1045-00002 · Calderwood & Harkness LLP · documents

letter-to-occ-acknowledgment-consent-order.docx DOCUMENT Antitrust

38 / 84 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Counselors at Law

1285 Avenue of the Americas, 40th Floor New York, New York 10019

Telephone: (212) 558-4000 Facsimile: (212) 558-3588

Philip Hartmann Partner Banking & Finance Practice Group Direct Dial: (212) 558-4127

Email: phartmann@calderwoodharkness.com

C&H Matter No.: 1045-00002

February 10, 2025

VIA OVERNIGHT COURIER AND ELECTRONIC SUBMISSION

Jonathan Frey National Bank Examiner, Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017

Re: Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845) — Acknowledgment of Consent Order No. OCC-2025-003, Effective January 15, 2025

Dear Mr. Frey:

I. Introduction and Identification of Representation

This firm, Calderwood & Harkness LLP ("C&H" or the "Firm"), has been retained by Belmont Ridge Bank National Association ("Belmont Ridge" or "BRB"), a national banking association organized and existing under 12 U.S.C. § 21 et seq., with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. BRB holds OCC Charter No. 48271 and FDIC Certificate No. 31845. BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company under the Bank Holding Company Act of 1956, as amended. BRFG's common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."

The purpose of this letter is to formally acknowledge, on behalf of BRB, receipt of Consent Order No. OCC-2025-003 (the "Consent Order"), which was issued by the Office of the Comptroller of the Currency (the "OCC") and became effective on January 15, 2025. By this letter, BRB confirms its intent to comply fully and in a timely manner with all provisions, requirements, corrective measures, and deadlines set forth in the Consent Order.

C&H has been engaged as outside regulatory counsel to BRB, effective as of February 10, 2025, to advise and guide BRB through all aspects of the comprehensive Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by the Consent Order. The Firm's engagement encompasses, without limitation, the development and submission of remediation plans, coordination with the independent consultant, preparation of all required reports and filings to the OCC, and ongoing counsel on regulatory compliance matters arising from or related to the Consent Order.

Gregory Nardone, General Counsel and Corporate Secretary of BRB and BRFG, has authorized C&H to submit this acknowledgment letter on BRB's behalf and to serve as BRB's outside counsel of record with respect to all matters relating to the Consent Order. We are prepared to provide the OCC with a formal written authorization from Mr. Nardone or from BRB's Board of Directors upon request.

II. Acknowledgment of Consent Order Findings

BRB confirms that it has received and carefully reviewed Consent Order No. OCC-2025-003 in its entirety, including all articles, provisions, and appendices thereto. BRB understands that the Consent Order was issued following the OCC's targeted BSA/AML examination of BRB, which was conducted over the period from March 2024 through September 2024, and which encompassed a detailed review of BRB's BSA/AML compliance program, its Office of Foreign Assets Control ("OFAC") sanctions screening processes, its suspicious activity monitoring and reporting functions, its customer due diligence procedures, its transaction monitoring model governance, and the effectiveness of Board-level oversight of BSA/AML compliance.

BRB acknowledges that the Consent Order identifies significant deficiencies in BRB's BSA/AML compliance program. Without limitation, BRB acknowledges the following five core deficiency categories as set forth in the Consent Order:

1. OFAC Sanctions Screening Deficiencies. The Consent Order identifies inadequate OFAC screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows. Specifically, the OCC's examination found that BRB failed to screen one hundred percent (100%) of transactions processed through certain BaaS partner channels against the Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC sanctions lists. The Consent Order identifies this gap as a critical vulnerability in BRB's sanctions compliance framework, particularly given the high volume and velocity of transactions processed through BRB's BaaS partnerships.

2. Suspicious Activity Report ("SAR") Filing Deficiencies. The Consent Order identifies deficiencies in BRB's suspicious activity monitoring and Suspicious Activity Report filing practices. These deficiencies include untimely SAR filings, an unacceptable backlog of unreviewed alerts in BRB's transaction monitoring system, and qualitative shortcomings in the narrative content and supporting documentation of filed SARs. The OCC's examination found that these deficiencies impaired BRB's ability to identify, investigate, and report potentially suspicious transactions in accordance with the requirements of 31 U.S.C. § 5318(g) and the implementing regulations at 31 C.F.R. § 1020.320.

3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. The Consent Order identifies insufficient Customer Due Diligence and Enhanced Due Diligence procedures for high-risk customers, with particular emphasis on deficiencies in the due diligence performed on customers onboarded through BRB's fintech partner channels. The OCC found that BRB's CDD and EDD processes did not adequately identify, verify, and assess the risk profiles of certain customer categories, including those with elevated geographical, transactional, or product-related risk indicators.

4. Transaction Monitoring Model Validation Deficiencies. The Consent Order identifies inadequate independent validation of BRB's transaction monitoring system. The OCC found that BRB had not conducted a comprehensive independent model validation in accordance with OCC Bulletin 2011-12 and applicable supervisory guidance, resulting in insufficient assurance that BRB's transaction monitoring scenarios, thresholds, and detection logic were appropriately calibrated to identify suspicious activity across all product lines and customer segments, including those associated with BaaS partner channels.

5. Board-Level Oversight Deficiencies. The Consent Order identifies deficiencies in the Board of Directors' oversight of BRB's BSA/AML compliance program governance. The OCC's examination found that the Board did not receive sufficiently detailed, timely, or accurate reporting on BSA/AML compliance risks, program performance metrics, or the status of prior supervisory findings. The Consent Order further found that the Board lacked a dedicated committee structure to oversee BSA/AML and sanctions compliance matters with the level of focus and expertise required given the scope and complexity of BRB's operations.

BRB further acknowledges that the Consent Order reflects an escalation from prior supervisory actions taken by the OCC. Specifically, the OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding deficiencies in BSA/AML transaction monitoring, and subsequently issued a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps associated with BaaS partner channels. BRB acknowledges that the progression from MRA to MRIA to the current Consent Order reflects the OCC's determination that BRB's prior remediation efforts were insufficient to address the identified deficiencies within the timeframes expected by the OCC.

BRB does not contest the findings set forth in the Consent Order. BRB's Board of Directors and senior management are fully committed to comprehensive, timely, and sustainable remediation of all identified deficiencies.

III. Acknowledgment of Civil Money Penalty

BRB acknowledges the assessment of a civil money penalty ("CMP") in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000), as set forth in Article IV of the Consent Order. BRB understands that the CMP is payable within sixty (60) calendar days of the Consent Order's effective date of January 15, 2025, establishing a payment due date of March 16, 2025.

BRB confirms that it is taking all necessary steps to ensure the timely payment of the CMP in full on or before March 16, 2025. BRB's Treasury Department has been instructed to coordinate the payment via wire transfer to the United States Treasury in accordance with the payment instructions set forth in the Consent Order and any supplemental instructions provided by the OCC. BRB will provide confirmation of payment to the OCC promptly following the execution of the wire transfer.

BRB further acknowledges that the CMP amount has been accrued in BRB's financial statements for the quarter ended December 31, 2024, and that BRFG has made appropriate disclosures regarding the Consent Order and the CMP in its public filings with the Securities and Exchange Commission, including its Form 8-K filed on January 16, 2025.

IV. Commitment to Compliance with Key Deadlines and Requirements

BRB confirms its intent to comply with all provisions, corrective measures, and deadlines established by the Consent Order. Without limitation, BRB acknowledges and commits to the following key requirements and associated timelines:

Board Resolution (Due February 28, 2025). Pursuant to Article V of the Consent Order, the Board of Directors of BRFG is required to adopt a resolution within forty-five (45) days of the Consent Order's effective date — that is, by no later than February 28, 2025 — acknowledging the Consent Order, establishing a dedicated Compliance Committee of the Board (the "Compliance Committee"), and authorizing the comprehensive remediation program contemplated by the Consent Order. BRB confirms that preparations for the adoption of this Board resolution are well underway, and the Board is scheduled to convene a special meeting on February 25, 2025, at which the resolution will be presented for adoption. BRB further confirms that James Rutherford, an independent director of BRFG with extensive experience in financial services regulation, has been designated as Chair of the newly created Compliance Committee. The Compliance Committee will be composed of no fewer than three independent directors and will meet no less frequently than monthly during the remediation period, as required by the Consent Order.

Independent Consultant Engagement (Article VII). The Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct an independent assessment of BRB's BSA/AML and sanctions compliance program. BRB selected Thornfield Consulting Group LLC ("Thornfield") as its independent consultant and submitted Thornfield's qualifications, proposed engagement scope, and engagement team credentials to the OCC for review in January 2025. The OCC issued its non-objection to the engagement of Thornfield on February 5, 2025. The engagement agreement between BRB and Thornfield was fully executed on February 10, 2025 (Thornfield engagement reference: TCG-BRB-2025-001). Thornfield's on-site assessment is scheduled to commence on March 1, 2025, and will encompass a comprehensive review of all five deficiency categories identified in the Consent Order. Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory at Thornfield, will serve as the engagement lead. Dr. Castellano brings more than twenty years of experience in BSA/AML compliance, including prior service as a senior examiner with the OCC and as the BSA Officer of a major national banking institution.

Comprehensive Remediation Action Plan (Due May 15, 2025). Pursuant to Article VIII of the Consent Order, BRB is required to develop and submit to the OCC a comprehensive Remediation Action Plan (the "Action Plan") addressing all deficiency categories identified in the Consent Order. BRB, with the assistance of C&H, Thornfield, and its internal compliance and risk management teams, will develop the Action Plan and submit it to the OCC no later than May 15, 2025. The Action Plan will include, for each deficiency category, a detailed description of the root cause, specific corrective actions to be undertaken, responsible personnel, resource allocations, measurable success criteria, implementation milestones, and completion dates. BRB anticipates that the Action Plan will be informed by the preliminary findings of Thornfield's independent assessment, which is expected to be substantially advanced by that date.

Interim SAR Backlog Status Report (Due March 31, 2025). Pursuant to Article VI, Section 3 of the Consent Order, BRB is required to submit an interim status report to the OCC on the clearance of the suspicious activity alert backlog no later than March 31, 2025. BRB has mobilized significant resources to address the alert backlog, including the deployment of temporary BSA/AML analysts, and will provide a detailed status report to the OCC by the required date. The report will include the total number of alerts in the backlog as of the Consent Order's effective date, the number of alerts cleared as of the reporting date, the number of SARs filed as a result of backlog clearance activity, and BRB's projected timeline for full backlog resolution.

CDD/EDD Remediation Milestones. The Consent Order establishes specific milestones for the remediation of Customer Due Diligence and Enhanced Due Diligence deficiencies with respect to high-risk customer accounts. BRB commits to remediating no less than fifty percent (50%) of identified high-risk accounts by July 15, 2025, and one hundred percent (100%) of identified high-risk accounts by January 15, 2026. BRB's CDD/EDD remediation efforts will include retroactive re-verification of customer identification information, updated risk assessments, collection of beneficial ownership information, and implementation of enhanced ongoing monitoring procedures for high-risk accounts, with particular focus on accounts originated through fintech partner channels.

Technology Upgrades. BRB is undertaking a significant upgrade of its transaction monitoring system and OFAC sanctions screening platform. The technology remediation program includes the following milestones:

• Completion of user acceptance testing for the upgraded transaction monitoring system and OFAC screening platform by August 1, 2025;

• Completion of independent model validation of the upgraded systems by an independent third-party model validation firm by October 1, 2025; and

• Full operationalization of OFAC screening across all BaaS partner channels, ensuring one hundred percent (100%) real-time screening of all transactions, by November 1, 2025.

BRB's Chief Information Officer and Chief Technology Officer, Linda Petrosian, is overseeing the technology upgrade program, in coordination with the BSA Officer, the Chief Compliance Officer, and external technology vendors. BRB will provide detailed reporting on technology upgrade progress in its quarterly progress reports to the OCC.

Quarterly Progress Reports. Pursuant to Article X of the Consent Order, BRB is required to submit quarterly progress reports to the OCC detailing the status of its remediation efforts across all deficiency categories. The first quarterly progress report is due September 15, 2025, and the second quarterly progress report is due December 15, 2025. Each quarterly report will provide a comprehensive update on BRB's progress against the milestones and corrective actions set forth in the Action Plan, including any material deviations from projected timelines and the reasons therefor.

Full Compliance and Self-Certification (Due February 15, 2026). Pursuant to Article XII of the Consent Order, BRB is required to complete the full implementation of its remediated BSA/AML and sanctions compliance program and submit a compliance self-certification to the OCC, supported by the independent consultant's final validation report, by no later than February 15, 2026. BRB understands that the self-certification must be executed by BRB's Chief Executive Officer and Chief Compliance Officer and approved by the Compliance Committee of the Board. BRB is committed to achieving full compliance within this timeframe and will devote all necessary resources to that objective.

V. Remediation Governance and Resources

BRB's Board of Directors and senior management have committed substantial institutional resources to the remediation effort mandated by the Consent Order. Recognizing the seriousness of the identified deficiencies and the critical importance of restoring the integrity and effectiveness of BRB's BSA/AML and sanctions compliance program, the Board has approved a total remediation budget of Forty-Two Million Five Hundred Thousand Dollars ($42,500,000), exclusive of the $14,500,000 civil money penalty. This brings the total anticipated expenditure related to the Consent Order to approximately Fifty-Seven Million Dollars ($57,000,000). The remediation budget encompasses, among other items, the costs of the independent consultant engagement, technology system upgrades, additional permanent and temporary staffing, external testing and validation, training and education programs, and outside counsel fees.

The following key BRB personnel have been designated to lead the remediation effort:

• Patricia Langston, Chief Compliance Officer (appointed January 2024), who will serve as the senior executive with day-to-day oversight responsibility for all remediation workstreams and who will serve as the primary internal point of accountability for compliance with the Consent Order's requirements;

• Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), who will be responsible for the operational execution of BSA/AML program enhancements, including SAR filing remediation, transaction monitoring system upgrades, and CDD/EDD process improvements;

• Melissa Chu, Chief Risk Officer, who will provide enterprise risk management oversight and will ensure that BSA/AML and sanctions compliance risks are appropriately integrated into BRB's broader risk management framework;

• Warren Ashby, Head of Fintech Partnerships and BaaS Division, who will lead the remediation of compliance processes specific to BRB's BaaS partner channels, including OFAC screening integration and partner due diligence enhancements;

• Linda Petrosian, Chief Information Officer and Chief Technology Officer, who will oversee all technology system upgrades, including the transaction monitoring system and OFAC screening platform implementations; and

• Derek Ballard, Head of Internal Audit, who will provide independent assurance testing of remediation activities and will coordinate with the external independent testing firm to ensure comprehensive coverage.

In addition to leveraging its existing compliance and risk management staff, BRB is substantially augmenting its BSA/AML department. BRB has authorized the hiring of fifteen (15) permanent full-time-equivalent ("FTE") positions in the BSA/AML department, which will bring the department's headcount from sixty-two (62) to seventy-seven (77). Recruitment for these positions is underway, and BRB expects to have all positions filled by April 30, 2025. To provide immediate capacity during the ramp-up period, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide thirty (30) temporary full-time-equivalent BSA/AML analysts. The Pinnacle engagement commenced on January 27, 2025, and these temporary analysts are currently deployed and actively assisting with alert backlog clearance, SAR preparation, and CDD/EDD remediation activities.

BRB has also engaged Caldera & Pope LLP ("Caldera & Pope") as its external BSA/AML independent testing firm. Caldera & Pope has been performing independent BSA/AML testing for BRB since 2022 and will continue to support testing and validation activities during the remediation period, including transaction testing, SAR quality reviews, and assessments of the effectiveness of remediated controls. BRB understands that the work product of Caldera & Pope is distinct from, and not a substitute for, the independent assessment to be conducted by Thornfield Consulting Group LLC pursuant to Article VII of the Consent Order.

VI. Designation of Points of Contact

BRB designates the following individuals as the primary points of contact for all communications with the OCC regarding the Consent Order and the associated remediation program:

Outside Counsel: Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127

Email: phartmann@calderwoodharkness.com

BRB General Counsel: Gregory Nardone, General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022 Telephone: (212) 493-7200

Email: gnardone@belmontridgebank.com

BRB Chief Compliance Officer: Patricia Langston, Chief Compliance Officer Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022 Telephone: (212) 493-7315

Email: plangston@belmontridgebank.com

BRB respectfully requests that all formal correspondence, notices, and communications from the OCC regarding Consent Order No. OCC-2025-003 be directed to Philip Hartmann at Calderwood & Harkness LLP, with simultaneous copies to Gregory Nardone and Patricia Langston at BRB. BRB will ensure that all submissions and filings required by the Consent Order are made through the undersigned, unless otherwise directed by the OCC.

VII. Reservation and Cooperation

BRB is fully committed to cooperating with the OCC, including the Examiner-in-Charge and all OCC examination and supervisory personnel, throughout the duration of the remediation process. BRB will respond promptly to all requests for information, documentation, and access to personnel, and will make all relevant records, systems, and facilities available to the OCC and its representatives as needed.

BRB understands and acknowledges that the Consent Order does not preclude additional supervisory or enforcement action by the OCC, the Financial Crimes Enforcement Network ("FinCEN"), or any other federal or state governmental authority. Nothing in this letter is intended to limit or qualify the OCC's supervisory or enforcement authority in any respect.

BRB further confirms that it will promptly notify the OCC of any material developments that may affect its ability to meet the deadlines, milestones, or requirements of the Consent Order, including but not limited to changes in key personnel, significant operational disruptions, material changes in BRB's risk profile, or any circumstances that could necessitate an adjustment to the remediation timeline. BRB commits to providing such notification in writing to the Examiner-in-Charge as soon as practicable after BRB becomes aware of any such material development.

VIII. Closing

BRB reiterates its unequivocal commitment to achieving full and timely compliance with all provisions and requirements of Consent Order No. OCC-2025-003. BRB's Board of Directors, senior management, and the entire remediation team understand the gravity of the deficiencies identified by the OCC and the critical importance of restoring a robust, effective, and sustainable BSA/AML and sanctions compliance program.

BRB intends to work constructively and transparently with the OCC throughout the remediation process. We welcome the opportunity to meet with you and your team at your earliest convenience to discuss BRB's remediation plans, the engagement of Thornfield Consulting Group, and any other matters that the OCC may wish to address.

Should the OCC require any additional information, documentation, or clarification in connection with this acknowledgment or any aspect of BRB's remediation efforts, please do not hesitate to contact the undersigned.

We thank you for your attention to this matter and look forward to a productive and collaborative dialogue with the OCC as BRB works to fulfill the requirements of the Consent Order.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Philip Hartmann Partner, Banking & Finance Practice Group 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127

Email: phartmann@calderwoodharkness.com

cc: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association cc: Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association cc: Diane Whitford, Chief Executive Officer, Belmont Ridge Bank National Association cc: James Rutherford, Chair, Compliance Committee, BRFG Board of Directors

Enclosures: None (substantive filings to follow per schedule set forth in Consent Order No. OCC-2025-003)

CALDERWOOD & HARKNESS LLP Counselors at Law
1285 Avenue of the Americas, 40th Floor New York, New York 10019
Telephone: (212) 558-4000 Facsimile: (212) 558-3588
Philip Hartmann Partner Banking & Finance Practice Group Direct Dial: (212) 558-4127
Email: phartmann@calderwoodharkness.com
C&H Matter No.: 1045-00002
February 10, 2025
VIA OVERNIGHT COURIER AND ELECTRONIC SUBMISSION
Jonathan Frey National Bank Examiner, Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017
Re: Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845) — Acknowledgment of Consent Order No. OCC-2025-003, Effective January 15, 2025
Dear Mr. Frey:
I. Introduction and Identification of Representation
This firm, Calderwood & Harkness LLP ("C&H" or the "Firm"), has been retained by Belmont Ridge Bank National Association ("Belmont Ridge" or "BRB"), a national banking association organized and existing under 12 U.S.C. § 21 et seq., with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. BRB holds OCC Charter No. 48271 and FDIC Certificate No. 31845. BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company under the Bank Holding Company Act of 1956, as amended. BRFG's common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."
The purpose of this letter is to formally acknowledge, on behalf of BRB, receipt of Consent Order No. OCC-2025-003 (the "Consent Order"), which was issued by the Office of the Comptroller of the Currency (the "OCC") and became effective on January 15, 2025. By this letter, BRB confirms its intent to comply fully and in a timely manner with all provisions, requirements, corrective measures, and deadlines set forth in the Consent Order.
C&H has been engaged as outside regulatory counsel to BRB, effective as of February 10, 2025, to advise and guide BRB through all aspects of the comprehensive Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by the Consent Order. The Firm's engagement encompasses, without limitation, the development and submission of remediation plans, coordination with the independent consultant, preparation of all required reports and filings to the OCC, and ongoing counsel on regulatory compliance matters arising from or related to the Consent Order.
Gregory Nardone, General Counsel and Corporate Secretary of BRB and BRFG, has authorized C&H to submit this acknowledgment letter on BRB's behalf and to serve as BRB's outside counsel of record with respect to all matters relating to the Consent Order. We are prepared to provide the OCC with a formal written authorization from Mr. Nardone or from BRB's Board of Directors upon request.
II. Acknowledgment of Consent Order Findings
BRB confirms that it has received and carefully reviewed Consent Order No. OCC-2025-003 in its entirety, including all articles, provisions, and appendices thereto. BRB understands that the Consent Order was issued following the OCC's targeted BSA/AML examination of BRB, which was conducted over the period from March 2024 through September 2024, and which encompassed a detailed review of BRB's BSA/AML compliance program, its Office of Foreign Assets Control ("OFAC") sanctions screening processes, its suspicious activity monitoring and reporting functions, its customer due diligence procedures, its transaction monitoring model governance, and the effectiveness of Board-level oversight of BSA/AML compliance.
BRB acknowledges that the Consent Order identifies significant deficiencies in BRB's BSA/AML compliance program. Without limitation, BRB acknowledges the following five core deficiency categories as set forth in the Consent Order:
1. OFAC Sanctions Screening Deficiencies. The Consent Order identifies inadequate OFAC screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows. Specifically, the OCC's examination found that BRB failed to screen one hundred percent (100%) of transactions processed through certain BaaS partner channels against the Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC sanctions lists. The Consent Order identifies this gap as a critical vulnerability in BRB's sanctions compliance framework, particularly given the high volume and velocity of transactions processed through BRB's BaaS partnerships.
2. Suspicious Activity Report ("SAR") Filing Deficiencies. The Consent Order identifies deficiencies in BRB's suspicious activity monitoring and Suspicious Activity Report filing practices. These deficiencies include untimely SAR filings, an unacceptable backlog of unreviewed alerts in BRB's transaction monitoring system, and qualitative shortcomings in the narrative content and supporting documentation of filed SARs. The OCC's examination found that these deficiencies impaired BRB's ability to identify, investigate, and report potentially suspicious transactions in accordance with the requirements of 31 U.S.C. § 5318(g) and the implementing regulations at 31 C.F.R. § 1020.320.
3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. The Consent Order identifies insufficient Customer Due Diligence and Enhanced Due Diligence procedures for high-risk customers, with particular emphasis on deficiencies in the due diligence performed on customers onboarded through BRB's fintech partner channels. The OCC found that BRB's CDD and EDD processes did not adequately identify, verify, and assess the risk profiles of certain customer categories, including those with elevated geographical, transactional, or product-related risk indicators.
4. Transaction Monitoring Model Validation Deficiencies. The Consent Order identifies inadequate independent validation of BRB's transaction monitoring system. The OCC found that BRB had not conducted a comprehensive independent model validation in accordance with OCC Bulletin 2011-12 and applicable supervisory guidance, resulting in insufficient assurance that BRB's transaction monitoring scenarios, thresholds, and detection logic were appropriately calibrated to identify suspicious activity across all product lines and customer segments, including those associated with BaaS partner channels.
5. Board-Level Oversight Deficiencies. The Consent Order identifies deficiencies in the Board of Directors' oversight of BRB's BSA/AML compliance program governance. The OCC's examination found that the Board did not receive sufficiently detailed, timely, or accurate reporting on BSA/AML compliance risks, program performance metrics, or the status of prior supervisory findings. The Consent Order further found that the Board lacked a dedicated committee structure to oversee BSA/AML and sanctions compliance matters with the level of focus and expertise required given the scope and complexity of BRB's operations.
BRB further acknowledges that the Consent Order reflects an escalation from prior supervisory actions taken by the OCC. Specifically, the OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding deficiencies in BSA/AML transaction monitoring, and subsequently issued a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps associated with BaaS partner channels. BRB acknowledges that the progression from MRA to MRIA to the current Consent Order reflects the OCC's determination that BRB's prior remediation efforts were insufficient to address the identified deficiencies within the timeframes expected by the OCC.
BRB does not contest the findings set forth in the Consent Order. BRB's Board of Directors and senior management are fully committed to comprehensive, timely, and sustainable remediation of all identified deficiencies.
III. Acknowledgment of Civil Money Penalty
BRB acknowledges the assessment of a civil money penalty ("CMP") in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000), as set forth in Article IV of the Consent Order. BRB understands that the CMP is payable within sixty (60) calendar days of the Consent Order's effective date of January 15, 2025, establishing a payment due date of March 16, 2025.
BRB confirms that it is taking all necessary steps to ensure the timely payment of the CMP in full on or before March 16, 2025. BRB's Treasury Department has been instructed to coordinate the payment via wire transfer to the United States Treasury in accordance with the payment instructions set forth in the Consent Order and any supplemental instructions provided by the OCC. BRB will provide confirmation of payment to the OCC promptly following the execution of the wire transfer.
BRB further acknowledges that the CMP amount has been accrued in BRB's financial statements for the quarter ended December 31, 2024, and that BRFG has made appropriate disclosures regarding the Consent Order and the CMP in its public filings with the Securities and Exchange Commission, including its Form 8-K filed on January 16, 2025.
IV. Commitment to Compliance with Key Deadlines and Requirements
BRB confirms its intent to comply with all provisions, corrective measures, and deadlines established by the Consent Order. Without limitation, BRB acknowledges and commits to the following key requirements and associated timelines:
Board Resolution (Due February 28, 2025). Pursuant to Article V of the Consent Order, the Board of Directors of BRFG is required to adopt a resolution within forty-five (45) days of the Consent Order's effective date — that is, by no later than February 28, 2025 — acknowledging the Consent Order, establishing a dedicated Compliance Committee of the Board (the "Compliance Committee"), and authorizing the comprehensive remediation program contemplated by the Consent Order. BRB confirms that preparations for the adoption of this Board resolution are well underway, and the Board is scheduled to convene a special meeting on February 25, 2025, at which the resolution will be presented for adoption. BRB further confirms that James Rutherford, an independent director of BRFG with extensive experience in financial services regulation, has been designated as Chair of the newly created Compliance Committee. The Compliance Committee will be composed of no fewer than three independent directors and will meet no less frequently than monthly during the remediation period, as required by the Consent Order.
Independent Consultant Engagement (Article VII). The Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct an independent assessment of BRB's BSA/AML and sanctions compliance program. BRB selected Thornfield Consulting Group LLC ("Thornfield") as its independent consultant and submitted Thornfield's qualifications, proposed engagement scope, and engagement team credentials to the OCC for review in January 2025. The OCC issued its non-objection to the engagement of Thornfield on February 5, 2025. The engagement agreement between BRB and Thornfield was fully executed on February 10, 2025 (Thornfield engagement reference: TCG-BRB-2025-001). Thornfield's on-site assessment is scheduled to commence on March 1, 2025, and will encompass a comprehensive review of all five deficiency categories identified in the Consent Order. Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory at Thornfield, will serve as the engagement lead. Dr. Castellano brings more than twenty years of experience in BSA/AML compliance, including prior service as a senior examiner with the OCC and as the BSA Officer of a major national banking institution.
Comprehensive Remediation Action Plan (Due May 15, 2025). Pursuant to Article VIII of the Consent Order, BRB is required to develop and submit to the OCC a comprehensive Remediation Action Plan (the "Action Plan") addressing all deficiency categories identified in the Consent Order. BRB, with the assistance of C&H, Thornfield, and its internal compliance and risk management teams, will develop the Action Plan and submit it to the OCC no later than May 15, 2025. The Action Plan will include, for each deficiency category, a detailed description of the root cause, specific corrective actions to be undertaken, responsible personnel, resource allocations, measurable success criteria, implementation milestones, and completion dates. BRB anticipates that the Action Plan will be informed by the preliminary findings of Thornfield's independent assessment, which is expected to be substantially advanced by that date.
Interim SAR Backlog Status Report (Due March 31, 2025). Pursuant to Article VI, Section 3 of the Consent Order, BRB is required to submit an interim status report to the OCC on the clearance of the suspicious activity alert backlog no later than March 31, 2025. BRB has mobilized significant resources to address the alert backlog, including the deployment of temporary BSA/AML analysts, and will provide a detailed status report to the OCC by the required date. The report will include the total number of alerts in the backlog as of the Consent Order's effective date, the number of alerts cleared as of the reporting date, the number of SARs filed as a result of backlog clearance activity, and BRB's projected timeline for full backlog resolution.
CDD/EDD Remediation Milestones. The Consent Order establishes specific milestones for the remediation of Customer Due Diligence and Enhanced Due Diligence deficiencies with respect to high-risk customer accounts. BRB commits to remediating no less than fifty percent (50%) of identified high-risk accounts by July 15, 2025, and one hundred percent (100%) of identified high-risk accounts by January 15, 2026. BRB's CDD/EDD remediation efforts will include retroactive re-verification of customer identification information, updated risk assessments, collection of beneficial ownership information, and implementation of enhanced ongoing monitoring procedures for high-risk accounts, with particular focus on accounts originated through fintech partner channels.
Technology Upgrades. BRB is undertaking a significant upgrade of its transaction monitoring system and OFAC sanctions screening platform. The technology remediation program includes the following milestones:
• Completion of user acceptance testing for the upgraded transaction monitoring system and OFAC screening platform by August 1, 2025;
• Completion of independent model validation of the upgraded systems by an independent third-party model validation firm by October 1, 2025; and
• Full operationalization of OFAC screening across all BaaS partner channels, ensuring one hundred percent (100%) real-time screening of all transactions, by November 1, 2025.
BRB's Chief Information Officer and Chief Technology Officer, Linda Petrosian, is overseeing the technology upgrade program, in coordination with the BSA Officer, the Chief Compliance Officer, and external technology vendors. BRB will provide detailed reporting on technology upgrade progress in its quarterly progress reports to the OCC.
Quarterly Progress Reports. Pursuant to Article X of the Consent Order, BRB is required to submit quarterly progress reports to the OCC detailing the status of its remediation efforts across all deficiency categories. The first quarterly progress report is due September 15, 2025, and the second quarterly progress report is due December 15, 2025. Each quarterly report will provide a comprehensive update on BRB's progress against the milestones and corrective actions set forth in the Action Plan, including any material deviations from projected timelines and the reasons therefor.
Full Compliance and Self-Certification (Due February 15, 2026). Pursuant to Article XII of the Consent Order, BRB is required to complete the full implementation of its remediated BSA/AML and sanctions compliance program and submit a compliance self-certification to the OCC, supported by the independent consultant's final validation report, by no later than February 15, 2026. BRB understands that the self-certification must be executed by BRB's Chief Executive Officer and Chief Compliance Officer and approved by the Compliance Committee of the Board. BRB is committed to achieving full compliance within this timeframe and will devote all necessary resources to that objective.
V. Remediation Governance and Resources
BRB's Board of Directors and senior management have committed substantial institutional resources to the remediation effort mandated by the Consent Order. Recognizing the seriousness of the identified deficiencies and the critical importance of restoring the integrity and effectiveness of BRB's BSA/AML and sanctions compliance program, the Board has approved a total remediation budget of Forty-Two Million Five Hundred Thousand Dollars ($42,500,000), exclusive of the $14,500,000 civil money penalty. This brings the total anticipated expenditure related to the Consent Order to approximately Fifty-Seven Million Dollars ($57,000,000). The remediation budget encompasses, among other items, the costs of the independent consultant engagement, technology system upgrades, additional permanent and temporary staffing, external testing and validation, training and education programs, and outside counsel fees.
The following key BRB personnel have been designated to lead the remediation effort:
• Patricia Langston, Chief Compliance Officer (appointed January 2024), who will serve as the senior executive with day-to-day oversight responsibility for all remediation workstreams and who will serve as the primary internal point of accountability for compliance with the Consent Order's requirements;
• Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), who will be responsible for the operational execution of BSA/AML program enhancements, including SAR filing remediation, transaction monitoring system upgrades, and CDD/EDD process improvements;
• Melissa Chu, Chief Risk Officer, who will provide enterprise risk management oversight and will ensure that BSA/AML and sanctions compliance risks are appropriately integrated into BRB's broader risk management framework;
• Warren Ashby, Head of Fintech Partnerships and BaaS Division, who will lead the remediation of compliance processes specific to BRB's BaaS partner channels, including OFAC screening integration and partner due diligence enhancements;
• Linda Petrosian, Chief Information Officer and Chief Technology Officer, who will oversee all technology system upgrades, including the transaction monitoring system and OFAC screening platform implementations; and
• Derek Ballard, Head of Internal Audit, who will provide independent assurance testing of remediation activities and will coordinate with the external independent testing firm to ensure comprehensive coverage.
In addition to leveraging its existing compliance and risk management staff, BRB is substantially augmenting its BSA/AML department. BRB has authorized the hiring of fifteen (15) permanent full-time-equivalent ("FTE") positions in the BSA/AML department, which will bring the department's headcount from sixty-two (62) to seventy-seven (77). Recruitment for these positions is underway, and BRB expects to have all positions filled by April 30, 2025. To provide immediate capacity during the ramp-up period, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide thirty (30) temporary full-time-equivalent BSA/AML analysts. The Pinnacle engagement commenced on January 27, 2025, and these temporary analysts are currently deployed and actively assisting with alert backlog clearance, SAR preparation, and CDD/EDD remediation activities.
BRB has also engaged Caldera & Pope LLP ("Caldera & Pope") as its external BSA/AML independent testing firm. Caldera & Pope has been performing independent BSA/AML testing for BRB since 2022 and will continue to support testing and validation activities during the remediation period, including transaction testing, SAR quality reviews, and assessments of the effectiveness of remediated controls. BRB understands that the work product of Caldera & Pope is distinct from, and not a substitute for, the independent assessment to be conducted by Thornfield Consulting Group LLC pursuant to Article VII of the Consent Order.
VI. Designation of Points of Contact
BRB designates the following individuals as the primary points of contact for all communications with the OCC regarding the Consent Order and the associated remediation program:
Outside Counsel: Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127
Email: phartmann@calderwoodharkness.com
BRB General Counsel: Gregory Nardone, General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022 Telephone: (212) 493-7200
Email: gnardone@belmontridgebank.com
BRB Chief Compliance Officer: Patricia Langston, Chief Compliance Officer Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022 Telephone: (212) 493-7315
Email: plangston@belmontridgebank.com
BRB respectfully requests that all formal correspondence, notices, and communications from the OCC regarding Consent Order No. OCC-2025-003 be directed to Philip Hartmann at Calderwood & Harkness LLP, with simultaneous copies to Gregory Nardone and Patricia Langston at BRB. BRB will ensure that all submissions and filings required by the Consent Order are made through the undersigned, unless otherwise directed by the OCC.
VII. Reservation and Cooperation
BRB is fully committed to cooperating with the OCC, including the Examiner-in-Charge and all OCC examination and supervisory personnel, throughout the duration of the remediation process. BRB will respond promptly to all requests for information, documentation, and access to personnel, and will make all relevant records, systems, and facilities available to the OCC and its representatives as needed.
BRB understands and acknowledges that the Consent Order does not preclude additional supervisory or enforcement action by the OCC, the Financial Crimes Enforcement Network ("FinCEN"), or any other federal or state governmental authority. Nothing in this letter is intended to limit or qualify the OCC's supervisory or enforcement authority in any respect.
BRB further confirms that it will promptly notify the OCC of any material developments that may affect its ability to meet the deadlines, milestones, or requirements of the Consent Order, including but not limited to changes in key personnel, significant operational disruptions, material changes in BRB's risk profile, or any circumstances that could necessitate an adjustment to the remediation timeline. BRB commits to providing such notification in writing to the Examiner-in-Charge as soon as practicable after BRB becomes aware of any such material development.
VIII. Closing
BRB reiterates its unequivocal commitment to achieving full and timely compliance with all provisions and requirements of Consent Order No. OCC-2025-003. BRB's Board of Directors, senior management, and the entire remediation team understand the gravity of the deficiencies identified by the OCC and the critical importance of restoring a robust, effective, and sustainable BSA/AML and sanctions compliance program.
BRB intends to work constructively and transparently with the OCC throughout the remediation process. We welcome the opportunity to meet with you and your team at your earliest convenience to discuss BRB's remediation plans, the engagement of Thornfield Consulting Group, and any other matters that the OCC may wish to address.
Should the OCC require any additional information, documentation, or clarification in connection with this acknowledgment or any aspect of BRB's remediation efforts, please do not hesitate to contact the undersigned.
We thank you for your attention to this matter and look forward to a productive and collaborative dialogue with the OCC as BRB works to fulfill the requirements of the Consent Order.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Philip Hartmann Partner, Banking & Finance Practice Group 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4127
Email: phartmann@calderwoodharkness.com
cc: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association cc: Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association cc: Diane Whitford, Chief Executive Officer, Belmont Ridge Bank National Association cc: James Rutherford, Chair, Compliance Committee, BRFG Board of Directors
Enclosures: None (substantive filings to follow per schedule set forth in Consent Order No. OCC-2025-003)

CALDERWOOD & HARKNESS LLP Counselors at Law

VIA OVERNIGHT COURIER AND ELECTRONIC SUBMISSION

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts