ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION AND/OR REGULATORY PROCEEDINGS DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
MEMORANDUM
FROM: Philip Hartmann, Esq. Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Telephone: (212) 558-4000
Email: p.hartmann@calderwoodharkness.com
TO: Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
CC: Patricia Langston, Chief Compliance Officer Thomas Ikeda, BSA Officer / AML Program Director Melissa Chu, Chief Risk Officer Derek Ballard, Head of Internal Audit
DATE: Prepared for Use Beginning Approximately August 2025 (Phase 2 — Post-Remediation Follow-Up Examination Preparation)
RE: Preparation for Anticipated OCC Follow-Up BSA/AML Examination — Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845)
C&H Matter No.: 1045-00002
Reference: OCC Consent Order No. OCC-2025-003 (Effective January 15, 2025)
Right-click to update Table of Contents
I. PURPOSE AND EXECUTIVE SUMMARY
A. Purpose
The purpose of this memorandum is to provide comprehensive, actionable guidance to Belmont Ridge Bank National Association ("BRB" or the "Bank") on preparing for the anticipated follow-up targeted BSA/AML examination by the Office of the Comptroller of the Currency (the "OCC"). Calderwood & Harkness LLP ("C&H") expects the OCC to schedule this follow-up examination following — or in conjunction with — the February 15, 2026 self-certification deadline established under Consent Order No. OCC-2025-003 (the "Consent Order"). This memorandum is designed to serve as the Bank's primary strategic and operational guide for examination readiness, and should be treated as a living document to be updated as remediation progresses and as additional information regarding examination timing and scope becomes available.
B. Background and Context
On January 15, 2025, the OCC issued the Consent Order against BRB, citing five core categories of deficiency within the Bank's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance program. The Consent Order followed a targeted BSA/AML examination that spanned March 2024 through September 2024 — a six-month examination cycle conducted under the supervision of OCC Examiner-in-Charge Jonathan Frey of the Northeastern District Office, located at 340 Madison Avenue, New York, NY 10017. It is our expectation that Mr. Frey will lead or directly supervise the follow-up examination as well, ensuring continuity of institutional knowledge on the OCC's side.
In response to the Consent Order, BRB has undertaken a series of remedial actions, including the filing of a Comprehensive Remediation Action Plan with the OCC on May 15, 2025 (the "Remediation Action Plan"). The Bank has also engaged Thornfield Consulting Group LLC ("Thornfield") as the independent consultant required under the Consent Order, pursuant to an engagement referenced as TCG-BRB-2025-001. Thornfield is conducting a twelve-month assessment and validation engagement designed to evaluate the Bank's remediation efforts across all five deficiency categories and to produce a final validation report that will accompany the Bank's self-certification submission to the OCC on February 15, 2026.
The prior targeted examination represented an escalation of the OCC's supervisory posture toward BRB. Examiners will be well aware of the regulatory history, including the June 2022 Matter Requiring Attention ("MRA") regarding BSA/AML transaction monitoring and the November 2023 Matter Requiring Immediate Attention ("MRIA") regarding OFAC sanctions screening gaps. The follow-up examination will be conducted against this backdrop of escalating supervisory concern, and the examination team will be evaluating not only whether the specific Consent Order requirements have been met, but whether the Bank has addressed the root causes that led to repeated supervisory findings.
C. Scope of This Memorandum
This memorandum covers six principal areas of examination preparation:
(A) Anticipated examination scope and focus areas, based on C&H's assessment of OCC examination practices and the specific requirements of the Consent Order;
(B) Document readiness and evidence of remediation, including a comprehensive category-by-category documentation checklist;
(C) Interview preparation for key Bank personnel who are likely to be examined;
(D) Board-level documentation of oversight activities, reflecting the Consent Order's emphasis on governance failures;
(E) Coordination with Thornfield Consulting Group and C&H during the examination process; and
(F) Timeline and logistics planning, including a detailed pre-examination preparation timeline and milestone verification schedule.
D. Overall Objective
The overarching objective of BRB's examination preparation efforts is to demonstrate to the OCC that the Bank has achieved full, sustainable compliance with every article of the Consent Order. This demonstration must be supported by documentary evidence that is organized, comprehensive, and readily accessible. It must be validated by the independent consultant's findings. And, critically, it must reflect that the reforms undertaken during the remediation period have been embedded in the Bank's ongoing governance structure, operational processes, and institutional culture — not merely implemented as a transient response to regulatory pressure. The OCC will be looking for evidence that compliance is sustainable and that the Bank has built the infrastructure, staffing, technology, and governance framework necessary to maintain compliance on an ongoing basis.
If the Bank can make this demonstration convincingly, C&H believes the OCC will be in a position to recommend termination of the Consent Order. Conversely, if gaps remain or if the examination team perceives that remediation has been superficial or incomplete, the consequences could include continuation of the Consent Order, issuance of additional supervisory actions, or referral for further enforcement proceedings. The stakes of this follow-up examination cannot be overstated.
II. ANTICIPATED EXAMINATION SCOPE AND FOCUS AREAS
A. Basis for Follow-Up Examination
It is standard OCC practice to conduct a targeted follow-up examination following the issuance of a consent order or other formal enforcement action. The purpose of such an examination is to validate that the institution has achieved the required remediation and to assess whether the consent order can be terminated or whether additional supervisory action is warranted. The OCC's Policies and Procedures Manual (PPM 5310-3) and the Bank Supervision Process guidance (Comptroller's Handbook) both contemplate follow-up supervisory activity to verify compliance with formal enforcement actions.
The Consent Order requires BRB to achieve full compliance program implementation by February 15, 2026. At that time, the Bank must submit a written self-certification, signed by the Board of Directors, attesting to the Bank's compliance with each article of the Consent Order. This self-certification must be supported by the final validation report of Thornfield Consulting Group, the independent consultant. Based on C&H's experience with OCC follow-up examinations in comparable circumstances, we anticipate that the OCC will schedule the follow-up examination in the first or second quarter of 2026 — that is, shortly after or concurrent with the February 15, 2026 self-certification. In some instances, the OCC initiates on-site examination activity even before the self-certification deadline, beginning with a review of interim progress reports and documents, and then conducting on-site examiner interviews and transaction testing in the weeks following the self-certification submission.
We also note the possibility of coordination between the OCC and the Financial Crimes Enforcement Network ("FinCEN") in connection with this examination. FinCEN Associate Director Angela Drummond of the Enforcement Division has been monitoring BRB's SAR filing remediation efforts throughout the Consent Order period. FinCEN reserved its independent enforcement rights as part of the inter-agency coordination that accompanied the OCC's issuance of the Consent Order. While FinCEN has not, to our knowledge, initiated a separate enforcement proceeding, the Bank should be aware that FinCEN may request to participate in the OCC's follow-up examination or may conduct its own review of BRB's SAR filing practices. Any requests or inquiries from FinCEN should be immediately communicated to C&H.
B. Five Core Deficiency Categories to Be Re-Examined
The Consent Order identified five core categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each of these categories will be the subject of intensive re-examination during the follow-up examination. We address each in turn.
1. OFAC Sanctions Screening
The OCC's findings regarding OFAC sanctions screening represented one of the most significant deficiencies cited in the Consent Order and the most operationally complex to remediate given the Bank's extensive Banking-as-a-Service ("BaaS") operations. The follow-up examination team will focus on the following:
Screening Coverage. Examiners will test whether 100% of transactions across all channels — including all fourteen active BaaS partner flows — are being screened against applicable OFAC sanctions lists. The Consent Order established a deadline of November 1, 2025 for OFAC screening to be fully operational for all BaaS channels. Examiners will verify compliance with this deadline and will test both real-time and batch screening workflows to confirm that no gaps exist. The examination will likely involve transaction sampling across multiple channels and time periods.
NovaPay Technologies Inc. Screening Gap. The NovaPay screening gap was the signature finding of the prior examination and will receive particular scrutiny. During calendar year 2023, approximately 3,800,000 transactions out of 31,700,000 total NovaPay transactions — representing approximately 12% — were not screened against OFAC sanctions lists. This gap resulted from a technical integration failure in the BaaS channel API that was not detected by BRB's quality assurance processes. Examiners will require evidence that the root cause of this failure has been permanently remediated, that compensating controls are in place, and that ongoing monitoring prevents recurrence.
List Management. Examiners will review the Bank's processes for maintaining and updating OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and Sectoral Sanctions Identifications lists. The review will encompass the timeliness of list updates, the completeness of list coverage, and the Bank's procedures for screening against newly added entries.
False Positive Management. The prior examination identified that the Bank's OFAC screening system generated 14,320 screening hits during calendar year 2024, of which only 12 were determined to be true matches — resulting in a false-positive rate of approximately 99.9%. While a high false-positive rate is common in sanctions screening, examiners will evaluate whether the Bank has undertaken appropriate tuning of its screening parameters to reduce false positives to a manageable level without compromising detection of true matches. Excessive false positives can degrade the effectiveness of the compliance program by overwhelming analysts and creating alert fatigue.
BaaS Channel Integration. Beyond NovaPay, examiners will examine the integration of OFAC screening across all fourteen BaaS partner channels, including the manner in which transaction data is transmitted from partners to the Bank's screening system, the latency of screening relative to transaction execution, and the handling of screening hits generated by BaaS partner transactions.
2. SAR Filing Deficiencies
The Consent Order cited pervasive deficiencies in the Bank's Suspicious Activity Report ("SAR") filing processes, including an unacceptable backlog of unreviewed alerts and prolonged filing timelines. The follow-up examination will address the following:
Backlog Clearance. Examiners will validate that the backlog of 2,400 unreviewed alerts that existed as of September 2024 was fully cleared by the June 30, 2025 target date established in the Remediation Action Plan. This validation will include a review of how alerts were dispositioned — whether they resulted in SAR filings, were determined to require no filing, or were escalated for further review. Examiners will assess whether the triage and disposition process was appropriately rigorous and whether any alerts were improperly closed without filing.
Filing Timeliness. The Bank's average SAR filing time prior to the Consent Order was approximately 78 days from the date of alert generation to the date of SAR filing — far in excess of the regulatory expectation that SARs be filed within 30 days of initial detection of suspicious activity. Examiners will review metrics demonstrating that the Bank has reduced its average filing time to within 30 days and will examine whether this improvement is consistent across all SAR categories and transaction types, including BaaS-related SARs.
SAR Quality and Completeness. Beyond timeliness, examiners will evaluate the quality and completeness of SARs filed during and after the remediation period. This includes the adequacy of SAR narratives, the completeness of subject identification information, the accuracy of transaction data reported, and the consistency of filing decisions with the Bank's policies and procedures.
Lookback Results. The Consent Order required BRB to conduct a comprehensive lookback review to identify potentially suspicious activity that was not reported during the period of deficient operations. This lookback, budgeted at $5.5 million, will be scrutinized for its scope, methodology, and results. Examiners will evaluate whether the lookback identified unreported suspicious activity, whether appropriate retroactive SARs were filed, and whether the lookback methodology was sufficiently comprehensive.
Volume Benchmarking. The examination team will benchmark BRB's SAR filing volumes against industry norms and peer institutions. For context, BRB filed 3,847 SARs in calendar year 2024 and 2,914 SARs in calendar year 2023. BaaS-related SARs constituted 2,108 of the 3,847 total SARs filed in calendar year 2024, representing 54.8% of all filings — a proportion that reflects the significant BSA/AML risk inherent in BRB's BaaS operations. The Bank also filed 28,612 Currency Transaction Reports ("CTRs") in calendar year 2024. Examiners may compare these volumes to prior periods and to peer institutions to assess whether the Bank's filing activity reflects an appropriate level of detection and reporting.
3. CDD/EDD Failures
The Consent Order identified systemic failures in the Bank's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes, particularly with respect to high-risk accounts. The follow-up examination will focus on:
Remediation of Existing Accounts. Examiners will confirm that the Bank remediated all 47,000 high-risk accounts that were identified as lacking adequate CDD/EDD documentation. The Remediation Action Plan established two milestones: 50% (23,500 accounts) to be remediated by July 15, 2025, and 100% (47,000 accounts) to be remediated by January 15, 2026. Examiners will verify achievement of both milestones and will review supporting documentation to confirm that remediation was substantive — that is, that the accounts in question now contain complete and adequate CDD/EDD documentation, not merely that they were reviewed and marked as "remediated" without meaningful enhancement.
Quality of Remediated Files. Examiners will select a sample of remediated account files for detailed review. The sample will likely be risk-stratified, with a higher sampling rate for the highest-risk accounts (e.g., foreign correspondent accounts, MSB accounts, accounts linked to BaaS partners). The quality review will assess whether the remediated files contain all required identification and verification documents, beneficial ownership information, risk ratings, and ongoing monitoring records.
Revised Policies and Procedures. Examiners will review the Bank's revised CDD/EDD policies and procedures to assess their adequacy, including their alignment with the Consent Order requirements, FinCEN's Customer Due Diligence Rule (31 C.F.R. § 1010.230), and industry best practices. The review will include the Bank's risk-based approach to CDD/EDD, the criteria for assigning elevated risk ratings, the procedures for conducting and documenting enhanced due diligence, and the triggers for CDD/EDD refresh reviews.
Ongoing Compliance for New Accounts. Examiners will test the Bank's CDD/EDD processes for accounts onboarded during and after the remediation period, with particular focus on accounts opened through BaaS channels. This testing will assess whether the Bank's revised processes are being consistently applied to new accounts and whether the deficiencies that affected the 47,000 legacy accounts have been prevented from recurring.
4. Model Validation
The Consent Order cited the Bank's failure to conduct timely independent validation of its transaction monitoring system, the Veridian Transaction Monitoring System ("Veridian TMS"). The follow-up examination will examine:
System Upgrade and Deployment. Examiners will verify that Veridian TMS v.10.0 was deployed following successful completion of User Acceptance Testing ("UAT") by the August 1, 2025 deadline. The examination will include a review of the UAT results, the deployment process, and any issues identified and resolved during the implementation.
Independent Model Validation. The Consent Order required independent validation of the upgraded TMS by October 1, 2025. The prior independent validation of the Veridian TMS was completed in March 2021 — more than three years before the Consent Order — and the last parameter tuning was performed in October 2022. The examination team will review the independent validation report in detail, including the validation methodology, the scope of testing performed, the findings and recommendations, and the Bank's response to any identified issues. Examiners will assess whether the validation was truly independent and whether it was conducted with sufficient rigor.
Tuning and Threshold Analysis. Examiners will review the tuning parameter updates implemented in connection with the system upgrade, including the rationale for parameter adjustments, the results of above-the-line and below-the-line testing, and the impact of tuning on alert volumes and SAR conversion rates. The Bank's transaction monitoring system generated 41,500 alerts in calendar year 2024, of which 3,847 resulted in SAR filings — a SAR conversion rate of approximately 9.3%. Examiners will evaluate whether this conversion rate is appropriate and whether the system's alert generation parameters are calibrated to detect suspicious activity without generating an unmanageable volume of false-positive alerts.
Ongoing Validation Schedule. Examiners will review the Bank's established schedule for ongoing periodic model validation to ensure that the failure to conduct timely validation will not recur. Industry standards and OCC guidance generally call for model validation at least annually or whenever material changes are made to the model.
5. Board Oversight
The Consent Order's findings regarding deficient Board oversight represented a governance failure of significant concern to the OCC. The follow-up examination will examine:
Compliance Committee Establishment and Functioning. Examiners will evaluate the establishment and ongoing operations of the Board-level Compliance Committee, chaired by James Rutherford. This evaluation will include a review of the Committee's charter, its membership, the frequency and substance of its meetings, and the quality of the reporting packages it receives. Examiners will assess whether the Committee exercises genuine, informed oversight — as distinguished from pro forma acknowledgment of management reports.
Board Resolution. Examiners will confirm that the Board Resolution required by the Consent Order was adopted by the February 28, 2025 deadline and will review its contents for adequacy. The resolution should demonstrate the Board's acknowledgment of the Consent Order, its commitment to remediation, and its authorization of the resources necessary to achieve compliance.
Reporting Quality and Frequency. The prior examination found that the Board received only quarterly BSA/AML reporting, and that this reporting lacked key quantitative metrics. Examiners will assess whether the new reporting framework represents a substantive improvement, including the inclusion of SAR volumes, OFAC screening hit rates, CDD/EDD progress metrics, BaaS partner risk ratings, and other relevant performance indicators. Examiners will expect to see at minimum monthly reporting during the remediation period.
Amended Bylaws. Examiners will review the Bank's amended corporate bylaws to confirm that they incorporate provisions for the Compliance Committee and reflect the Bank's enhanced governance framework.
C. Additional Areas of Likely Scrutiny
Beyond the five core deficiency categories, C&H anticipates that the follow-up examination will also include scrutiny of the following areas:
BaaS Partner Oversight Framework. Given that BRB's BaaS operations are a significant source of BSA/AML risk — generating $74.3 billion in transaction volume in calendar year 2024 and $127.4 million in revenue — the OCC will likely conduct a thorough review of the Bank's oversight of its fourteen active BaaS partners. The examination will focus on the adequacy of compliance controls over BaaS partner activities, with particular attention to the three largest partners by transaction volume: NovaPay Technologies Inc. (41% of BaaS transaction volume, approximately $30.5 billion), FairLend Digital (28%), and VaultEdge (18%). The remaining eleven partners collectively account for approximately 13% of BaaS transaction volume. Examiners will evaluate the Bank's BaaS partner risk assessment processes, compliance addenda, ongoing monitoring procedures, and escalation and termination triggers.
Staffing Adequacy. The Consent Order implicitly recognized that staffing deficiencies contributed to the Bank's compliance failures. The BSA/AML department headcount has grown from 62 full-time equivalent employees ("FTEs") to 77 FTEs through the addition of 15 permanent positions. In addition, 30 temporary FTEs from Pinnacle Compliance Solutions have been deployed to support remediation activities. Examiners will evaluate whether the Bank's permanent staffing levels are adequate to sustain the enhanced compliance program on an ongoing basis, and will inquire about the Bank's plans for transitioning from reliance on temporary staffing to sustainable permanent capacity.
Training Program Effectiveness. Examiners will review the Bank's BSA/AML training program, including completion rates, content adequacy, and the incorporation of OFAC-specific training modules. The review will likely extend to training provided to BaaS partner personnel whose activities affect the Bank's compliance obligations.
Policies and Procedures. The examination team will conduct a comprehensive review of the Bank's revised BSA/AML and sanctions policies and procedures, comparing them against the specific requirements of the Consent Order, the BSA/AML Examination Manual, and industry standards. This review will assess not only the adequacy of the written policies but also evidence that they have been effectively implemented and are being followed in practice.
Prior Supervisory Action History. Examiners will trace the escalation of supervisory findings from the June 2022 MRA (regarding BSA/AML transaction monitoring) and the November 2023 MRIA (regarding OFAC screening gaps) through to the Consent Order. This historical analysis will inform the examination team's assessment of whether the Bank has finally addressed the root causes of its compliance failures — or whether the same underlying weaknesses persist despite successive rounds of remediation efforts. The failure to remediate the MRA and MRIA findings is a significant aggravating factor in the OCC's assessment of BRB, and the Bank should be prepared to explain what changed in its approach to remediation following the Consent Order.
Civil Money Penalty Payment. Examiners will confirm the timely payment of the $14,500,000 civil money penalty ("CMP") by the March 16, 2025 deadline (60 days from the effective date of the Consent Order). Documentation of payment should be readily available.
III. DOCUMENT READINESS AND EVIDENCE OF REMEDIATION
A. Master Documentation Framework
The single most important element of examination preparation is the organization and availability of documentary evidence demonstrating that the Bank has achieved compliance with every article of the Consent Order. To this end, BRB should establish a centralized "Examination Readiness Repository" (the "Repository") organized by Consent Order article and remediation workstream. The Repository should serve as the authoritative source for all documents that may be requested or reviewed by the examination team.
The Repository should be cross-referenced to the Consolidated BSA/AML & Sanctions Policy Suite — Redline Index (the "Redline Index"), which catalogs all revised policies, procedures, and manuals produced during the remediation period and maps each document to the corresponding Consent Order article and deficiency category. The Redline Index serves as an index and audit trail for the Bank's policy overhaul, and should be maintained in a format that allows the examination team to quickly identify the current version of any relevant policy or procedure.
All documents within the Repository must be version-controlled, with clear dating, approval records, and implementation evidence. For each document, the Repository should include: (i) the document itself in its current approved version; (ii) the approval record (e.g., minutes of the committee or officer that approved the document); (iii) evidence of implementation (e.g., training records, system configuration records, operational reports demonstrating that the procedures described in the document are being followed in practice); and (iv) any prior versions that may be relevant to demonstrating the evolution of the Bank's compliance program during remediation.
C&H recommends that Patricia Langston (CCO) be designated as the primary document custodian for examination purposes, supported by Thomas Ikeda (BSA Officer) and Derek Ballard (Head of Internal Audit). Ms. Langston will serve as the primary point of contact for examiner document requests and will be responsible for ensuring that all document productions are reviewed by C&H for privilege and work-product protection before being provided to the examination team.
B. Category-by-Category Documentation Checklist
The following checklist identifies the principal documents that should be compiled and maintained in the Repository for each of the five Consent Order deficiency categories. This checklist is not exhaustive; additional documents may be identified as remediation progresses and as the examination scope becomes clearer. Each category workstream leader should supplement this checklist with additional documents specific to their area of responsibility.
1. OFAC Sanctions Screening
The following documents should be compiled and organized for the OFAC sanctions screening workstream:
(a) Revised OFAC Compliance Policy (enterprise-wide), including the approval record and effective date, demonstrating comprehensive coverage of all Bank activities and all BaaS partner channels.
(b) OFAC Screening Procedures Manual, setting forth operational procedures for all transaction types, including wire transfers, ACH transactions, check processing, account opening, and all BaaS partner transaction flows. The procedures manual should describe the screening methodology, the handling of screening hits, the escalation process for potential matches, and the blocking and rejection procedures for confirmed matches.
(c) Veridian OFAC module Statement of Work ("SOW") and implementation evidence, including go-live records, UAT results, system configuration documentation, and post-implementation testing results. This documentation should demonstrate that the OFAC screening module was properly configured and tested before deployment.
(d) OFAC remediation testing results, confirming that 100% of BaaS transactions are being screened against applicable OFAC sanctions lists following the November 1, 2025 operational deadline. Testing results should cover all fourteen BaaS partner channels and should include both real-time and batch screening workflows.
(e) OFAC screening hit logs, disposition records, and blocking/rejection reports, demonstrating that the Bank's screening process is generating hits, that hits are being timely reviewed and dispositioned by qualified analysts, and that blocking and rejection actions are being taken as required.
(f) OFAC voluntary self-disclosure analysis — this document is subject to significant privilege considerations and should be logged in the Repository but may not be producible to the examination team without prior C&H review. The Bank should consult with C&H before producing any document related to the OFAC voluntary self-disclosure analysis.
(g) Evidence of BaaS channel integration for OFAC screening across all fourteen active partners, including API integration documentation, data flow diagrams, testing records, and ongoing monitoring reports confirming continued screening coverage.
2. SAR Backlog and Process Improvement
The following documents should be compiled and organized for the SAR backlog and process improvement workstream:
(a) SAR Backlog Triage Protocol documentation, including the methodology for prioritizing and dispositionining the 2,400 unreviewed alerts, the staffing resources deployed (including Pinnacle Compliance Solutions temporary staff), and the quality assurance procedures applied to backlog triage decisions.
(b) Evidence of full clearance of the 2,400 unreviewed alerts by the June 30, 2025 target date, including a summary of dispositions (SARs filed, alerts closed without filing, alerts escalated for further review) and supporting documentation for a representative sample of dispositions.
(c) Interim SAR Backlog Status Report submitted to the OCC on March 31, 2025, together with any OCC feedback or correspondence related to the report.
(d) SAR lookback scope, methodology, and results documentation, including the engagement terms for the $5.5 million lookback project, the period and transaction types covered, the criteria for identifying potentially suspicious activity, the number of retroactive SARs filed, and the aggregate dollar amount of suspicious activity identified.
(e) Revised SAR Policy & Procedures, including updated procedures for alert triage, investigation, SAR drafting, quality review, filing, and recordkeeping.
(f) SAR Quality Assurance Framework documentation, including the QA sampling methodology, sample sizes, error rates identified, error categorization, corrective action procedures, and trend analysis.
(g) Metrics demonstrating reduced SAR filing time, including monthly or weekly data showing the average time from alert generation to SAR filing, with the target of filing within 30 days compared to the prior average of 78 days. These metrics should be presented in a format that allows the examination team to assess the consistency and sustainability of the improvement.
(h) Pinnacle Compliance Solutions staffing deployment records and transition documentation, including the number of temporary FTEs deployed, their assignments, their qualifications, and the Bank's plan for transitioning from temporary to permanent staffing.
3. CDD/EDD Remediation
The following documents should be compiled and organized for the CDD/EDD remediation workstream:
(a) CDD/EDD Remediation Methodology & Prioritization documentation, describing the methodology used to identify and prioritize the 47,000 high-risk accounts for remediation, the risk-stratification criteria applied, and the procedures for conducting and documenting remediation reviews.
(b) Progress tracking dashboard data showing milestone achievement, including documentation that the 50% milestone (23,500 accounts) was met by July 15, 2025 and that the 100% milestone (47,000 accounts) was met by January 15, 2026. The dashboard data should be supported by underlying records and should be reconcilable to the Bank's account-level tracking systems.
(c) Revised CDD/EDD Policy, including updated procedures for customer identification and verification, beneficial ownership determination, risk rating assignment, enhanced due diligence for high-risk customers, ongoing monitoring, and periodic CDD refresh reviews.
(d) BaaS Partner CDD/EDD Responsibility Matrix, in the form of a RACI matrix (Responsible, Accountable, Consulted, Informed) applicable to all fourteen BaaS partners, with detailed allocations of CDD/EDD responsibilities for NovaPay Technologies Inc., FairLend Digital, and VaultEdge. The matrix should clearly identify which CDD/EDD functions are performed by the Bank, which are delegated to partners, and the controls in place to ensure that delegated functions are performed to the Bank's standards.
(e) Sample remediated account files, representing a quality review sample selected by risk stratum, demonstrating the adequacy and completeness of remediation work performed.
(f) Ongoing monitoring evidence for remediated accounts, demonstrating that the Bank is conducting post-remediation monitoring to ensure that the enhanced CDD/EDD information obtained during remediation is maintained and updated as required.
4. Transaction Monitoring Model Validation
The following documents should be compiled and organized for the transaction monitoring model validation workstream:
(a) Veridian TMS v.10.0 implementation records, including the project charter, implementation timeline, system requirements documentation, data migration records, and UAT completion documentation demonstrating successful testing by the August 1, 2025 deadline.
(b) Independent model validation report, completed by October 1, 2025, including the validation methodology, scope of testing, findings, risk ratings, recommendations, and the Bank's management response and remediation plan for any identified issues.
(c) Tuning parameter update documentation, including the rationale for each parameter adjustment, the analysis supporting the adjustment, the pre- and post-adjustment alert volumes and SAR conversion rates, and the approval record.
(d) Threshold analysis documentation, including above-the-line testing (confirming that scenarios are generating alerts for transactions above established thresholds) and below-the-line testing (confirming that transactions below thresholds do not represent unreported suspicious activity), with statistical analysis and supporting workpapers.
(e) Ongoing periodic validation schedule, documenting the Bank's commitment to conduct model validation at intervals consistent with OCC guidance and industry best practices, and the governance framework for ensuring that scheduled validations are performed on time.
(f) Amendment to the Veridian Master Service Agreement (Contract No. VA-BRB-2023-0044), reflecting the $2,800,000 implementation cost for the v.10.0 upgrade, the $1,900,000 per year incremental licensing fee, and the new annual contract value of $6,000,000 per year. This document should be available in the Repository for examiner review as evidence of the Bank's financial commitment to the technology upgrade.
5. Board and Governance
The following documents should be compiled and organized for the Board and governance workstream:
(a) Board Resolution adopted by February 28, 2025, acknowledging the Consent Order, establishing the Compliance Committee, and authorizing the $42,500,000 remediation budget (exclusive of the $14,500,000 civil money penalty).
(b) Compliance Committee Charter, including the Committee's mandate, membership, meeting frequency, reporting requirements, and authority.
(c) Amended Corporate Bylaws, incorporating provisions for the Compliance Committee and reflecting the Bank's enhanced governance framework.
(d) Compliance Committee meeting minutes (monthly during the remediation period), demonstrating active oversight, substantive discussion of key metrics (SAR volumes, OFAC screening hit rates, CDD/EDD progress, BaaS partner risk ratings, transaction monitoring alert volumes, remediation workstream status, and budget utilization), questions posed by Committee members, management responses, and directives issued by the Committee.
(e) Compliance Committee Reporting Framework documentation, describing the structure, content, and frequency of reports provided to the Committee, the process for preparing and reviewing reports, and the metrics and key performance indicators included.
(f) Board-level and Compliance Committee reporting packages, including all quantitative metrics that were previously absent from Board reporting (SAR volumes, OFAC screening hit rates, risk ratings by BaaS partner, CDD/EDD remediation progress, transaction monitoring alert volumes and SAR conversion rates, staffing levels, training completion rates, and remediation budget utilization).
(g) Evidence of Board receipt and discussion of Thornfield's deliverables, including the preliminary gap assessment (April 15, 2025), interim reports, and the final validation report (February 15, 2026), as reflected in Board and Compliance Committee meeting minutes and correspondence.
(h) Audit Committee (Margaret Dao, Chair) and Risk Committee (Arthur Connelly, Chair) records showing coordination with the Compliance Committee, including joint sessions or information-sharing arrangements, and demonstrating that the Bank's committee structure facilitates comprehensive oversight of BSA/AML compliance.
C. OCC Submissions and Correspondence
The Repository should include a complete file of all submissions to the OCC made in connection with the Consent Order, organized chronologically and cross-referenced to the relevant Consent Order articles. These submissions include:
(a) Consent Order acknowledgment letter;
(b) Independent consultant proposal letter, nominating Thornfield Consulting Group LLC;
(c) Comprehensive Remediation Action Plan, filed May 15, 2025;
(d) Interim SAR Backlog Status Report, filed March 31, 2025;
(e) First Quarterly Progress Report, filed September 15, 2025;
(f) Second Quarterly Progress Report, filed December 15, 2025; and
(g) Compliance Self-Certification, with Thornfield final validation report attached, filed February 15, 2026.
In addition, the Bank should maintain the OCC Correspondence Log & Tracking Memorandum, which is being maintained as a living spreadsheet documenting all communications between BRB and the OCC and between BRB and FinCEN. This log should capture the date, author, recipient, subject matter, and disposition of every communication, whether formal or informal. The log should be updated in real time and should be reviewed by C&H on a periodic basis to ensure completeness and accuracy.
The Repository should also include confirmation of the timely payment of the $14,500,000 civil money penalty by March 16, 2025, including wire transfer records or other payment documentation.
D. Independent Consultant Materials
The Repository should include the following materials related to the Thornfield Consulting Group engagement:
(a) Thornfield engagement agreement, executed February 10, 2025, reflecting a fixed fee of $6,500,000 payable in monthly installments of $541,666.67, plus an expense cap of $400,000;
(b) Scope of Work (Appendix A to the engagement agreement), defining the scope of Thornfield's assessment and validation activities across all five deficiency categories;
(c) Thornfield preliminary gap assessment, delivered April 15, 2025;
(d) Thornfield interim findings and correspondence, including any interim reports, management letters, or other communications from Thornfield regarding the status of remediation;
(e) Thornfield final validation report, due February 15, 2026; and
(f) Privilege & Confidentiality Side Letter, governing the treatment of privileged materials exchanged between BRB, C&H, and Thornfield during the engagement.
It is essential that the Privilege & Confidentiality Side Letter protocols be scrupulously maintained during the examination document production process. Certain materials exchanged with Thornfield may be subject to attorney-client privilege or work-product protection, and the Bank should consult with C&H before producing any Thornfield-related documents to the examination team. The fact that Thornfield is an independent consultant engaged pursuant to the Consent Order does not waive privilege over communications between BRB and C&H that were shared with Thornfield under the terms of the side letter.
E. External Audit and Testing
The Repository should also include materials from the Bank's external auditor that are relevant to BSA/AML compliance:
(a) Caldera & Pope LLP BSA/AML independent testing results (most recent: September 2024, engagement fee: $1,100,000). This testing identified deficiencies that were substantially consistent with the findings underlying the Consent Order, and examiners may review the testing results to assess the Bank's response to internal and external audit findings.
(b) Any subsequent Caldera & Pope BSA/AML testing performed during or after the remediation period, including testing scope, methodology, findings, and management responses.
(c) Caldera & Pope annual external audit (fiscal year 2024, engagement fee: $3,400,000), specifically any BSA/AML-related audit findings, management letter comments, and management responses. The engagement partner for Caldera & Pope is Franklin Dorsey.
IV. INTERVIEW PREPARATION FOR KEY PERSONNEL
A. General Interview Preparation Principles
OCC follow-up examinations invariably include interviews with key Bank personnel. These interviews serve multiple purposes: they allow examiners to test whether personnel have substantive knowledge of the Bank's compliance program, whether they are engaged in the remediation effort, whether they understand the deficiencies that gave rise to the Consent Order, and whether the Bank's compliance culture has genuinely improved. Examiner interviews are not merely procedural; they are a critical component of the OCC's assessment.
All BRB personnel who may be interviewed by the examination team should be prepared in accordance with the following principles:
Factual Accuracy. Personnel should respond to examiner questions factually and completely. Responses should be based on personal knowledge and supported by documentary evidence where possible. Personnel should not guess, speculate, or offer opinions on matters outside their area of responsibility.
Scope Discipline. Personnel should answer the questions posed by examiners without volunteering unrelated information. Responses should be responsive and concise, while providing sufficient detail to demonstrate knowledge and engagement.
Legal Questions. If examiners pose questions that implicate legal analysis, legal strategy, or privileged communications, personnel should politely direct the question to Gregory Nardone (General Counsel) or to C&H. Personnel should not attempt to answer legal questions on their own.
Privilege Protocol. All personnel should understand the Bank's privilege protocol and should avoid inadvertent disclosure of privileged C&H legal advice, attorney work product, or communications that are protected by the attorney-client privilege. If a personnel member is uncertain whether a particular communication or document is privileged, the member should decline to respond and refer the question to Mr. Nardone or C&H for guidance.
Demeanor and Engagement. Personnel should present themselves as knowledgeable, engaged, and committed to the Bank's compliance program. Defensiveness, evasiveness, or a lack of familiarity with basic program elements will be viewed unfavorably by the examination team.
C&H will conduct mock interview sessions ("examination readiness interviews") with key personnel prior to the follow-up examination, as described in Section IV.F below. The interviews will likely be conducted by the OCC examination team led by Examiner-in-Charge Jonathan Frey, and personnel should be prepared for a thorough and probing interview process.
B. Patricia Langston — Chief Compliance Officer
Ms. Langston was appointed as Chief Compliance Officer in January 2024, following the termination of her predecessor. By the anticipated date of the follow-up examination, she will have served in the role for approximately two years, encompassing the entire remediation period. As the senior officer responsible for the Bank's compliance program, Ms. Langston will be one of the most important interviewees and should be prepared to address the following topics in depth:
Remediation Program Oversight. Ms. Langston should be prepared to describe her role in overseeing the remediation program from inception, including her involvement in the development and implementation of the Remediation Action Plan, her coordination with C&H and Thornfield, and her management of the remediation workstreams.
Current State of the BSA/AML Compliance Program. Ms. Langston should be able to articulate the current state of the Bank's BSA/AML compliance program in comparison to its pre-Consent Order state, identifying specific improvements in each of the five deficiency categories. She should be prepared to explain what has changed, why those changes are effective, and how they are being sustained.
Compliance Committee Reporting. Ms. Langston should describe the cadence and content of her reporting to the Compliance Committee (chaired by James Rutherford), including the key metrics reported, the level of engagement by Committee members, and the actions taken by the Committee in response to her reports. She should note that reporting has been monthly during the remediation period.
Ongoing Compliance Monitoring. Ms. Langston should describe how she monitors ongoing compliance across all five deficiency categories, including the tools, metrics, and processes she uses to identify emerging issues and ensure that remediation gains are maintained.
BaaS Partner Oversight. Ms. Langston should be prepared to describe her role in supervising compliance across all fourteen active BaaS partners, including the risk assessment process, the compliance addenda, the ongoing monitoring procedures, and any escalation actions taken during the remediation period.
Staffing. Ms. Langston should address the growth in BSA/AML department headcount from 62 FTEs to 77 FTEs (15 permanent additions), the deployment and management of 30 Pinnacle Compliance Solutions temporary staff, and the Bank's plan for ensuring permanent staffing sustainability after the remediation period concludes and temporary staffing is wound down.
Thornfield Relationship. Ms. Langston should describe her working relationship with Thornfield Consulting, including how Thornfield's findings have been received, evaluated, and incorporated into the remediation effort.
Risk Assessment. Ms. Langston should be prepared to discuss the Bank's ongoing BSA/AML risk assessment process, including how emerging risks are identified, assessed, and mitigated.
Reporting Lines. Ms. Langston should clearly articulate her reporting relationships — to the Board, the Compliance Committee (James Rutherford, Chair), and the CEO (Diane Whitford) — and should demonstrate that she has appropriate access to the Board and senior management.
Key Metrics. Ms. Langston should be fluent in the key metrics she monitors, including SAR volumes and filing timeliness, OFAC screening coverage rates and hit disposition statistics, CDD/EDD remediation completion percentages, transaction monitoring alert volumes and SAR conversion rates, and staffing and training metrics.
Prior MRA and MRIA. Examiners will likely ask Ms. Langston about the prior MRA (June 2022) and MRIA (November 2023), and specifically why prior remediation efforts failed to address the underlying deficiencies. Ms. Langston should be prepared to provide a candid assessment of what went wrong in prior remediation efforts and what has changed under her leadership and the current remediation program. This is a critical question and should be rehearsed carefully during mock examination sessions.
C. Thomas Ikeda — BSA Officer / AML Program Director
Mr. Ikeda was appointed as BSA Officer and AML Program Director in March 2023. By the anticipated date of the follow-up examination, he will have served in the role for approximately three years and will be leading a BSA/AML department of 77 permanent FTEs (post-hiring). As the officer responsible for the day-to-day management of the BSA/AML program, Mr. Ikeda will be a key interviewee. He should be prepared to address the following topics:
Day-to-Day Program Management. Mr. Ikeda should describe his role in managing the BSA/AML program on a daily basis, including his supervisory responsibilities, the organizational structure of his department, and the processes and procedures he oversees.
SAR Backlog Clearance. Mr. Ikeda should be prepared to describe in detail how the 2,400-alert backlog was dispositioned, including the triage methodology, the resources deployed, the quality assurance procedures applied, and the results of the clearance effort. He should also discuss the results of the lookback and the current SAR filing timeliness metrics, demonstrating achievement of the target of filing within 30 days.
Transaction Monitoring. Mr. Ikeda should be prepared to discuss the deployment of Veridian TMS v.10.0, the tuning performed, the results of the independent validation, and the current operational performance of the transaction monitoring system. He should be fluent in the current alert volumes and SAR conversion rates, and should be able to discuss scenario coverage and the system's ability to detect the types of suspicious activity most relevant to BRB's risk profile.
OFAC Screening. Mr. Ikeda should describe the current operational status of OFAC screening across all channels, including screening coverage metrics, the hit disposition workflow, and the management of the false-positive rate. He should be prepared to discuss the integration of OFAC screening across all fourteen BaaS partner channels.
CDD/EDD. Mr. Ikeda should describe the ongoing monitoring process for remediated accounts and the procedures for onboarding new high-risk accounts, including accounts onboarded through BaaS channels.
Quality Control. Mr. Ikeda should describe the Bank's quality assurance processes, including QA sampling methodologies, error rates identified, error categorization, and corrective action procedures.
Staffing. Mr. Ikeda should discuss his supervisory role over both permanent and temporary (Pinnacle) staff, the quality of work performed by temporary analysts, and the Bank's hiring and retention efforts for permanent staff. He should be candid about any staffing challenges and how they have been addressed.
SAR Filing Statistics. Mr. Ikeda should be fluent in the Bank's SAR filing statistics, including the total of 3,847 SARs filed in calendar year 2024 (compared to 2,914 in calendar year 2023), the 2,108 BaaS-related SARs (representing 54.8% of total filings in calendar year 2024), and the 28,612 CTRs filed in calendar year 2024.
Reporting Lines. Mr. Ikeda should clearly articulate his reporting lines to Patricia Langston and, indirectly, to the Compliance Committee.
Training. Mr. Ikeda should describe his role in delivering and overseeing the BSA/AML training program, including the content and frequency of training, completion rates, and any enhancements made during the remediation period.
D. Warren Ashby — Head of Fintech Partnerships / BaaS Division
Mr. Ashby is the Head of the Fintech Partnerships / BaaS Division and will be a critical interviewee given the significance of BaaS operations to BRB's BSA/AML risk profile. He should be prepared to address the following topics:
BaaS Business Model. Mr. Ashby should be prepared to describe BRB's BaaS business model, including the current portfolio of fourteen active partners, total transaction volume of $74.3 billion in calendar year 2024, and revenue of $127.4 million. He should be able to contextualize the BaaS business within the Bank's overall operations and strategic direction.
Top Three Partners. Mr. Ashby should have detailed knowledge of BRB's three largest BaaS partners:
• NovaPay Technologies Inc. — 41% of BaaS transaction volume (approximately $30.5 billion); CEO Ethan Garrison; approximately 2.1 million end-user accounts; onboarded 2021. NovaPay is the partner most closely associated with the OFAC screening gap and will be the subject of particular examiner scrutiny.
• FairLend Digital — 28% of BaaS transaction volume (approximately $1.4 billion in loan originations for fiscal year 2024); CEO Aisha Okonkwo; onboarded 2022. FairLend Digital's lending activities present distinct BSA/AML risks, including structuring, loan fraud, and straw borrower schemes.
• VaultEdge — 18% of BaaS transaction volume; 870,000 deposit accounts; CEO Marcus Tan; onboarded 2023. As a more recently onboarded partner, VaultEdge may be subject to particular scrutiny regarding the adequacy of due diligence conducted at onboarding.
Revised BaaS Compliance Oversight Framework. Mr. Ashby should describe his role in implementing the revised BaaS Compliance Oversight Framework, including the enhanced due diligence, ongoing monitoring, and escalation procedures applicable to all BaaS partners.
Partner Compliance Addenda. Mr. Ashby should provide the status of compliance addenda execution with all fourteen partners, including any partners that have resisted or delayed execution of the addenda and how those situations were resolved.
Compliance Remediation Letters. Mr. Ashby should describe the Compliance Remediation Letters sent to NovaPay and FairLend Digital, the partners' cooperation and response, and any additional measures taken to address partner-specific compliance deficiencies.
BaaS Partner BSA/AML Risk Assessment. Mr. Ashby should describe the quarterly BaaS partner risk assessment process, including the assessment methodology, the risk factors evaluated, the risk rating scale, and the actions triggered by elevated risk ratings.