1045-00002 · Calderwood & Harkness LLP · documents

memo-board-oversight-obligations-consent-order.docx DOCUMENT Antitrust

40 / 84 ← → ✕

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4000 Facsimile: (212) 558-3588

February 20, 2025

MEMORANDUM

TO: Board of Directors Belmont Ridge Financial Group, Inc. 680 Lexington Avenue, 22nd Floor New York, New York 10022

FROM: Philip Hartmann, Partner Calderwood & Harkness LLP

RE: Board Oversight Obligations Under OCC Consent Order No. OCC-2025-003 — Belmont Ridge Bank National Association

MATTER NO.: 1045-00002

COPIES TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Financial Group, Inc.; Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association; Yuki Nakamura, Associate, Calderwood & Harkness LLP

PRIVILEGE DESIGNATION: This memorandum is protected by the attorney-client privilege and the work-product doctrine. It is intended solely for the Board of Directors of Belmont Ridge Financial Group, Inc. and its subsidiary Belmont Ridge Bank National Association. This memorandum contains confidential legal advice and analysis regarding regulatory enforcement matters. It should not be distributed to, shared with, or disclosed to any person or entity without the prior written approval of outside counsel at Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of privilege or any other applicable protection.

Right-click to update Table of Contents

I. EXECUTIVE SUMMARY AND PURPOSE

Calderwood & Harkness LLP ("C&H" or "the Firm") was engaged by Belmont Ridge Bank National Association ("BRB," "Belmont Ridge," or "the Bank"; OCC Charter No. 48271; FDIC Certificate No. 31845) on February 10, 2025, to serve as outside regulatory counsel and to advise on the Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025. This engagement encompasses advisory services to the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), the Bank's parent holding company, a Delaware corporation and NYSE-listed bank holding company (Ticker: BRFG), as well as to the Bank's senior management, in connection with all aspects of the Consent Order remediation.

The purpose of this memorandum is to advise the BRFG Board of Directors (the "Board") on their individual and collective obligations for active oversight of BSA/AML compliance under the Consent Order, applicable federal banking law, OCC supervisory expectations, and related guidance from the Federal Deposit Insurance Corporation ("FDIC") and the Financial Crimes Enforcement Network ("FinCEN"). This memorandum is intended to serve as a comprehensive governance guide for the Board throughout the remediation period, which is expected to extend through at least February 15, 2026, the date by which full compliance program implementation, a compliance self-certification, and a final validation report from the independent consultant are due to the OCC.

As outlined in greater detail below, the Consent Order identified five core categories of deficiency in BRB's BSA/AML and sanctions compliance program:

(i) failures in the screening of transactions against the Office of Foreign Assets Control ("OFAC") sanctions lists, particularly with respect to Banking-as-a-Service ("BaaS") channel transactions;

(ii) deficiencies in the filing of Suspicious Activity Reports ("SARs"), including a substantial backlog of unreviewed alerts and material delays in the filing timeline;

(iii) failures in Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes, most notably with respect to accounts onboarded through fintech BaaS partnerships;

(iv) deficiencies in independent model validation of the Bank's transaction monitoring system; and

(v) inadequate board-level oversight of BSA/AML compliance, including the absence of a dedicated Compliance Committee and the insufficiency of reporting metrics provided to the Board.

It is critically important that each director understand that the Board's failure to maintain adequate governance structures was specifically cited as a deficiency in the Consent Order. The OCC's examiners concluded that the Board did not receive timely, complete, or actionable information regarding the Bank's BSA/AML compliance posture and that the absence of a dedicated committee structure devoted to compliance oversight contributed to the persistence and escalation of the underlying deficiencies. Remediation of this governance deficiency is not merely one component of the broader remediation program — it is a regulatory obligation that carries direct personal accountability implications for each director.

The total estimated remediation outlay in connection with the Consent Order is approximately $57,000,000, comprised of a Board-approved remediation budget of $42,500,000 and a civil money penalty ("CMP") of $14,500,000 assessed against the Bank. These figures are material relative to BRFG's consolidated financial profile and underscore the seriousness with which the OCC views the identified deficiencies.

This memorandum is organized as follows: Section II provides background on the Consent Order and its context, including the escalation history and the five core deficiency categories. Section III addresses the legal framework governing Board oversight of BSA/AML compliance. Section IV discusses the establishment and mandate of the Compliance Committee. Section V outlines individual director responsibilities and standards of conduct. Section VI addresses reporting and information flow. Section VII analyzes personal liability exposure for directors and officers. Section VIII sets forth practical recommendations for immediate and ongoing Board action. Section IX addresses privilege and confidentiality considerations. Section X provides a brief conclusion.

II. BACKGROUND: THE CONSENT ORDER AND ITS CONTEXT

A. Summary of Consent Order No. OCC-2025-003

On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order became effective immediately upon issuance. It is a public enforcement action and was posted to the OCC's enforcement actions database on the date of issuance.

The Consent Order is the culmination of a targeted BSA/AML examination conducted by the OCC's Northeastern District Office between March 2024 and September 2024. The examination was led by Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, New York 10017. The examination focused on the Bank's BSA/AML compliance program, with particular emphasis on the Bank's OFAC sanctions screening processes, SAR filing practices, CDD/EDD procedures for high-risk customers (including those onboarded through fintech BaaS channels), transaction monitoring system governance, and board-level oversight structures. The scope of the examination was informed by the OCC's prior supervisory interactions with the Bank, including a Matter Requiring Attention issued in June 2022 and a Matter Requiring Immediate Attention issued in November 2023, as discussed in Section II.B below.

The Consent Order assessed a civil money penalty of $14,500,000 against the Bank. This penalty is due and payable within sixty (60) days of the date of the Consent Order — that is, no later than March 16, 2025. The penalty is to be remitted by wire transfer to the United States Treasury. The Bank's failure to make timely payment would constitute a separate violation of the Consent Order and could result in additional enforcement action, including the accrual of interest and the imposition of supplemental penalties.

It is important for the Board to understand that, as of the date of this memorandum (February 20, 2025), no criminal referral to the United States Department of Justice ("DOJ") has been made in connection with the matters addressed in the Consent Order. However, the Consent Order expressly does not preclude future referral by the OCC to the DOJ or to any other federal or state law enforcement authority. C&H is monitoring this matter closely and will advise the Board promptly if there is any indication that a criminal referral is under consideration. In addition, FinCEN — through its liaison, Angela Drummond, Associate Director of the Enforcement Division — is separately monitoring BRB's SAR filing remediation efforts and has expressly reserved its independent enforcement rights. FinCEN's parallel monitoring creates an additional layer of regulatory oversight that the Board must take into account.

B. Escalation History

The Consent Order did not arise in a vacuum. The OCC's enforcement action represents the culmination of an escalating series of supervisory actions over a period of more than two and a half years. The Board should be fully aware of this escalation history, as it informs the OCC's expectations for the remediation and is directly relevant to the Board's personal liability exposure.

June 2022 — Matter Requiring Attention (MRA). In June 2022, the OCC issued a Matter Requiring Attention to BRB regarding identified deficiencies in the Bank's BSA/AML transaction monitoring processes. The MRA identified concerns regarding the calibration of the Bank's transaction monitoring system, the volume and quality of alerts generated, and the timeliness with which alerts were investigated and resolved. An MRA is a supervisory action that requires the Bank to take corrective measures within a reasonable period; it is not a formal enforcement action, but it is a serious communication from the regulator that demands a responsive and timely remediation effort. The Bank was expected to address the MRA deficiencies and to report on its remediation progress in subsequent examination cycles.

November 2023 — Matter Requiring Immediate Attention (MRIA). In November 2023, the OCC escalated its supervisory concerns by issuing a Matter Requiring Immediate Attention. The MRIA was specifically directed at the Bank's OFAC sanctions screening processes and identified significant gaps in the Bank's ability to ensure that 100% of transactions — particularly those flowing through BaaS partner channels — were screened against OFAC sanctions lists. An MRIA is a more severe supervisory action than an MRA and reflects the OCC's conclusion that the identified deficiencies pose an imminent risk to the safety and soundness of the Bank or to its compliance with applicable law. An MRIA demands immediate corrective action.

Aggravating Factor. The Consent Order expressly cites the Bank's failure to adequately remediate the June 2022 MRA and the November 2023 MRIA as an aggravating factor supporting the issuance of a formal consent order and the assessment of a civil money penalty. The OCC's examiners concluded that the Bank had been placed on notice of the deficiencies in its BSA/AML compliance program well before the 2024 examination and that the Bank's response was inadequate in scope, timeliness, and effectiveness. This finding has significant implications for the Board's remediation obligations and for the intensity of the OCC's ongoing supervisory oversight.

Termination of Prior Outside Counsel. During the 2023–2024 examination cycle, BRB was represented by Drayton Mercer LLP, with Helen Frazier serving as lead partner. That engagement was terminated in January 2025 following the issuance of the Consent Order. C&H's engagement commenced on February 10, 2025. C&H has obtained and is reviewing all relevant files and work product from the prior engagement to ensure continuity of representation and to identify any issues that may require attention.

C. Five Core Deficiency Categories

The Consent Order identifies five core categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each category is summarized below, together with the specific factual findings cited in the Consent Order and the applicable regulatory expectations.

1. OFAC Sanctions Screening Failures

The OCC found that BRB failed to screen 100% of transactions processed through its BaaS partner channels against OFAC sanctions lists. Specifically, the Consent Order determined that approximately 12% of all transactions processed through the Bank's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), were not subjected to OFAC screening during calendar year 2023. This failure affected approximately 3,800,000 of the approximately 31,700,000 total NovaPay transactions processed by BRB during that period. The screening gap was attributable to deficiencies in the integration of NovaPay's transaction flow with the Bank's OFAC screening infrastructure, including misconfigurations in the data feed between NovaPay's payment processing platform and the Bank's screening engine. The OCC concluded that this failure created a material risk that the Bank processed transactions involving sanctioned persons or entities without detection, in potential violation of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act, and OFAC regulations at 31 C.F.R. Part 501 et seq.

2. SAR Filing Deficiencies

The OCC found that BRB maintained a substantial backlog of unreviewed suspicious activity alerts. As of September 2024, the Bank had approximately 2,400 unreviewed alerts pending disposition. In addition, the Bank's average SAR filing time during the examination period was approximately 78 days from the date of initial detection of suspicious activity — far in excess of the 30-day regulatory expectation set forth in FinCEN's regulations and guidance. The OCC concluded that the Bank's SAR filing practices did not meet the requirements of 31 C.F.R. § 1020.320 and that the backlog of unreviewed alerts created a risk that reportable suspicious activity was not being identified and reported to FinCEN in a timely manner.

3. CDD/EDD Failures

The OCC found that approximately 47,000 high-risk customer accounts lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation. The vast majority of these accounts were onboarded through the Bank's fintech BaaS partner channels. The OCC concluded that the Bank's CDD/EDD processes did not satisfy the requirements of FinCEN's CDD Rule (31 C.F.R. § 1010.230) or the Bank's own internal policies and procedures. The deficiency was particularly pronounced with respect to accounts involving beneficial ownership information, source-of-funds documentation, and risk-tier classification for customers onboarded through BaaS partners.

4. Model Validation Deficiencies

The OCC found that the Bank's transaction monitoring system — Veridian TMS v.8.3, provided by Veridian Analytics Inc. — had not been independently validated since March 2021, a period of more than three years prior to the commencement of the 2024 examination. In addition, the tuning parameters for the system had not been updated since October 2022. The OCC concluded that the Bank's failure to conduct timely independent model validation and to update tuning parameters created a risk that the transaction monitoring system was not detecting suspicious activity with appropriate sensitivity and specificity, in contravention of OCC Bulletin 2011-12 (Sound Practices for Model Risk Management) and the Bank's own model risk management framework.

5. Board Oversight Deficiencies

The OCC found that the BRB Board of Directors lacked a dedicated Compliance Committee and that BSA/AML reporting to the Board was only quarterly in frequency and omitted key metrics, including SAR volumes, OFAC screening hit rates, and risk ratings by BaaS partner. The OCC concluded that the Board's governance structure was insufficient to provide the level of oversight required by the Bank's risk profile, the regulatory expectations applicable to BRB's BSA/AML compliance program, and the specific supervisory concerns that had been communicated to the Bank through the June 2022 MRA and the November 2023 MRIA. The absence of a dedicated compliance oversight committee and the insufficiency of reporting to the Board were identified as contributing causes of the Bank's failure to remediate previously identified deficiencies in a timely and effective manner.

D. Key Deadlines Under the Consent Order

The Consent Order establishes a series of mandatory deadlines for the Bank's remediation efforts. The Board must be fully aware of these deadlines and must ensure that all required actions are completed on or before the applicable dates. Failure to meet any deadline could result in additional enforcement action by the OCC, including the imposition of supplemental penalties, modifications to the Consent Order's terms, or further restrictions on the Bank's activities. The key deadlines are as follows:

The Board should treat these deadlines as immovable. C&H will work with management to build an internal project timeline that establishes interim milestones well in advance of each regulatory deadline, providing adequate time for Board and committee review, credible challenge, and any necessary revisions before submission to the OCC.

III. LEGAL FRAMEWORK FOR BOARD OVERSIGHT OF BSA/AML COMPLIANCE

A. Federal Banking Law — Statutory Obligations

The Bank Secrecy Act, codified at 31 U.S.C. §§ 5311–5332, together with its implementing regulations at 31 C.F.R. Chapter X, imposes on all banks and other covered financial institutions the obligation to establish and maintain an effective BSA/AML compliance program. The statutory and regulatory framework is designed to prevent and detect money laundering, terrorist financing, and other illicit financial activity, and to ensure that financial institutions serve as effective partners in the United States' effort to safeguard the integrity of the financial system.

Under the BSA and its implementing regulations, the Bank's compliance program must include, at a minimum, the following five pillars:

(i) A system of internal controls to ensure ongoing compliance with the BSA and its implementing regulations;

(ii) Independent testing of the BSA/AML compliance program by qualified personnel, whether internal audit staff or outside parties, conducted on a regular basis;

(iii) Designation of a qualified individual or individuals as BSA compliance officer(s) responsible for day-to-day administration of the compliance program (currently Thomas Ikeda, who was appointed BSA Officer of BRB in March 2023);

(iv) Training for appropriate personnel, including directors, officers, and employees, to ensure awareness of BSA/AML requirements and the institution's policies and procedures; and

(v) Appropriate risk-based procedures for conducting ongoing customer due diligence, including but not limited to understanding the nature and purpose of customer relationships and conducting ongoing monitoring to identify and report suspicious transactions.

The OCC, as BRB's primary federal banking regulator, exercises supervisory authority over the Bank's BSA/AML compliance program. The OCC's enforcement powers are derived principally from 12 U.S.C. § 1818, which authorizes the OCC to issue consent orders, cease-and-desist orders, and civil money penalties for violations of law, unsafe or unsound banking practices, and breaches of fiduciary duty, including violations of the BSA and its implementing regulations. The OCC may exercise these powers against the institution itself or against individual "institution-affiliated parties," a category that expressly includes directors and officers, as discussed in Section VII below.

B. OCC Heightened Standards (12 C.F.R. Part 30, Appendix D)

The OCC's Heightened Standards for certain large insured national banks, insured federal savings associations, and insured federal branches of foreign banks are codified at 12 C.F.R. Part 30, Appendix D. These standards apply directly to institutions with total consolidated assets of $50 billion or more. BRB reported total consolidated assets of approximately $38.7 billion as of December 31, 2024, which places the Bank below the mandatory applicability threshold.

However, the Board should be aware that the OCC has increasingly applied the principles and expectations embodied in the Heightened Standards to institutions below the $50 billion threshold, particularly in the context of enforcement actions and consent orders involving BSA/AML compliance failures. The Heightened Standards serve as best-practice guidance for institutions of BRB's size and complexity, and the OCC's examiners have referenced these standards in their supervisory communications with the Bank.

The Heightened Standards emphasize the Board's responsibility for several critical governance functions, including:

• Establishing and maintaining a risk governance framework that provides for the identification, measurement, monitoring, and control of the institution's material risks;

• Ensuring the independence of the risk management function and providing for direct reporting by the chief risk officer to the Board or an appropriate committee thereof;

• Setting and communicating risk limits (including compliance risk tolerances) and ensuring that these limits are adhered to by management;

• Establishing a comprehensive compliance infrastructure capable of identifying, monitoring, and addressing compliance risks across all business lines and activities;

• Providing effective "credible challenge" to management's risk assessments, compliance reports, and strategic decisions — meaning that the Board must possess sufficient expertise, receive sufficient information, and devote sufficient time and attention to meaningfully evaluate and question the information presented by management, rather than passively accepting management's representations.

The concept of "credible challenge" is of particular importance in the context of the Consent Order remediation. The OCC's finding that the Board's prior oversight was deficient reflects, in substantial part, the regulator's conclusion that the Board did not provide adequate credible challenge to management's representations regarding the effectiveness of the Bank's BSA/AML compliance program. Going forward, the Board must demonstrate — through its actions, its questions, and its documented deliberations — that it is exercising meaningful, independent judgment in evaluating the Bank's compliance posture and remediation progress.

C. OCC Consent Order — Specific Board Requirements

Article VII of Consent Order No. OCC-2025-003, captioned "Governance and Board Oversight Provisions," imposes a series of specific requirements on the Board of Directors. These requirements are mandatory, not advisory, and the Board's compliance with each requirement will be closely monitored by the OCC's examiners and by the independent consultant, Thornfield Consulting Group LLC. The key requirements are as follows:

(a) Board Resolution. The Board must adopt a formal resolution acknowledging the Consent Order and committing to full compliance with all of its provisions. This resolution must be adopted no later than February 28, 2025 — forty-five (45) days from the date of the Consent Order. A draft resolution has been prepared by C&H and is enclosed with this memorandum for the Board's consideration.

(b) Compliance Committee. The Board must establish a dedicated Compliance Committee of the Board to oversee BSA/AML and sanctions compliance remediation. The Compliance Committee must be composed of directors who are capable of devoting the time and attention necessary to fulfill the Committee's mandate and who possess or will promptly acquire sufficient knowledge of BSA/AML and sanctions compliance to exercise informed judgment.

(c) Monthly Committee Meetings. The Compliance Committee must meet no less frequently than monthly during the remediation period. Each meeting must be substantive, with a structured agenda addressing the status of each remediation workstream. The Committee must provide a written report to the full Board after each meeting summarizing the matters reviewed, the Committee's findings and conclusions, and any directives issued to management.

(d) Monthly Board Reporting. The Board must receive and review detailed monthly reporting on remediation progress, including specific metrics on each of the five core deficiency categories identified in the Consent Order. The reporting must be sufficiently detailed to enable the Board to assess whether remediation is proceeding on schedule, whether the resources allocated are adequate, and whether management is effectively executing the remediation plan.

(e) Independent Consultant. The Board must ensure retention of and full cooperation with an independent consultant acceptable to the OCC. The Bank has engaged Thornfield Consulting Group LLC ("Thornfield"; engagement reference TCG-BRB-2025-001) for this purpose. The engagement was executed on February 10, 2025, following the receipt of OCC non-objection on February 5, 2025. The Board must ensure that Thornfield receives unrestricted access to the Bank's personnel, records, systems, and facilities as needed to fulfill its mandate.

(f) Resource Authorization. The Board must authorize adequate financial, technological, and human resources for remediation. The Board has approved a remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP). The Consent Order requires the Board to ensure that this budget is sufficient and to authorize additional resources if needed.

D. FDIC Guidance on Board Oversight of BSA/AML Programs

BRB holds FDIC deposit insurance under FDIC Certificate No. 31845. As a result, the Bank is subject to the FDIC's requirements and expectations regarding BSA/AML compliance, in addition to those of the OCC. While the OCC serves as the Bank's primary federal banking regulator, the FDIC has an independent interest in ensuring that insured depository institutions maintain effective BSA/AML programs, given the potential for BSA/AML compliance failures to threaten the safety and soundness of insured institutions and the integrity of the deposit insurance fund.

FDIC expectations regarding Board engagement in BSA/AML oversight are generally aligned with OCC guidance. The FDIC expects Boards of Directors to review the results of independent BSA/AML testing, to receive regular reporting on the institution's compliance posture, and to ensure that identified deficiencies are remediated in a timely and effective manner. The most recent BSA/AML independent test of BRB's compliance program was conducted by Caldera & Pope LLP and was completed in September 2024. The engagement was led by Franklin Dorsey, CPA, as engagement partner, and the total fee for the engagement was approximately $1,100,000. The results of that independent test — which identified a number of the deficiencies subsequently cited in the Consent Order — should be reviewed by the Board and the Compliance Committee in the context of the remediation effort.

E. FinCEN Regulatory Expectations

FinCEN, a bureau of the United States Department of the Treasury, is responsible for administering the BSA and for collecting, analyzing, and disseminating financial intelligence derived from BSA filings. FinCEN's regulations require banks to file SARs and Currency Transaction Reports ("CTRs") in a timely and accurate manner.

BRB filed 3,847 SARs in calendar year 2024, an increase from 2,914 SARs in calendar year 2023. The Bank also filed 28,612 CTRs in calendar year 2024. Of the 3,847 SARs filed in 2024, 2,108 — or approximately 54.8% — were related to activity in the Bank's BaaS partner channels. This figure underscores the significant compliance risks associated with the Bank's BaaS business and the importance of adequate oversight of fintech partner relationships.

As noted above, FinCEN Associate Director Angela Drummond is monitoring BRB's SAR filing remediation. The Board should be aware that FinCEN has expressly reserved its independent enforcement rights in connection with the Bank's SAR filing deficiencies. This means that FinCEN may bring its own enforcement action against the Bank — separate from and in addition to the OCC's Consent Order — if it determines that the Bank's SAR filing practices remain deficient or that the Bank's remediation efforts are inadequate. FinCEN civil money penalties for willful violations of the BSA can be substantial and may be assessed against both the institution and individual officers and employees.

IV. ESTABLISHMENT AND MANDATE OF THE COMPLIANCE COMMITTEE

A. Compliance Committee Composition

The Consent Order requires the Board to establish a dedicated Compliance Committee to oversee all aspects of the Bank's BSA/AML and sanctions compliance remediation. The establishment of this Committee is one of the most immediate and important governance actions required of the Board. The Committee must be formally established, and its charter adopted, no later than February 28, 2025.

C&H recommends that the Compliance Committee be composed of at least three independent directors who possess, or are prepared to promptly acquire, the expertise and commitment necessary to fulfill the Committee's mandate. Based on discussions with the Board's Nominating and Governance Committee and with General Counsel Gregory Nardone, the following composition is recommended:

• James Rutherford, Chair. Mr. Rutherford has been designated by the Board as the Chair of the Compliance Committee, consistent with the Consent Order's requirements. Mr. Rutherford has served on the BRFG Board since 2018 and brings extensive experience in financial services regulation, having previously served as a Senior Deputy Comptroller at the OCC and as General Counsel of a major national bank.

• Sandra Villarreal, Member. Ms. Villarreal has served on the BRFG Board since 2020 and currently serves on the Audit Committee. She has significant experience in compliance and risk management, having served as Chief Compliance Officer of a large regional banking organization prior to her retirement.

• Keith Yamamoto, Member. Mr. Yamamoto has served on the BRFG Board since 2021 and currently serves on the Risk Committee. He brings expertise in technology and financial services, having served as Chief Technology Officer of a Beaumont Industries.

The Compliance Committee will need to coordinate closely with the Board's two other principal oversight committees: the Audit Committee, chaired by Margaret Dao, and the Risk Committee, chaired by Arthur Connelly, who also serves as the Lead Independent Director. It is important that the respective mandates of these three committees be clearly delineated to avoid duplication of effort or gaps in oversight. As a general matter, the Compliance Committee will have primary responsibility for overseeing the BSA/AML and sanctions compliance remediation, while the Audit Committee will retain responsibility for overseeing internal audit activities (including internal audit's role in assessing remediation progress) and the Risk Committee will retain responsibility for overseeing the Bank's broader risk management framework. Where matters fall within the purview of more than one committee, the committee chairs should coordinate to ensure effective and efficient coverage.

C&H is preparing a separate draft charter for the Compliance Committee, which will define the Committee's scope of authority, reporting relationships, and operating procedures. In addition, C&H is preparing draft amendments to the BRFG corporate bylaws to formalize the Compliance Committee as a standing committee of the Board. Both documents will be circulated to the Board for review and adoption in advance of the February 28, 2025 deadline.

B. Compliance Committee Responsibilities

The Compliance Committee's responsibilities will be extensive and will require a substantial commitment of time and attention from each member throughout the remediation period. The Committee's core responsibilities include, but are not limited to, the following:

Oversight of Remediation. The Compliance Committee will have overall Board-level oversight responsibility for all aspects of the BSA/AML and sanctions compliance remediation mandated by the Consent Order. This includes oversight of each of the five core deficiency categories and all related workstreams.

Remediation Action Plan. The Compliance Committee must review and approve the Comprehensive Remediation Action Plan prior to its submission to the OCC by May 15, 2025. The Remediation Action Plan will set forth in detail the Bank's strategy, timeline, resource allocation, and accountability structure for addressing each deficiency category. The Committee should review the Plan in draft form, provide substantive feedback and credible challenge, and satisfy itself that the Plan is realistic, comprehensive, and responsive to the OCC's expectations before authorizing its submission.

Monthly Reporting Review. The Compliance Committee must receive and evaluate monthly reporting on each remediation workstream. The monthly reporting package should include, at a minimum, the following categories of information:

• SAR Filing Metrics. SAR volumes, backlog clearance progress (current backlog: 2,400 unreviewed alerts; target for full clearance: June 30, 2025), and filing timeliness (reduction from the current 78-day average toward the 30-day regulatory target). The Committee should track month-over-month trends and assess whether the rate of backlog clearance and the improvement in filing timeliness are sufficient to meet the applicable deadlines.

• OFAC Screening Coverage. Metrics on OFAC screening coverage across all business lines and across the Bank's 14 active BaaS partner channels. The Committee should receive reporting on the status of the integration of each BaaS partner's transaction flows with the Bank's OFAC screening engine, with a target of full operationalization by November 1, 2025.

• CDD/EDD Remediation Progress. The number of accounts remediated out of the 47,000 accounts identified as lacking adequate CDD/EDD documentation, broken down by BaaS partner and risk tier. The Consent Order contemplates a phased remediation, with a 50% milestone (23,500 accounts) by July 15, 2025 and 100% completion by January 15, 2026.

• Veridian TMS Upgrade. The status of the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including user acceptance testing ("UAT"), which is targeted for completion by August 1, 2025, and independent model validation, which is targeted for completion by October 1, 2025.

• Training and Policy Development. Completion rates for BSA/AML training across all relevant personnel, including Board members, senior management, compliance staff, front-line employees, and BaaS partner personnel. Status of policy and procedure updates.

• BaaS Partner Risk Ratings and Compliance Assessments. The Committee should receive updated risk ratings and compliance assessments for all 14 active BaaS partners. Three partners in particular — NovaPay Technologies (41% of BaaS transaction volume), FairLend Digital (28%), and VaultEdge (18%) — collectively account for approximately 87% of the Bank's BaaS transaction volume and warrant the Committee's closest attention.

Direct Engagement with Key Stakeholders. The Compliance Committee should engage directly with the following individuals and parties:

• Independent Consultant. Dr. Vivian Castellano, Managing Director of Thornfield Consulting Group LLC, serves as the engagement lead for the independent consultant engagement. Her team includes Robert Eastman, Jennifer Hwang, and Nathaniel Burgess. The Committee Chair should establish and maintain a direct communication channel with Dr. Castellano and should ensure that the Committee receives candid and unfiltered assessments of the Bank's remediation progress from Thornfield.

• Outside Counsel. The primary C&H contact for the Compliance Committee is Philip Hartmann, the responsible partner for this engagement. The Committee may direct questions or requests for legal advice to Mr. Hartmann at any time.

• BRB Management. The Committee should receive presentations from and engage in substantive discussion with the following members of BRB management: Patricia Langston (Chief Compliance Officer), Thomas Ikeda (BSA Officer), Melissa Chu (Chief Risk Officer), Warren Ashby (Head of Fintech Partnerships/BaaS Division), and Linda Petrosian (Chief Information Officer/Chief Technology Officer). The Committee should expect management to provide candid, complete, and accurate reporting and should not hesitate to probe areas of concern or to request additional information.

Review of OCC Submissions. The Compliance Committee must review and provide credible challenge to all quarterly progress reports before submission to the OCC. The first quarterly progress report is due September 15, 2025, and the second is due December 15, 2025. The Committee should also review the compliance self-certification prior to its submission on February 15, 2026. The Board should view these submissions as its own representations to the OCC and should ensure that each submission is accurate, complete, and reflective of the Board's own assessment of the Bank's remediation progress.

C. Meeting Cadence and Documentation

The Consent Order requires the Compliance Committee to meet no less frequently than monthly during the remediation period, which extends from February 2025 through February 2026. C&H recommends that the Committee establish a standing monthly meeting schedule and that additional special meetings be convened as needed in response to material developments, such as new regulatory communications, significant remediation delays, or adverse findings by the independent consultant.

Detailed minutes of each Compliance Committee meeting must be prepared and maintained. The minutes should document all matters reviewed, all questions raised by directors, all responses provided by management and consultants, all directives issued by the Committee, and all decisions made. The minutes should reflect active, substantive engagement by each Committee member and should demonstrate that the Committee exercised independent judgment and credible challenge in evaluating the information presented.

The Board should be aware that the Compliance Committee's minutes and supporting materials will be subject to review by the OCC's examiners and by the independent consultant. These documents will serve as a critical evidentiary record of the Board's compliance with the governance requirements of the Consent Order. C&H will work with the Board Secretary's office to establish protocols for the preparation, review, and maintenance of Committee minutes to ensure that they are both thorough and appropriately reflective of the Committee's substantive deliberations, while also maintaining applicable privilege protections.

V. INDIVIDUAL DIRECTOR RESPONSIBILITIES AND STANDARDS OF CONDUCT

A. Duty of Care

Each director of BRFG and BRB has a fiduciary duty of care that requires informed, diligent, and independent participation in Board and committee deliberations related to BSA/AML compliance and the Consent Order remediation. The duty of care is not a passive obligation; it demands that each director take affirmative steps to fulfill his or her oversight responsibilities.

In practice, the duty of care in this context requires each director to:

• Review materials in advance. Directors must review the monthly reporting package, committee reports, and all other materials distributed in advance of Board and committee meetings. Directors should come to each meeting prepared to engage substantively with the information presented.

• Ask informed questions. Directors must actively participate in discussions and ask probing questions of management and consultants. Passive attendance at meetings is insufficient. Directors should inquire about the status of specific remediation milestones, the reasons for any delays or shortfalls, the adequacy of resources, and the effectiveness of corrective measures.

• Exercise independent judgment. Directors must evaluate the information presented to them independently and should not simply defer to management's characterizations of the Bank's compliance posture or remediation progress. Where management's representations are inconsistent with information available from other sources (such as the independent consultant, internal audit, or the OCC), directors should seek to understand and resolve those inconsistencies.

Failure to fulfill the duty of care could expose individual directors to personal liability under federal banking enforcement theories, as discussed in Section VII below. In addition, the OCC's examiners will evaluate the Board's compliance with its governance obligations under the Consent Order, and a finding that individual directors failed to participate meaningfully in oversight activities could lead to supervisory criticism or, in severe cases, enforcement action directed at individual directors.

B. Duty to Monitor (Caremark Standard)

BRFG is incorporated in Delaware, and the fiduciary obligations of its directors are governed by Delaware law. Under the seminal Delaware Supreme Court decision in Stone v. Ritter, 911 A.2d 362 (Del. 2006), which adopted and refined the standard established in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), the Board of Directors has an affirmative obligation to ensure that adequate information and reporting systems exist to bring to the Board's attention compliance failures that rise to the level of violations of law or breaches of fiduciary duty.

Under the Caremark standard, a director may be held personally liable for a failure of oversight if the plaintiffs demonstrate either (a) that the directors "utterly failed to implement any reporting or information system or controls," or (b) that "having implemented such a system or controls, [the directors] consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention." While Caremark claims have historically been described as "among the most difficult of corporate claims to plead and prove," the Delaware courts have in recent years demonstrated an increased willingness to sustain such claims at the pleading stage where the allegations suggest a sustained and systematic failure of Board oversight in the face of known regulatory risks. The Delaware Supreme Court's decision in Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), and subsequent decisions including In re Harborview & Co. Derivative Litigation, C.A. No. 2019-0907-MTZ (Del. Ch. 2021), have underscored that Caremark liability may attach where the Board fails to establish adequate monitoring systems for compliance risks that are "mission critical" to the company's operations.

The OCC's finding that BSA/AML reporting to the Board was inadequate — quarterly only, missing key metrics such as SAR volumes, OFAC screening hit rates, and BaaS partner risk ratings — is precisely the type of monitoring failure that can give rise to Caremark liability. The OCC's escalation history — from MRA in June 2022 to MRIA in November 2023 to Consent Order in January 2025 — provides a factual basis for an allegation that the Board was on notice of material compliance risks and failed to ensure that adequate reporting systems were in place to monitor the Bank's response. These facts create a heightened risk of shareholder derivative litigation alleging breach of the duty of oversight, as discussed in Section VII.C below.

The establishment of the Compliance Committee, the implementation of monthly reporting with detailed metrics, and the engagement of the independent consultant directly address this obligation going forward. These measures, if faithfully implemented and documented, should provide substantial protection against Caremark claims related to the remediation period. However, directors must ensure that these measures are not merely formalistic — they must reflect genuine, substantive engagement.

C. Active Engagement with Independent Consultant

The Consent Order requires the Bank to retain and cooperate fully with an independent consultant acceptable to the OCC. Thornfield Consulting Group LLC has been retained for this purpose, and OCC non-objection was received on February 5, 2025. Each director should understand the role that Thornfield will play in the remediation process and should be prepared to engage actively with Thornfield's findings and recommendations.

Thornfield will produce two principal deliverables:

• Preliminary Gap Assessment, due April 15, 2025. This assessment will evaluate the current state of BRB's BSA/AML compliance program, identify gaps relative to regulatory requirements and industry best practices, and set forth recommendations for remediation. The Board and the Compliance Committee should review the gap assessment thoroughly and should use it as a baseline for evaluating the sufficiency of the Bank's Remediation Action Plan.

• Final Validation Report, due February 15, 2026. This report will assess whether the Bank has achieved the remediation objectives set forth in the Consent Order and the Remediation Action Plan. The final validation report will be submitted to the OCC and will be a critical factor in the OCC's determination of whether the Bank has achieved full compliance.

Directors should allocate sufficient time to review and discuss both deliverables in depth. The Compliance Committee Chair, James Rutherford, should maintain a direct communication channel with Dr. Vivian Castellano, the Thornfield Managing Director leading the engagement, and should, through C&H, coordinate with the OCC as appropriate. Any interim findings or concerns raised by Thornfield between the two formal deliverables should be escalated to the Compliance Committee immediately.

D. Resource Authorization

A critical component of the Board's oversight obligation is the duty to ensure that the Bank has committed adequate financial, technological, and human resources to the remediation effort. The OCC's examiners will closely scrutinize whether the Board authorized sufficient resources and whether those resources were deployed effectively. The Board has approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP). The principal components of this budget are as follows:

If, during the course of the remediation, management determines that additional resources are required to meet the Consent Order's deadlines and requirements — whether due to unforeseen complexities, scope expansion, or changes in regulatory expectations — the Board should be prepared to authorize supplemental funding promptly. Delays in resource authorization could compromise the remediation timeline and expose the Board to additional regulatory criticism.

VI. REPORTING AND INFORMATION FLOW

A. Monthly Reporting Package

C&H recommends that BRB management, through Patricia Langston (CCO) and Thomas Ikeda (BSA Officer), prepare a comprehensive monthly BSA/AML compliance reporting package for the Compliance Committee. The reporting package should be distributed to Committee members no fewer than five (5) business days in advance of each scheduled monthly meeting to provide adequate time for review. The monthly reporting package should include the following categories of information:

• Remediation Milestone Tracker. A comprehensive tracker showing the status of each Consent Order deadline and each interim milestone established in the Remediation Action Plan, with a color-coded or equivalent designation for each item (on-track, at-risk, or behind schedule), together with narrative commentary explaining any items that are at risk or behind schedule and the corrective actions being taken.

• SAR Filing Metrics. Volume of SARs filed during the reporting period, filing timeliness (average days from detection to filing, with the goal of reducing from the current 78-day average toward the 30-day regulatory target), backlog status (number of unreviewed alerts remaining out of the 2,400-alert backlog, with interim clearance targets), and SAR conversion rate (the percentage of alerts that result in a SAR filing; CY 2024 conversion rate: 9.3%, based on 3,847 SARs from approximately 41,500 alerts).

• OFAC Screening Metrics. Coverage percentage across all business lines, hit volume (CY 2024: 14,320 total hits, of which 12 were true matches, reflecting a 99.9% false-positive rate), and the status of BaaS channel integration for each of the Bank's 14 active BaaS partner channels.

• CDD/EDD Remediation. Number of accounts remediated during the reporting period and cumulative progress toward the 47,000-account total, broken down by BaaS partner and risk tier.

• Veridian TMS Upgrade. Implementation progress, including status of data migration, system configuration, UAT, and independent model validation planning.

• Pinnacle Staffing Deployment. Number of Pinnacle temporary staff deployed, utilization rates, and quality metrics (such as alert disposition accuracy rates and SAR quality scores).

• Internal Hiring Progress. Status of permanent headcount additions against the 15-FTE target, including positions posted, candidates in pipeline, offers extended, and positions filled.

• Budget Utilization. Expenditures to date against the $42,500,000 remediation budget, by budget category, with projected run-rate and any anticipated budget variances.

• Regulatory Correspondence. Copies of or summaries of any new correspondence from the OCC, FinCEN, the FDIC, or other regulators related to the Consent Order or the Bank's BSA/AML compliance program.

The reporting package should be accompanied by a brief executive summary prepared by the CCO highlighting key developments, accomplishments, risks, and items requiring Board or Committee attention during the reporting period.

B. Quarterly OCC Reporting

The Consent Order requires the Bank to submit quarterly progress reports to the OCC. The first quarterly progress report is due September 15, 2025, and the second is due December 15, 2025. These reports will be prepared by C&H in coordination with BRB management and will detail the Bank's progress in addressing each of the five core deficiency categories and in meeting the remediation milestones established in the Comprehensive Remediation Action Plan.

The quarterly progress reports will be reviewed by the Compliance Committee before submission to the OCC. The Committee should devote adequate time to a thorough review and discussion of each report, should provide substantive feedback and credible challenge, and should satisfy itself that the report accurately reflects the Bank's remediation progress. The full Board should also have the opportunity to review the quarterly reports before they are submitted. The reports to the OCC are formal representations of the Bank and its Board, and each director should treat them with the same seriousness that he or she would apply to any public filing or regulatory submission.

C. Independent Consultant Reports

As discussed above, Thornfield will produce a preliminary gap assessment (due April 15, 2025) and a final validation report (due February 15, 2026). Both deliverables should be presented to the full Board, not merely to the Compliance Committee, and should be discussed in depth at a dedicated Board session. Directors should receive these reports well in advance of the Board meeting at which they will be discussed and should come prepared with substantive questions and observations.

In addition, any interim findings or concerns raised by Thornfield during the course of the engagement — whether communicated in writing, verbally, or through C&H — should be escalated to the Compliance Committee immediately. The Committee should maintain an open and responsive communication channel with Thornfield at all times.

D. Internal Audit Coordination

Derek Ballard, Head of Internal Audit, plays an important role in the remediation process. Internal audit serves as the Bank's third line of defense and provides independent assessments of the effectiveness of the Bank's risk management, compliance, and internal control processes. Mr. Ballard should provide the Audit Committee (chaired by Margaret Dao) and the Compliance Committee with independent assessments of remediation progress at regular intervals throughout the remediation period.

C&H recommends that the scope and timing of Caldera & Pope LLP's next BSA/AML independent testing engagement be coordinated with the remediation timeline and the Thornfield assessment. Specifically, Caldera & Pope should plan to conduct its next independent test following the completion of the major remediation workstreams (anticipated in late 2025 or early 2026), so that the testing can evaluate the effectiveness of the remediated compliance program. The results of the Caldera & Pope testing should be shared with the Compliance Committee, the Audit Committee, and the full Board, as well as with Thornfield and C&H.

VII. PERSONAL LIABILITY EXPOSURE FOR DIRECTORS AND OFFICERS

The Board should understand that the Consent Order and the circumstances surrounding it create meaningful personal liability exposure for individual directors and officers. This section summarizes the principal categories of risk.

A. Civil Money Penalties Under 12 U.S.C. § 1818

The OCC has broad authority under 12 U.S.C. § 1818(i) to impose civil money penalties not only on an insured depository institution but also on any "institution-affiliated party." The term "institution-affiliated party" is defined broadly in 12 U.S.C. § 1813(u) and expressly includes any director, officer, employee, agent, or other person participating in the conduct of the affairs of an insured depository institution.

Civil money penalties may be assessed at three tiers, depending on the severity of the conduct:

• First Tier (12 U.S.C. § 1818(i)(2)(A)): Penalties for violations of law, regulation, or any order or condition imposed in writing by the OCC. First-tier penalties may be assessed without a showing of intent or knowledge and are subject to statutory maximums that are adjusted annually for inflation.

• Second Tier (12 U.S.C. § 1818(i)(2)(B)): Penalties for violations that are part of a pattern of misconduct, that cause or are likely to cause more than a minimal loss to the institution, or that result in a pecuniary gain to the individual. Second-tier penalties carry substantially higher statutory maximums.

• Third Tier (12 U.S.C. § 1818(i)(2)(C)): Penalties for violations committed knowingly, in circumstances involving reckless disregard for the law, and that cause a substantial loss to the institution or result in a substantial pecuniary gain to the individual. Third-tier penalties carry the highest statutory maximums, which can reach $2,334,331 per day (as adjusted for inflation).

While the current Consent Order imposes a $14,500,000 CMP on the institution and does not impose individual CMPs on any director or officer, individual CMP actions remain a possibility. If the OCC determines that specific directors or officers failed to fulfill their oversight obligations — including obligations imposed by the Consent Order itself — the OCC could initiate individual CMP proceedings. The escalation history (the June 2022 MRA, the November 2023 MRIA, and the Board oversight deficiency findings in the Consent Order) provides a factual basis that the OCC could potentially draw upon in support of such actions. Active, documented Board engagement during the remediation period will serve as the most effective defense against any potential individual CMP action.

B. Removal and Prohibition Orders

Under 12 U.S.C. § 1818(e), the OCC has authority to seek removal and prohibition orders against any institution-affiliated party who has engaged in or participated in any unsafe or unsound practice in connection with any insured depository institution, or who has committed or engaged in any act, omission, or practice that constitutes a breach of the party's fiduciary duty. A removal and prohibition order bars the individual from participating in the affairs of any insured depository institution, which effectively ends the individual's career in the banking industry.

A finding that a director was aware of compliance deficiencies — as the BRFG Board was made aware through the June 2022 MRA and the November 2023 MRIA — and failed to take adequate corrective action could potentially support removal and prohibition proceedings. While such proceedings against outside directors are relatively uncommon, the OCC has pursued them in cases involving particularly egregious or prolonged failures of oversight. The Board should treat the remediation period as an opportunity to demonstrate affirmatively that it is fulfilling its oversight obligations with the level of diligence and engagement that the regulatory framework requires.

C. Shareholder Derivative Litigation Risk

The circumstances surrounding the Consent Order create conditions in which shareholder derivative claims alleging breach of fiduciary duty and failure of oversight are foreseeable. Several factors contribute to this risk:

• Stock Price Impact. BRFG's stock price experienced a significant decline following the public disclosure of the Consent Order, falling from approximately $47.82 per share on February 7, 2025 (a partial recovery level) to a post-disclosure low of approximately $41.15 per share on January 16, 2025, the trading day following the Consent Order's issuance. This represents a decline of approximately $6.67 per share, or approximately 13.9%.

• Material Financial Impact. The total remediation outlay of approximately $57,000,000 (including the $14,500,000 CMP) is material relative to BRFG's fiscal year 2024 net income of approximately $412,000,000, representing approximately 13.8% of annual net income.

• Activist Shareholder Activity. Brindoval Capital Partners LP (managing partner: Julian Whitmore), which holds approximately 8.3% of BRFG's outstanding common stock (approximately 14.9 million shares), has already expressed concern — through its outside counsel, Amberly Knox LLP (partner: Steven Briggs) — regarding the costs of remediation, the potential for additional enforcement fines, and the reputational impact on the company. While Brindoval has not, to our knowledge, filed or threatened to file a shareholder derivative action as of the date of this memorandum, the expression of concern through outside counsel is a significant development that the Board should take seriously.

A shareholder derivative complaint in this context would likely allege, among other claims, that the Board breached its fiduciary duty of oversight under the Caremark standard by failing to ensure that adequate reporting and monitoring systems were in place to address BSA/AML compliance risks, and that this failure resulted in harm to the company in the form of the CMP, remediation costs, reputational damage, and stock price decline. The factual predicate for such a claim is strong, given the escalation history, the Consent Order's specific finding of Board oversight deficiencies, and the magnitude of the financial impact. As noted in Section V.B above, the Delaware courts have demonstrated an increased willingness to sustain Caremark claims at the pleading stage in circumstances comparable to those presented here.

The Board's most effective defense against shareholder derivative liability is to demonstrate — through its actions during the remediation period — that it has taken the Consent Order seriously, has established robust oversight structures, has allocated adequate resources, has engaged actively and substantively with the

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4000 Facsimile: (212) 558-3588
February 20, 2025
MEMORANDUM
TO: Board of Directors Belmont Ridge Financial Group, Inc. 680 Lexington Avenue, 22nd Floor New York, New York 10022
FROM: Philip Hartmann, Partner Calderwood & Harkness LLP
RE: Board Oversight Obligations Under OCC Consent Order No. OCC-2025-003 — Belmont Ridge Bank National Association
MATTER NO.: 1045-00002
COPIES TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Financial Group, Inc.; Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association; Yuki Nakamura, Associate, Calderwood & Harkness LLP
PRIVILEGE DESIGNATION: This memorandum is protected by the attorney-client privilege and the work-product doctrine. It is intended solely for the Board of Directors of Belmont Ridge Financial Group, Inc. and its subsidiary Belmont Ridge Bank National Association. This memorandum contains confidential legal advice and analysis regarding regulatory enforcement matters. It should not be distributed to, shared with, or disclosed to any person or entity without the prior written approval of outside counsel at Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of privilege or any other applicable protection.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY AND PURPOSE
Calderwood & Harkness LLP ("C&H" or "the Firm") was engaged by Belmont Ridge Bank National Association ("BRB," "Belmont Ridge," or "the Bank"; OCC Charter No. 48271; FDIC Certificate No. 31845) on February 10, 2025, to serve as outside regulatory counsel and to advise on the Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025. This engagement encompasses advisory services to the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), the Bank's parent holding company, a Delaware corporation and NYSE-listed bank holding company (Ticker: BRFG), as well as to the Bank's senior management, in connection with all aspects of the Consent Order remediation.
The purpose of this memorandum is to advise the BRFG Board of Directors (the "Board") on their individual and collective obligations for active oversight of BSA/AML compliance under the Consent Order, applicable federal banking law, OCC supervisory expectations, and related guidance from the Federal Deposit Insurance Corporation ("FDIC") and the Financial Crimes Enforcement Network ("FinCEN"). This memorandum is intended to serve as a comprehensive governance guide for the Board throughout the remediation period, which is expected to extend through at least February 15, 2026, the date by which full compliance program implementation, a compliance self-certification, and a final validation report from the independent consultant are due to the OCC.
As outlined in greater detail below, the Consent Order identified five core categories of deficiency in BRB's BSA/AML and sanctions compliance program:
(i) failures in the screening of transactions against the Office of Foreign Assets Control ("OFAC") sanctions lists, particularly with respect to Banking-as-a-Service ("BaaS") channel transactions;
(ii) deficiencies in the filing of Suspicious Activity Reports ("SARs"), including a substantial backlog of unreviewed alerts and material delays in the filing timeline;
(iii) failures in Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes, most notably with respect to accounts onboarded through fintech BaaS partnerships;
(iv) deficiencies in independent model validation of the Bank's transaction monitoring system; and
(v) inadequate board-level oversight of BSA/AML compliance, including the absence of a dedicated Compliance Committee and the insufficiency of reporting metrics provided to the Board.
It is critically important that each director understand that the Board's failure to maintain adequate governance structures was specifically cited as a deficiency in the Consent Order. The OCC's examiners concluded that the Board did not receive timely, complete, or actionable information regarding the Bank's BSA/AML compliance posture and that the absence of a dedicated committee structure devoted to compliance oversight contributed to the persistence and escalation of the underlying deficiencies. Remediation of this governance deficiency is not merely one component of the broader remediation program — it is a regulatory obligation that carries direct personal accountability implications for each director.
The total estimated remediation outlay in connection with the Consent Order is approximately $57,000,000, comprised of a Board-approved remediation budget of $42,500,000 and a civil money penalty ("CMP") of $14,500,000 assessed against the Bank. These figures are material relative to BRFG's consolidated financial profile and underscore the seriousness with which the OCC views the identified deficiencies.
This memorandum is organized as follows: Section II provides background on the Consent Order and its context, including the escalation history and the five core deficiency categories. Section III addresses the legal framework governing Board oversight of BSA/AML compliance. Section IV discusses the establishment and mandate of the Compliance Committee. Section V outlines individual director responsibilities and standards of conduct. Section VI addresses reporting and information flow. Section VII analyzes personal liability exposure for directors and officers. Section VIII sets forth practical recommendations for immediate and ongoing Board action. Section IX addresses privilege and confidentiality considerations. Section X provides a brief conclusion.
II. BACKGROUND: THE CONSENT ORDER AND ITS CONTEXT
A. Summary of Consent Order No. OCC-2025-003
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order became effective immediately upon issuance. It is a public enforcement action and was posted to the OCC's enforcement actions database on the date of issuance.
The Consent Order is the culmination of a targeted BSA/AML examination conducted by the OCC's Northeastern District Office between March 2024 and September 2024. The examination was led by Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, New York 10017. The examination focused on the Bank's BSA/AML compliance program, with particular emphasis on the Bank's OFAC sanctions screening processes, SAR filing practices, CDD/EDD procedures for high-risk customers (including those onboarded through fintech BaaS channels), transaction monitoring system governance, and board-level oversight structures. The scope of the examination was informed by the OCC's prior supervisory interactions with the Bank, including a Matter Requiring Attention issued in June 2022 and a Matter Requiring Immediate Attention issued in November 2023, as discussed in Section II.B below.
The Consent Order assessed a civil money penalty of $14,500,000 against the Bank. This penalty is due and payable within sixty (60) days of the date of the Consent Order — that is, no later than March 16, 2025. The penalty is to be remitted by wire transfer to the United States Treasury. The Bank's failure to make timely payment would constitute a separate violation of the Consent Order and could result in additional enforcement action, including the accrual of interest and the imposition of supplemental penalties.
It is important for the Board to understand that, as of the date of this memorandum (February 20, 2025), no criminal referral to the United States Department of Justice ("DOJ") has been made in connection with the matters addressed in the Consent Order. However, the Consent Order expressly does not preclude future referral by the OCC to the DOJ or to any other federal or state law enforcement authority. C&H is monitoring this matter closely and will advise the Board promptly if there is any indication that a criminal referral is under consideration. In addition, FinCEN — through its liaison, Angela Drummond, Associate Director of the Enforcement Division — is separately monitoring BRB's SAR filing remediation efforts and has expressly reserved its independent enforcement rights. FinCEN's parallel monitoring creates an additional layer of regulatory oversight that the Board must take into account.
B. Escalation History
The Consent Order did not arise in a vacuum. The OCC's enforcement action represents the culmination of an escalating series of supervisory actions over a period of more than two and a half years. The Board should be fully aware of this escalation history, as it informs the OCC's expectations for the remediation and is directly relevant to the Board's personal liability exposure.
June 2022 — Matter Requiring Attention (MRA). In June 2022, the OCC issued a Matter Requiring Attention to BRB regarding identified deficiencies in the Bank's BSA/AML transaction monitoring processes. The MRA identified concerns regarding the calibration of the Bank's transaction monitoring system, the volume and quality of alerts generated, and the timeliness with which alerts were investigated and resolved. An MRA is a supervisory action that requires the Bank to take corrective measures within a reasonable period; it is not a formal enforcement action, but it is a serious communication from the regulator that demands a responsive and timely remediation effort. The Bank was expected to address the MRA deficiencies and to report on its remediation progress in subsequent examination cycles.
November 2023 — Matter Requiring Immediate Attention (MRIA). In November 2023, the OCC escalated its supervisory concerns by issuing a Matter Requiring Immediate Attention. The MRIA was specifically directed at the Bank's OFAC sanctions screening processes and identified significant gaps in the Bank's ability to ensure that 100% of transactions — particularly those flowing through BaaS partner channels — were screened against OFAC sanctions lists. An MRIA is a more severe supervisory action than an MRA and reflects the OCC's conclusion that the identified deficiencies pose an imminent risk to the safety and soundness of the Bank or to its compliance with applicable law. An MRIA demands immediate corrective action.
Aggravating Factor. The Consent Order expressly cites the Bank's failure to adequately remediate the June 2022 MRA and the November 2023 MRIA as an aggravating factor supporting the issuance of a formal consent order and the assessment of a civil money penalty. The OCC's examiners concluded that the Bank had been placed on notice of the deficiencies in its BSA/AML compliance program well before the 2024 examination and that the Bank's response was inadequate in scope, timeliness, and effectiveness. This finding has significant implications for the Board's remediation obligations and for the intensity of the OCC's ongoing supervisory oversight.
Termination of Prior Outside Counsel. During the 2023–2024 examination cycle, BRB was represented by Drayton Mercer LLP, with Helen Frazier serving as lead partner. That engagement was terminated in January 2025 following the issuance of the Consent Order. C&H's engagement commenced on February 10, 2025. C&H has obtained and is reviewing all relevant files and work product from the prior engagement to ensure continuity of representation and to identify any issues that may require attention.
C. Five Core Deficiency Categories
The Consent Order identifies five core categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each category is summarized below, together with the specific factual findings cited in the Consent Order and the applicable regulatory expectations.
1. OFAC Sanctions Screening Failures
The OCC found that BRB failed to screen 100% of transactions processed through its BaaS partner channels against OFAC sanctions lists. Specifically, the Consent Order determined that approximately 12% of all transactions processed through the Bank's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), were not subjected to OFAC screening during calendar year 2023. This failure affected approximately 3,800,000 of the approximately 31,700,000 total NovaPay transactions processed by BRB during that period. The screening gap was attributable to deficiencies in the integration of NovaPay's transaction flow with the Bank's OFAC screening infrastructure, including misconfigurations in the data feed between NovaPay's payment processing platform and the Bank's screening engine. The OCC concluded that this failure created a material risk that the Bank processed transactions involving sanctioned persons or entities without detection, in potential violation of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act, and OFAC regulations at 31 C.F.R. Part 501 et seq.
2. SAR Filing Deficiencies
The OCC found that BRB maintained a substantial backlog of unreviewed suspicious activity alerts. As of September 2024, the Bank had approximately 2,400 unreviewed alerts pending disposition. In addition, the Bank's average SAR filing time during the examination period was approximately 78 days from the date of initial detection of suspicious activity — far in excess of the 30-day regulatory expectation set forth in FinCEN's regulations and guidance. The OCC concluded that the Bank's SAR filing practices did not meet the requirements of 31 C.F.R. § 1020.320 and that the backlog of unreviewed alerts created a risk that reportable suspicious activity was not being identified and reported to FinCEN in a timely manner.
3. CDD/EDD Failures
The OCC found that approximately 47,000 high-risk customer accounts lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation. The vast majority of these accounts were onboarded through the Bank's fintech BaaS partner channels. The OCC concluded that the Bank's CDD/EDD processes did not satisfy the requirements of FinCEN's CDD Rule (31 C.F.R. § 1010.230) or the Bank's own internal policies and procedures. The deficiency was particularly pronounced with respect to accounts involving beneficial ownership information, source-of-funds documentation, and risk-tier classification for customers onboarded through BaaS partners.
4. Model Validation Deficiencies
The OCC found that the Bank's transaction monitoring system — Veridian TMS v.8.3, provided by Veridian Analytics Inc. — had not been independently validated since March 2021, a period of more than three years prior to the commencement of the 2024 examination. In addition, the tuning parameters for the system had not been updated since October 2022. The OCC concluded that the Bank's failure to conduct timely independent model validation and to update tuning parameters created a risk that the transaction monitoring system was not detecting suspicious activity with appropriate sensitivity and specificity, in contravention of OCC Bulletin 2011-12 (Sound Practices for Model Risk Management) and the Bank's own model risk management framework.
5. Board Oversight Deficiencies
The OCC found that the BRB Board of Directors lacked a dedicated Compliance Committee and that BSA/AML reporting to the Board was only quarterly in frequency and omitted key metrics, including SAR volumes, OFAC screening hit rates, and risk ratings by BaaS partner. The OCC concluded that the Board's governance structure was insufficient to provide the level of oversight required by the Bank's risk profile, the regulatory expectations applicable to BRB's BSA/AML compliance program, and the specific supervisory concerns that had been communicated to the Bank through the June 2022 MRA and the November 2023 MRIA. The absence of a dedicated compliance oversight committee and the insufficiency of reporting to the Board were identified as contributing causes of the Bank's failure to remediate previously identified deficiencies in a timely and effective manner.
D. Key Deadlines Under the Consent Order
The Consent Order establishes a series of mandatory deadlines for the Bank's remediation efforts. The Board must be fully aware of these deadlines and must ensure that all required actions are completed on or before the applicable dates. Failure to meet any deadline could result in additional enforcement action by the OCC, including the imposition of supplemental penalties, modifications to the Consent Order's terms, or further restrictions on the Bank's activities. The key deadlines are as follows:
The Board should treat these deadlines as immovable. C&H will work with management to build an internal project timeline that establishes interim milestones well in advance of each regulatory deadline, providing adequate time for Board and committee review, credible challenge, and any necessary revisions before submission to the OCC.
III. LEGAL FRAMEWORK FOR BOARD OVERSIGHT OF BSA/AML COMPLIANCE
A. Federal Banking Law — Statutory Obligations
The Bank Secrecy Act, codified at 31 U.S.C. §§ 5311–5332, together with its implementing regulations at 31 C.F.R. Chapter X, imposes on all banks and other covered financial institutions the obligation to establish and maintain an effective BSA/AML compliance program. The statutory and regulatory framework is designed to prevent and detect money laundering, terrorist financing, and other illicit financial activity, and to ensure that financial institutions serve as effective partners in the United States' effort to safeguard the integrity of the financial system.
Under the BSA and its implementing regulations, the Bank's compliance program must include, at a minimum, the following five pillars:
(i) A system of internal controls to ensure ongoing compliance with the BSA and its implementing regulations;
(ii) Independent testing of the BSA/AML compliance program by qualified personnel, whether internal audit staff or outside parties, conducted on a regular basis;
(iii) Designation of a qualified individual or individuals as BSA compliance officer(s) responsible for day-to-day administration of the compliance program (currently Thomas Ikeda, who was appointed BSA Officer of BRB in March 2023);
(iv) Training for appropriate personnel, including directors, officers, and employees, to ensure awareness of BSA/AML requirements and the institution's policies and procedures; and
(v) Appropriate risk-based procedures for conducting ongoing customer due diligence, including but not limited to understanding the nature and purpose of customer relationships and conducting ongoing monitoring to identify and report suspicious transactions.
The OCC, as BRB's primary federal banking regulator, exercises supervisory authority over the Bank's BSA/AML compliance program. The OCC's enforcement powers are derived principally from 12 U.S.C. § 1818, which authorizes the OCC to issue consent orders, cease-and-desist orders, and civil money penalties for violations of law, unsafe or unsound banking practices, and breaches of fiduciary duty, including violations of the BSA and its implementing regulations. The OCC may exercise these powers against the institution itself or against individual "institution-affiliated parties," a category that expressly includes directors and officers, as discussed in Section VII below.
B. OCC Heightened Standards (12 C.F.R. Part 30, Appendix D)
The OCC's Heightened Standards for certain large insured national banks, insured federal savings associations, and insured federal branches of foreign banks are codified at 12 C.F.R. Part 30, Appendix D. These standards apply directly to institutions with total consolidated assets of $50 billion or more. BRB reported total consolidated assets of approximately $38.7 billion as of December 31, 2024, which places the Bank below the mandatory applicability threshold.
However, the Board should be aware that the OCC has increasingly applied the principles and expectations embodied in the Heightened Standards to institutions below the $50 billion threshold, particularly in the context of enforcement actions and consent orders involving BSA/AML compliance failures. The Heightened Standards serve as best-practice guidance for institutions of BRB's size and complexity, and the OCC's examiners have referenced these standards in their supervisory communications with the Bank.
The Heightened Standards emphasize the Board's responsibility for several critical governance functions, including:
• Establishing and maintaining a risk governance framework that provides for the identification, measurement, monitoring, and control of the institution's material risks;
• Ensuring the independence of the risk management function and providing for direct reporting by the chief risk officer to the Board or an appropriate committee thereof;
• Setting and communicating risk limits (including compliance risk tolerances) and ensuring that these limits are adhered to by management;
• Establishing a comprehensive compliance infrastructure capable of identifying, monitoring, and addressing compliance risks across all business lines and activities;
• Providing effective "credible challenge" to management's risk assessments, compliance reports, and strategic decisions — meaning that the Board must possess sufficient expertise, receive sufficient information, and devote sufficient time and attention to meaningfully evaluate and question the information presented by management, rather than passively accepting management's representations.
The concept of "credible challenge" is of particular importance in the context of the Consent Order remediation. The OCC's finding that the Board's prior oversight was deficient reflects, in substantial part, the regulator's conclusion that the Board did not provide adequate credible challenge to management's representations regarding the effectiveness of the Bank's BSA/AML compliance program. Going forward, the Board must demonstrate — through its actions, its questions, and its documented deliberations — that it is exercising meaningful, independent judgment in evaluating the Bank's compliance posture and remediation progress.
C. OCC Consent Order — Specific Board Requirements
Article VII of Consent Order No. OCC-2025-003, captioned "Governance and Board Oversight Provisions," imposes a series of specific requirements on the Board of Directors. These requirements are mandatory, not advisory, and the Board's compliance with each requirement will be closely monitored by the OCC's examiners and by the independent consultant, Thornfield Consulting Group LLC. The key requirements are as follows:
(a) Board Resolution. The Board must adopt a formal resolution acknowledging the Consent Order and committing to full compliance with all of its provisions. This resolution must be adopted no later than February 28, 2025 — forty-five (45) days from the date of the Consent Order. A draft resolution has been prepared by C&H and is enclosed with this memorandum for the Board's consideration.
(b) Compliance Committee. The Board must establish a dedicated Compliance Committee of the Board to oversee BSA/AML and sanctions compliance remediation. The Compliance Committee must be composed of directors who are capable of devoting the time and attention necessary to fulfill the Committee's mandate and who possess or will promptly acquire sufficient knowledge of BSA/AML and sanctions compliance to exercise informed judgment.
(c) Monthly Committee Meetings. The Compliance Committee must meet no less frequently than monthly during the remediation period. Each meeting must be substantive, with a structured agenda addressing the status of each remediation workstream. The Committee must provide a written report to the full Board after each meeting summarizing the matters reviewed, the Committee's findings and conclusions, and any directives issued to management.
(d) Monthly Board Reporting. The Board must receive and review detailed monthly reporting on remediation progress, including specific metrics on each of the five core deficiency categories identified in the Consent Order. The reporting must be sufficiently detailed to enable the Board to assess whether remediation is proceeding on schedule, whether the resources allocated are adequate, and whether management is effectively executing the remediation plan.
(e) Independent Consultant. The Board must ensure retention of and full cooperation with an independent consultant acceptable to the OCC. The Bank has engaged Thornfield Consulting Group LLC ("Thornfield"; engagement reference TCG-BRB-2025-001) for this purpose. The engagement was executed on February 10, 2025, following the receipt of OCC non-objection on February 5, 2025. The Board must ensure that Thornfield receives unrestricted access to the Bank's personnel, records, systems, and facilities as needed to fulfill its mandate.
(f) Resource Authorization. The Board must authorize adequate financial, technological, and human resources for remediation. The Board has approved a remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP). The Consent Order requires the Board to ensure that this budget is sufficient and to authorize additional resources if needed.
D. FDIC Guidance on Board Oversight of BSA/AML Programs
BRB holds FDIC deposit insurance under FDIC Certificate No. 31845. As a result, the Bank is subject to the FDIC's requirements and expectations regarding BSA/AML compliance, in addition to those of the OCC. While the OCC serves as the Bank's primary federal banking regulator, the FDIC has an independent interest in ensuring that insured depository institutions maintain effective BSA/AML programs, given the potential for BSA/AML compliance failures to threaten the safety and soundness of insured institutions and the integrity of the deposit insurance fund.
FDIC expectations regarding Board engagement in BSA/AML oversight are generally aligned with OCC guidance. The FDIC expects Boards of Directors to review the results of independent BSA/AML testing, to receive regular reporting on the institution's compliance posture, and to ensure that identified deficiencies are remediated in a timely and effective manner. The most recent BSA/AML independent test of BRB's compliance program was conducted by Caldera & Pope LLP and was completed in September 2024. The engagement was led by Franklin Dorsey, CPA, as engagement partner, and the total fee for the engagement was approximately $1,100,000. The results of that independent test — which identified a number of the deficiencies subsequently cited in the Consent Order — should be reviewed by the Board and the Compliance Committee in the context of the remediation effort.
E. FinCEN Regulatory Expectations
FinCEN, a bureau of the United States Department of the Treasury, is responsible for administering the BSA and for collecting, analyzing, and disseminating financial intelligence derived from BSA filings. FinCEN's regulations require banks to file SARs and Currency Transaction Reports ("CTRs") in a timely and accurate manner.
BRB filed 3,847 SARs in calendar year 2024, an increase from 2,914 SARs in calendar year 2023. The Bank also filed 28,612 CTRs in calendar year 2024. Of the 3,847 SARs filed in 2024, 2,108 — or approximately 54.8% — were related to activity in the Bank's BaaS partner channels. This figure underscores the significant compliance risks associated with the Bank's BaaS business and the importance of adequate oversight of fintech partner relationships.
As noted above, FinCEN Associate Director Angela Drummond is monitoring BRB's SAR filing remediation. The Board should be aware that FinCEN has expressly reserved its independent enforcement rights in connection with the Bank's SAR filing deficiencies. This means that FinCEN may bring its own enforcement action against the Bank — separate from and in addition to the OCC's Consent Order — if it determines that the Bank's SAR filing practices remain deficient or that the Bank's remediation efforts are inadequate. FinCEN civil money penalties for willful violations of the BSA can be substantial and may be assessed against both the institution and individual officers and employees.
IV. ESTABLISHMENT AND MANDATE OF THE COMPLIANCE COMMITTEE
A. Compliance Committee Composition
The Consent Order requires the Board to establish a dedicated Compliance Committee to oversee all aspects of the Bank's BSA/AML and sanctions compliance remediation. The establishment of this Committee is one of the most immediate and important governance actions required of the Board. The Committee must be formally established, and its charter adopted, no later than February 28, 2025.
C&H recommends that the Compliance Committee be composed of at least three independent directors who possess, or are prepared to promptly acquire, the expertise and commitment necessary to fulfill the Committee's mandate. Based on discussions with the Board's Nominating and Governance Committee and with General Counsel Gregory Nardone, the following composition is recommended:
• James Rutherford, Chair. Mr. Rutherford has been designated by the Board as the Chair of the Compliance Committee, consistent with the Consent Order's requirements. Mr. Rutherford has served on the BRFG Board since 2018 and brings extensive experience in financial services regulation, having previously served as a Senior Deputy Comptroller at the OCC and as General Counsel of a major national bank.
• Sandra Villarreal, Member. Ms. Villarreal has served on the BRFG Board since 2020 and currently serves on the Audit Committee. She has significant experience in compliance and risk management, having served as Chief Compliance Officer of a large regional banking organization prior to her retirement.
• Keith Yamamoto, Member. Mr. Yamamoto has served on the BRFG Board since 2021 and currently serves on the Risk Committee. He brings expertise in technology and financial services, having served as Chief Technology Officer of a Beaumont Industries.
The Compliance Committee will need to coordinate closely with the Board's two other principal oversight committees: the Audit Committee, chaired by Margaret Dao, and the Risk Committee, chaired by Arthur Connelly, who also serves as the Lead Independent Director. It is important that the respective mandates of these three committees be clearly delineated to avoid duplication of effort or gaps in oversight. As a general matter, the Compliance Committee will have primary responsibility for overseeing the BSA/AML and sanctions compliance remediation, while the Audit Committee will retain responsibility for overseeing internal audit activities (including internal audit's role in assessing remediation progress) and the Risk Committee will retain responsibility for overseeing the Bank's broader risk management framework. Where matters fall within the purview of more than one committee, the committee chairs should coordinate to ensure effective and efficient coverage.
C&H is preparing a separate draft charter for the Compliance Committee, which will define the Committee's scope of authority, reporting relationships, and operating procedures. In addition, C&H is preparing draft amendments to the BRFG corporate bylaws to formalize the Compliance Committee as a standing committee of the Board. Both documents will be circulated to the Board for review and adoption in advance of the February 28, 2025 deadline.
B. Compliance Committee Responsibilities
The Compliance Committee's responsibilities will be extensive and will require a substantial commitment of time and attention from each member throughout the remediation period. The Committee's core responsibilities include, but are not limited to, the following:
Oversight of Remediation. The Compliance Committee will have overall Board-level oversight responsibility for all aspects of the BSA/AML and sanctions compliance remediation mandated by the Consent Order. This includes oversight of each of the five core deficiency categories and all related workstreams.
Remediation Action Plan. The Compliance Committee must review and approve the Comprehensive Remediation Action Plan prior to its submission to the OCC by May 15, 2025. The Remediation Action Plan will set forth in detail the Bank's strategy, timeline, resource allocation, and accountability structure for addressing each deficiency category. The Committee should review the Plan in draft form, provide substantive feedback and credible challenge, and satisfy itself that the Plan is realistic, comprehensive, and responsive to the OCC's expectations before authorizing its submission.
Monthly Reporting Review. The Compliance Committee must receive and evaluate monthly reporting on each remediation workstream. The monthly reporting package should include, at a minimum, the following categories of information:
• SAR Filing Metrics. SAR volumes, backlog clearance progress (current backlog: 2,400 unreviewed alerts; target for full clearance: June 30, 2025), and filing timeliness (reduction from the current 78-day average toward the 30-day regulatory target). The Committee should track month-over-month trends and assess whether the rate of backlog clearance and the improvement in filing timeliness are sufficient to meet the applicable deadlines.
• OFAC Screening Coverage. Metrics on OFAC screening coverage across all business lines and across the Bank's 14 active BaaS partner channels. The Committee should receive reporting on the status of the integration of each BaaS partner's transaction flows with the Bank's OFAC screening engine, with a target of full operationalization by November 1, 2025.
• CDD/EDD Remediation Progress. The number of accounts remediated out of the 47,000 accounts identified as lacking adequate CDD/EDD documentation, broken down by BaaS partner and risk tier. The Consent Order contemplates a phased remediation, with a 50% milestone (23,500 accounts) by July 15, 2025 and 100% completion by January 15, 2026.
• Veridian TMS Upgrade. The status of the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including user acceptance testing ("UAT"), which is targeted for completion by August 1, 2025, and independent model validation, which is targeted for completion by October 1, 2025.
• Training and Policy Development. Completion rates for BSA/AML training across all relevant personnel, including Board members, senior management, compliance staff, front-line employees, and BaaS partner personnel. Status of policy and procedure updates.
• BaaS Partner Risk Ratings and Compliance Assessments. The Committee should receive updated risk ratings and compliance assessments for all 14 active BaaS partners. Three partners in particular — NovaPay Technologies (41% of BaaS transaction volume), FairLend Digital (28%), and VaultEdge (18%) — collectively account for approximately 87% of the Bank's BaaS transaction volume and warrant the Committee's closest attention.
Direct Engagement with Key Stakeholders. The Compliance Committee should engage directly with the following individuals and parties:
• Independent Consultant. Dr. Vivian Castellano, Managing Director of Thornfield Consulting Group LLC, serves as the engagement lead for the independent consultant engagement. Her team includes Robert Eastman, Jennifer Hwang, and Nathaniel Burgess. The Committee Chair should establish and maintain a direct communication channel with Dr. Castellano and should ensure that the Committee receives candid and unfiltered assessments of the Bank's remediation progress from Thornfield.
• Outside Counsel. The primary C&H contact for the Compliance Committee is Philip Hartmann, the responsible partner for this engagement. The Committee may direct questions or requests for legal advice to Mr. Hartmann at any time.
• BRB Management. The Committee should receive presentations from and engage in substantive discussion with the following members of BRB management: Patricia Langston (Chief Compliance Officer), Thomas Ikeda (BSA Officer), Melissa Chu (Chief Risk Officer), Warren Ashby (Head of Fintech Partnerships/BaaS Division), and Linda Petrosian (Chief Information Officer/Chief Technology Officer). The Committee should expect management to provide candid, complete, and accurate reporting and should not hesitate to probe areas of concern or to request additional information.
Review of OCC Submissions. The Compliance Committee must review and provide credible challenge to all quarterly progress reports before submission to the OCC. The first quarterly progress report is due September 15, 2025, and the second is due December 15, 2025. The Committee should also review the compliance self-certification prior to its submission on February 15, 2026. The Board should view these submissions as its own representations to the OCC and should ensure that each submission is accurate, complete, and reflective of the Board's own assessment of the Bank's remediation progress.
C. Meeting Cadence and Documentation
The Consent Order requires the Compliance Committee to meet no less frequently than monthly during the remediation period, which extends from February 2025 through February 2026. C&H recommends that the Committee establish a standing monthly meeting schedule and that additional special meetings be convened as needed in response to material developments, such as new regulatory communications, significant remediation delays, or adverse findings by the independent consultant.
Detailed minutes of each Compliance Committee meeting must be prepared and maintained. The minutes should document all matters reviewed, all questions raised by directors, all responses provided by management and consultants, all directives issued by the Committee, and all decisions made. The minutes should reflect active, substantive engagement by each Committee member and should demonstrate that the Committee exercised independent judgment and credible challenge in evaluating the information presented.
The Board should be aware that the Compliance Committee's minutes and supporting materials will be subject to review by the OCC's examiners and by the independent consultant. These documents will serve as a critical evidentiary record of the Board's compliance with the governance requirements of the Consent Order. C&H will work with the Board Secretary's office to establish protocols for the preparation, review, and maintenance of Committee minutes to ensure that they are both thorough and appropriately reflective of the Committee's substantive deliberations, while also maintaining applicable privilege protections.
V. INDIVIDUAL DIRECTOR RESPONSIBILITIES AND STANDARDS OF CONDUCT
A. Duty of Care
Each director of BRFG and BRB has a fiduciary duty of care that requires informed, diligent, and independent participation in Board and committee deliberations related to BSA/AML compliance and the Consent Order remediation. The duty of care is not a passive obligation; it demands that each director take affirmative steps to fulfill his or her oversight responsibilities.
In practice, the duty of care in this context requires each director to:
• Review materials in advance. Directors must review the monthly reporting package, committee reports, and all other materials distributed in advance of Board and committee meetings. Directors should come to each meeting prepared to engage substantively with the information presented.
• Ask informed questions. Directors must actively participate in discussions and ask probing questions of management and consultants. Passive attendance at meetings is insufficient. Directors should inquire about the status of specific remediation milestones, the reasons for any delays or shortfalls, the adequacy of resources, and the effectiveness of corrective measures.
• Exercise independent judgment. Directors must evaluate the information presented to them independently and should not simply defer to management's characterizations of the Bank's compliance posture or remediation progress. Where management's representations are inconsistent with information available from other sources (such as the independent consultant, internal audit, or the OCC), directors should seek to understand and resolve those inconsistencies.
Failure to fulfill the duty of care could expose individual directors to personal liability under federal banking enforcement theories, as discussed in Section VII below. In addition, the OCC's examiners will evaluate the Board's compliance with its governance obligations under the Consent Order, and a finding that individual directors failed to participate meaningfully in oversight activities could lead to supervisory criticism or, in severe cases, enforcement action directed at individual directors.
B. Duty to Monitor (Caremark Standard)
BRFG is incorporated in Delaware, and the fiduciary obligations of its directors are governed by Delaware law. Under the seminal Delaware Supreme Court decision in Stone v. Ritter, 911 A.2d 362 (Del. 2006), which adopted and refined the standard established in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), the Board of Directors has an affirmative obligation to ensure that adequate information and reporting systems exist to bring to the Board's attention compliance failures that rise to the level of violations of law or breaches of fiduciary duty.
Under the Caremark standard, a director may be held personally liable for a failure of oversight if the plaintiffs demonstrate either (a) that the directors "utterly failed to implement any reporting or information system or controls," or (b) that "having implemented such a system or controls, [the directors] consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention." While Caremark claims have historically been described as "among the most difficult of corporate claims to plead and prove," the Delaware courts have in recent years demonstrated an increased willingness to sustain such claims at the pleading stage where the allegations suggest a sustained and systematic failure of Board oversight in the face of known regulatory risks. The Delaware Supreme Court's decision in Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), and subsequent decisions including In re Harborview & Co. Derivative Litigation, C.A. No. 2019-0907-MTZ (Del. Ch. 2021), have underscored that Caremark liability may attach where the Board fails to establish adequate monitoring systems for compliance risks that are "mission critical" to the company's operations.
The OCC's finding that BSA/AML reporting to the Board was inadequate — quarterly only, missing key metrics such as SAR volumes, OFAC screening hit rates, and BaaS partner risk ratings — is precisely the type of monitoring failure that can give rise to Caremark liability. The OCC's escalation history — from MRA in June 2022 to MRIA in November 2023 to Consent Order in January 2025 — provides a factual basis for an allegation that the Board was on notice of material compliance risks and failed to ensure that adequate reporting systems were in place to monitor the Bank's response. These facts create a heightened risk of shareholder derivative litigation alleging breach of the duty of oversight, as discussed in Section VII.C below.
The establishment of the Compliance Committee, the implementation of monthly reporting with detailed metrics, and the engagement of the independent consultant directly address this obligation going forward. These measures, if faithfully implemented and documented, should provide substantial protection against Caremark claims related to the remediation period. However, directors must ensure that these measures are not merely formalistic — they must reflect genuine, substantive engagement.
C. Active Engagement with Independent Consultant
The Consent Order requires the Bank to retain and cooperate fully with an independent consultant acceptable to the OCC. Thornfield Consulting Group LLC has been retained for this purpose, and OCC non-objection was received on February 5, 2025. Each director should understand the role that Thornfield will play in the remediation process and should be prepared to engage actively with Thornfield's findings and recommendations.
Thornfield will produce two principal deliverables:
• Preliminary Gap Assessment, due April 15, 2025. This assessment will evaluate the current state of BRB's BSA/AML compliance program, identify gaps relative to regulatory requirements and industry best practices, and set forth recommendations for remediation. The Board and the Compliance Committee should review the gap assessment thoroughly and should use it as a baseline for evaluating the sufficiency of the Bank's Remediation Action Plan.
• Final Validation Report, due February 15, 2026. This report will assess whether the Bank has achieved the remediation objectives set forth in the Consent Order and the Remediation Action Plan. The final validation report will be submitted to the OCC and will be a critical factor in the OCC's determination of whether the Bank has achieved full compliance.
Directors should allocate sufficient time to review and discuss both deliverables in depth. The Compliance Committee Chair, James Rutherford, should maintain a direct communication channel with Dr. Vivian Castellano, the Thornfield Managing Director leading the engagement, and should, through C&H, coordinate with the OCC as appropriate. Any interim findings or concerns raised by Thornfield between the two formal deliverables should be escalated to the Compliance Committee immediately.
D. Resource Authorization
A critical component of the Board's oversight obligation is the duty to ensure that the Bank has committed adequate financial, technological, and human resources to the remediation effort. The OCC's examiners will closely scrutinize whether the Board authorized sufficient resources and whether those resources were deployed effectively. The Board has approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP). The principal components of this budget are as follows:
If, during the course of the remediation, management determines that additional resources are required to meet the Consent Order's deadlines and requirements — whether due to unforeseen complexities, scope expansion, or changes in regulatory expectations — the Board should be prepared to authorize supplemental funding promptly. Delays in resource authorization could compromise the remediation timeline and expose the Board to additional regulatory criticism.
VI. REPORTING AND INFORMATION FLOW
A. Monthly Reporting Package
C&H recommends that BRB management, through Patricia Langston (CCO) and Thomas Ikeda (BSA Officer), prepare a comprehensive monthly BSA/AML compliance reporting package for the Compliance Committee. The reporting package should be distributed to Committee members no fewer than five (5) business days in advance of each scheduled monthly meeting to provide adequate time for review. The monthly reporting package should include the following categories of information:
• Remediation Milestone Tracker. A comprehensive tracker showing the status of each Consent Order deadline and each interim milestone established in the Remediation Action Plan, with a color-coded or equivalent designation for each item (on-track, at-risk, or behind schedule), together with narrative commentary explaining any items that are at risk or behind schedule and the corrective actions being taken.
• SAR Filing Metrics. Volume of SARs filed during the reporting period, filing timeliness (average days from detection to filing, with the goal of reducing from the current 78-day average toward the 30-day regulatory target), backlog status (number of unreviewed alerts remaining out of the 2,400-alert backlog, with interim clearance targets), and SAR conversion rate (the percentage of alerts that result in a SAR filing; CY 2024 conversion rate: 9.3%, based on 3,847 SARs from approximately 41,500 alerts).
• OFAC Screening Metrics. Coverage percentage across all business lines, hit volume (CY 2024: 14,320 total hits, of which 12 were true matches, reflecting a 99.9% false-positive rate), and the status of BaaS channel integration for each of the Bank's 14 active BaaS partner channels.
• CDD/EDD Remediation. Number of accounts remediated during the reporting period and cumulative progress toward the 47,000-account total, broken down by BaaS partner and risk tier.
• Veridian TMS Upgrade. Implementation progress, including status of data migration, system configuration, UAT, and independent model validation planning.
• Pinnacle Staffing Deployment. Number of Pinnacle temporary staff deployed, utilization rates, and quality metrics (such as alert disposition accuracy rates and SAR quality scores).
• Internal Hiring Progress. Status of permanent headcount additions against the 15-FTE target, including positions posted, candidates in pipeline, offers extended, and positions filled.
• Budget Utilization. Expenditures to date against the $42,500,000 remediation budget, by budget category, with projected run-rate and any anticipated budget variances.
• Regulatory Correspondence. Copies of or summaries of any new correspondence from the OCC, FinCEN, the FDIC, or other regulators related to the Consent Order or the Bank's BSA/AML compliance program.
The reporting package should be accompanied by a brief executive summary prepared by the CCO highlighting key developments, accomplishments, risks, and items requiring Board or Committee attention during the reporting period.
B. Quarterly OCC Reporting
The Consent Order requires the Bank to submit quarterly progress reports to the OCC. The first quarterly progress report is due September 15, 2025, and the second is due December 15, 2025. These reports will be prepared by C&H in coordination with BRB management and will detail the Bank's progress in addressing each of the five core deficiency categories and in meeting the remediation milestones established in the Comprehensive Remediation Action Plan.
The quarterly progress reports will be reviewed by the Compliance Committee before submission to the OCC. The Committee should devote adequate time to a thorough review and discussion of each report, should provide substantive feedback and credible challenge, and should satisfy itself that the report accurately reflects the Bank's remediation progress. The full Board should also have the opportunity to review the quarterly reports before they are submitted. The reports to the OCC are formal representations of the Bank and its Board, and each director should treat them with the same seriousness that he or she would apply to any public filing or regulatory submission.
C. Independent Consultant Reports
As discussed above, Thornfield will produce a preliminary gap assessment (due April 15, 2025) and a final validation report (due February 15, 2026). Both deliverables should be presented to the full Board, not merely to the Compliance Committee, and should be discussed in depth at a dedicated Board session. Directors should receive these reports well in advance of the Board meeting at which they will be discussed and should come prepared with substantive questions and observations.
In addition, any interim findings or concerns raised by Thornfield during the course of the engagement — whether communicated in writing, verbally, or through C&H — should be escalated to the Compliance Committee immediately. The Committee should maintain an open and responsive communication channel with Thornfield at all times.
D. Internal Audit Coordination
Derek Ballard, Head of Internal Audit, plays an important role in the remediation process. Internal audit serves as the Bank's third line of defense and provides independent assessments of the effectiveness of the Bank's risk management, compliance, and internal control processes. Mr. Ballard should provide the Audit Committee (chaired by Margaret Dao) and the Compliance Committee with independent assessments of remediation progress at regular intervals throughout the remediation period.
C&H recommends that the scope and timing of Caldera & Pope LLP's next BSA/AML independent testing engagement be coordinated with the remediation timeline and the Thornfield assessment. Specifically, Caldera & Pope should plan to conduct its next independent test following the completion of the major remediation workstreams (anticipated in late 2025 or early 2026), so that the testing can evaluate the effectiveness of the remediated compliance program. The results of the Caldera & Pope testing should be shared with the Compliance Committee, the Audit Committee, and the full Board, as well as with Thornfield and C&H.
VII. PERSONAL LIABILITY EXPOSURE FOR DIRECTORS AND OFFICERS
The Board should understand that the Consent Order and the circumstances surrounding it create meaningful personal liability exposure for individual directors and officers. This section summarizes the principal categories of risk.
A. Civil Money Penalties Under 12 U.S.C. § 1818
The OCC has broad authority under 12 U.S.C. § 1818(i) to impose civil money penalties not only on an insured depository institution but also on any "institution-affiliated party." The term "institution-affiliated party" is defined broadly in 12 U.S.C. § 1813(u) and expressly includes any director, officer, employee, agent, or other person participating in the conduct of the affairs of an insured depository institution.
Civil money penalties may be assessed at three tiers, depending on the severity of the conduct:
• First Tier (12 U.S.C. § 1818(i)(2)(A)): Penalties for violations of law, regulation, or any order or condition imposed in writing by the OCC. First-tier penalties may be assessed without a showing of intent or knowledge and are subject to statutory maximums that are adjusted annually for inflation.
• Second Tier (12 U.S.C. § 1818(i)(2)(B)): Penalties for violations that are part of a pattern of misconduct, that cause or are likely to cause more than a minimal loss to the institution, or that result in a pecuniary gain to the individual. Second-tier penalties carry substantially higher statutory maximums.
• Third Tier (12 U.S.C. § 1818(i)(2)(C)): Penalties for violations committed knowingly, in circumstances involving reckless disregard for the law, and that cause a substantial loss to the institution or result in a substantial pecuniary gain to the individual. Third-tier penalties carry the highest statutory maximums, which can reach $2,334,331 per day (as adjusted for inflation).
While the current Consent Order imposes a $14,500,000 CMP on the institution and does not impose individual CMPs on any director or officer, individual CMP actions remain a possibility. If the OCC determines that specific directors or officers failed to fulfill their oversight obligations — including obligations imposed by the Consent Order itself — the OCC could initiate individual CMP proceedings. The escalation history (the June 2022 MRA, the November 2023 MRIA, and the Board oversight deficiency findings in the Consent Order) provides a factual basis that the OCC could potentially draw upon in support of such actions. Active, documented Board engagement during the remediation period will serve as the most effective defense against any potential individual CMP action.
B. Removal and Prohibition Orders
Under 12 U.S.C. § 1818(e), the OCC has authority to seek removal and prohibition orders against any institution-affiliated party who has engaged in or participated in any unsafe or unsound practice in connection with any insured depository institution, or who has committed or engaged in any act, omission, or practice that constitutes a breach of the party's fiduciary duty. A removal and prohibition order bars the individual from participating in the affairs of any insured depository institution, which effectively ends the individual's career in the banking industry.
A finding that a director was aware of compliance deficiencies — as the BRFG Board was made aware through the June 2022 MRA and the November 2023 MRIA — and failed to take adequate corrective action could potentially support removal and prohibition proceedings. While such proceedings against outside directors are relatively uncommon, the OCC has pursued them in cases involving particularly egregious or prolonged failures of oversight. The Board should treat the remediation period as an opportunity to demonstrate affirmatively that it is fulfilling its oversight obligations with the level of diligence and engagement that the regulatory framework requires.
C. Shareholder Derivative Litigation Risk
The circumstances surrounding the Consent Order create conditions in which shareholder derivative claims alleging breach of fiduciary duty and failure of oversight are foreseeable. Several factors contribute to this risk:
• Stock Price Impact. BRFG's stock price experienced a significant decline following the public disclosure of the Consent Order, falling from approximately $47.82 per share on February 7, 2025 (a partial recovery level) to a post-disclosure low of approximately $41.15 per share on January 16, 2025, the trading day following the Consent Order's issuance. This represents a decline of approximately $6.67 per share, or approximately 13.9%.
• Material Financial Impact. The total remediation outlay of approximately $57,000,000 (including the $14,500,000 CMP) is material relative to BRFG's fiscal year 2024 net income of approximately $412,000,000, representing approximately 13.8% of annual net income.
• Activist Shareholder Activity. Brindoval Capital Partners LP (managing partner: Julian Whitmore), which holds approximately 8.3% of BRFG's outstanding common stock (approximately 14.9 million shares), has already expressed concern — through its outside counsel, Amberly Knox LLP (partner: Steven Briggs) — regarding the costs of remediation, the potential for additional enforcement fines, and the reputational impact on the company. While Brindoval has not, to our knowledge, filed or threatened to file a shareholder derivative action as of the date of this memorandum, the expression of concern through outside counsel is a significant development that the Board should take seriously.
A shareholder derivative complaint in this context would likely allege, among other claims, that the Board breached its fiduciary duty of oversight under the Caremark standard by failing to ensure that adequate reporting and monitoring systems were in place to address BSA/AML compliance risks, and that this failure resulted in harm to the company in the form of the CMP, remediation costs, reputational damage, and stock price decline. The factual predicate for such a claim is strong, given the escalation history, the Consent Order's specific finding of Board oversight deficiencies, and the magnitude of the financial impact. As noted in Section V.B above, the Delaware courts have demonstrated an increased willingness to sustain Caremark claims at the pleading stage in circumstances comparable to those presented here.
The Board's most effective defense against shareholder derivative liability is to demonstrate — through its actions during the remediation period — that it has taken the Consent Order seriously, has established robust oversight structures, has allocated adequate resources, has engaged actively and substantively with the