letter-to-occ-proposed-independent-consultant.docx

1045-00002 · Calderwood & Harkness LLP · documents

letter-to-occ-proposed-independent-consultant.docx DOCUMENT Antitrust

39 / 84 ← → ✕

CONFIDENTIAL SUPERVISORY INFORMATION — NOT FOR PUBLIC DISCLOSURE This document contains Confidential Supervisory Information within the meaning of 12 C.F.R. § 4.32 et seq. Unauthorized disclosure is prohibited by law.

CALDERWOOD & HARKNESS LLP Attorneys at Law 1285 Avenue of the Americas, 40th Floor New York, New York 10019

Telephone: (212) 547-6000 Facsimile: (212) 547-6001

Philip Hartmann Partner — Financial Institutions Regulatory & Enforcement Group Direct: (212) 547-6128 phartmann@calderwoodharkness.com

January 31, 2025

VIA ELECTRONIC SUBMISSION AND Sundial Data Systems

Mr. Jonathan Frey National Bank Examiner / Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017

Re: Proposed Independent Consultant Pursuant to Article VII of Consent Order No. OCC-2025-003 — Belmont Ridge Bank National Association (OCC Charter No. 48271)

Dear Mr. Frey:

I. Introduction

I write on behalf of Belmont Ridge Bank National Association ("BRB" or the "Bank"), OCC Charter No. 48271, FDIC Certificate No. 31845, in connection with the Bank's obligations under Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025. BRB is a national banking association headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022, and is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."

Calderwood & Harkness LLP serves as outside regulatory counsel to BRB in connection with the Bank's compliance with the Consent Order, including the Bank's engagement of an independent consultant as required thereunder. In that capacity, I submit this letter to the OCC on BRB's behalf.

The purpose of this letter is to submit for the OCC's non-objection the Bank's proposed engagement of Thornfield Consulting Group LLC ("Thornfield" or the "Consultant") as the independent consultant required under Article VII of the Consent Order. As the OCC is aware, Article VII requires BRB to retain, at its own expense, an independent consultant acceptable to the OCC to conduct a comprehensive assessment of BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance program, and to validate the Bank's remediation efforts in connection with the deficiencies identified in the Consent Order.

Article VII, Section 1 of the Consent Order establishes February 15, 2025 as the deadline by which the Bank must engage the independent consultant. BRB is committed to having this engagement fully in place well in advance of that deadline, and has accordingly undertaken an expedited but thorough selection process to identify a qualified and independent consultant. The Bank submits this proposal with the expectation that, upon receipt of the OCC's non-objection, the engagement agreement can be promptly executed and the Consultant's on-site assessment work can commence on or about March 1, 2025.

We respectfully request the OCC's non-objection to the proposed engagement of Thornfield Consulting Group LLC as the independent consultant pursuant to Article VII of the Consent Order. The balance of this letter sets forth (i) relevant background regarding the Consent Order, (ii) Thornfield's qualifications and proposed engagement team, (iii) the proposed scope of work, (iv) the proposed engagement terms, (v) information regarding the engagement agreement, and (vi) the Bank's formal request for non-objection. Supporting enclosures are described at the conclusion of this letter and are submitted concurrently herewith.

II. Background — Consent Order and Requirement for Independent Consultant

A. The Consent Order

Consent Order No. OCC-2025-003 was issued by the OCC on January 15, 2025, following the OCC's targeted BSA/AML examination of BRB conducted between March 2024 and September 2024 (the "Examination"). The Consent Order arose from the OCC's findings during the Examination that BRB maintained deficiencies in its BSA/AML and OFAC compliance program across five core categories. We summarize those categories below for the OCC's convenience in evaluating the alignment of the proposed engagement scope.

The five core deficiency categories identified in the Consent Order are as follows:

(i) Inadequate OFAC Sanctions Screening Protocols for Fintech BaaS Transaction Flows. The OCC identified a significant gap in BRB's OFAC sanctions screening for transactions processed through the Bank's Banking-as-a-Service ("BaaS") partner channels. In particular, the Examination revealed that approximately 12% of wire transfer and Automated Clearing House ("ACH") transactions originated through NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner by transaction volume, were not subjected to OFAC interdiction screening during calendar year 2023. This gap affected approximately 3.8 million transactions out of the approximately 31.7 million total NovaPay-originated transactions processed by BRB during that period. The OCC found that this screening gap resulted from a configuration deficiency in the integration layer between NovaPay's payment origination platform and BRB's sanctions screening infrastructure, which had not been identified through the Bank's existing quality assurance and testing procedures.

(ii) Deficient Suspicious Activity Report ("SAR") Filing Timeliness and Quality. The Examination identified material deficiencies in BRB's SAR filing processes. As of the September 2024 Examination date, the OCC found a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned by the Bank's AML investigations team. Additionally, the OCC found that BRB's average SAR filing time was approximately 78 days from the date of initial alert generation, which the OCC determined was inconsistent with the regulatory expectation of timely filing of SARs. The OCC further identified qualitative deficiencies in a sample of filed SARs, including insufficient narrative detail and inadequate documentation of investigative findings.

(iii) Insufficient Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for High-Risk Customers. The OCC found that BRB had failed to conduct adequate CDD and EDD for approximately 47,000 customers classified as high-risk, the substantial majority of whom had been onboarded through the Bank's fintech BaaS partner channels. The deficiencies included incomplete beneficial ownership information, insufficient documentation of the purpose and expected nature of customer accounts, and the absence of periodic EDD reviews for customers maintaining risk profiles warranting enhanced scrutiny.

(iv) Inadequate Model Validation for Transaction Monitoring System. The OCC determined that the Bank's primary transaction monitoring system, Veridian TMS version 8.3 ("Veridian TMS v.8.3"), provided by Veridian Analytics Inc., had not been subjected to a comprehensive independent model validation since March 2021 — a period of approximately three and one-half years as of the Examination date. The OCC found that this interval was inconsistent with sound risk management practices and the OCC's supervisory expectations for model risk management at institutions of BRB's size and complexity, particularly given the significant changes in the Bank's business model, customer base, and transaction volume resulting from the expansion of BRB's BaaS operations during the intervening period.

(v) Board-Level Oversight Deficiencies. The OCC found that BRB's Board of Directors (the "Board") had not exercised adequate oversight of the Bank's BSA/AML and OFAC compliance program. Among the specific findings, the OCC noted the absence of a dedicated Compliance Committee of the Board, with BSA/AML and OFAC compliance matters instead addressed on an ad hoc basis by the Board's Audit Committee. The OCC further found that Board-level reporting on BSA/AML and OFAC program performance was insufficiently detailed and that the Board had not taken timely and effective corrective action in response to prior supervisory findings.

B. Prior Supervisory History

The Consent Order references BRB's prior supervisory history, including a Matter Requiring Attention ("MRA") issued in June 2022 regarding deficiencies in BSA/AML transaction monitoring and a Matter Requiring Immediate Attention ("MRIA") issued in November 2023 regarding OFAC screening gaps identified during a supervisory review. The Consent Order cites BRB's failure to adequately remediate these prior supervisory findings as an aggravating factor contributing to the issuance of the Consent Order and the assessment of the civil money penalty described below.

C. Article VII — Independent Consultant Requirement

Article VII of the Consent Order requires BRB to retain an independent consultant, subject to OCC non-objection, to conduct a comprehensive assessment of the Bank's BSA/AML and OFAC compliance program, including an evaluation of each of the deficiency categories identified above, and to validate the Bank's remediation efforts. The independent consultant is required to be acceptable to the OCC, to be free from conflicts of interest, and to possess the qualifications and expertise necessary to conduct the assessment and validation contemplated by the Consent Order. The Consent Order establishes February 15, 2025 as the deadline for the Bank to engage the independent consultant.

D. Civil Money Penalty

In connection with the Consent Order, a civil money penalty in the amount of $14,500,000 was assessed against the Bank. BRB has acknowledged and accepted the penalty assessment, and payment arrangements are being administered separately in accordance with the terms of the Consent Order. The assessment of the civil money penalty underscores the seriousness with which the OCC and BRB view the identified deficiencies and further demonstrates the importance of the independent consultant engagement that is the subject of this letter.

III. Proposed Independent Consultant — Thornfield Consulting Group LLC

A. Firm Overview

BRB proposes to engage Thornfield Consulting Group LLC as the independent consultant under Article VII of the Consent Order. The key details of the proposed Consultant are as follows:

Full Legal Name: Thornfield Consulting Group LLC

Entity Type: Limited liability company organized and existing under the laws of the State of Delaware

Principal Office: 200 Park Avenue South, 15th Floor, New York, New York 10003

Engagement Reference Number: TCG-BRB-2025-001

Counsel to Thornfield: Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036

Thornfield is a specialized financial crimes advisory firm with deep expertise in BSA/AML compliance, OFAC sanctions program design and assessment, transaction monitoring system evaluation and optimization, and regulatory remediation for banking institutions subject to formal and informal enforcement actions. Since its founding, Thornfield has built a practice focused specifically on the complex regulatory and operational challenges faced by banking institutions operating in the financial crimes compliance space.

Thornfield has extensive experience advising national banks and other financial institutions on consent order compliance, OCC-mandated independent assessments, remediation planning and validation, and BSA/AML program design and enhancement. The firm has been engaged as an independent consultant in connection with OCC and FinCEN enforcement actions on multiple prior occasions, including engagements at institutions of comparable size and complexity to BRB. Thornfield's advisory practice encompasses the full spectrum of BSA/AML and OFAC compliance, from program governance and risk assessment to transaction monitoring, screening, customer due diligence, suspicious activity reporting, and regulatory reporting.

Critically for the present engagement, Thornfield possesses significant expertise in the unique BSA/AML and OFAC compliance challenges arising from Banking-as-a-Service operations and fintech partnerships. Given that the deficiencies identified in the Consent Order are substantially concentrated in BRB's BaaS partner channels, this expertise is directly relevant to the assessment and validation work required under Article VII.

B. Engagement Team Qualifications

Thornfield has designated a dedicated engagement team to conduct the independent consultant engagement for BRB. The proposed team is led by four senior professionals, each possessing specialized expertise directly relevant to one or more of the deficiency categories identified in the Consent Order. The qualifications of each team member are summarized below, and detailed curriculum vitae for each are enclosed as Enclosure 1 to this letter.

Dr. Vivian Castellano — Managing Director, Financial Crimes Advisory; Proposed Engagement Lead

Dr. Castellano will serve as the Engagement Lead for the Thornfield engagement and will bear overall responsibility for the conduct, quality, and timeliness of the independent assessment and validation work. Dr. Castellano is a Managing Director in Thornfield's Financial Crimes Advisory practice with more than twenty years of experience in financial crimes compliance, BSA/AML program design, regulatory remediation, and enforcement response for banking institutions.

Dr. Castellano has led multiple OCC-mandated independent consultant engagements at comparably sized national banking associations, including engagements involving BSA/AML consent orders with remediation scopes similar to the present matter. Her experience encompasses all phases of the independent consultant engagement lifecycle, from initial gap assessment through remediation validation and final reporting to the OCC. Dr. Castellano holds a Ph.D. in Economics from Columbia University, a J.D. from New York University School of Law, and is a Certified Anti-Money Laundering Specialist (CAMS). Prior to joining Thornfield, she held senior compliance leadership positions at two nationally chartered banking institutions and served as a supervisory examiner at the Federal Reserve Bank of New York.

Robert Eastman — Senior Director, AML Transaction Monitoring

Mr. Eastman will lead Thornfield's assessment and validation work with respect to the transaction monitoring system deficiencies identified in the Consent Order, including the inadequate model validation of Veridian TMS v.8.3 and the Bank's planned upgrade to Veridian TMS v.10.0. Mr. Eastman possesses deep expertise in transaction monitoring system assessment, model validation, scenario tuning and optimization, and above-the-line/below-the-line testing methodologies.

Mr. Eastman has more than fifteen years of experience evaluating transaction monitoring systems at large and mid-sized banking institutions. He has direct experience with the Veridian Analytics TMS platform, as well as other major AML technology platforms deployed across the banking industry. His prior engagements include model validation assessments for institutions subject to OCC and FinCEN enforcement actions, and he has extensive experience assessing the adequacy of transaction monitoring calibration in the context of rapidly evolving business models, including BaaS operations. Mr. Eastman will be directly responsible for assessing and validating remediation of the Veridian TMS v.8.3 model validation deficiencies and for evaluating the Bank's deployment of, and independent model validation for, TMS v.10.0.

Jennifer Hwang — Director, Sanctions & OFAC Compliance

Ms. Hwang will lead Thornfield's assessment and validation work with respect to the OFAC sanctions screening deficiencies identified in the Consent Order, with particular focus on the screening gap affecting NovaPay and the Bank's BaaS partner channels. Ms. Hwang is a recognized specialist in OFAC sanctions screening, list management, interdiction procedures, and sanctions program design. She has extensive experience assessing OFAC screening gaps across complex banking operations, including multi-channel and BaaS environments where sanctions screening must be integrated across multiple origination platforms and payment rails.

Ms. Hwang's prior experience includes engagements in which she assessed and validated the remediation of OFAC screening failures arising from technology integration deficiencies, configuration errors, and gaps in quality assurance and testing protocols — circumstances closely analogous to those presented in the current matter. Ms. Hwang will lead the assessment of BRB's OFAC screening remediation across all fourteen of the Bank's active BaaS partner channels, as well as the Bank's retail banking, commercial lending, and wealth management business lines.

Nathaniel Burgess — Director, Fintech & Payments Compliance

Mr. Burgess will lead Thornfield's assessment and validation work with respect to the CDD/EDD deficiencies identified in the Consent Order and the Bank's fintech partnership oversight framework. Mr. Burgess possesses specialized expertise in Banking-as-a-Service compliance frameworks, fintech partnership oversight, third-party risk management, and payments compliance. He has significant experience evaluating third-party risk management programs for banks with substantial BaaS operations, including assessments of customer onboarding controls, KYC/CDD/EDD processes, and the allocation of compliance responsibilities between banks and their fintech partners.

Mr. Burgess will lead the assessment of BRB's CDD/EDD remediation for the approximately 47,000 high-risk customer accounts identified in the Consent Order, as well as the Bank's fintech partner oversight frameworks and contractual compliance provisions across all fourteen active BaaS partner relationships, with particular attention to the top three partners by transaction volume: NovaPay Technologies Inc. (representing approximately 41% of BaaS transaction volume, or approximately $30.5 billion in calendar year 2023), FairLend Digital LLC (approximately 28% of BaaS transaction volume), and VaultEdge Inc. (approximately 18% of BaaS transaction volume).

In addition to the four named senior professionals, Thornfield will deploy additional team members, including analysts and subject-matter specialists, as needed during the course of the engagement. All additional team members will operate under the direct supervision of the named engagement leads and in accordance with the scope and protocols established in the engagement agreement.

C. Independence and Conflicts

Consistent with OCC expectations for independent consultant engagements under consent orders, BRB and Thornfield have conducted a thorough independence and conflicts assessment. The results of that assessment are summarized below. A formal Conflict of Interest and Independence Certification executed by Thornfield is enclosed as Enclosure 4 to this letter.

Thornfield has confirmed the following:

(a) Thornfield has no current or prior engagement, contractual relationship, or other business relationship with BRB, BRFG, or any subsidiary or affiliate of BRB or BRFG that would impair Thornfield's independence in conducting the engagement contemplated by Article VII of the Consent Order.

(b) Thornfield has no relationship, financial or otherwise, with Drayton Mercer LLP, BRB's former outside counsel in connection with BSA/AML regulatory matters, that would create a conflict of interest or impair Thornfield's ability to conduct an objective and independent assessment.

(c) Thornfield has confirmed that neither the firm nor any member of the proposed engagement team holds any financial interest in Veridian Analytics Inc. (the provider of BRB's current transaction monitoring system) or Ridgeline Data Systems LLC (one of the technology vendors under consideration in connection with BRB's compliance technology remediation efforts). Thornfield has no advisory, consulting, or other business relationship with either of these vendors that would create a conflict or impair independence.

(d) Thornfield is independent from Caldera & Pope LLP, BRB's external auditor and the firm that has performed BSA/AML independent testing for BRB in prior periods. Thornfield has no financial, organizational, or personnel relationship with Caldera & Pope LLP that would impair Thornfield's independence.

(e) Thornfield has confirmed that it is in full compliance with the OCC's expectations regarding consultant independence as set forth in the Consent Order and applicable OCC guidance, including OCC Bulletin 2017-43 and related supervisory communications.

BRB is satisfied, based on its own due diligence and Thornfield's certifications, that Thornfield satisfies the independence requirements of Article VII of the Consent Order and is free from conflicts that would impair the objectivity and reliability of the assessment and validation work to be performed.

IV. Proposed Scope of Engagement

The proposed scope of Thornfield's engagement encompasses three phases, designed to align with the requirements of Article VII of the Consent Order and the anticipated timeline for BRB's remediation efforts. A detailed Scope of Work is enclosed as Enclosure 2 (Appendix A to the Thornfield Engagement Agreement). The three phases are summarized below.

A. Phase 1 — On-Site Assessment and Gap Analysis

Thornfield's on-site assessment is proposed to commence on March 1, 2025, following execution of the engagement agreement and completion of any necessary administrative and logistical arrangements. Phase 1 will encompass a comprehensive review of all five deficiency categories identified in the Consent Order, as well as a broader assessment of BRB's BSA/AML and OFAC compliance program infrastructure.

The Phase 1 assessment will include, at a minimum, the following workstreams:

(i) OFAC Sanctions Screening. A comprehensive review of BRB's OFAC sanctions screening protocols across all business lines, including retail banking, commercial lending, wealth management, and all fourteen of the Bank's active BaaS partner channels. This workstream will include a focused examination of the NovaPay screening gap identified in the Consent Order, including the root cause of the configuration deficiency, the adequacy of the Bank's remedial measures, and the effectiveness of the Bank's quality assurance and testing protocols for sanctions screening across all BaaS partner integrations.

(ii) SAR Filing Processes. A comprehensive review of BRB's SAR filing processes, including an assessment of the approximately 2,400-alert backlog identified at the time of the Examination, the Bank's progress in clearing that backlog, the adequacy of the Bank's SAR filing timeliness controls, and the quality of filed SARs. This workstream will also assess the staffing and resource allocation dedicated to the Bank's AML investigations function.

(iii) CDD/EDD for High-Risk Customers. A comprehensive review of CDD and EDD documentation and procedures for the approximately 47,000 high-risk customer accounts identified in the Consent Order, including an assessment of the Bank's remediation plan for these accounts and the adequacy of the Bank's ongoing CDD/EDD processes for customers onboarded through BaaS partner channels.

(iv) Transaction Monitoring System Model Validation. An assessment of the current model validation status for Veridian TMS v.8.3, including the adequacy of any interim validation or tuning efforts undertaken since the Examination, and an evaluation of the Bank's plans for the upgrade to Veridian TMS v.10.0, including the planned timeline, testing protocols, and independent model validation arrangements.

(v) Board and Governance Oversight. A review of the Bank's Board-level BSA/AML and OFAC compliance oversight, including an assessment of the structure, charter, composition, and effectiveness of the newly established Compliance Committee of the Board, and the adequacy of management reporting to the Board on BSA/AML and OFAC program performance.

In addition to the five Consent Order deficiency areas, Phase 1 will include the following supplemental assessment components:

(vi) BSA/AML Department Staffing and Organizational Structure. A review of the Bank's BSA/AML compliance department, currently staffed at sixty-two full-time equivalents ("FTEs"), including an assessment of the adequacy of staffing levels relative to the Bank's risk profile, transaction volumes, and regulatory obligations. This review will also encompass the department's organizational structure, reporting lines, and the qualifications and experience of key compliance personnel.

(vii) BaaS Partner Oversight Framework. An assessment of BRB's oversight framework for all fourteen of its active BaaS partner relationships, with particular focus on the top three partners by transaction volume: NovaPay Technologies Inc. (representing approximately 41% of BRB's BaaS transaction volume, or approximately $30.5 billion in calendar year 2023), FairLend Digital LLC (approximately 28%), and VaultEdge Inc. (approximately 18%). This workstream will assess the adequacy of contractual compliance provisions, ongoing monitoring, escalation protocols, and the allocation of compliance responsibilities between BRB and its BaaS partners.

(viii) Policies, Procedures, Training Programs, and Internal Controls. A comprehensive review of BRB's written BSA/AML and OFAC policies and procedures, training programs for compliance personnel and business line staff, and internal controls, including quality assurance and quality control processes, audit coverage, and management self-testing.

Thornfield will prepare and deliver a preliminary gap assessment report (the "Preliminary Gap Assessment") by April 15, 2025. The Preliminary Gap Assessment will identify the current state of each deficiency area, assess the adequacy of the Bank's planned remediation measures, identify any additional gaps or deficiencies not previously identified, and provide recommendations for the Bank's Comprehensive Remediation Action Plan.

B. Phase 2 — Ongoing Monitoring and Remediation Validation

Phase 2 will consist of ongoing monitoring of BRB's implementation of the Comprehensive Remediation Action Plan, which is required to be submitted to the OCC by May 15, 2025 pursuant to Article V of the Consent Order. During Phase 2, Thornfield will validate the Bank's remediation efforts against each requirement of the Consent Order, assessing whether remediation milestones are being achieved on schedule and whether the remediated controls and processes are operating effectively.

Phase 2 will encompass validation of the following key remediation milestones established under the Consent Order and anticipated under the Comprehensive Remediation Action Plan:

(a) SAR Backlog Clearance. Validation that the approximately 2,400-alert backlog has been fully reviewed, dispositioned, and cleared, with target completion by June 30, 2025. This validation will include an assessment of the quality of alert dispositions and of any SARs filed as a result of the backlog clearance process.

(b) CDD/EDD Remediation. Validation of the Bank's progress in remediating CDD/EDD documentation and procedures for the approximately 47,000 identified high-risk customer accounts, with interim milestones of 50% completion by July 15, 2025 and 100% completion by January 15, 2026. Thornfield will conduct sample-based testing at each milestone to assess the quality and completeness of the remediated CDD/EDD documentation.

(c) Veridian TMS v.10.0 Deployment and User Acceptance Testing ("UAT"). Validation of the Bank's deployment of the upgraded transaction monitoring system, Veridian TMS v.10.0, including a review of UAT results and an assessment of the adequacy of the migration and testing process. The target completion date for deployment and UAT is August 1, 2025.

(d) Independent Model Validation of Upgraded TMS. Validation that a comprehensive independent model validation of the Veridian TMS v.10.0 system has been completed by a qualified independent party and that the results are satisfactory. The target completion date for this validation is October 1, 2025.

(e) OFAC Screening Full Operationalization for All BaaS Channels. Validation that OFAC sanctions screening is fully operational, tested, and effective across all fourteen of the Bank's active BaaS partner channels, with target completion by November 1, 2025. This validation will include testing of screening effectiveness, false negative analysis, and an assessment of quality assurance and testing protocols.

During Phase 2, Thornfield will provide periodic reporting to the Bank and to the OCC as required under the Consent Order. Thornfield will also support BRB in the preparation of the Bank's quarterly progress reports to the OCC, which are due September 15, 2025 and December 15, 2025, by providing independent assessments of the Bank's remediation progress for incorporation into or reference by those reports.

C. Phase 3 — Final Validation and Report

Phase 3 will consist of a final comprehensive validation of BRB's remediated BSA/AML and OFAC compliance program. This phase is designed to provide the OCC with an independent assessment of whether the Bank has fully remediated the deficiencies identified in the Consent Order and whether the Bank's compliance program is operating in a sustainable and effective manner.

Thornfield will deliver a final validation report (the "Final Validation Report") by February 15, 2026. The Final Validation Report will address, at a minimum, the following:

(a) Whether each requirement of the Consent Order has been fully satisfied;

(b) Whether the Bank's remediated BSA/AML and OFAC compliance program is operating effectively and in a manner reasonably designed to achieve and maintain compliance with applicable laws, regulations, and supervisory expectations;

(c) An assessment of the sustainability of the Bank's remediation measures, including the adequacy of ongoing staffing, governance, technology, policies, procedures, training, and internal controls; and

(d) Any recommendations for ongoing program enhancement or areas warranting continued supervisory attention.

The Final Validation Report is intended to support BRB's compliance self-certification under Article XII of the Consent Order and to provide the OCC with the independent assurance contemplated by Article VII.

V. Proposed Engagement Terms

A. Fee Structure

The proposed fee structure for the Thornfield engagement is as follows:

Fixed Professional Fee: $6,500,000 for the full twelve-month engagement period (February 2025 through February 2026), payable in monthly installments of $541,666.67.

Expenses: Reasonable and documented out-of-pocket expenses, including travel, lodging, technology and data access costs, and related engagement expenses, capped at $400,000 over the term of the engagement, billed separately from the fixed professional fee.

Total Engagement Cost: $6,900,000 (comprised of $6,500,000 in professional fees and $400,000 in expenses).

The fixed-fee structure is designed to provide cost certainty to the Bank and to align with the defined scope and timeline of the engagement. The fee reflects the complexity and breadth of the assessment and validation work required, the seniority and specialization of the engagement team, and the anticipated duration and intensity of the on-site and ongoing monitoring activities. BRB believes the proposed fee structure is reasonable and appropriate for an engagement of this nature and scope.

B. Term. The proposed engagement term is as follows:

Engagement Period: Twelve months, commencing February 2025 and concluding February 2026.

On-Site Assessment Commencement: March 1, 2025.

Preliminary Gap Assessment Delivery: April 15, 2025.

Final Validation Report Delivery: February 15, 2026.

The engagement term is aligned with the Consent Order's compliance timeline and is designed to provide Thornfield with sufficient time to conduct the Phase 1 assessment, monitor and validate remediation during Phase 2, and deliver the final validation during Phase 3. The engagement may be extended by mutual agreement of BRB and Thornfield, subject to any required OCC approval, in the event that circumstances warrant additional time.

C. Access and Cooperation

BRB has committed to providing Thornfield with full, unrestricted access to all systems, personnel, records, documents, and facilities reasonably required for the conduct of the engagement. This commitment is memorialized in the proposed engagement agreement and in a separate Access & Cooperation Protocol that has been negotiated between BRB and Thornfield.

The Bank has designated the following individuals as primary points of contact for the Thornfield engagement:

Patricia Langston — Chief Compliance Officer, Belmont Ridge Bank NA

Thomas Ikeda — BSA Officer / AML Program Director, Belmont Ridge Bank NA

Warren Ashby — Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA

Linda Petrosian — Chief Information Officer / Chief Technology Officer, Belmont Ridge Bank NA

The Access & Cooperation Protocol governs the procedures for document requests, interview scheduling, system access, data security, and the Bank's cooperation obligations during the engagement. The Protocol is designed to ensure that Thornfield's access is timely, complete, and unimpeded, while also addressing appropriate data security and confidentiality safeguards.

D. Reporting. Thornfield will report to the Bank and to the OCC as specified in Article VII of the Consent Order. Thornfield's reporting deliverables will include, at a minimum, the Preliminary Gap Assessment (due April 15, 2025), periodic progress updates during Phase 2 (at intervals to be determined in coordination with the OCC), and the Final Validation Report (due February 15, 2026).

All Thornfield reporting will be coordinated with Calderwood & Harkness LLP (Philip Hartmann, Responsible Partner) and BRB General Counsel (Gregory Nardone) with respect to privilege and confidentiality protocols. A common-interest privilege framework has been established among BRB, Calderwood & Harkness LLP, and Thornfield pursuant to a side letter agreement, designed to preserve applicable attorney-client privilege and attorney work product protections to the extent permitted by law, while ensuring that the OCC receives full and complete access to all independent consultant reports and findings as required by the Consent Order and applicable law.

E. Counsel to Thornfield

Thornfield is represented by Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036, with respect to the terms of the engagement agreement, liability and indemnification provisions, and regulatory privilege matters. Hargrove & Stein PC has been available to Calderwood & Harkness LLP and to BRB's General Counsel throughout the engagement negotiation process and will remain available to address any questions that may arise in connection with the OCC's review of this proposal.

VI. Engagement Agreement

BRB and Thornfield have negotiated a comprehensive engagement agreement (the "Engagement Agreement"), engagement reference TCG-BRB-2025-001, which is to be executed promptly upon receipt of the OCC's non-objection to the proposed engagement. A draft of the Engagement Agreement is enclosed as Enclosure 3 to this letter for the OCC's review.

The Engagement Agreement addresses all material terms of the engagement, including the scope of work (incorporating the Scope of Work attached as Appendix A, also enclosed separately as Enclosure 2), the fee structure, access and cooperation provisions, reporting obligations, confidentiality and data security requirements, indemnification and limitation of liability provisions, and termination provisions. The Engagement Agreement has been structured to be consistent with the requirements of Article VII of the Consent Order and with the OCC's expectations for independent consultant engagements.

Should the OCC prefer to review a fully executed version of the Engagement Agreement rather than the enclosed draft, BRB will make the executed agreement available promptly upon execution. BRB is also prepared to incorporate any modifications to the engagement scope or terms that the OCC may deem necessary in connection with its review of this proposal, subject to further negotiation with Thornfield as appropriate.

VII. Request for Non-Objection

On behalf of BRB, I respectfully request that the OCC confirm its non-objection to the engagement of Thornfield Consulting Group LLC as the independent consultant pursuant to Article VII of Consent Order No. OCC-2025-003. BRB believes that Thornfield possesses the qualifications, expertise, independence, and resources necessary to conduct the comprehensive BSA/AML and OFAC compliance program assessment and remediation validation required by the Consent Order. The proposed engagement scope is designed to address each of the five deficiency categories identified in the Consent Order, and the proposed timeline is aligned with the Consent Order's remediation milestones and reporting deadlines.

BRB is prepared to execute the Engagement Agreement and commence the Thornfield engagement promptly upon receipt of the OCC's non-objection, with the objective of commencing the on-site assessment on March 1, 2025 as proposed. BRB remains fully committed to compliance with all provisions, deadlines, and requirements of the Consent Order, and the Bank views the engagement of a qualified independent consultant as a critical component of its comprehensive remediation program.

Should the OCC require any additional information, supplemental materials, or clarification in connection with its evaluation of this proposal, BRB and Calderwood & Harkness LLP are prepared to provide such information promptly. We are also available to meet with the OCC examination team, in person or by teleconference, to discuss any aspect of the proposal at the OCC's convenience.

VIII. Closing

Thank you for your consideration of this proposal. BRB appreciates the OCC's engagement and cooperation throughout this process, and we look forward to receiving the OCC's response at its earliest convenience, recognizing the February 15, 2025 engagement deadline established by the Consent Order.

I am available to discuss this letter and the enclosed materials at any time at the OCC's convenience. I can be reached at the contact information set forth below.

Philip Hartmann Partner — Financial Institutions Regulatory & Enforcement Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 547-6128

Email: phartmann@calderwoodharkness.com

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Philip Hartmann Partner Financial Institutions Regulatory & Enforcement Group

Date: January 31, 2025

cc: (via electronic mail)

Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association

Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association

Diane Whitford, Chief Executive Officer, Belmont Ridge Bank National Association

Enclosures:

Enclosure 1: Curriculum Vitae / Biographical Summaries — Dr. Vivian Castellano, Robert Eastman, Jennifer Hwang, and Nathaniel Burgess

Enclosure 2: Proposed Scope of Work (Appendix A to Thornfield Engagement Agreement, Engagement Reference TCG-BRB-2025-001)

Enclosure 3: Draft Engagement Agreement between Belmont Ridge Bank National Association and Thornfield Consulting Group LLC (Engagement Reference TCG-BRB-2025-001)

Enclosure 4: Thornfield Consulting Group LLC — Conflict of Interest and Independence Certification

CONFIDENTIAL SUPERVISORY INFORMATION — NOT FOR PUBLIC DISCLOSURE This document contains Confidential Supervisory Information within the meaning of 12 C.F.R. § 4.32 et seq. Unauthorized disclosure is prohibited by law.
CALDERWOOD & HARKNESS LLP Attorneys at Law 1285 Avenue of the Americas, 40th Floor New York, New York 10019
Telephone: (212) 547-6000 Facsimile: (212) 547-6001
Philip Hartmann Partner — Financial Institutions Regulatory & Enforcement Group Direct: (212) 547-6128 phartmann@calderwoodharkness.com
January 31, 2025
VIA ELECTRONIC SUBMISSION AND Sundial Data Systems
Mr. Jonathan Frey National Bank Examiner / Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, New York 10017
Re: Proposed Independent Consultant Pursuant to Article VII of Consent Order No. OCC-2025-003 — Belmont Ridge Bank National Association (OCC Charter No. 48271)
Dear Mr. Frey:
I. Introduction
I write on behalf of Belmont Ridge Bank National Association ("BRB" or the "Bank"), OCC Charter No. 48271, FDIC Certificate No. 31845, in connection with the Bank's obligations under Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025. BRB is a national banking association headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022, and is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."
Calderwood & Harkness LLP serves as outside regulatory counsel to BRB in connection with the Bank's compliance with the Consent Order, including the Bank's engagement of an independent consultant as required thereunder. In that capacity, I submit this letter to the OCC on BRB's behalf.
The purpose of this letter is to submit for the OCC's non-objection the Bank's proposed engagement of Thornfield Consulting Group LLC ("Thornfield" or the "Consultant") as the independent consultant required under Article VII of the Consent Order. As the OCC is aware, Article VII requires BRB to retain, at its own expense, an independent consultant acceptable to the OCC to conduct a comprehensive assessment of BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance program, and to validate the Bank's remediation efforts in connection with the deficiencies identified in the Consent Order.
Article VII, Section 1 of the Consent Order establishes February 15, 2025 as the deadline by which the Bank must engage the independent consultant. BRB is committed to having this engagement fully in place well in advance of that deadline, and has accordingly undertaken an expedited but thorough selection process to identify a qualified and independent consultant. The Bank submits this proposal with the expectation that, upon receipt of the OCC's non-objection, the engagement agreement can be promptly executed and the Consultant's on-site assessment work can commence on or about March 1, 2025.
We respectfully request the OCC's non-objection to the proposed engagement of Thornfield Consulting Group LLC as the independent consultant pursuant to Article VII of the Consent Order. The balance of this letter sets forth (i) relevant background regarding the Consent Order, (ii) Thornfield's qualifications and proposed engagement team, (iii) the proposed scope of work, (iv) the proposed engagement terms, (v) information regarding the engagement agreement, and (vi) the Bank's formal request for non-objection. Supporting enclosures are described at the conclusion of this letter and are submitted concurrently herewith.
II. Background — Consent Order and Requirement for Independent Consultant
A. The Consent Order
Consent Order No. OCC-2025-003 was issued by the OCC on January 15, 2025, following the OCC's targeted BSA/AML examination of BRB conducted between March 2024 and September 2024 (the "Examination"). The Consent Order arose from the OCC's findings during the Examination that BRB maintained deficiencies in its BSA/AML and OFAC compliance program across five core categories. We summarize those categories below for the OCC's convenience in evaluating the alignment of the proposed engagement scope.
The five core deficiency categories identified in the Consent Order are as follows:
(i) Inadequate OFAC Sanctions Screening Protocols for Fintech BaaS Transaction Flows. The OCC identified a significant gap in BRB's OFAC sanctions screening for transactions processed through the Bank's Banking-as-a-Service ("BaaS") partner channels. In particular, the Examination revealed that approximately 12% of wire transfer and Automated Clearing House ("ACH") transactions originated through NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner by transaction volume, were not subjected to OFAC interdiction screening during calendar year 2023. This gap affected approximately 3.8 million transactions out of the approximately 31.7 million total NovaPay-originated transactions processed by BRB during that period. The OCC found that this screening gap resulted from a configuration deficiency in the integration layer between NovaPay's payment origination platform and BRB's sanctions screening infrastructure, which had not been identified through the Bank's existing quality assurance and testing procedures.
(ii) Deficient Suspicious Activity Report ("SAR") Filing Timeliness and Quality. The Examination identified material deficiencies in BRB's SAR filing processes. As of the September 2024 Examination date, the OCC found a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned by the Bank's AML investigations team. Additionally, the OCC found that BRB's average SAR filing time was approximately 78 days from the date of initial alert generation, which the OCC determined was inconsistent with the regulatory expectation of timely filing of SARs. The OCC further identified qualitative deficiencies in a sample of filed SARs, including insufficient narrative detail and inadequate documentation of investigative findings.
(iii) Insufficient Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for High-Risk Customers. The OCC found that BRB had failed to conduct adequate CDD and EDD for approximately 47,000 customers classified as high-risk, the substantial majority of whom had been onboarded through the Bank's fintech BaaS partner channels. The deficiencies included incomplete beneficial ownership information, insufficient documentation of the purpose and expected nature of customer accounts, and the absence of periodic EDD reviews for customers maintaining risk profiles warranting enhanced scrutiny.
(iv) Inadequate Model Validation for Transaction Monitoring System. The OCC determined that the Bank's primary transaction monitoring system, Veridian TMS version 8.3 ("Veridian TMS v.8.3"), provided by Veridian Analytics Inc., had not been subjected to a comprehensive independent model validation since March 2021 — a period of approximately three and one-half years as of the Examination date. The OCC found that this interval was inconsistent with sound risk management practices and the OCC's supervisory expectations for model risk management at institutions of BRB's size and complexity, particularly given the significant changes in the Bank's business model, customer base, and transaction volume resulting from the expansion of BRB's BaaS operations during the intervening period.
(v) Board-Level Oversight Deficiencies. The OCC found that BRB's Board of Directors (the "Board") had not exercised adequate oversight of the Bank's BSA/AML and OFAC compliance program. Among the specific findings, the OCC noted the absence of a dedicated Compliance Committee of the Board, with BSA/AML and OFAC compliance matters instead addressed on an ad hoc basis by the Board's Audit Committee. The OCC further found that Board-level reporting on BSA/AML and OFAC program performance was insufficiently detailed and that the Board had not taken timely and effective corrective action in response to prior supervisory findings.
B. Prior Supervisory History
The Consent Order references BRB's prior supervisory history, including a Matter Requiring Attention ("MRA") issued in June 2022 regarding deficiencies in BSA/AML transaction monitoring and a Matter Requiring Immediate Attention ("MRIA") issued in November 2023 regarding OFAC screening gaps identified during a supervisory review. The Consent Order cites BRB's failure to adequately remediate these prior supervisory findings as an aggravating factor contributing to the issuance of the Consent Order and the assessment of the civil money penalty described below.
C. Article VII — Independent Consultant Requirement
Article VII of the Consent Order requires BRB to retain an independent consultant, subject to OCC non-objection, to conduct a comprehensive assessment of the Bank's BSA/AML and OFAC compliance program, including an evaluation of each of the deficiency categories identified above, and to validate the Bank's remediation efforts. The independent consultant is required to be acceptable to the OCC, to be free from conflicts of interest, and to possess the qualifications and expertise necessary to conduct the assessment and validation contemplated by the Consent Order. The Consent Order establishes February 15, 2025 as the deadline for the Bank to engage the independent consultant.
D. Civil Money Penalty
In connection with the Consent Order, a civil money penalty in the amount of $14,500,000 was assessed against the Bank. BRB has acknowledged and accepted the penalty assessment, and payment arrangements are being administered separately in accordance with the terms of the Consent Order. The assessment of the civil money penalty underscores the seriousness with which the OCC and BRB view the identified deficiencies and further demonstrates the importance of the independent consultant engagement that is the subject of this letter.
III. Proposed Independent Consultant — Thornfield Consulting Group LLC
A. Firm Overview
BRB proposes to engage Thornfield Consulting Group LLC as the independent consultant under Article VII of the Consent Order. The key details of the proposed Consultant are as follows:
Full Legal Name: Thornfield Consulting Group LLC
Entity Type: Limited liability company organized and existing under the laws of the State of Delaware
Principal Office: 200 Park Avenue South, 15th Floor, New York, New York 10003
Engagement Reference Number: TCG-BRB-2025-001
Counsel to Thornfield: Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036
Thornfield is a specialized financial crimes advisory firm with deep expertise in BSA/AML compliance, OFAC sanctions program design and assessment, transaction monitoring system evaluation and optimization, and regulatory remediation for banking institutions subject to formal and informal enforcement actions. Since its founding, Thornfield has built a practice focused specifically on the complex regulatory and operational challenges faced by banking institutions operating in the financial crimes compliance space.
Thornfield has extensive experience advising national banks and other financial institutions on consent order compliance, OCC-mandated independent assessments, remediation planning and validation, and BSA/AML program design and enhancement. The firm has been engaged as an independent consultant in connection with OCC and FinCEN enforcement actions on multiple prior occasions, including engagements at institutions of comparable size and complexity to BRB. Thornfield's advisory practice encompasses the full spectrum of BSA/AML and OFAC compliance, from program governance and risk assessment to transaction monitoring, screening, customer due diligence, suspicious activity reporting, and regulatory reporting.
Critically for the present engagement, Thornfield possesses significant expertise in the unique BSA/AML and OFAC compliance challenges arising from Banking-as-a-Service operations and fintech partnerships. Given that the deficiencies identified in the Consent Order are substantially concentrated in BRB's BaaS partner channels, this expertise is directly relevant to the assessment and validation work required under Article VII.
B. Engagement Team Qualifications
Thornfield has designated a dedicated engagement team to conduct the independent consultant engagement for BRB. The proposed team is led by four senior professionals, each possessing specialized expertise directly relevant to one or more of the deficiency categories identified in the Consent Order. The qualifications of each team member are summarized below, and detailed curriculum vitae for each are enclosed as Enclosure 1 to this letter.
Dr. Vivian Castellano — Managing Director, Financial Crimes Advisory; Proposed Engagement Lead
Dr. Castellano will serve as the Engagement Lead for the Thornfield engagement and will bear overall responsibility for the conduct, quality, and timeliness of the independent assessment and validation work. Dr. Castellano is a Managing Director in Thornfield's Financial Crimes Advisory practice with more than twenty years of experience in financial crimes compliance, BSA/AML program design, regulatory remediation, and enforcement response for banking institutions.
Dr. Castellano has led multiple OCC-mandated independent consultant engagements at comparably sized national banking associations, including engagements involving BSA/AML consent orders with remediation scopes similar to the present matter. Her experience encompasses all phases of the independent consultant engagement lifecycle, from initial gap assessment through remediation validation and final reporting to the OCC. Dr. Castellano holds a Ph.D. in Economics from Columbia University, a J.D. from New York University School of Law, and is a Certified Anti-Money Laundering Specialist (CAMS). Prior to joining Thornfield, she held senior compliance leadership positions at two nationally chartered banking institutions and served as a supervisory examiner at the Federal Reserve Bank of New York.
Robert Eastman — Senior Director, AML Transaction Monitoring
Mr. Eastman will lead Thornfield's assessment and validation work with respect to the transaction monitoring system deficiencies identified in the Consent Order, including the inadequate model validation of Veridian TMS v.8.3 and the Bank's planned upgrade to Veridian TMS v.10.0. Mr. Eastman possesses deep expertise in transaction monitoring system assessment, model validation, scenario tuning and optimization, and above-the-line/below-the-line testing methodologies.
Mr. Eastman has more than fifteen years of experience evaluating transaction monitoring systems at large and mid-sized banking institutions. He has direct experience with the Veridian Analytics TMS platform, as well as other major AML technology platforms deployed across the banking industry. His prior engagements include model validation assessments for institutions subject to OCC and FinCEN enforcement actions, and he has extensive experience assessing the adequacy of transaction monitoring calibration in the context of rapidly evolving business models, including BaaS operations. Mr. Eastman will be directly responsible for assessing and validating remediation of the Veridian TMS v.8.3 model validation deficiencies and for evaluating the Bank's deployment of, and independent model validation for, TMS v.10.0.
Jennifer Hwang — Director, Sanctions & OFAC Compliance
Ms. Hwang will lead Thornfield's assessment and validation work with respect to the OFAC sanctions screening deficiencies identified in the Consent Order, with particular focus on the screening gap affecting NovaPay and the Bank's BaaS partner channels. Ms. Hwang is a recognized specialist in OFAC sanctions screening, list management, interdiction procedures, and sanctions program design. She has extensive experience assessing OFAC screening gaps across complex banking operations, including multi-channel and BaaS environments where sanctions screening must be integrated across multiple origination platforms and payment rails.
Ms. Hwang's prior experience includes engagements in which she assessed and validated the remediation of OFAC screening failures arising from technology integration deficiencies, configuration errors, and gaps in quality assurance and testing protocols — circumstances closely analogous to those presented in the current matter. Ms. Hwang will lead the assessment of BRB's OFAC screening remediation across all fourteen of the Bank's active BaaS partner channels, as well as the Bank's retail banking, commercial lending, and wealth management business lines.
Nathaniel Burgess — Director, Fintech & Payments Compliance
Mr. Burgess will lead Thornfield's assessment and validation work with respect to the CDD/EDD deficiencies identified in the Consent Order and the Bank's fintech partnership oversight framework. Mr. Burgess possesses specialized expertise in Banking-as-a-Service compliance frameworks, fintech partnership oversight, third-party risk management, and payments compliance. He has significant experience evaluating third-party risk management programs for banks with substantial BaaS operations, including assessments of customer onboarding controls, KYC/CDD/EDD processes, and the allocation of compliance responsibilities between banks and their fintech partners.
Mr. Burgess will lead the assessment of BRB's CDD/EDD remediation for the approximately 47,000 high-risk customer accounts identified in the Consent Order, as well as the Bank's fintech partner oversight frameworks and contractual compliance provisions across all fourteen active BaaS partner relationships, with particular attention to the top three partners by transaction volume: NovaPay Technologies Inc. (representing approximately 41% of BaaS transaction volume, or approximately $30.5 billion in calendar year 2023), FairLend Digital LLC (approximately 28% of BaaS transaction volume), and VaultEdge Inc. (approximately 18% of BaaS transaction volume).
In addition to the four named senior professionals, Thornfield will deploy additional team members, including analysts and subject-matter specialists, as needed during the course of the engagement. All additional team members will operate under the direct supervision of the named engagement leads and in accordance with the scope and protocols established in the engagement agreement.
C. Independence and Conflicts
Consistent with OCC expectations for independent consultant engagements under consent orders, BRB and Thornfield have conducted a thorough independence and conflicts assessment. The results of that assessment are summarized below. A formal Conflict of Interest and Independence Certification executed by Thornfield is enclosed as Enclosure 4 to this letter.
Thornfield has confirmed the following:
(a) Thornfield has no current or prior engagement, contractual relationship, or other business relationship with BRB, BRFG, or any subsidiary or affiliate of BRB or BRFG that would impair Thornfield's independence in conducting the engagement contemplated by Article VII of the Consent Order.
(b) Thornfield has no relationship, financial or otherwise, with Drayton Mercer LLP, BRB's former outside counsel in connection with BSA/AML regulatory matters, that would create a conflict of interest or impair Thornfield's ability to conduct an objective and independent assessment.
(c) Thornfield has confirmed that neither the firm nor any member of the proposed engagement team holds any financial interest in Veridian Analytics Inc. (the provider of BRB's current transaction monitoring system) or Ridgeline Data Systems LLC (one of the technology vendors under consideration in connection with BRB's compliance technology remediation efforts). Thornfield has no advisory, consulting, or other business relationship with either of these vendors that would create a conflict or impair independence.
(d) Thornfield is independent from Caldera & Pope LLP, BRB's external auditor and the firm that has performed BSA/AML independent testing for BRB in prior periods. Thornfield has no financial, organizational, or personnel relationship with Caldera & Pope LLP that would impair Thornfield's independence.
(e) Thornfield has confirmed that it is in full compliance with the OCC's expectations regarding consultant independence as set forth in the Consent Order and applicable OCC guidance, including OCC Bulletin 2017-43 and related supervisory communications.
BRB is satisfied, based on its own due diligence and Thornfield's certifications, that Thornfield satisfies the independence requirements of Article VII of the Consent Order and is free from conflicts that would impair the objectivity and reliability of the assessment and validation work to be performed.
IV. Proposed Scope of Engagement
The proposed scope of Thornfield's engagement encompasses three phases, designed to align with the requirements of Article VII of the Consent Order and the anticipated timeline for BRB's remediation efforts. A detailed Scope of Work is enclosed as Enclosure 2 (Appendix A to the Thornfield Engagement Agreement). The three phases are summarized below.
A. Phase 1 — On-Site Assessment and Gap Analysis
Thornfield's on-site assessment is proposed to commence on March 1, 2025, following execution of the engagement agreement and completion of any necessary administrative and logistical arrangements. Phase 1 will encompass a comprehensive review of all five deficiency categories identified in the Consent Order, as well as a broader assessment of BRB's BSA/AML and OFAC compliance program infrastructure.
The Phase 1 assessment will include, at a minimum, the following workstreams:
(i) OFAC Sanctions Screening. A comprehensive review of BRB's OFAC sanctions screening protocols across all business lines, including retail banking, commercial lending, wealth management, and all fourteen of the Bank's active BaaS partner channels. This workstream will include a focused examination of the NovaPay screening gap identified in the Consent Order, including the root cause of the configuration deficiency, the adequacy of the Bank's remedial measures, and the effectiveness of the Bank's quality assurance and testing protocols for sanctions screening across all BaaS partner integrations.
(ii) SAR Filing Processes. A comprehensive review of BRB's SAR filing processes, including an assessment of the approximately 2,400-alert backlog identified at the time of the Examination, the Bank's progress in clearing that backlog, the adequacy of the Bank's SAR filing timeliness controls, and the quality of filed SARs. This workstream will also assess the staffing and resource allocation dedicated to the Bank's AML investigations function.
(iii) CDD/EDD for High-Risk Customers. A comprehensive review of CDD and EDD documentation and procedures for the approximately 47,000 high-risk customer accounts identified in the Consent Order, including an assessment of the Bank's remediation plan for these accounts and the adequacy of the Bank's ongoing CDD/EDD processes for customers onboarded through BaaS partner channels.
(iv) Transaction Monitoring System Model Validation. An assessment of the current model validation status for Veridian TMS v.8.3, including the adequacy of any interim validation or tuning efforts undertaken since the Examination, and an evaluation of the Bank's plans for the upgrade to Veridian TMS v.10.0, including the planned timeline, testing protocols, and independent model validation arrangements.
(v) Board and Governance Oversight. A review of the Bank's Board-level BSA/AML and OFAC compliance oversight, including an assessment of the structure, charter, composition, and effectiveness of the newly established Compliance Committee of the Board, and the adequacy of management reporting to the Board on BSA/AML and OFAC program performance.
In addition to the five Consent Order deficiency areas, Phase 1 will include the following supplemental assessment components:
(vi) BSA/AML Department Staffing and Organizational Structure. A review of the Bank's BSA/AML compliance department, currently staffed at sixty-two full-time equivalents ("FTEs"), including an assessment of the adequacy of staffing levels relative to the Bank's risk profile, transaction volumes, and regulatory obligations. This review will also encompass the department's organizational structure, reporting lines, and the qualifications and experience of key compliance personnel.
(vii) BaaS Partner Oversight Framework. An assessment of BRB's oversight framework for all fourteen of its active BaaS partner relationships, with particular focus on the top three partners by transaction volume: NovaPay Technologies Inc. (representing approximately 41% of BRB's BaaS transaction volume, or approximately $30.5 billion in calendar year 2023), FairLend Digital LLC (approximately 28%), and VaultEdge Inc. (approximately 18%). This workstream will assess the adequacy of contractual compliance provisions, ongoing monitoring, escalation protocols, and the allocation of compliance responsibilities between BRB and its BaaS partners.
(viii) Policies, Procedures, Training Programs, and Internal Controls. A comprehensive review of BRB's written BSA/AML and OFAC policies and procedures, training programs for compliance personnel and business line staff, and internal controls, including quality assurance and quality control processes, audit coverage, and management self-testing.
Thornfield will prepare and deliver a preliminary gap assessment report (the "Preliminary Gap Assessment") by April 15, 2025. The Preliminary Gap Assessment will identify the current state of each deficiency area, assess the adequacy of the Bank's planned remediation measures, identify any additional gaps or deficiencies not previously identified, and provide recommendations for the Bank's Comprehensive Remediation Action Plan.
B. Phase 2 — Ongoing Monitoring and Remediation Validation
Phase 2 will consist of ongoing monitoring of BRB's implementation of the Comprehensive Remediation Action Plan, which is required to be submitted to the OCC by May 15, 2025 pursuant to Article V of the Consent Order. During Phase 2, Thornfield will validate the Bank's remediation efforts against each requirement of the Consent Order, assessing whether remediation milestones are being achieved on schedule and whether the remediated controls and processes are operating effectively.
Phase 2 will encompass validation of the following key remediation milestones established under the Consent Order and anticipated under the Comprehensive Remediation Action Plan:
(a) SAR Backlog Clearance. Validation that the approximately 2,400-alert backlog has been fully reviewed, dispositioned, and cleared, with target completion by June 30, 2025. This validation will include an assessment of the quality of alert dispositions and of any SARs filed as a result of the backlog clearance process.
(b) CDD/EDD Remediation. Validation of the Bank's progress in remediating CDD/EDD documentation and procedures for the approximately 47,000 identified high-risk customer accounts, with interim milestones of 50% completion by July 15, 2025 and 100% completion by January 15, 2026. Thornfield will conduct sample-based testing at each milestone to assess the quality and completeness of the remediated CDD/EDD documentation.
(c) Veridian TMS v.10.0 Deployment and User Acceptance Testing ("UAT"). Validation of the Bank's deployment of the upgraded transaction monitoring system, Veridian TMS v.10.0, including a review of UAT results and an assessment of the adequacy of the migration and testing process. The target completion date for deployment and UAT is August 1, 2025.
(d) Independent Model Validation of Upgraded TMS. Validation that a comprehensive independent model validation of the Veridian TMS v.10.0 system has been completed by a qualified independent party and that the results are satisfactory. The target completion date for this validation is October 1, 2025.
(e) OFAC Screening Full Operationalization for All BaaS Channels. Validation that OFAC sanctions screening is fully operational, tested, and effective across all fourteen of the Bank's active BaaS partner channels, with target completion by November 1, 2025. This validation will include testing of screening effectiveness, false negative analysis, and an assessment of quality assurance and testing protocols.
During Phase 2, Thornfield will provide periodic reporting to the Bank and to the OCC as required under the Consent Order. Thornfield will also support BRB in the preparation of the Bank's quarterly progress reports to the OCC, which are due September 15, 2025 and December 15, 2025, by providing independent assessments of the Bank's remediation progress for incorporation into or reference by those reports.
C. Phase 3 — Final Validation and Report
Phase 3 will consist of a final comprehensive validation of BRB's remediated BSA/AML and OFAC compliance program. This phase is designed to provide the OCC with an independent assessment of whether the Bank has fully remediated the deficiencies identified in the Consent Order and whether the Bank's compliance program is operating in a sustainable and effective manner.
Thornfield will deliver a final validation report (the "Final Validation Report") by February 15, 2026. The Final Validation Report will address, at a minimum, the following:
(a) Whether each requirement of the Consent Order has been fully satisfied;
(b) Whether the Bank's remediated BSA/AML and OFAC compliance program is operating effectively and in a manner reasonably designed to achieve and maintain compliance with applicable laws, regulations, and supervisory expectations;
(c) An assessment of the sustainability of the Bank's remediation measures, including the adequacy of ongoing staffing, governance, technology, policies, procedures, training, and internal controls; and
(d) Any recommendations for ongoing program enhancement or areas warranting continued supervisory attention.
The Final Validation Report is intended to support BRB's compliance self-certification under Article XII of the Consent Order and to provide the OCC with the independent assurance contemplated by Article VII.
V. Proposed Engagement Terms
A. Fee Structure
The proposed fee structure for the Thornfield engagement is as follows:
Fixed Professional Fee: $6,500,000 for the full twelve-month engagement period (February 2025 through February 2026), payable in monthly installments of $541,666.67.
Expenses: Reasonable and documented out-of-pocket expenses, including travel, lodging, technology and data access costs, and related engagement expenses, capped at $400,000 over the term of the engagement, billed separately from the fixed professional fee.
Total Engagement Cost: $6,900,000 (comprised of $6,500,000 in professional fees and $400,000 in expenses).
The fixed-fee structure is designed to provide cost certainty to the Bank and to align with the defined scope and timeline of the engagement. The fee reflects the complexity and breadth of the assessment and validation work required, the seniority and specialization of the engagement team, and the anticipated duration and intensity of the on-site and ongoing monitoring activities. BRB believes the proposed fee structure is reasonable and appropriate for an engagement of this nature and scope.
B. Term.  The proposed engagement term is as follows:
Engagement Period: Twelve months, commencing February 2025 and concluding February 2026.
On-Site Assessment Commencement: March 1, 2025.
Preliminary Gap Assessment Delivery: April 15, 2025.
Final Validation Report Delivery: February 15, 2026.
The engagement term is aligned with the Consent Order's compliance timeline and is designed to provide Thornfield with sufficient time to conduct the Phase 1 assessment, monitor and validate remediation during Phase 2, and deliver the final validation during Phase 3. The engagement may be extended by mutual agreement of BRB and Thornfield, subject to any required OCC approval, in the event that circumstances warrant additional time.
C. Access and Cooperation
BRB has committed to providing Thornfield with full, unrestricted access to all systems, personnel, records, documents, and facilities reasonably required for the conduct of the engagement. This commitment is memorialized in the proposed engagement agreement and in a separate Access & Cooperation Protocol that has been negotiated between BRB and Thornfield.
The Bank has designated the following individuals as primary points of contact for the Thornfield engagement:
Patricia Langston — Chief Compliance Officer, Belmont Ridge Bank NA
Thomas Ikeda — BSA Officer / AML Program Director, Belmont Ridge Bank NA
Warren Ashby — Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA
Linda Petrosian — Chief Information Officer / Chief Technology Officer, Belmont Ridge Bank NA
The Access & Cooperation Protocol governs the procedures for document requests, interview scheduling, system access, data security, and the Bank's cooperation obligations during the engagement. The Protocol is designed to ensure that Thornfield's access is timely, complete, and unimpeded, while also addressing appropriate data security and confidentiality safeguards.
D. Reporting.  Thornfield will report to the Bank and to the OCC as specified in Article VII of the Consent Order. Thornfield's reporting deliverables will include, at a minimum, the Preliminary Gap Assessment (due April 15, 2025), periodic progress updates during Phase 2 (at intervals to be determined in coordination with the OCC), and the Final Validation Report (due February 15, 2026).
All Thornfield reporting will be coordinated with Calderwood & Harkness LLP (Philip Hartmann, Responsible Partner) and BRB General Counsel (Gregory Nardone) with respect to privilege and confidentiality protocols. A common-interest privilege framework has been established among BRB, Calderwood & Harkness LLP, and Thornfield pursuant to a side letter agreement, designed to preserve applicable attorney-client privilege and attorney work product protections to the extent permitted by law, while ensuring that the OCC receives full and complete access to all independent consultant reports and findings as required by the Consent Order and applicable law.
E. Counsel to Thornfield
Thornfield is represented by Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, New York 10036, with respect to the terms of the engagement agreement, liability and indemnification provisions, and regulatory privilege matters. Hargrove & Stein PC has been available to Calderwood & Harkness LLP and to BRB's General Counsel throughout the engagement negotiation process and will remain available to address any questions that may arise in connection with the OCC's review of this proposal.
VI. Engagement Agreement
BRB and Thornfield have negotiated a comprehensive engagement agreement (the "Engagement Agreement"), engagement reference TCG-BRB-2025-001, which is to be executed promptly upon receipt of the OCC's non-objection to the proposed engagement. A draft of the Engagement Agreement is enclosed as Enclosure 3 to this letter for the OCC's review.
The Engagement Agreement addresses all material terms of the engagement, including the scope of work (incorporating the Scope of Work attached as Appendix A, also enclosed separately as Enclosure 2), the fee structure, access and cooperation provisions, reporting obligations, confidentiality and data security requirements, indemnification and limitation of liability provisions, and termination provisions. The Engagement Agreement has been structured to be consistent with the requirements of Article VII of the Consent Order and with the OCC's expectations for independent consultant engagements.
Should the OCC prefer to review a fully executed version of the Engagement Agreement rather than the enclosed draft, BRB will make the executed agreement available promptly upon execution. BRB is also prepared to incorporate any modifications to the engagement scope or terms that the OCC may deem necessary in connection with its review of this proposal, subject to further negotiation with Thornfield as appropriate.
VII. Request for Non-Objection
On behalf of BRB, I respectfully request that the OCC confirm its non-objection to the engagement of Thornfield Consulting Group LLC as the independent consultant pursuant to Article VII of Consent Order No. OCC-2025-003. BRB believes that Thornfield possesses the qualifications, expertise, independence, and resources necessary to conduct the comprehensive BSA/AML and OFAC compliance program assessment and remediation validation required by the Consent Order. The proposed engagement scope is designed to address each of the five deficiency categories identified in the Consent Order, and the proposed timeline is aligned with the Consent Order's remediation milestones and reporting deadlines.
BRB is prepared to execute the Engagement Agreement and commence the Thornfield engagement promptly upon receipt of the OCC's non-objection, with the objective of commencing the on-site assessment on March 1, 2025 as proposed. BRB remains fully committed to compliance with all provisions, deadlines, and requirements of the Consent Order, and the Bank views the engagement of a qualified independent consultant as a critical component of its comprehensive remediation program.
Should the OCC require any additional information, supplemental materials, or clarification in connection with its evaluation of this proposal, BRB and Calderwood & Harkness LLP are prepared to provide such information promptly. We are also available to meet with the OCC examination team, in person or by teleconference, to discuss any aspect of the proposal at the OCC's convenience.
VIII. Closing
Thank you for your consideration of this proposal. BRB appreciates the OCC's engagement and cooperation throughout this process, and we look forward to receiving the OCC's response at its earliest convenience, recognizing the February 15, 2025 engagement deadline established by the Consent Order.
I am available to discuss this letter and the enclosed materials at any time at the OCC's convenience. I can be reached at the contact information set forth below.
Philip Hartmann Partner — Financial Institutions Regulatory & Enforcement Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 547-6128
Email: phartmann@calderwoodharkness.com
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Philip Hartmann Partner Financial Institutions Regulatory & Enforcement Group
Date: January 31, 2025
cc: (via electronic mail)
Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
Diane Whitford, Chief Executive Officer, Belmont Ridge Bank National Association
Enclosures:
Enclosure 1: Curriculum Vitae / Biographical Summaries — Dr. Vivian Castellano, Robert Eastman, Jennifer Hwang, and Nathaniel Burgess
Enclosure 2: Proposed Scope of Work (Appendix A to Thornfield Engagement Agreement, Engagement Reference TCG-BRB-2025-001)
Enclosure 3: Draft Engagement Agreement between Belmont Ridge Bank National Association and Thornfield Consulting Group LLC (Engagement Reference TCG-BRB-2025-001)
Enclosure 4: Thornfield Consulting Group LLC — Conflict of Interest and Independence Certification
CONFIDENTIAL SUPERVISORY INFORMATION — NOT FOR PUBLIC DISCLOSURE This document contains Confidential Supervisory Information within the meaning of 12 C.F.R. § 4.32 et seq. Unauthorized disclosure is prohibited by law.

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts