PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF CALDERWOOD & HARKNESS LLP
MEMORANDUM
FROM: Philip Hartmann, Responsible Partner, and Yuki Nakamura, Lead Associate Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
TO: Patricia Langston, Chief Compliance Officer, and Thomas Ikeda, BSA Officer / AML Program Director Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
CC: Gregory Nardone, General Counsel & Corporate Secretary, BRB Carlos Espinoza, Working Associate, Calderwood & Harkness LLP Derek Ballard, Head of Internal Audit, BRB
Date: February 20, 2025
Re: Supervision and Quality Control Protocols for Pinnacle Compliance Solutions LLC Temporary BSA/AML Analysts
Matter No.: 1045-00002
PRIVILEGE DESIGNATION: This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This memorandum is not to be distributed, copied, or disclosed to any person or entity without the prior written approval of Calderwood & Harkness LLP. Any unauthorized disclosure may result in a waiver of applicable privileges.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY AND PURPOSE
A. Purpose of This Memorandum
The purpose of this memorandum is to establish a comprehensive framework for the supervision, quality assurance, and quality control of the thirty (30) full-time-equivalent ("FTE") temporary BSA/AML compliance analysts to be provided by Pinnacle Compliance Solutions LLC ("Pinnacle") to Belmont Ridge Bank National Association ("BRB" or the "Bank") under the Managed Services Agreement, Statement of Work Reference No. PCS-BRB-2025-0012 (the "MSA"). This framework addresses all material aspects of the temporary staffing engagement, including organizational reporting structures, pre-deployment and ongoing training requirements, multi-tiered quality review and sampling methodologies, performance benchmarking and remediation, escalation protocols, reporting cadences, confidentiality and information security requirements, contractual enforcement mechanisms, and transition and wind-down planning.
The protocols described herein are designed to ensure that BRB maintains substantive control over all work performed by Pinnacle temporary staff, that the quality of such work meets or exceeds regulatory expectations, and that BRB can demonstrate to the Office of the Comptroller of the Currency ("OCC"), the independent consultant, and other stakeholders that its remediation program is supported by robust and well-documented supervisory infrastructure.
B. Regulatory and Remediation Context
This memorandum is issued in the context of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Consent Order"), which identified significant deficiencies in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program. As documented in the Consent Order and supporting examination findings, the OCC identified, among other things, the following material deficiencies:
• A backlog of approximately 2,400 unreviewed suspicious activity alerts in BRB's transaction monitoring system as of September 2024, representing a substantial failure to timely investigate and disposition alerts generated by the Bank's automated monitoring systems;
• An average Suspicious Activity Report ("SAR") filing time of approximately 78 days from the date of initial alert generation, far exceeding the 30-day regulatory expectation and reflecting systemic delays in the investigation and filing workflow;
• Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") deficiencies affecting approximately 47,000 high-risk customer accounts, primarily accounts onboarded through BRB's fintech Banking-as-a-Service ("BaaS") partnerships, including incomplete beneficial ownership information, absent or inadequate risk ratings, and insufficient enhanced due diligence documentation for accounts presenting elevated risk profiles.
The Pinnacle engagement, with a total contract value of $3,600,000 for a twelve-month term (30 FTEs at $10,000 per month per FTE), constitutes a critical component of BRB's remediation program. As such, the engagement will be subject to heightened scrutiny by the OCC (Jonathan Frey, Examiner-in-Charge), by the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"), engagement reference TCG-BRB-2025-001, and by the Financial Crimes Enforcement Network ("FinCEN"), which is monitoring SAR filing remediation through its Enforcement Division (liaison: Angela Drummond, Associate Director).
C. Fundamental Principle: Regulatory Accountability Cannot Be Outsourced
It is imperative that all BRB personnel involved in the Pinnacle engagement understand and internalize the foundational principle that BRB, as the chartered national banking association (OCC Charter No. 48271), bears ultimate and non-delegable responsibility for the quality, accuracy, completeness, and timeliness of all BSA/AML compliance work performed on its behalf, regardless of whether that work is performed by permanent BRB employees, temporary contract staff, or third-party service providers. The outsourcing of execution does not outsource regulatory accountability. This principle is well established in OCC supervisory guidance, including OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and its successor guidance, and has been reinforced by the OCC in numerous enforcement actions.
Failure to maintain adequate supervision and quality control over the Pinnacle engagement could expose BRB to additional regulatory criticism, potential supplementary enforcement action, and could undermine the Bank's credibility with the OCC and Thornfield at a critical juncture in the remediation process.
D. Related Documents
This memorandum must be read in conjunction with the following related documents, each of which addresses complementary aspects of BRB's overall remediation program:
• The Comprehensive Remediation Action Plan (the "RAP"), which is due for submission to the OCC by May 15, 2025, and which will incorporate the supervisory and quality control framework established herein;
• The SAR Backlog Triage Protocol, which establishes the prioritization methodology for addressing the approximately 2,400 unreviewed alerts;
• The SAR Lookback Scope & Methodology Memorandum, which defines the parameters of the historical lookback review; and
• The C&H Privilege Protocol Memorandum, which governs the handling of privileged communications and work product in the context of the remediation engagement.
II. BACKGROUND AND ENGAGEMENT PARAMETERS
A. Pinnacle Compliance Solutions LLC Engagement Overview
BRB has engaged Pinnacle Compliance Solutions LLC, a limited liability company organized under the laws of the State of New York, with its principal office located at 90 Broad Street, 20th Floor, New York, NY 10004, to provide managed BSA/AML compliance staffing services. The key engagement parameters are summarized below:
The 30 FTEs provided under the Pinnacle engagement are allocated across three functional categories, as follows:
• SAR Investigators: Approximately 15 FTEs, responsible for investigating and dispositioning suspicious activity alerts and drafting SARs for submission to FinCEN;
• KYC/CDD Analysts: Approximately 10 FTEs, responsible for reviewing and remediating CDD/EDD deficiencies across the identified population of approximately 47,000 high-risk customer accounts; and
• Transaction Monitoring Alert Reviewers: Approximately 5 FTEs, responsible for the first-line review and triage of new alerts generated by BRB's transaction monitoring system.
The MSA was drafted by Calderwood & Harkness LLP and contains detailed provisions regarding analyst qualification standards, performance benchmarks, replacement obligations, confidentiality requirements, data security obligations, indemnification, and termination rights. The supervisory and quality control framework set forth in this memorandum is designed to complement and give operational effect to the contractual provisions of the MSA.
B. Remediation Context and Key Deadlines
The Pinnacle engagement serves the broader remediation objectives established by the Consent Order and the forthcoming Comprehensive Remediation Action Plan. The following key milestones and deadlines govern the remediation timeline and directly affect the scope and urgency of the Pinnacle engagement:
SAR Backlog Remediation:
• Backlog Clearance Target: June 30, 2025 — All approximately 2,400 unreviewed suspicious activity alerts (as of the September 2024 baseline) must be dispositioned by this date.
• SAR Filing Timeliness: BRB must demonstrate sustained improvement in SAR filing timeliness, reducing the average filing time from 78 days to within 30 days of alert generation, consistent with regulatory expectations.
• Interim SAR Backlog Status Report: Due to the OCC by March 31, 2025 — This report must reflect meaningful progress toward backlog clearance and will be among the first data points used by the OCC to evaluate the adequacy of BRB's remediation efforts, including the effectiveness of the Pinnacle engagement.
CDD/EDD Remediation:
• 50% Remediation Milestone: July 15, 2025 — Completion of CDD/EDD remediation for at least 23,500 of the 47,000 identified accounts.
• 100% Remediation Completion: January 15, 2026 — Full remediation of all 47,000 accounts.
Regulatory Reporting:
• First Quarterly Progress Report to OCC: September 15, 2025.
Relevant Production and Filing Volumes (Calendar Year 2024 Data):
The following data points provide essential context for the scale and complexity of BRB's BSA/AML operations and the demands that will be placed on Pinnacle analysts:
Project Budgets:
• SAR Lookback Project Budget: $5,500,000
• CDD/EDD Remediation Project Budget: $4,300,000
• Pinnacle Managed Services: $3,600,000
These budget figures underscore the magnitude of BRB's remediation investment and the importance of ensuring that all expenditures—particularly those related to temporary staffing—produce work product of demonstrable quality and regulatory adequacy.
C. Regulatory Expectations
The OCC Consent Order requires BRB to maintain adequate staffing and expertise for all BSA/AML functions throughout the remediation period and beyond. The use of temporary contract staff is an accepted remediation practice, but the OCC expects the Bank to demonstrate that such staff are properly supervised, that their work product is subject to rigorous quality controls, and that the Bank is simultaneously building permanent internal capacity to sustain compliance after the temporary engagement concludes.
Thornfield Consulting Group — Independent Assessment:
Thornfield Consulting Group LLC, the OCC-mandated independent consultant, will be assessing the adequacy of BRB's remediation staffing and quality controls as part of its engagement (TCG-BRB-2025-001). The Thornfield team is led by Dr. Vivian Castellano, Managing Director, and includes Robert Eastman, Senior Director, AML Transaction Monitoring, and Nathaniel Burgess, Senior Manager, Fintech/Payments Compliance. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, with a preliminary gap assessment due to the OCC by April 15, 2025. It is virtually certain that Thornfield will evaluate BRB's supervisory framework for the Pinnacle engagement as a key component of its gap assessment. BRB should be prepared to present this memorandum and the resulting Standard Operating Procedures to Thornfield as evidence of the rigor and intentionality of its supervisory approach.
FinCEN Monitoring:
FinCEN (Angela Drummond, Associate Director, Enforcement Division) is actively monitoring BRB's SAR filing remediation. The quality of SARs produced during the remediation period—including SARs drafted by Pinnacle analysts—will be subject to heightened scrutiny. Deficient SAR narratives, incomplete filings, or evidence of inadequate investigation could result in additional FinCEN attention, including potential referral for civil money penalties.
External Audit and Independent Testing:
BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP (engagement partner: Franklin Dorsey), will incorporate an assessment of Pinnacle work product quality into its next independent BSA/AML test. The timing and scope of that testing will be coordinated with Derek Ballard's Internal Audit function. BRB should anticipate that Caldera & Pope will evaluate whether the Bank's quality review sampling methodology and accuracy benchmarks are sufficient and whether BRB is adhering to the protocols established herein.
III. ORGANIZATIONAL STRUCTURE AND SUPERVISORY HIERARCHY
A. Primary Supervisory Authority
All Pinnacle temporary analysts engaged under the MSA report directly to Thomas Ikeda, BSA Officer and AML Program Director of BRB, for all substantive work-related matters. Thomas Ikeda has ultimate day-to-day operational authority over work assignments, prioritization of tasks and workstreams, establishment and enforcement of quality standards, and all decisions regarding the disposition of alerts, the filing of SARs, and the resolution of CDD/EDD deficiencies. This direct reporting relationship is critical to ensuring that BRB maintains substantive control over the remediation work product and that there is no ambiguity regarding the locus of supervisory authority.
Thomas Ikeda was appointed BSA Officer of BRB in March 2023 and has approximately two years of tenure in the role. Given the demands of the remediation program and the addition of 30 temporary FTEs to his span of control, the supervisory structure described below is designed to ensure that Thomas Ikeda is supported by sufficient layers of oversight and that the supervisory burden is distributed appropriately across the Bank's BSA/AML management team.
B. Supervisory Reporting Chain
The supervisory reporting chain for the Pinnacle engagement is organized into five tiers, each serving a distinct oversight function:
Tier 1 — Direct Supervision: Thomas Ikeda (BSA Officer) and Designated BRB Team Leads
Thomas Ikeda, as BSA Officer, is the primary supervisor of all Pinnacle temporary analysts. To ensure effective day-to-day oversight across the 30-FTE temporary workforce, BRB shall assign at least three (3) senior BSA/AML analysts as dedicated team leads, each overseeing approximately ten (10) Pinnacle FTEs. These team leads will serve as the first point of contact for Pinnacle analysts on substantive work questions, will conduct first-line quality reviews, and will manage the day-to-day workflow within their respective teams.
The following requirements apply to the designation of team leads:
• All team leads must be permanent BRB employees. No Pinnacle staff member may serve as a team lead or exercise supervisory authority over other Pinnacle analysts for purposes of quality control or work product approval.
• Each team lead must possess a minimum of three (3) years of direct BSA/AML experience, including experience in SAR investigation and filing, CDD/EDD review, or transaction monitoring alert review, as applicable to the workstream they supervise.
• Team lead assignments must be documented and communicated to Pinnacle's on-site engagement manager and to Calderwood & Harkness LLP.
BRB's existing BSA/AML department currently comprises 62 FTEs and is anticipated to be augmented by 15 permanent FTE additions during the remediation period, bringing the total permanent headcount to 77. The three designated team leads will be drawn from this permanent staff complement.
Tier 2 — Compliance Oversight: Patricia Langston, Chief Compliance Officer
Patricia Langston, as Chief Compliance Officer, provides senior management oversight of the Pinnacle engagement as part of her broader responsibility for BRB's compliance program. Thomas Ikeda shall provide monthly written reports to Patricia Langston covering Pinnacle staff performance, output volumes, quality metrics, error rates, escalated issues, and any material developments affecting the engagement. Patricia Langston is responsible for ensuring that the Compliance Committee and senior management receive timely and accurate information regarding the status and effectiveness of the temporary staffing program.
Tier 3 — Risk and Audit Oversight: Melissa Chu, Chief Risk Officer, and Derek Ballard, Head of Internal Audit
Melissa Chu, as Chief Risk Officer, provides enterprise risk management oversight of the remediation program, including assessment of the risks associated with reliance on temporary staff for critical compliance functions. Derek Ballard, as Head of Internal Audit, is responsible for conducting independent quality assurance testing of Pinnacle work product on a quarterly basis, as described in greater detail in Section V.D of this memorandum. Internal Audit findings will be reported to both Patricia Langston and to the Audit Committee.
Tier 4 — Board Oversight: Compliance Committee (James Rutherford, Chair)
The Compliance Committee, established pursuant to the Consent Order and chaired by James Rutherford, exercises board-level oversight of BRB's remediation program. The Compliance Committee shall receive summary reports on temporary staffing quality, productivity, and milestone progress at each of its monthly meetings. These reports, prepared by Patricia Langston based on data provided by Thomas Ikeda, will enable the Compliance Committee to monitor the effectiveness of the Pinnacle engagement and to identify any issues requiring board-level attention or intervention.
Tier 5 — Outside Counsel: Calderwood & Harkness LLP
Calderwood & Harkness LLP (Philip Hartmann, Responsible Partner; Yuki Nakamura, Lead Associate) is available to provide legal guidance on questions arising from the Pinnacle engagement, including the escalation of potential enforcement-sensitive findings, privilege-related issues, regulatory communication strategy, and contractual interpretation and enforcement matters. The role of outside counsel in the supervisory hierarchy is advisory and consultative; Calderwood & Harkness does not exercise direct supervisory authority over Pinnacle analysts but serves as a resource for BRB management on legal and privilege-sensitive matters.
C. Pinnacle Internal Supervision
While BRB retains full supervisory authority over all substantive work product, Pinnacle maintains certain administrative and logistical responsibilities with respect to its assigned analysts:
• Andrea Solis, Director of Managed Services, Pinnacle, is responsible for ensuring that Pinnacle analysts meet the contractual qualification standards set forth in the MSA, including educational background, certification requirements (e.g., CAMS, CFE), and minimum experience levels.
• On-Site Engagement Manager: Pinnacle shall designate an on-site engagement manager who will be present at BRB's offices during normal business hours throughout the engagement period. The on-site engagement manager will coordinate staffing logistics (scheduling, attendance, time-tracking), address human resources issues related to Pinnacle analysts (performance counseling, replacement requests), and serve as the primary administrative liaison between Pinnacle and Thomas Ikeda's team.
• Limitation on Pinnacle Supervisory Authority: The Pinnacle on-site engagement manager does not replace or supplement BRB's supervisory authority with respect to the substance, quality, or accuracy of work product. BRB retains full quality control and decision-making authority over all substantive aspects of the engagement. All decisions regarding alert dispositions, SAR filings, CDD/EDD determinations, and escalation actions are made by BRB personnel, not Pinnacle management.
D. Segregation of Duties and Access Controls
Appropriate segregation of duties and role-based access controls are essential to maintaining the integrity and security of BRB's BSA/AML systems and data. Linda Petrosian, Chief Information Officer / Chief Technology Officer, shall be responsible for provisioning system access credentials for Pinnacle analysts in accordance with the following requirements:
SAR Investigators (approximately 15 FTEs):
• Read-only access to alert queues within the Veridian TMS v.8.3 transaction monitoring system (Contract No. VA-BRB-2023-0044);
• Write access limited to alert disposition fields (disposition coding and rationale documentation) and SAR narrative drafting fields within the case management module;
• No access to system configuration, tuning parameters, threshold settings, or administrative functions.
KYC/CDD Analysts (approximately 10 FTEs):
• Access to the CDD/EDD documentation repository for assigned customer accounts;
• Access to customer onboarding records, including records originating from BaaS partner systems, for assigned accounts only;
• All access must be logged and auditable, with access logs retained for a minimum of five (5) years.
Transaction Monitoring Alert Reviewers (approximately 5 FTEs):
• Access to the alert review queue within Veridian TMS v.8.3, limited to Level 1 triage functions;
• No authority to permanently close or archive alerts; all dispositions subject to review by BRB permanent staff.
Access Termination:
All system access credentials, physical access badges, and data access permissions for Pinnacle analysts shall be terminated within twenty-four (24) hours of the conclusion of the Pinnacle engagement or the departure of any individual Pinnacle analyst, whichever occurs first. Linda Petrosian's team shall maintain a current roster of all active Pinnacle access credentials and shall coordinate with Pinnacle's on-site engagement manager and Thomas Ikeda to ensure prompt termination upon departure.
IV. TRAINING REQUIREMENTS
A. Pre-Deployment Training (Mandatory, Prior to Commencing Work)
All thirty (30) Pinnacle FTEs must complete a mandatory pre-deployment training program before performing any substantive work on BRB's BSA/AML compliance functions. No Pinnacle analyst may be assigned to live work queues, granted production-level system access, or permitted to review, investigate, or disposition any alert, SAR, or customer file until the training program has been completed and the analyst has been certified as described in Section IV.B below.
The pre-deployment training program shall be developed and delivered jointly by BRB's BSA/AML department, under the direction of Thomas Ikeda, and Calderwood & Harkness LLP (Yuki Nakamura, Lead Associate, and Carlos Espinoza, Working Associate). The training program shall consist of the following core curriculum modules:
Module 1: BSA/AML Regulatory Framework Overview
This module will provide an overview of the federal BSA/AML regulatory framework, including the Bank Secrecy Act (31 U.S.C. §§ 5311-5332), the Anti-Money Laundering Act of 2020, applicable FinCEN regulations (31 C.F.R. Chapter X), and OCC supervisory expectations as reflected in the Comptroller's Handbook, OCC Bulletins, and relevant examination guidance. The module will cover the five pillars of an effective BSA/AML compliance program and will situate BRB's remediation obligations within the broader regulatory context.
Module 2: BRB-Specific BSA/AML Policies and Procedures
This module will familiarize Pinnacle analysts with BRB's current BSA/AML policies and procedures, as well as any interim revised policies that have been adopted or are pending adoption as part of the remediation program. Analysts will be required to review and demonstrate understanding of BRB's SAR Policy, CDD/EDD Policy, Transaction Monitoring Policy, OFAC Compliance Policy, and BaaS Partner Compliance Policy. As updated policies are issued during the remediation period, supplemental training will be provided in accordance with Section IV.C below.
Module 3: OFAC Sanctions Screening and Interdiction Procedures
This module is required for all Pinnacle staff regardless of their assigned functional role. It covers OFAC sanctions screening protocols, Specially Designated Nationals and blocked Persons List ("SDN") management, Sectoral Sanctions Identifications List ("SSI") and consolidated sanctions list management, procedures for reviewing and escalating potential screening hits, the OFAC blocking and rejection process, and BaaS channel-specific sanctions screening procedures. Given the severity of potential OFAC violations and the criminal penalties that may attach, all Pinnacle analysts must have a working understanding of BRB's OFAC obligations and escalation procedures, even if their primary assignment does not involve sanctions screening.
Module 4: SAR Filing Standards
This module will cover SAR narrative drafting standards, evidentiary standards for determining whether activity is "suspicious" within the meaning of 31 C.F.R. § 1020.320, timeliness requirements (including the 30-day filing target established under the Consent Order), FinCEN BSA E-Filing procedures, quality benchmarks for SAR narratives, and common SAR drafting deficiencies identified in regulatory examinations and independent testing. The module will include practical exercises requiring analysts to draft sample SAR narratives based on hypothetical fact patterns.
Module 5: CDD/EDD Requirements
This module will cover customer identification program ("CIP") requirements, BRB's risk rating methodology, beneficial ownership identification and verification (including the 25% ownership threshold under the FinCEN CDD Rule, 31 C.F.R. § 1010.230), ongoing monitoring requirements, and the specific enhanced due diligence procedures applicable to high-risk customers, including source of funds and source of wealth documentation, purpose of account, expected activity profiling, and adverse media screening. The module will include specific instruction on the CDD/EDD requirements applicable to accounts onboarded through BRB's BaaS partnerships, including the allocation of CDD responsibilities between BRB and its BaaS partners.
Module 6: Veridian TMS v.8.3 System Training
This module will provide hands-on training on BRB's current transaction monitoring system, Veridian TMS v.8.3 (Contract No. VA-BRB-2023-0044). The training will cover the alert review interface, disposition coding and rationale documentation, case management workflows, evidence attachment and linking procedures, and documentation standards. Upon the anticipated deployment of Veridian TMS v.10.0 (User Acceptance Testing completion targeted for August 1, 2025), all Pinnacle analysts will be required to complete additional system training as described in Section IV.C.
Module 7: BRB Fintech BaaS Partnership Overview
This module will provide an overview of BRB's fintech BaaS program, including the structure and risk profile of the Bank's fourteen (14) active BaaS partnerships. The module will include particular focus on the three largest BaaS partners by transaction volume:
• NovaPay Technologies Inc.: Accounting for approximately 41% of BaaS transaction volume and approximately $30.5 billion in transaction volume in CY 2024. NovaPay operates a peer-to-peer payments and digital wallet platform with a customer base presenting elevated money laundering and structuring risk.
• FairLend Digital LLC: Accounting for approximately 28% of BaaS volume and approximately $1.4 billion in loan originations in FY 2024. FairLend operates a digital lending platform with exposure to synthetic identity fraud and straw borrower risk.
• VaultEdge Inc.: Accounting for approximately 18% of BaaS volume and approximately 870,000 deposit accounts. VaultEdge operates a high-yield savings and checking platform with exposure to rapid fund movement and potential layering activity.
The module will address the compliance risks unique to BaaS relationships, the allocation of BSA/AML compliance responsibilities between BRB and its BaaS partners, and the specific alert patterns and typologies associated with BaaS transaction flows.
Module 8: Privilege and Confidentiality Obligations
This module will instruct Pinnacle analysts on attorney-client privilege protocols applicable to the remediation engagement, as set forth in the C&H Privilege Protocol Memorandum. The module will cover the identification and handling of privileged materials, restrictions on disclosure, proper labeling and storage of privileged documents, and the procedures for consulting with Calderwood & Harkness on privilege-sensitive matters. Pinnacle analysts must understand that certain communications and work product generated during the remediation engagement may be protected by the attorney-client privilege and/or the work product doctrine, and that unauthorized disclosure could result in a waiver of those protections.
Module 9: Escalation Procedures
This module will instruct Pinnacle analysts on the escalation procedures described in Section IX of this memorandum. The module will cover when and how to escalate potential enforcement-sensitive findings, OFAC blocking situations, high-risk customer issues, matters requiring BRB management attention, and matters requiring Calderwood & Harkness legal guidance. Analysts will be provided with decision trees and reference guides to assist in identifying escalation triggers.
Module 10: Information Security and Data Protection
This module will cover BRB's IT security policies as administered by Linda Petrosian (CIO/CTO), including data handling and classification requirements, prohibited external transmissions of BRB data, restrictions on the use of personal devices and personal email for BRB business, clean-desk protocols, and physical security requirements within BRB's offices. Pinnacle analysts will be required to acknowledge in writing their understanding of and agreement to comply with all applicable BRB information security policies.
B. Training Completion and Certification
Each Pinnacle analyst must pass a written assessment covering the core curriculum modules described above before being assigned to any live work queue. The minimum passing score on the written assessment is 80%. The assessment shall be administered by Thomas Ikeda's office, with content developed in consultation with Calderwood & Harkness LLP.
All training records, including attendance logs, assessment scores, certifications, and any documentation of remedial training, shall be maintained by Thomas Ikeda's office in a centralized, auditable repository. These records must be made available to Thornfield Consulting Group and to the OCC upon request. BRB should anticipate that Thornfield will review training records as part of its preliminary gap assessment (due April 15, 2025) and subsequent on-site assessments.
Any Pinnacle analyst who fails the initial written assessment may retake the assessment one (1) additional time after completing supplemental instruction on the areas of deficiency. An analyst who fails the assessment on the second attempt shall be deemed unqualified for deployment and must be removed and replaced by Pinnacle at no additional cost to BRB, in accordance with the analyst replacement provisions of the MSA.
C. Ongoing and Refresher Training
Pre-deployment training establishes the baseline, but ongoing training is essential to maintaining quality and adapting to evolving requirements. The following ongoing training obligations apply:
• Monthly Refresher Sessions: Thomas Ikeda's team, in coordination with Calderwood & Harkness, shall conduct monthly refresher training sessions of approximately one (1) hour in duration. These sessions shall cover common errors identified in quality assurance reviews, new or emerging suspicious activity typologies, regulatory updates, lessons learned from completed investigations, and any changes to BRB policies, procedures, or systems.
• Veridian TMS v.10.0 Retraining: Upon the deployment of Veridian TMS v.10.0 (User Acceptance Testing completion targeted for August 1, 2025), all Pinnacle analysts shall be required to complete mandatory retraining on the updated system. No Pinnacle analyst may perform work on the new system until retraining has been completed and documented.
• Ad Hoc Training Sessions: Additional training sessions shall be conducted as warranted by emerging risks, the onboarding of new BaaS partners, the issuance of updated policies and procedures, or the identification of systemic quality issues in Pinnacle work product.
All ongoing and refresher training shall be documented in the same centralized training records repository maintained by Thomas Ikeda's office.
V. QUALITY REVIEW SAMPLING METHODOLOGY
A. Overview
BRB must implement and maintain a structured, multi-layered quality review program for all work performed by Pinnacle analysts. The quality review program is designed to identify and correct errors before they result in regulatory deficiencies, to provide data for individual and aggregate performance tracking, and to demonstrate to the OCC, Thornfield, and other stakeholders that BRB is exercising meaningful oversight of the temporary staffing engagement.
Quality reviews at the first and second levels described below must be conducted by permanent BRB BSA/AML staff. Pinnacle employees may not conduct quality reviews of other Pinnacle employees' work product. For specific legal issues or matters involving potential enforcement sensitivity, Calderwood & Harkness attorneys may conduct or participate in quality reviews as appropriate.
B. First-Level Review (100% Review — Initial Ramp-Up Period)
For the first thirty (30) calendar days following each individual Pinnacle analyst's deployment to a live work queue (the "Ramp-Up Period"), 100% of that analyst's completed work product must be reviewed by a designated BRB team lead before the work product is finalized, filed, or acted upon. This 100% review requirement applies to all categories of work product, including alert dispositions, SAR drafts, and CDD/EDD file reviews.
The purpose of the First-Level Review is to establish an individual baseline quality profile for each Pinnacle analyst, to identify training deficiencies or knowledge gaps early in the engagement (when they can be remediated with the least disruption), and to build confidence in the reliability of each analyst's work before transitioning to the standard sampling regime.
Upon satisfactory completion of the 30-day Ramp-Up Period—defined as achieving an accuracy rate of 95% or greater across all work product categories—the analyst may transition to the Standard Sampling Regime described in Section V.C. Any analyst who does not achieve 95% accuracy during the Ramp-Up Period shall remain subject to the 100% review requirement until such time as the 95% threshold is achieved over a consecutive 30-day period, or until BRB determines that the analyst should be replaced pursuant to Section XII.
C. Second-Level Review (Standard Sampling Regime)
Following satisfactory completion of the Ramp-Up Period, Pinnacle analysts will transition to the Standard Sampling Regime, under which a defined percentage of each analyst's work product will be subject to quality review by BRB senior staff. The sampling rates and methodologies for each work category are as follows:
1. SAR Drafts and Filings
A minimum of 25% of all SARs drafted by Pinnacle analysts must be reviewed by BRB senior SAR investigators before the SAR is filed with FinCEN. The sample shall be selected randomly from the population of all Pinnacle-drafted SARs, subject to the following stratification and targeted review requirements:
• Stratification Requirement: At least 50% of the sampled SARs must involve BaaS-related activity. This stratification reflects the fact that BaaS-related SARs comprised 54.8% of all SARs filed by BRB in CY 2024 (2,108 of 3,847) and that BaaS-related activity presents heightened complexity and risk.
• Mandatory 100% Review Categories: Notwithstanding the 25% random sampling rate, the following categories of SARs are subject to 100% review by BRB senior staff before filing:
(a) All SARs involving potential OFAC sanctions violations or sanctions nexus;
(b) All SARs involving transactions exceeding $500,000 in aggregate value;
(c) All SARs involving activity by or on behalf of politically exposed persons ("PEPs"); and
(d) All SARs involving law enforcement requests or subpoenas, as further described in Section VII.C.
2. Alert Dispositions (Transaction Monitoring)
A minimum of 20% of all alerts dispositioned as "no SAR required" by Pinnacle analysts must be reviewed by BRB senior staff. This review is critical because false negatives—alerts improperly cleared without SAR filing—represent the most significant compliance risk associated with the alert disposition function.
The alert disposition sample shall be weighted toward the following categories, which present elevated risk of error or regulatory concern:
(a) High-dollar alerts, defined as alerts involving aggregate transaction activity exceeding $100,000; and
(b) Alerts generated by BaaS partner transaction flows, which may present unique typologies and risk factors not fully captured by standard disposition criteria.
3. CDD/EDD File Reviews
A minimum of 15% of all customer files reviewed and updated by Pinnacle KYC/CDD analysts must be reviewed by BRB senior staff. The CDD/EDD file review sample shall be weighted toward accounts presenting the highest remediation risk, including:
(a) Accounts onboarded by NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. (the three largest BaaS partners by volume), which collectively account for the majority of the 47,000 accounts requiring CDD/EDD remediation; and
(b) All files involving beneficial ownership deficiencies (i.e., missing or incomplete beneficial ownership information at the 25% threshold) or customer nexus with high-risk jurisdictions, as identified in BRB's country risk rating methodology.
Files involving beneficial ownership deficiencies or high-risk jurisdiction nexus are subject to 100% review by BRB senior staff, regardless of the random sampling rate.
D. Third-Level Review (Internal Audit Sampling)
In addition to the first-line and second-line quality reviews described above, Derek Ballard, Head of Internal Audit, shall conduct independent quarterly quality assurance testing of Pinnacle work product. Internal Audit's quarterly testing serves as a third line of defense, providing an independent assessment of the effectiveness of the first- and second-level quality review processes and identifying any systemic issues that may not be apparent from front-line sampling alone.
The sample size for Internal Audit's quarterly testing shall be determined using a statistically valid sampling methodology consistent with Internal Audit's established practices. Calderwood & Harkness recommends a minimum sample size of 5% of total Pinnacle output across all work categories (alert dispositions, SAR filings, CDD/EDD file reviews) for each quarterly testing cycle.
Internal Audit findings shall be reported to Patricia Langston, to the Compliance Committee (James Rutherford, Chair), and to the Audit Committee (Margaret Dao, Chair). Internal Audit findings that identify material quality deficiencies or systemic issues must be immediately communicated to Thomas Ikeda for remedial action and to Calderwood & Harkness for assessment of any regulatory or legal implications.
E. Thornfield Consulting Oversight
Thornfield Consulting Group (Dr. Vivian Castellano, Managing Director, and team, including Robert Eastman, Senior Director, AML Transaction Monitoring, and Nathaniel Burgess, Senior Manager, Fintech/Payments Compliance) will conduct its own independent assessment of the quality and adequacy of Pinnacle work product as part of its OCC-mandated independent engagement (TCG-BRB-2025-001). Thornfield's assessment is separate from and independent of BRB's internal quality review processes and Internal Audit testing.
BRB must cooperate fully with Thornfield's review of Pinnacle work product in accordance with the Access & Cooperation Protocol established for the Thornfield engagement. This cooperation includes providing Thornfield with timely access to work product samples, QA review results, training records, performance data, and any other documentation Thornfield reasonably requests.
Any findings by Thornfield regarding deficiencies in Pinnacle work product quality—whether identified during the preliminary gap assessment (due April 15, 2025) or in subsequent assessment phases—must be immediately escalated to Thomas Ikeda, Patricia Langston, and Philip Hartmann at Calderwood & Harkness for evaluation and remedial action. Thornfield findings will likely be communicated to the OCC, and BRB must be prepared to demonstrate prompt and effective remedial responses.
VI. ALERT DISPOSITION ACCURACY BENCHMARKS
A. Performance Standards
BRB establishes the following accuracy benchmarks for alert dispositions performed by Pinnacle analysts:
Target Accuracy Rate: ≥95% accuracy for all alert dispositions, encompassing both "SAR filed" and "no SAR required" outcomes. This target reflects the expectation that Pinnacle analysts, following completion of the pre-deployment training program and the 30-day Ramp-Up Period, should be capable of producing work product that is substantially consistent with the dispositions that would be reached by experienced, permanent BRB BSA/AML staff.
Accuracy is measured by comparing the disposition reached by the Pinnacle analyst against the outcome determined upon quality assurance review by BRB permanent staff. Where the QA reviewer reaches a different disposition than the Pinnacle analyst, the QA reviewer's determination is considered the correct outcome for purposes of accuracy measurement, subject to any further review or escalation that may be warranted.
Classification of Errors:
Errors identified during quality review are classified into three categories, reflecting their relative severity and regulatory significance:
• Type I Error (False Negative / Missed SAR): An alert improperly closed by the Pinnacle analyst as "no SAR required" when the QA review determines that a SAR should have been filed. Type I errors are classified as critical errors. A pattern of Type I errors represents the most serious quality concern, as it indicates that suspicious activity may be going unreported to FinCEN in violation of BRB's SAR filing obligations.
• Type II Error (False Positive / Unnecessary SAR): An alert escalated by the Pinnacle analyst to SAR filing when the QA review determines that no SAR was warranted. Type II errors are classified as non-critical errors. While Type II errors do not result in unreported suspicious activity, they impose unnecessary workload on SAR review and approval personnel, may result in defensive filing practices that reduce the informational value of BRB's SAR filings, and may be viewed by regulators as indicative of insufficient investigative rigor. Type II errors are tracked for efficiency monitoring purposes.
• Documentation Error: The Pinnacle analyst's disposition rationale is incomplete, factually inaccurate, or insufficiently documented to support the disposition reached, even if the ultimate disposition outcome is correct. Documentation errors are classified as moderate errors. Persistent documentation errors may impair BRB's ability to demonstrate the adequacy of its alert review process to examiners and may undermine the evidentiary value of disposition records.
B. Individual Analyst Performance Tracking
Each Pinnacle analyst's accuracy rate shall be tracked on a rolling 30-day basis, calculated as the percentage of the analyst's dispositions reviewed during the period that are confirmed as accurate by QA reviewers. Individual performance tracking is essential to identifying analysts who may require additional training, coaching, or replacement.
The following performance management thresholds and consequences apply:
• Below 90% Accuracy (Any Rolling 30-Day Period): Any Pinnacle analyst whose accuracy rate falls below 90% in any rolling 30-day period must be placed on a performance improvement plan ("PIP"). The PIP shall specify the identified deficiencies, required corrective actions (which may include targeted retraining, increased supervision, or assignment to a reduced or modified workload), and a 15-calendar-day remediation period during which the analyst's accuracy will be closely monitored.
• Below 85% Accuracy, or Failure to Improve After PIP: Any Pinnacle analyst whose accuracy rate falls below 85% at any time, or who fails to demonstrate sustained improvement to at least 90% accuracy following completion of a PIP, must be removed from live work queues and either subjected to comprehensive retraining (with successful completion of the retraining assessment required before return to live work) or replaced by Pinnacle under the terms of the MSA.
• Type I Error Threshold: Any Pinnacle analyst who commits more than two (2) Type I errors (missed SARs) within any 60-day period must be immediately removed from alert disposition work, regardless of the analyst's overall accuracy rate. The analyst may not return to alert disposition work until a thorough assessment of the underlying cause of the errors has been completed, retraining has been provided, and the analyst has demonstrated satisfactory performance on a re-assessment. This threshold reflects the critical nature of Type I errors and the potential regulatory consequences of unreported suspicious activity.
C. Aggregate Portfolio Performance
In addition to individual analyst tracking, the overall accuracy rate of the Pinnacle analyst team as a whole shall be reported monthly to Patricia Langston and included in the monthly reporting package submitted to the Compliance Committee. Aggregate performance metrics provide a portfolio-level view of the quality of the Pinnacle engagement and can reveal systemic issues—such as inadequate training content, insufficient supervisory resources, or flawed investigation tools—that may not be apparent from individual analyst data alone.
The following aggregate performance thresholds and responses apply:
• Below 92% Aggregate Accuracy (Any Calendar Month): If the aggregate Pinnacle team accuracy rate falls below 92% for any calendar month, BRB must initiate a root cause analysis within five (5) business days and convene a remedial action conference with Andrea Solis, Director of Managed Services at Pinnacle, to discuss the findings and agree on corrective measures. The root cause analysis should examine whether the deficiency is attributable to individual analyst performance, training gaps, supervisory deficiencies, system or tool limitations, or other factors.
• Below 90% Aggregate Accuracy (Two Consecutive Months): If the aggregate Pinnacle team accuracy rate falls below 90% for two consecutive calendar months, BRB shall have the right, under the MSA, to require Pinnacle to replace underperforming analysts and to reassess the adequacy of Pinnacle's pre-deployment screening and qualification process. BRB should consult with Calderwood & Harkness before exercising this right to assess the regulatory and remediation-timeline implications, as discussed further in Section XII.