, representing a year-over-year increase of approximately 32.0%. During the same period, the Bank's transaction monitoring system generated 41,500 alerts in calendar year 2024, with a SAR conversion rate of approximately 9.3%.
These volumes are expected to remain elevated on a sustained basis given the Bank's continued BaaS operations and the enhanced sensitivity of the transaction monitoring rules being implemented as part of the Veridian TMS v.10.0 upgrade. The hiring plan recommends two (2) Senior SAR Investigators (Positions 2–3) and three (3) SAR Analysts/Investigators (Positions 4–6) to build the sustainable investigative capacity necessary to maintain timely SAR filing after the Pinnacle temporary staff conclude their engagement.
3. CDD/EDD Failures (Consent Order, Article V)
Article V of the Consent Order addresses BRB's failure to maintain an adequate Customer Due Diligence and Enhanced Due Diligence program, as required by 31 C.F.R. § 1020.210 and OCC supervisory expectations. The examination identified approximately 47,000 high-risk customer accounts that lacked adequate CDD/EDD documentation. The majority of these accounts were onboarded through the Bank's fintech partner channels, where the allocation of CDD/EDD responsibilities between BRB and its BaaS partners was insufficiently defined and monitored.
While the remediation of the 47,000-account backlog will be substantially accomplished through the combined efforts of existing staff, the Pinnacle temporary staff, and the CDD/EDD remediation project (budgeted at $4,300,000), BRB will require additional permanent KYC/CDD analysts to manage the ongoing periodic review obligations and maintain adequate documentation for high-risk accounts on a continuing basis. The hiring plan recommends two (2) KYC/CDD/EDD Analysts (Positions 9–10) to augment the existing team.
4. Model Validation Deficiencies (Consent Order, Article VI)
Article VI of the Consent Order addresses deficiencies in BRB's transaction monitoring model risk management practices. Specifically, the OCC found that the Bank's primary transaction monitoring system, Veridian TMS v.8.3, had not been subjected to an independent model validation since March 2021—a gap of nearly four years. Furthermore, the system's detection scenarios and thresholds had not been tuned since October 2022, resulting in detection rules that were not calibrated to the Bank's current transaction volumes, product mix, or risk profile.
The Bank has committed to upgrading to Veridian TMS v.10.0, with User Acceptance Testing ("UAT") targeted for completion by August 1, 2025, and full production deployment thereafter. The new system will require ongoing governance, including periodic tuning, threshold management, model performance monitoring, and coordination with the vendor for system updates. BRB currently has no dedicated model validation or model governance personnel within the BSA/AML compliance department. The hiring plan recommends one (1) Model Risk / TM Governance Analyst (Position 13) to fill this gap and ensure ongoing model integrity.
5. Board Oversight and Program Governance (Consent Order, Article VIII)
Article VIII of the Consent Order addresses deficiencies in Board-level oversight of BRB's BSA/AML compliance program. In response, the Bank has established a dedicated Compliance Committee of the Board, chaired by James Rutherford, which will receive monthly reporting on key compliance metrics including SAR volumes and filing timeliness, OFAC screening hit rates, CDD/EDD remediation progress, transaction monitoring alert volumes and SAR conversion rates, and BaaS partner risk ratings.
The enhanced reporting infrastructure required to support the Compliance Committee necessitates additional compliance program management and data analytics capacity. The hiring plan recommends the addition of a Deputy BSA Officer / Senior AML Program Manager (Position 1) and a Compliance Data Analyst / Reporting Specialist (Position 15) to provide this capacity.
B. Prior MRA/MRIA History
The deficiencies identified in the Consent Order did not arise in a vacuum. BRB has a documented history of supervisory findings related to its BSA/AML compliance program that preceded the issuance of the Consent Order:
• June 2022 — Matter Requiring Attention (MRA): The OCC issued an MRA regarding deficiencies in BRB's BSA/AML transaction monitoring program, including concerns about the adequacy of detection scenarios, alert investigation timeliness, and the documentation of case dispositions. The MRA required the Bank to conduct a comprehensive review of its transaction monitoring rules and implement enhancements to its alert investigation procedures.
• November 2023 — Matter Requiring Immediate Attention (MRIA): The OCC escalated its concerns by issuing an MRIA regarding OFAC screening gaps, specifically identifying the failure to screen certain categories of BaaS-channel transactions. The MRIA required the Bank to immediately implement controls to ensure 100% screening coverage and to conduct a retroactive review of unscreened transactions.
The Bank's failure to adequately remediate these prior supervisory findings was a significant factor contributing to the OCC's decision to issue the Consent Order. Importantly, inadequate staffing was identified as a root cause of the Bank's inability to address these findings effectively. Thornfield Consulting Group ("Thornfield"), the independent consultant retained by the Bank pursuant to the Consent Order, has noted in its preliminary observations that staffing levels within the BSA/AML compliance department were a material contributing factor to the program deficiencies. The hiring plan recommended herein is designed to address this root cause directly.
C. Sustainability Expectation
A central theme of the Consent Order is the OCC's expectation that BRB's remediation efforts will produce a sustainable compliance program—not merely a set of temporary fixes that dissipate once the immediate remediation period concludes. This expectation has direct and significant implications for the Bank's staffing strategy.
The OCC expects that any staffing augmentation undertaken as part of the remediation will result in a compliance infrastructure that is adequately resourced to manage the Bank's risk profile on an ongoing basis, including the elevated volumes and complexities associated with its BaaS program. Relying solely on temporary staffing arrangements (such as the Pinnacle engagement) to address structural understaffing would be inconsistent with this expectation and would likely be viewed unfavorably by the OCC during follow-up examinations.
The addition of fifteen permanent FTEs demonstrates BRB's institutional commitment to maintaining adequate compliance staffing on a long-term basis. The OCC's anticipated follow-up examination—expected to be conducted in the second half of 2026—will assess whether the Bank's staffing levels are adequate for ongoing operations after the Pinnacle temporary staff have departed and the acute remediation workstreams have concluded. The hiring plan should be presented to the OCC as a core element of BRB's sustainability strategy.
III. Current Organizational Structure — BSA/AML Department
A. Existing Headcount: 62 FTEs
BRB's BSA/AML compliance department currently comprises sixty-two (62) permanent FTEs, organized across nine functional areas. The department is led by Thomas Ikeda, who holds the title of BSA Officer and AML Program Director. Mr. Ikeda was appointed to this role in March 2023 and is responsible for the overall design, implementation, and administration of BRB's BSA/AML compliance program, including SAR and CTR filing, OFAC sanctions screening, customer due diligence, transaction monitoring, and regulatory examination management.
Mr. Ikeda reports directly to Patricia Langston, Chief Compliance Officer ("CCO"), who was appointed in January 2024. Ms. Langston maintains a direct reporting line to Chief Executive Officer Diane Whitford and a dotted-line reporting relationship to the newly established Compliance Committee of the Board, chaired by James Rutherford.
The current breakdown of the sixty-two FTEs across functional areas is as follows:
This organizational structure was substantially established under the prior BSA Officer and has remained largely unchanged since Mr. Ikeda's appointment, notwithstanding the significant growth in the Bank's BaaS program and the corresponding increase in compliance workload.
B. Identified Gaps in Current Staffing
Based on C&H's analysis of BRB's current staffing levels relative to operational volumes, risk profile, and regulatory expectations, the following gaps are apparent:
Transaction Monitoring and SAR Investigation Teams. The combined transaction monitoring and SAR investigation teams total thirty (30) FTEs (18 TM analysts + 12 SAR investigators). In calendar year 2024, the transaction monitoring system generated 41,500 alerts. This yields an approximate caseload of 1,383 alerts per analyst per year, or approximately 115 alerts per analyst per month. While not all alerts require full investigation (many are closed as false positives at the initial review stage), the sheer volume—combined with the 9.3% SAR conversion rate that produces a substantial number of cases requiring full investigation and narrative drafting—renders the current staffing level inadequate to achieve the thirty-day filing standard. The SAR investigation team of twelve is particularly strained given the complexity of BaaS-related investigations, which typically require more extensive research into multi-layered transaction flows and third-party payment processor data.
OFAC/Sanctions Screening Team. The current OFAC/sanctions team of six (6) FTEs is responsible for overseeing sanctions screening across the entirety of BRB's operations, including its fourteen BaaS partner channels. In calendar year 2024, the screening process generated 14,320 hits requiring human review and disposition. While the vast majority of these hits are false positives (estimated false-positive rate of 99.9%), the review and documentation process for each hit requires analyst time, and the identification and proper handling of true matches—twelve (12) in calendar year 2024 requiring blocking or rejection actions—demands a high degree of expertise and vigilance. The team must also maintain oversight of screening processes across fourteen distinct BaaS partners, each with its own transaction processing infrastructure and integration points. A team of six is insufficient for this scope of responsibility, particularly given that BaaS partner transactions totaled approximately $74.3 billion in annual volume.
BaaS / Fintech Compliance Oversight Team. The current BaaS compliance oversight team of four (4) FTEs is responsible for monitoring compliance obligations across all fourteen active BaaS partner relationships. This ratio of approximately 3.5 partners per analyst is inadequate, particularly given the concentration of volume and risk among the largest partners. NovaPay alone accounts for approximately 41% of total BaaS volume ($30.5 billion), FairLend Digital accounts for approximately 28% (with approximately $1.4 billion in loan originations in FY 2024), and VaultEdge accounts for approximately 18% (with approximately 870,000 deposit accounts). Moreover, BaaS-related SARs represented 54.8% of all SARs filed by BRB in calendar year 2024 (2,108 of 3,847 total SARs), underscoring the disproportionate compliance risk associated with the BaaS channel. Four FTEs cannot effectively conduct quarterly risk assessments, ongoing compliance testing, CDD/EDD oversight, and escalation monitoring across fourteen partners.
Model Validation and Governance. BRB currently has no dedicated model validation or model governance personnel within the BSA/AML compliance department. Model risk oversight has historically been handled on an ad hoc basis by the transaction monitoring team lead, with limited coordination with the Bank's broader model risk management framework. This absence contributed directly to the four-year gap in independent model validation identified in the Consent Order.
Compliance Reporting and Data Analytics. The current data and analytics team of two (2) FTEs is insufficient to support the enhanced reporting framework required by the Compliance Committee. The Committee's charter calls for monthly reporting packages containing detailed metrics on SAR volumes and filing timeliness, OFAC screening hit rates, CDD/EDD remediation progress, transaction monitoring alert volumes and SAR conversion rates, and BaaS partner risk ratings. In addition, the team must support the development and maintenance of the CDD/EDD Progress Tracking Dashboard, the compilation of data for OCC quarterly progress reports, and ad hoc analytics requests from the BSA Officer and CCO. Two FTEs cannot sustain this level of output while also maintaining existing reporting obligations.
IV. Recommended Position Descriptions — 15 New Permanent FTEs
The following section provides detailed position descriptions for each of the fifteen recommended new permanent FTE positions. Each description includes the reporting structure, estimated fully loaded annual cost, purpose and rationale, minimum qualifications, and key responsibilities. The positions are numbered sequentially and organized by functional area.
Position 1: Deputy BSA Officer / Senior AML Program Manager (1 FTE)
Reports to: Thomas Ikeda, BSA Officer / AML Program Director
Estimated Fully Loaded Annual Cost: $200,000
Purpose and Rationale: This position is designed to provide critical senior-level capacity within the BSA Officer's office. The Deputy BSA Officer will serve as the acting BSA Officer when Mr. Ikeda is unavailable due to travel, regulatory meetings, leave, or other commitments, ensuring continuity of program leadership at all times. This is a significant gap in the current structure, as the BSA Officer role is a regulatory position with specific responsibilities under the BSA and OCC regulations that must be discharged without interruption. The Deputy BSA Officer will oversee day-to-day remediation workstreams and serve as a key liaison among BRB's internal compliance teams, Thornfield Consulting Group, Pinnacle Compliance Solutions, and Calderwood & Harkness LLP. Following the completion of the remediation period, this position will continue to serve as the second-in-command of the BSA/AML department, providing program management capacity for ongoing operations and supporting the BSA Officer in regulatory examination preparation.
Minimum Qualifications:
• Minimum ten (10) years of progressive BSA/AML compliance experience in the banking or financial services industry
• Certified Anti-Money Laundering Specialist ("CAMS") certification required
• Demonstrated experience with OCC or other federal banking agency consent order remediation strongly preferred
• Prior experience managing BSA/AML compliance programs in institutions with active BaaS or fintech partnership programs
• Familiarity with regulatory examination processes, including preparation, document production, and examiner interactions
• Strong leadership, communication, and project management skills
• Bachelor's degree required; advanced degree or JD preferred
Key Responsibilities:
• Serve as acting BSA Officer in Mr. Ikeda's absence, with authority to approve SAR filings, OFAC blocking actions, and other time-sensitive compliance decisions
• Oversee day-to-day management of remediation workstreams, including tracking progress against Consent Order milestone deadlines
• Coordinate with Thornfield Consulting Group (Dr. Vivian Castellano, engagement lead) on gap assessment findings, remediation plan development, and validation testing
• Prepare and review Compliance Committee reporting packages, including monthly metrics and executive summaries
• Serve as primary operational liaison between BRB's BSA/AML department and Calderwood & Harkness LLP for ongoing remediation advice and regulatory communication matters
• Coordinate regulatory reporting obligations, including SAR and CTR filing oversight, and OFAC blocking reports
• Support the BSA Officer in preparing for OCC follow-up examinations and responding to examiner requests
• Supervise quality control activities related to Pinnacle temporary staff work product
Positions 2–3: Senior SAR Investigators (2 FTEs)
Reports to: SAR Investigations Unit Lead (existing position)
Estimated Fully Loaded Annual Cost: $160,000 per FTE ($320,000 total)
Purpose and Rationale: These two senior-level positions are designed to increase the investigative capacity of the SAR Investigations Unit for complex and escalated cases, with a particular emphasis on BaaS-related matters that require specialized knowledge of fintech transaction flows, payment processing structures, and multi-party relationships. The current SAR investigation team of twelve FTEs has been unable to sustain timely SAR filing given the volume and complexity of its caseload. The addition of two senior investigators will provide critical capacity for handling the most complex investigations, ensuring that SAR narratives are thorough and accurate, and mentoring junior analysts to improve overall team performance. These positions are designated as Phase A critical hires due to the immediate need for senior investigative capacity to oversee the quality of SAR backlog clearance work being performed by Pinnacle temporary staff and to ensure that the Bank meets its June 30, 2025 SAR backlog clearance target.
Minimum Qualifications:
• Five to seven (5–7) years of AML investigation experience in banking, financial services, or law enforcement
• CAMS or Certified Fraud Examiner ("CFE") certification required
• Demonstrated experience drafting SAR narratives for complex transaction patterns, including structuring, layering, and integration-stage money laundering typologies
• Experience with fintech, payments, or neobanking-related AML investigations strongly preferred
• Familiarity with law enforcement information-sharing protocols, including Section 314(a) and 314(b) processes
• Strong analytical, writing, and communication skills
• Bachelor's degree required
Key Responsibilities:
• Conduct complex and escalated SAR investigations, including cases involving BaaS partner transactions, correspondent banking activity, and high-value wire transfers
• Draft SAR narratives for complex cases, ensuring compliance with FinCEN filing requirements and BRB's internal SAR quality standards
• Perform quality review of SAR narratives prepared by junior investigators and Pinnacle temporary staff
• Mentor and train junior SAR analysts and investigators on investigative techniques, narrative writing standards, and case documentation protocols
• Serve as liaison with law enforcement agencies, including the FBI, IRS-CI, HSI, and FinCEN, as needed for case coordination and information sharing
• Assist the SAR Investigations Unit Lead in managing caseload distribution, prioritization, and escalation protocols
• Contribute to the development and refinement of investigation procedures and SAR filing guidelines as part of the remediation program
Positions 4–6: SAR Analysts / Investigators (3 FTEs)
Reports to: SAR Investigations Unit Lead (existing position)
Estimated Fully Loaded Annual Cost: $130,000 per FTE ($390,000 total)
Purpose and Rationale: These three positions are designed to increase the baseline investigative and filing capacity of the SAR Investigations Unit, reducing the Bank's reliance on Pinnacle temporary staff for steady-state operations after the remediation period concludes. As noted above, BRB filed 3,847 SARs in calendar year 2024, and alert volumes of 41,500 with a 9.3% SAR conversion rate indicate that approximately 3,860 alerts per year will require full investigation and potential SAR filing. With the expanded team of seventeen permanent SAR investigators (12 existing + 5 new), the per-analyst caseload for SAR-generating alerts will be approximately 227 cases per year, or approximately 19 per month—a sustainable level that permits thorough investigation and timely filing within the thirty-day standard. These analysts will also provide support for Currency Transaction Report ("CTR") oversight, with BRB having filed 28,612 CTRs in calendar year 2024.
Minimum Qualifications:
• Two to five (2–5) years of AML/BSA compliance experience, including transaction monitoring alert investigation and SAR preparation
• Bachelor's degree required
• Familiarity with transaction monitoring systems and alert investigation workflows
• CAMS certification preferred; candidates without CAMS must obtain certification within twelve months of hire
• Strong analytical and written communication skills
• Ability to manage a significant caseload while maintaining quality and timeliness standards
Key Responsibilities:
• Investigate transaction monitoring alerts, including initial alert triage, data gathering, analysis, and case disposition determination
• Prepare SAR narratives in compliance with FinCEN requirements and BRB internal standards
• Maintain thorough case documentation, including supporting evidence, analysis memoranda, and disposition rationale
• Support CTR filing oversight, including review of automated CTR filings for accuracy and completeness
• Escalate complex or unusual cases to Senior SAR Investigators or the Unit Lead as appropriate
• Participate in ongoing training and professional development activities
• Coordinate with the Transaction Monitoring team on alert quality feedback and rule tuning recommendations
Positions 7–8: OFAC / Sanctions Compliance Analysts (2 FTEs)
Reports to: OFAC / Sanctions Screening Unit Lead (existing position)
Estimated Fully Loaded Annual Cost: $145,000 per FTE ($290,000 total)
Purpose and Rationale: These two positions will expand the OFAC/sanctions screening team from six (6) to eight (8) FTEs. The expanded team is necessary to provide adequate oversight of sanctions screening across all of BRB's BaaS channels, including both real-time and batch screening workflows for the upgraded Veridian OFAC module. The Bank's fourteen active BaaS partners collectively process approximately $74.3 billion in annual transaction volume, all of which must be screened against applicable OFAC sanctions lists. In calendar year 2024, the screening process generated 14,320 hits requiring human review, and even with a 99.9% false-positive rate, the twelve (12) true matches identified during the year required immediate blocking or rejection actions and subsequent OFAC reporting. The expansion of this team is essential to ensure that screening hit review and disposition is conducted promptly and accurately, that BaaS partner screening processes are effectively monitored, and that the deficiencies identified in Article III of the Consent Order are permanently remediated.
Minimum Qualifications:
• Three to five (3–5) years of OFAC/sanctions compliance experience in banking, financial services, or a related regulatory environment
• Thorough knowledge of the SDN List, Consolidated Sanctions List, sectoral sanctions programs, and country-based sanctions programs administered by OFAC
• Experience with sanctions screening technology platforms, including tuning of screening algorithms, list management, and hit disposition workflows
• Familiarity with BaaS/fintech transaction flows, payment processing, and the unique sanctions screening challenges associated with third-party-originated transactions
• Strong attention to detail and ability to make risk-based decisions under time pressure
• Bachelor's degree required
Key Responsibilities:
• Review and adjudicate sanctions screening hits generated by the Veridian OFAC screening module, including real-time wire screening and batch ACH and card screening
• Manage false-positive adjudication processes, ensuring that dispositions are properly documented and that screening tuning recommendations are communicated to the technology team
• Prepare OFAC blocking reports within the ten (10)-business-day regulatory requirement for true-match blocking actions
• Monitor sanctions screening processes across BaaS partner channels, including periodic review of partner screening integration points and coverage metrics
• Escalate true matches and potential sanctions violations to the OFAC Unit Lead and BSA Officer for immediate action
• Support OFAC-related regulatory reporting, including preparation of materials for Compliance Committee reports and OCC progress updates
• Participate in the implementation and testing of the upgraded Veridian OFAC module as part of the TMS v.10.0 deployment
Positions 9–10: KYC / CDD / EDD Analysts (2 FTEs)
Reports to: KYC/CDD Unit Lead (existing position)
Estimated Fully Loaded Annual Cost: $125,000 per FTE ($250,000 total)
Purpose and Rationale: These two positions will augment the KYC/CDD/EDD team from ten (10) to twelve (12) FTEs. While the remediation of the 47,000 high-risk account documentation backlog will be substantially accomplished through the combined efforts of existing staff, Pinnacle temporary staff, and the dedicated CDD/EDD remediation project, the Bank will require additional permanent KYC/CDD analysts to manage ongoing periodic review obligations, maintain adequate documentation for high-risk accounts on a continuing basis, and support the enhanced due diligence requirements applicable to customers onboarded through BaaS partner channels. The Bank's customer risk rating methodology is also being revised as part of the remediation, and the expanded team will be responsible for implementing and maintaining the updated risk ratings across the customer portfolio.
Minimum Qualifications:
• Two to four (2–4) years of KYC/CDD/EDD experience in banking, financial services, or a fintech environment
• Knowledge of beneficial ownership requirements under the CDD Rule (31 C.F.R. § 1010.230) and BRB's internal CDD/EDD policies and procedures
• Experience with customer risk rating methodologies, including the assignment and periodic reassessment of risk ratings based on customer profile, geography, product usage, and transaction behavior
• Familiarity with BaaS/fintech customer onboarding processes and the allocation of CDD/EDD responsibilities between banks and their fintech partners
• Bachelor's degree required
• Strong organizational skills and attention to detail
Key Responsibilities:
• Conduct ongoing CDD/EDD reviews for existing customers, including periodic reviews triggered by risk rating, account activity, or elapsed time since last review
• Update customer risk ratings based on changes in customer profile, transaction patterns, or external information (e.g., adverse media, law enforcement inquiries)
• Perform enhanced due diligence on high-risk customers, including collection and review of source of funds/source of wealth documentation, beneficial ownership verification, and ongoing monitoring assessments
• Oversee the quality of CDD/EDD performed by BaaS partners pursuant to the BaaS Partner CDD/EDD Responsibility Matrix, including periodic sampling and testing of partner-performed reviews
• Maintain accurate and complete CDD/EDD documentation in BRB's customer records management system
• Support the CDD/EDD remediation project by assisting with backlog reviews as capacity permits, with primary focus on ongoing steady-state obligations
Positions 11–12: BaaS / Fintech Compliance Specialists (2 FTEs)
Reports to: Warren Ashby, Head of Fintech Partnerships / BaaS Division (with functional reporting line to Patricia Langston, Chief Compliance Officer)
Estimated Fully Loaded Annual Cost: $155,000 per FTE ($310,000 total)
Purpose and Rationale: These two positions will expand the BaaS compliance oversight team from four (4) to six (6) FTEs. Given the significant and disproportionate compliance risk associated with BRB's BaaS program—which generated 54.8% of all SARs filed in calendar year 2024 despite representing one of many business lines—the current staffing level is clearly inadequate. The expanded team will provide dedicated monitoring capacity for the fourteen active fintech partners, including the ability to conduct quarterly risk assessments using the newly developed BaaS Partner BSA/AML Risk Assessment Template.
Particular attention is required for the three highest-volume partners: NovaPay, which accounts for approximately 41% of BaaS volume ($30.5 billion in annual transactions); FairLend Digital, which accounts for approximately 28% of BaaS activity (with approximately $1.4 billion in loan originations in FY 2024); and VaultEdge, which accounts for approximately 18% of BaaS activity (with approximately 870,000 deposit accounts). These three partners alone represent approximately 87% of total BaaS volume and warrant dedicated compliance specialist coverage.
These positions feature a dual reporting structure: the BaaS Compliance Specialists will report administratively to Warren Ashby as Head of the BaaS Division, but will maintain a functional reporting line to the CCO, Patricia Langston, to ensure independence of compliance oversight from business line management.
Minimum Qualifications:
• Three to six (3–6) years of compliance experience with fintech partnerships, BaaS programs, payment processing, or related financial services activities
• Understanding of interchange revenue structures, program fee structures, and the business models of P2P payment platforms, neobanks, and digital lending platforms
• Experience with OCC third-party risk management guidance (OCC Bulletin 2023-17 and related guidance) and the application of risk management frameworks to fintech/BaaS relationships
• Knowledge of BSA/AML compliance requirements as they apply to bank-fintech partnerships, including the allocation of regulatory responsibilities and the bank's obligation to maintain oversight of compliance activities delegated to partners
• Strong analytical, communication, and relationship management skills
• Bachelor's degree required
Key Responsibilities:
• Conduct quarterly BaaS partner BSA/AML risk assessments using the approved Risk Assessment Template, evaluating each partner's compliance controls, transaction monitoring effectiveness, CDD/EDD practices, sanctions screening coverage, and overall risk posture
• Perform ongoing compliance testing of partner operations, including transaction sampling, CDD/EDD file reviews, and sanctions screening coverage verification
• Monitor partner compliance with CDD/EDD obligations as specified in the BaaS Partner CDD/EDD Responsibility Matrix, escalating deficiencies to the BSA Officer and CCO
• Track escalation and termination triggers as defined in BaaS Program Agreements, including material compliance failures, regulatory actions against partners, or significant increases in SAR activity
• Conduct annual partner due diligence reviews, including assessment of partner financial condition, regulatory status, control environment changes, and key personnel changes
• Coordinate with BaaS partners on remediation activities, including follow-up on compliance remediation letters issued to NovaPay, FairLend Digital, and other partners
• Prepare BaaS compliance metrics and partner risk rating summaries for inclusion in Compliance Committee reporting packages
Position 13: Model Risk / TM Governance Analyst (1 FTE)
Reports to: Thomas Ikeda, BSA Officer (with functional coordination with Linda Petrosian, CIO/CTO, and Melissa Chu, Chief Risk Officer)
Estimated Fully Loaded Annual Cost: $170,000
Purpose and Rationale: This position creates a dedicated resource for ongoing transaction monitoring model governance within the BSA/AML compliance department. This is a new function that has not previously existed within the department, and its absence was a direct contributing factor to the model validation and tuning deficiencies identified in Article VI of the Consent Order. The Model Risk / TM Governance Analyst will be responsible for overseeing the integrity and effectiveness of the Veridian TMS v.10.0 platform on an ongoing basis, including tuning oversight, above-the-line and below-the-line threshold management, model performance monitoring, and coordination of periodic independent model validations.
This position will maintain functional coordination with the Bank's CIO/CTO, Linda Petrosian, whose technology team is responsible for the technical implementation and maintenance of the Veridian platform, and with the Chief Risk Officer, Melissa Chu, whose risk management framework encompasses model risk management at the enterprise level. The Model Risk / TM Governance Analyst will serve as the BSA/AML department's subject matter expert on TMS model risk issues and will ensure that the department's model governance practices are aligned with OCC model risk management guidance (OCC Bulletin 2011-12, "Supervisory Guidance on Model Risk Management").
Minimum Qualifications:
• Three to five (3–5) years of experience in model risk management, quantitative AML analytics, or a closely related field
• Familiarity with transaction monitoring system tuning and validation methodologies, including scenario analysis, above/below-the-line testing, and performance benchmarking
• Background in statistics, data science, applied mathematics, or a related quantitative discipline preferred
• Understanding of OCC model risk management guidance (OCC Bulletin 2011-12) and its application to BSA/AML transaction monitoring models
• Experience working with transaction monitoring platform vendors on system configuration, tuning, and updates
• Strong analytical and technical skills, including proficiency with data analysis tools
• Bachelor's degree in a quantitative field required; Master's degree preferred
Key Responsibilities:
• Oversee the tuning of Veridian TMS v.10.0 detection scenarios and thresholds, ensuring that rules are calibrated to BRB's current transaction volumes, product mix, customer risk profile, and known typologies
• Manage above-the-line and below-the-line threshold analysis, documenting the rationale for threshold settings and monitoring the impact of threshold changes on alert volumes and detection rates
• Monitor TMS model performance on an ongoing basis, including tracking key metrics such as alert volume, SAR conversion rate, false-positive rate, and detection coverage