1045-00002 · Calderwood & Harkness LLP · documents

novapay-compliance-remediation-letter.docx DOCUMENT Antitrust

45 / 84 ← → ✕

CONFIDENTIAL

BELMONT RIDGE BANK NATIONAL ASSOCIATION 680 Lexington Avenue, 22nd Floor New York, NY 10022

February 14, 2025

Via Overnight Courier and Email

Mr. Ethan Garrison Chief Executive Officer NovaPay Technologies Inc. 450 Mission Street, Suite 1200 San Francisco, CA 94105

Re: BSA/AML and Sanctions Compliance Remediation — Demand for Enhanced Cooperation, Data Sharing, and Compliance Commitments

Dear Mr. Garrison:

I. Purpose

I write on behalf of Belmont Ridge Bank National Association ("Belmont Ridge" or "BRB"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), to NovaPay Technologies Inc. ("NovaPay"), a Delaware corporation. As you are aware, NovaPay has operated as a Banking-as-a-Service ("BaaS") partner through BRB's national bank charter since NovaPay's onboarding in 2021, pursuant to the BaaS Program Agreement entered into between BRB and NovaPay dated as of June 7, 2021 (as amended and supplemented from time to time, the "BaaS Program Agreement").

The purpose of this letter is to formally notify NovaPay of significant compliance deficiencies identified in connection with NovaPay's BaaS channel and to demand enhanced cooperation, data sharing, and compliance commitments from NovaPay as part of BRB's comprehensive Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") sanctions compliance remediation program. This letter is issued pursuant to BRB's rights under the BaaS Program Agreement and its regulatory obligations as the chartering institution. While this letter references certain regulatory matters to the extent necessary to explain the basis for the cooperation obligations demanded herein, it is not intended to disclose privileged regulatory communications beyond what is reasonably required for NovaPay to understand and fulfill its cooperation duties.

BRB expects NovaPay to treat this correspondence and the matters described herein with the utmost seriousness and to respond promptly and comprehensively. The regulatory stakes for both parties are considerable, and the timeline for remediation is aggressive but non-negotiable.

II. Background — Regulatory Context

BRB has been the subject of a targeted BSA/AML examination conducted by the Office of the Comptroller of the Currency ("OCC") over the period from March 2024 through September 2024. The examination encompassed a comprehensive review of BRB's BSA/AML compliance program, including its OFAC sanctions screening infrastructure, suspicious activity monitoring and reporting processes, customer due diligence ("CDD") and enhanced due diligence ("EDD") procedures, and the Bank's oversight of third-party relationships — including, in particular, its BaaS partner channels.

As a result of the examination, the OCC issued Consent Order No. OCC-2025-003, effective January 15, 2025 (the "Consent Order"), which identified significant deficiencies in BRB's BSA/AML compliance program. The Consent Order addresses, among other matters, deficiencies in OFAC sanctions screening, suspicious activity monitoring and Suspicious Activity Report ("SAR") filing practices, and customer due diligence — each of which implicates activities conducted through BRB's BaaS partner channels.

Under the terms of the Consent Order, BRB is required to undertake a comprehensive remediation of its BSA/AML and sanctions compliance program within specified deadlines, with full implementation of all corrective actions required by February 15, 2026. BRB's Board of Directors and senior management bear responsibility for ensuring compliance with the Consent Order's requirements, and BRB is subject to ongoing supervisory oversight and reporting obligations to the OCC throughout the remediation period.

In furtherance of the remediation program, BRB has engaged Calderwood & Harkness LLP as outside regulatory counsel to advise BRB on all aspects of the remediation, and Thornfield Consulting Group LLC as the OCC-mandated independent consultant to guide, assess, and validate the remediation program. These engagements represent a critical component of BRB's compliance infrastructure going forward, and NovaPay's cooperation with both Calderwood & Harkness LLP and Thornfield Consulting Group LLC, as described in this letter, is essential.

It is important to emphasize a fundamental principle that governs the BRB-NovaPay relationship: as BRB's chartered banking partner, NovaPay operates under BRB's regulatory umbrella. BRB bears ultimate regulatory responsibility for all activities conducted through its national bank charter, including those of its BaaS partners. The OCC has consistently held that a national bank cannot delegate its compliance obligations through third-party arrangements, and BRB's regulatory accountability extends to the full scope of activities that NovaPay conducts on behalf of, or through, BRB's charter.

NovaPay is BRB's largest BaaS partner by transaction volume. In calendar year 2024, NovaPay accounted for approximately 41% of total BaaS transaction volume processed through BRB's charter — approximately $30.5 billion of $74.3 billion in total BaaS volume. NovaPay's platform currently serves approximately 2.1 million end-user accounts. Given the scale and significance of NovaPay's operations within BRB's charter, NovaPay's full and timely cooperation in the remediation program is not merely desirable — it is indispensable.

III. Identification of Specific Compliance Deficiencies Related to NovaPay

BRB has identified the following specific compliance deficiencies that directly involve or significantly implicate NovaPay's BaaS channel. These deficiencies are consistent with the findings described in the Consent Order, and their remediation is a priority under BRB's corrective action plan.

A. OFAC Sanctions Screening Gap

BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through NovaPay's BaaS channel. Specifically, BRB has determined that approximately 12% of NovaPay wire transfer and Automated Clearing House ("ACH") transactions were not screened against the applicable OFAC sanctions lists — including the Specially Designated Nationals and blocked Persons ("SDN") List and other OFAC-administered restricted party lists — during calendar year 2023.

To quantify the magnitude of this deficiency: this screening gap affected approximately 3,800,000 transactions out of approximately 31,700,000 total NovaPay transactions processed through BRB's charter in CY 2023 (3,800,000 ÷ 31,700,000 ≈ 12.0%). These unscreened transactions spanned wire transfers and ACH payments across a range of domestic and cross-border payment flows, all of which were required to be screened under BRB's OFAC compliance program and applicable federal law and regulations, including 31 C.F.R. Part 501 et seq.

The OFAC sanctions screening gap was identified as a core deficiency in the Consent Order. Moreover, the root causes of the screening gap trace back to a prior Matter Requiring Immediate Attention ("MRIA") issued by the OCC in November 2023 specifically concerning OFAC screening gaps in BRB's BaaS transaction processing environment. Despite that MRIA, BRB was unable to achieve full screening coverage during the examination period, in part due to data integration challenges with NovaPay's transaction data feeds.

The failure to achieve 100% OFAC screening coverage for NovaPay transactions represents a serious regulatory and national security risk exposure for BRB. OFAC violations carry strict liability under the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1701 et seq., and the Trading with the Enemy Act ("TWEA"), 50 U.S.C. § 4301 et seq., and the potential penalties for screening failures of this magnitude are substantial. BRB cannot and will not tolerate any continued gap in sanctions screening coverage across any of its BaaS channels.

B. SAR Filing and Suspicious Activity Monitoring Deficiencies

BRB's transaction monitoring and SAR filing program has also been subject to significant deficiencies, many of which are closely linked to the Bank's BaaS operations. In CY 2024, BaaS-related SARs constituted approximately 54.8% of all SARs filed by BRB — specifically, 2,108 BaaS-related SARs out of 3,847 total SARs filed by BRB during the calendar year. NovaPay, as BRB's largest BaaS partner by transaction volume and end-user account base, is a significant contributor to BaaS-related suspicious activity alerts and SAR filings.

As of September 2024 — the conclusion of the OCC examination period — BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed. The Bank's average SAR filing time during the relevant period was 78 days from the date of initial alert generation, compared to the regulatory expectation of timely filing, which is generally understood to require filing within 30 days of initial detection of facts that may constitute a basis for a SAR. This backlog and the extended filing timelines represent a material deficiency in BRB's compliance program as cited in the Consent Order.

BRB's internal review has identified that deficiencies in NovaPay's transaction data feeds — including incomplete or delayed transmission of transaction metadata, inconsistent formatting of data fields, and gaps in the provision of customer behavioral data — contributed to monitoring challenges, false-negative alert suppression, and delays in alert investigation and disposition. NovaPay's full cooperation in remediating these data quality and data sharing deficiencies is therefore essential to BRB's ability to meet its SAR-related remediation obligations under the Consent Order.

C. CDD/EDD Deficiencies

The OCC examination further identified that approximately 47,000 high-risk customer accounts across BRB's BaaS channels lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation as required under the Bank Secrecy Act, 31 U.S.C. § 5318(l), and the OCC's implementing regulations, including the CDD Rule at 31 C.F.R. § 1010.230. These documentation deficiencies encompass missing or incomplete customer identification information, inadequate verification of customer identity, insufficient beneficial ownership information for applicable legal entity customers, and the absence of required EDD documentation for customers presenting elevated risk indicators.

A significant portion of these deficient accounts were onboarded through NovaPay's platform, which is unsurprising given NovaPay's approximately 2.1 million end-user account base and its status as BRB's largest BaaS partner. NovaPay serves as the primary customer-facing interface for account opening and onboarding, and NovaPay's onboarding workflows and data collection processes directly affect the quality and completeness of CDD and EDD documentation maintained in BRB's systems of record.

The inadequate CDD/EDD documentation for NovaPay-onboarded customers is a specifically cited deficiency in the Consent Order and represents a fundamental gap in BRB's know-your-customer ("KYC") infrastructure. BRB must remediate these documentation deficiencies within the timelines prescribed by the Consent Order, and NovaPay's active cooperation in this remediation effort is both a contractual obligation under the BaaS Program Agreement and a practical necessity.

IV. Demands for Enhanced Cooperation and Compliance Commitments

In light of the foregoing deficiencies and the requirements of the Consent Order, BRB hereby demands that NovaPay undertake the following enhanced cooperation measures and compliance commitments. These demands are made pursuant to BRB's rights under the BaaS Program Agreement — including, without limitation, the cooperation, audit, data access, and compliance provisions thereof — and in fulfillment of BRB's regulatory obligations as the chartering institution.

A. OFAC Screening Cooperation

NovaPay must immediately provide BRB with complete, real-time access to all transaction data streams necessary to ensure 100% OFAC sanctions screening coverage across all NovaPay wire, ACH, card, and peer-to-peer ("P2P") transfer transactions processed through BRB's charter. This includes, without limitation, access to all originator and beneficiary information, transaction reference data, payment instructions, and any intermediary routing information for each transaction.

NovaPay must cooperate fully with BRB and its technology vendor, Veridian Analytics Inc. ("Veridian"), in integrating NovaPay's transaction flows into BRB's upgraded sanctions screening platform. The upgraded platform will be based on Veridian TMS v.10.0, including an enhanced OFAC screening module designed to provide real-time, pre-execution screening of all transactions. NovaPay's technical teams must make themselves available to work directly with Veridian's integration engineers and BRB's technology operations staff to complete the integration on the timeline specified herein. NovaPay must provide all necessary application programming interface ("API") documentation, data dictionaries, schema specifications, and technical support required to effectuate this integration.

NovaPay must further support BRB's testing and validation of the OFAC screening remediation, including participation in user acceptance testing, parallel-run testing, and production validation. The target for full OFAC screening operationalization for all BaaS channels, including NovaPay's channel, is November 1, 2025. NovaPay's cooperation in meeting this target is essential.

Additionally, effective immediately upon receipt of this letter, NovaPay must not implement any new transaction types, payment channels, product features, or modifications to existing transaction flows without prior written approval from BRB's compliance team. This requirement is necessary to ensure that sanctions screening coverage is maintained and that no transactions are processed outside the scope of BRB's screening infrastructure. Any request for approval of new transaction types or product features must be submitted to BRB's Head of Fintech Partnerships, Warren Ashby, in writing, with sufficient lead time to allow for compliance review and, where applicable, screening system configuration.

B. Suspicious Activity Monitoring and SAR Cooperation

NovaPay must significantly enhance its data sharing with BRB's transaction monitoring team. Specifically, NovaPay must provide complete and timely transaction metadata, customer behavioral data, and device and geolocation information necessary for effective alert generation, investigation, and disposition. This data must be transmitted in the format, frequency, and structure specified by BRB's BSA/AML operations team, and NovaPay must work with BRB to resolve any existing data quality issues, transmission delays, or formatting inconsistencies that have been identified as contributing to monitoring deficiencies.

NovaPay must cooperate promptly and fully with BRB investigators and the temporary compliance staff deployed by Pinnacle Compliance Solutions LLC ("Pinnacle") in connection with the SAR backlog clearance project. As noted above, BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts unreviewed as of September 2024. The target for full clearance of this backlog is June 30, 2025. NovaPay's cooperation is required in providing transaction records, customer account information, supporting documentation, and explanatory context for alerts involving NovaPay-originated transactions or NovaPay-onboarded customers. NovaPay must also cooperate with BRB in connection with the SAR lookback project, which will involve a retrospective review of transactions and customer activity across specified lookback periods as required by the Consent Order.

NovaPay must designate a dedicated compliance liaison — an individual with appropriate seniority, authority, and BSA/AML compliance expertise — to coordinate with BRB's BSA Officer, Thomas Ikeda, and BRB's Head of Fintech Partnerships, Warren Ashby, on all suspicious activity matters arising from or related to NovaPay's BaaS channel. The compliance liaison must be available to participate in regular coordination meetings, respond to ad hoc inquiries, and serve as the primary point of contact between NovaPay and BRB's compliance function for SAR-related matters.

All responses to BRB investigative inquiries — including requests for transaction records, customer information, account documentation, and any other information relevant to the investigation of potentially suspicious activity — must be provided within forty-eight (48) hours of the date of BRB's request. Where the scope of an inquiry is such that a complete response cannot be provided within 48 hours, NovaPay must provide an interim response within 48 hours confirming receipt, describing the steps being taken to compile the requested information, and providing a definitive timeline for full response, which in no event may exceed five (5) business days.

C. CDD/EDD Remediation Cooperation

NovaPay must cooperate fully in the remediation of all NovaPay-onboarded customer accounts identified as lacking adequate CDD or EDD documentation. This remediation effort will require NovaPay to work in close coordination with BRB's CDD/EDD remediation team to identify affected accounts, develop and execute outreach strategies to collect missing documentation from existing customers, and implement corrective measures for accounts where required documentation cannot be obtained.

NovaPay must assist BRB in collecting and verifying required customer identification and beneficial ownership information for affected accounts. This assistance includes, without limitation, deploying in-app and email notifications to affected customers, facilitating the secure collection and transmission of identity documents and beneficial ownership declarations, and supporting BRB's verification processes through NovaPay's existing customer-facing channels and technology infrastructure.

NovaPay must implement enhanced onboarding procedures consistent with BRB's revised CDD/EDD Policy (the "Revised CDD/EDD Policy"), which will be provided to NovaPay separately, for all new customer accounts going forward. NovaPay's onboarding workflows, identity verification processes, and customer data collection procedures must be updated to conform fully to the requirements of the Revised CDD/EDD Policy, and NovaPay must not onboard any new customers until such updated procedures have been reviewed and approved by BRB's compliance team.

BRB's CDD/EDD remediation milestones, as established in the Consent Order's corrective action plan, require 50% completion — remediation of approximately 23,500 of the 47,000 identified deficient accounts across all BaaS channels — by July 15, 2025, and 100% completion by January 15, 2026. NovaPay's timely, active, and sustained cooperation is critical to BRB's ability to meet these milestones. Any delay or deficiency in NovaPay's cooperation that jeopardizes BRB's ability to satisfy these milestones will be viewed as a material failure of NovaPay's obligations under this letter and the BaaS Program Agreement.

D. Data Sharing and System Access

NovaPay must provide BRB and its authorized agents — including Thornfield Consulting Group LLC (the OCC-mandated independent consultant), Calderwood & Harkness LLP (BRB's outside regulatory counsel), and any other consultants, auditors, or advisors retained by BRB in connection with the remediation program — with full access to NovaPay's systems, records, customer data, and transaction logs as reasonably required for the remediation program. This access must include, without limitation, read-only access to NovaPay's customer relationship management systems, transaction processing platforms, onboarding databases, and compliance case management systems, as well as the ability to extract and analyze data in formats compatible with BRB's and Thornfield's analytical tools.

NovaPay must cooperate fully with Thornfield Consulting Group LLC's on-site assessment, which is scheduled to commence on March 1, 2025. The on-site assessment will involve review of NovaPay's systems, processes, and controls as they relate to the BaaS channel and BRB's compliance program. NovaPay must respond to all information requests and interview requests from Thornfield in a timely manner, and NovaPay must make its personnel — including members of its technology, operations, compliance, product, and executive teams — available for interviews and working sessions as requested.

NovaPay must maintain and provide to BRB complete records of all customer onboarding activities, transaction processing operations, and compliance-related activities conducted through BRB's charter. These records must be maintained in a manner that allows for efficient retrieval and production, and NovaPay must ensure that its record retention practices comply with the requirements of the BaaS Program Agreement and applicable law and regulation, including the recordkeeping requirements of the Bank Secrecy Act and its implementing regulations.

E. Compliance Program Enhancements

NovaPay must implement internal BSA/AML and OFAC compliance training for all NovaPay personnel involved in customer onboarding, transaction processing, customer service, and any other function that touches upon activities conducted through BRB's charter. This training must be conducted in coordination with BRB's enterprise-wide BSA/AML and OFAC training plan, and the training curriculum and materials must be reviewed and approved by BRB's BSA Officer, Thomas Ikeda, prior to deployment. Training must be completed by all relevant NovaPay personnel within sixty (60) days of BRB's approval of the training program, and NovaPay must maintain records of training completion and provide such records to BRB upon request.

NovaPay must adopt and comply with the enhanced compliance addendum to the BaaS Program Agreement (the "Compliance Addendum"), which will be provided to NovaPay separately by BRB. The Compliance Addendum will incorporate strengthened BSA/AML and OFAC obligations, enhanced audit rights for BRB and its designees, compliance performance standards and key performance indicators, escalation and notification requirements, and consequences for non-compliance. NovaPay's execution of the Compliance Addendum will be required as a condition of NovaPay's continued participation in BRB's BaaS program.

NovaPay must submit to periodic compliance testing and audits conducted by BRB or BRB's designees, including Caldera & Pope LLP (BRB's external BSA/AML testing firm) and Thornfield Consulting Group LLC, at such times and with such frequency as BRB determines to be appropriate. NovaPay must cooperate fully with such testing and audits, including by providing requested documentation, making personnel available for interviews, and granting system access as required. The results of such testing and audits may be shared with the OCC and other applicable regulators in connection with BRB's supervisory reporting obligations.

F. Reporting Obligations

NovaPay must provide BRB with monthly compliance status reports detailing, at a minimum, the following information for the applicable reporting period:

(i) total transaction volumes by transaction type (wire, ACH, card, P2P) processed through BRB's charter;

(ii) OFAC sanctions screening coverage rates, including the number and percentage of transactions screened and any identified screening gaps or exceptions;

(iii) customer onboarding metrics, including the number of new accounts opened, the completion rate for CDD and EDD documentation, and any identified onboarding deficiencies;

(iv) a summary of any compliance incidents, including potential OFAC matches, suspicious activity referrals, customer complaints related to compliance matters, and any operational errors affecting transaction processing or screening; and

(v) the status of NovaPay's implementation of the remediation measures and compliance commitments described in this letter.

These monthly reports must be submitted to BRB's BSA Officer, Thomas Ikeda, and BRB's Head of Fintech Partnerships, Warren Ashby, no later than the tenth (10th) calendar day of each month for the immediately preceding month, commencing with the report for March 2025 (due April 10, 2025).

In addition, NovaPay must immediately report to BRB — without delay and in no event later than twenty-four (24) hours after discovery — any known or suspected sanctions violations, suspicious activity, compliance failures, data breaches, or system malfunctions that may affect the integrity of BRB's compliance program or the processing of transactions through BRB's charter. Such immediate reports must be directed to Thomas Ikeda, BSA Officer, and Gregory Nardone, General Counsel, by both telephone and email.

V. Timeline and Deadlines

The remediation program operates under strict regulatory deadlines imposed by the Consent Order, and NovaPay's cooperation must be timely, consistent, and sustained throughout the remediation period. BRB requires NovaPay to adhere to the following timeline:

Written Confirmation of Commitment. NovaPay must confirm in writing its commitment to all cooperation and compliance requirements set forth in this letter within fifteen (15) business days of receipt of this letter. The written confirmation must be signed by NovaPay's Chief Executive Officer and must affirm NovaPay's understanding of and agreement to each of the obligations described herein.

Designation of Compliance Liaison. NovaPay must designate its dedicated compliance liaison — with the qualifications described in Section IV.B above — within ten (10) business days of receipt of this letter, and must provide the liaison's name, title, contact information, and relevant qualifications to BRB's BSA Officer and Head of Fintech Partnerships.

Key Remediation Milestones Requiring NovaPay Cooperation. The following milestones represent critical dates in BRB's remediation program, each of which requires NovaPay's active cooperation:

BRB expects NovaPay to work backward from each milestone to ensure that all prerequisites, technical work, data production, and coordination activities are completed well in advance of the applicable deadline. BRB will not accept last-minute cooperation or incomplete deliverables as a substitute for sustained, proactive engagement throughout the remediation period.

VI. Consequences of Non-Cooperation

BRB wishes to be transparent regarding the potential consequences of NovaPay's failure to provide the requested cooperation and comply with the commitments demanded in this letter. Failure to cooperate may result in actions by BRB including, but not limited to, the following:

(a) Suspension or Restriction of BaaS Activities. BRB may suspend or restrict NovaPay's ability to onboard new customers, launch new products or features, or process certain transaction types through BRB's charter. Such restrictions may be imposed immediately and without prior notice if BRB determines that continued unrestricted activity poses an unacceptable compliance or regulatory risk.

(b) Enhanced Oversight Measures. BRB may impose enhanced oversight measures on NovaPay's BaaS channel, including transaction volume limitations, mandatory pre-approval requirements for specified transaction types, enhanced monitoring and reporting requirements, and the placement of BRB compliance personnel within NovaPay's operations.

(c) Termination of the BaaS Program Agreement. BRB may terminate the BaaS Program Agreement between BRB and NovaPay, in accordance with the agreement's termination provisions, including any applicable cure periods and wind-down procedures. Termination of the BaaS Program Agreement would result in the orderly cessation of NovaPay's ability to operate through BRB's national bank charter.

(d) Regulatory Referral. BRB may refer compliance failures to the OCC and other applicable regulators, including the Financial Crimes Enforcement Network ("FinCEN") and OFAC. BRB is obligated to report to the OCC any material compliance issues involving its BaaS partners, and BRB will fulfill this obligation irrespective of the status of its commercial relationship with NovaPay.

BRB's regulatory obligations under the Consent Order are paramount. BRB will take all steps necessary to ensure compliance with the Consent Order and applicable law, including restructuring or terminating BaaS partner relationships where a partner's cooperation is insufficient to support BRB's remediation objectives. BRB urges NovaPay in the strongest terms to treat this matter with the seriousness it warrants and to commit fully to the cooperation and compliance measures described in this letter.

VII. Reservation of Rights

BRB expressly reserves all rights and remedies available to it under the BaaS Program Agreement, applicable law, and regulation, including but not limited to the right to exercise all contractual remedies, seek damages, and enforce all obligations of NovaPay under the BaaS Program Agreement and any amendments or addenda thereto. Nothing in this letter, or in BRB's forbearance in exercising any right or remedy, shall be construed as a waiver of any rights, claims, or defenses that BRB may have, whether arising under the BaaS Program Agreement, at law, in equity, or otherwise.

BRB reserves the right to seek indemnification from NovaPay for all costs, losses, expenses, fines, penalties, and liabilities attributable to compliance deficiencies in NovaPay's BaaS channel, to the extent provided for under the existing BaaS Program Agreement, including the indemnification provisions contained therein. BRB's costs associated with the remediation program — including, without limitation, fees and expenses of outside counsel, consultants, temporary compliance staff, and technology enhancements — are substantial and continue to accrue. BRB will look to all available sources of recovery, including indemnification from its BaaS partners, for costs attributable to partner-related compliance deficiencies.

This letter does not constitute legal advice to NovaPay, and nothing herein should be construed as legal guidance regarding NovaPay's own regulatory obligations or potential exposure. NovaPay is strongly advised to consult its own legal counsel regarding its obligations under this letter, the BaaS Program Agreement, and applicable law and regulation.

VIII. Point of Contact

All communications regarding the matters addressed in this letter should be directed to the following individuals:

Gregory Nardone General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022

Email: gnardone@belmontridgebank.com

Telephone: (212) 554-7100

With a copy to:

Warren Ashby Head of Fintech Partnerships / BaaS Division Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022

Email: washby@belmontridgebank.com

Telephone: (212) 554-7245

And to outside counsel:

Philip Hartmann Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

Email: phartmann@calderwoodharkness.com

Telephone: (212) 819-3000

NovaPay should ensure that all correspondence, notices, and deliverables submitted in connection with this letter are directed to all three of the above contacts simultaneously unless otherwise instructed.

IX. Closing

BRB requests NovaPay's prompt acknowledgment of receipt of this letter and a written response confirming NovaPay's commitment to the cooperation and compliance requirements described herein within the fifteen (15) business day period specified above. BRB expects NovaPay to treat this matter with the urgency that the regulatory context demands. The timelines set forth in this letter are driven by binding regulatory obligations, and any delay in NovaPay's response or cooperation will directly impair BRB's ability to meet its commitments to the OCC.

BRB values its partnership with NovaPay and recognizes that the BaaS relationship has been commercially significant for both parties. BRB looks forward to NovaPay's continued partnership and cooperation in achieving full compliance with the requirements of the Consent Order and in building a stronger, more resilient compliance infrastructure for the benefit of both organizations and the customers they serve. BRB is committed to working collaboratively with NovaPay throughout the remediation process, and BRB expects the same commitment from NovaPay.

Please do not hesitate to contact me directly should you have any questions regarding this letter or the matters described herein.

Very truly yours,

BELMONT RIDGE BANK NATIONAL ASSOCIATION

By: ________

Name: Gregory Nardone

Title: General Counsel & Corporate Secretary

Date: February 14, 2025

cc: (via email)

Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA

Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA

Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA

Philip Hartmann, Calderwood & Harkness LLP

Yuki Nakamura, Calderwood & Harkness LLP

Date	Milestone
March 1, 2025	Thornfield Consulting Group on-site assessment commences; NovaPay cooperation required, including system access, document production, and personnel availability for interviews
March 31, 2025	Interim SAR backlog status report due to OCC; NovaPay must have provided all requested information for backlog clearance efforts to date
June 30, 2025	SAR backlog clearance target — full clearance of approximately 2,400 backlogged potentially suspicious activity alerts
July 15, 2025	CDD/EDD 50% remediation milestone — remediation of 23,500 of 47,000 identified deficient accounts across all BaaS channels
August 1, 2025	Veridian TMS v.10.0 deployment, including integration of NovaPay transaction flows into BRB's upgraded transaction monitoring and sanctions screening platform
November 1, 2025	Full OFAC screening operationalization for all BaaS channels, including NovaPay — achievement of 100% screening coverage
January 15, 2026	CDD/EDD 100% remediation milestone — remediation of all 47,000 identified deficient accounts
February 15, 2026	Full compliance program implementation and Consent Order self-certification to the OCC

CONFIDENTIAL
BELMONT RIDGE BANK NATIONAL ASSOCIATION 680 Lexington Avenue, 22nd Floor New York, NY 10022
February 14, 2025
Via Overnight Courier and Email
Mr. Ethan Garrison Chief Executive Officer NovaPay Technologies Inc. 450 Mission Street, Suite 1200 San Francisco, CA 94105
Re: BSA/AML and Sanctions Compliance Remediation — Demand for Enhanced Cooperation, Data Sharing, and Compliance Commitments
Dear Mr. Garrison:
I. Purpose
I write on behalf of Belmont Ridge Bank National Association ("Belmont Ridge" or "BRB"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), to NovaPay Technologies Inc. ("NovaPay"), a Delaware corporation. As you are aware, NovaPay has operated as a Banking-as-a-Service ("BaaS") partner through BRB's national bank charter since NovaPay's onboarding in 2021, pursuant to the BaaS Program Agreement entered into between BRB and NovaPay dated as of June 7, 2021 (as amended and supplemented from time to time, the "BaaS Program Agreement").
The purpose of this letter is to formally notify NovaPay of significant compliance deficiencies identified in connection with NovaPay's BaaS channel and to demand enhanced cooperation, data sharing, and compliance commitments from NovaPay as part of BRB's comprehensive Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") sanctions compliance remediation program. This letter is issued pursuant to BRB's rights under the BaaS Program Agreement and its regulatory obligations as the chartering institution. While this letter references certain regulatory matters to the extent necessary to explain the basis for the cooperation obligations demanded herein, it is not intended to disclose privileged regulatory communications beyond what is reasonably required for NovaPay to understand and fulfill its cooperation duties.
BRB expects NovaPay to treat this correspondence and the matters described herein with the utmost seriousness and to respond promptly and comprehensively. The regulatory stakes for both parties are considerable, and the timeline for remediation is aggressive but non-negotiable.
II. Background — Regulatory Context
BRB has been the subject of a targeted BSA/AML examination conducted by the Office of the Comptroller of the Currency ("OCC") over the period from March 2024 through September 2024. The examination encompassed a comprehensive review of BRB's BSA/AML compliance program, including its OFAC sanctions screening infrastructure, suspicious activity monitoring and reporting processes, customer due diligence ("CDD") and enhanced due diligence ("EDD") procedures, and the Bank's oversight of third-party relationships — including, in particular, its BaaS partner channels.
As a result of the examination, the OCC issued Consent Order No. OCC-2025-003, effective January 15, 2025 (the "Consent Order"), which identified significant deficiencies in BRB's BSA/AML compliance program. The Consent Order addresses, among other matters, deficiencies in OFAC sanctions screening, suspicious activity monitoring and Suspicious Activity Report ("SAR") filing practices, and customer due diligence — each of which implicates activities conducted through BRB's BaaS partner channels.
Under the terms of the Consent Order, BRB is required to undertake a comprehensive remediation of its BSA/AML and sanctions compliance program within specified deadlines, with full implementation of all corrective actions required by February 15, 2026. BRB's Board of Directors and senior management bear responsibility for ensuring compliance with the Consent Order's requirements, and BRB is subject to ongoing supervisory oversight and reporting obligations to the OCC throughout the remediation period.
In furtherance of the remediation program, BRB has engaged Calderwood & Harkness LLP as outside regulatory counsel to advise BRB on all aspects of the remediation, and Thornfield Consulting Group LLC as the OCC-mandated independent consultant to guide, assess, and validate the remediation program. These engagements represent a critical component of BRB's compliance infrastructure going forward, and NovaPay's cooperation with both Calderwood & Harkness LLP and Thornfield Consulting Group LLC, as described in this letter, is essential.
It is important to emphasize a fundamental principle that governs the BRB-NovaPay relationship: as BRB's chartered banking partner, NovaPay operates under BRB's regulatory umbrella. BRB bears ultimate regulatory responsibility for all activities conducted through its national bank charter, including those of its BaaS partners. The OCC has consistently held that a national bank cannot delegate its compliance obligations through third-party arrangements, and BRB's regulatory accountability extends to the full scope of activities that NovaPay conducts on behalf of, or through, BRB's charter.
NovaPay is BRB's largest BaaS partner by transaction volume. In calendar year 2024, NovaPay accounted for approximately 41% of total BaaS transaction volume processed through BRB's charter — approximately $30.5 billion of $74.3 billion in total BaaS volume. NovaPay's platform currently serves approximately 2.1 million end-user accounts. Given the scale and significance of NovaPay's operations within BRB's charter, NovaPay's full and timely cooperation in the remediation program is not merely desirable — it is indispensable.
III. Identification of Specific Compliance Deficiencies Related to NovaPay
BRB has identified the following specific compliance deficiencies that directly involve or significantly implicate NovaPay's BaaS channel. These deficiencies are consistent with the findings described in the Consent Order, and their remediation is a priority under BRB's corrective action plan.
A. OFAC Sanctions Screening Gap
BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through NovaPay's BaaS channel. Specifically, BRB has determined that approximately 12% of NovaPay wire transfer and Automated Clearing House ("ACH") transactions were not screened against the applicable OFAC sanctions lists — including the Specially Designated Nationals and blocked Persons ("SDN") List and other OFAC-administered restricted party lists — during calendar year 2023.
To quantify the magnitude of this deficiency: this screening gap affected approximately 3,800,000 transactions out of approximately 31,700,000 total NovaPay transactions processed through BRB's charter in CY 2023 (3,800,000 ÷ 31,700,000 ≈ 12.0%). These unscreened transactions spanned wire transfers and ACH payments across a range of domestic and cross-border payment flows, all of which were required to be screened under BRB's OFAC compliance program and applicable federal law and regulations, including 31 C.F.R. Part 501 et seq.
The OFAC sanctions screening gap was identified as a core deficiency in the Consent Order. Moreover, the root causes of the screening gap trace back to a prior Matter Requiring Immediate Attention ("MRIA") issued by the OCC in November 2023 specifically concerning OFAC screening gaps in BRB's BaaS transaction processing environment. Despite that MRIA, BRB was unable to achieve full screening coverage during the examination period, in part due to data integration challenges with NovaPay's transaction data feeds.
The failure to achieve 100% OFAC screening coverage for NovaPay transactions represents a serious regulatory and national security risk exposure for BRB. OFAC violations carry strict liability under the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1701 et seq., and the Trading with the Enemy Act ("TWEA"), 50 U.S.C. § 4301 et seq., and the potential penalties for screening failures of this magnitude are substantial. BRB cannot and will not tolerate any continued gap in sanctions screening coverage across any of its BaaS channels.
B. SAR Filing and Suspicious Activity Monitoring Deficiencies
BRB's transaction monitoring and SAR filing program has also been subject to significant deficiencies, many of which are closely linked to the Bank's BaaS operations. In CY 2024, BaaS-related SARs constituted approximately 54.8% of all SARs filed by BRB — specifically, 2,108 BaaS-related SARs out of 3,847 total SARs filed by BRB during the calendar year. NovaPay, as BRB's largest BaaS partner by transaction volume and end-user account base, is a significant contributor to BaaS-related suspicious activity alerts and SAR filings.
As of September 2024 — the conclusion of the OCC examination period — BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed. The Bank's average SAR filing time during the relevant period was 78 days from the date of initial alert generation, compared to the regulatory expectation of timely filing, which is generally understood to require filing within 30 days of initial detection of facts that may constitute a basis for a SAR. This backlog and the extended filing timelines represent a material deficiency in BRB's compliance program as cited in the Consent Order.
BRB's internal review has identified that deficiencies in NovaPay's transaction data feeds — including incomplete or delayed transmission of transaction metadata, inconsistent formatting of data fields, and gaps in the provision of customer behavioral data — contributed to monitoring challenges, false-negative alert suppression, and delays in alert investigation and disposition. NovaPay's full cooperation in remediating these data quality and data sharing deficiencies is therefore essential to BRB's ability to meet its SAR-related remediation obligations under the Consent Order.
C. CDD/EDD Deficiencies
The OCC examination further identified that approximately 47,000 high-risk customer accounts across BRB's BaaS channels lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation as required under the Bank Secrecy Act, 31 U.S.C. § 5318(l), and the OCC's implementing regulations, including the CDD Rule at 31 C.F.R. § 1010.230. These documentation deficiencies encompass missing or incomplete customer identification information, inadequate verification of customer identity, insufficient beneficial ownership information for applicable legal entity customers, and the absence of required EDD documentation for customers presenting elevated risk indicators.
A significant portion of these deficient accounts were onboarded through NovaPay's platform, which is unsurprising given NovaPay's approximately 2.1 million end-user account base and its status as BRB's largest BaaS partner. NovaPay serves as the primary customer-facing interface for account opening and onboarding, and NovaPay's onboarding workflows and data collection processes directly affect the quality and completeness of CDD and EDD documentation maintained in BRB's systems of record.
The inadequate CDD/EDD documentation for NovaPay-onboarded customers is a specifically cited deficiency in the Consent Order and represents a fundamental gap in BRB's know-your-customer ("KYC") infrastructure. BRB must remediate these documentation deficiencies within the timelines prescribed by the Consent Order, and NovaPay's active cooperation in this remediation effort is both a contractual obligation under the BaaS Program Agreement and a practical necessity.
IV. Demands for Enhanced Cooperation and Compliance Commitments
In light of the foregoing deficiencies and the requirements of the Consent Order, BRB hereby demands that NovaPay undertake the following enhanced cooperation measures and compliance commitments. These demands are made pursuant to BRB's rights under the BaaS Program Agreement — including, without limitation, the cooperation, audit, data access, and compliance provisions thereof — and in fulfillment of BRB's regulatory obligations as the chartering institution.
A. OFAC Screening Cooperation
NovaPay must immediately provide BRB with complete, real-time access to all transaction data streams necessary to ensure 100% OFAC sanctions screening coverage across all NovaPay wire, ACH, card, and peer-to-peer ("P2P") transfer transactions processed through BRB's charter. This includes, without limitation, access to all originator and beneficiary information, transaction reference data, payment instructions, and any intermediary routing information for each transaction.
NovaPay must cooperate fully with BRB and its technology vendor, Veridian Analytics Inc. ("Veridian"), in integrating NovaPay's transaction flows into BRB's upgraded sanctions screening platform. The upgraded platform will be based on Veridian TMS v.10.0, including an enhanced OFAC screening module designed to provide real-time, pre-execution screening of all transactions. NovaPay's technical teams must make themselves available to work directly with Veridian's integration engineers and BRB's technology operations staff to complete the integration on the timeline specified herein. NovaPay must provide all necessary application programming interface ("API") documentation, data dictionaries, schema specifications, and technical support required to effectuate this integration.
NovaPay must further support BRB's testing and validation of the OFAC screening remediation, including participation in user acceptance testing, parallel-run testing, and production validation. The target for full OFAC screening operationalization for all BaaS channels, including NovaPay's channel, is November 1, 2025. NovaPay's cooperation in meeting this target is essential.
Additionally, effective immediately upon receipt of this letter, NovaPay must not implement any new transaction types, payment channels, product features, or modifications to existing transaction flows without prior written approval from BRB's compliance team. This requirement is necessary to ensure that sanctions screening coverage is maintained and that no transactions are processed outside the scope of BRB's screening infrastructure. Any request for approval of new transaction types or product features must be submitted to BRB's Head of Fintech Partnerships, Warren Ashby, in writing, with sufficient lead time to allow for compliance review and, where applicable, screening system configuration.
B. Suspicious Activity Monitoring and SAR Cooperation
NovaPay must significantly enhance its data sharing with BRB's transaction monitoring team. Specifically, NovaPay must provide complete and timely transaction metadata, customer behavioral data, and device and geolocation information necessary for effective alert generation, investigation, and disposition. This data must be transmitted in the format, frequency, and structure specified by BRB's BSA/AML operations team, and NovaPay must work with BRB to resolve any existing data quality issues, transmission delays, or formatting inconsistencies that have been identified as contributing to monitoring deficiencies.
NovaPay must cooperate promptly and fully with BRB investigators and the temporary compliance staff deployed by Pinnacle Compliance Solutions LLC ("Pinnacle") in connection with the SAR backlog clearance project. As noted above, BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts unreviewed as of September 2024. The target for full clearance of this backlog is June 30, 2025. NovaPay's cooperation is required in providing transaction records, customer account information, supporting documentation, and explanatory context for alerts involving NovaPay-originated transactions or NovaPay-onboarded customers. NovaPay must also cooperate with BRB in connection with the SAR lookback project, which will involve a retrospective review of transactions and customer activity across specified lookback periods as required by the Consent Order.
NovaPay must designate a dedicated compliance liaison — an individual with appropriate seniority, authority, and BSA/AML compliance expertise — to coordinate with BRB's BSA Officer, Thomas Ikeda, and BRB's Head of Fintech Partnerships, Warren Ashby, on all suspicious activity matters arising from or related to NovaPay's BaaS channel. The compliance liaison must be available to participate in regular coordination meetings, respond to ad hoc inquiries, and serve as the primary point of contact between NovaPay and BRB's compliance function for SAR-related matters.
All responses to BRB investigative inquiries — including requests for transaction records, customer information, account documentation, and any other information relevant to the investigation of potentially suspicious activity — must be provided within forty-eight (48) hours of the date of BRB's request. Where the scope of an inquiry is such that a complete response cannot be provided within 48 hours, NovaPay must provide an interim response within 48 hours confirming receipt, describing the steps being taken to compile the requested information, and providing a definitive timeline for full response, which in no event may exceed five (5) business days.
C. CDD/EDD Remediation Cooperation
NovaPay must cooperate fully in the remediation of all NovaPay-onboarded customer accounts identified as lacking adequate CDD or EDD documentation. This remediation effort will require NovaPay to work in close coordination with BRB's CDD/EDD remediation team to identify affected accounts, develop and execute outreach strategies to collect missing documentation from existing customers, and implement corrective measures for accounts where required documentation cannot be obtained.
NovaPay must assist BRB in collecting and verifying required customer identification and beneficial ownership information for affected accounts. This assistance includes, without limitation, deploying in-app and email notifications to affected customers, facilitating the secure collection and transmission of identity documents and beneficial ownership declarations, and supporting BRB's verification processes through NovaPay's existing customer-facing channels and technology infrastructure.
NovaPay must implement enhanced onboarding procedures consistent with BRB's revised CDD/EDD Policy (the "Revised CDD/EDD Policy"), which will be provided to NovaPay separately, for all new customer accounts going forward. NovaPay's onboarding workflows, identity verification processes, and customer data collection procedures must be updated to conform fully to the requirements of the Revised CDD/EDD Policy, and NovaPay must not onboard any new customers until such updated procedures have been reviewed and approved by BRB's compliance team.
BRB's CDD/EDD remediation milestones, as established in the Consent Order's corrective action plan, require 50% completion — remediation of approximately 23,500 of the 47,000 identified deficient accounts across all BaaS channels — by July 15, 2025, and 100% completion by January 15, 2026. NovaPay's timely, active, and sustained cooperation is critical to BRB's ability to meet these milestones. Any delay or deficiency in NovaPay's cooperation that jeopardizes BRB's ability to satisfy these milestones will be viewed as a material failure of NovaPay's obligations under this letter and the BaaS Program Agreement.
D. Data Sharing and System Access
NovaPay must provide BRB and its authorized agents — including Thornfield Consulting Group LLC (the OCC-mandated independent consultant), Calderwood & Harkness LLP (BRB's outside regulatory counsel), and any other consultants, auditors, or advisors retained by BRB in connection with the remediation program — with full access to NovaPay's systems, records, customer data, and transaction logs as reasonably required for the remediation program. This access must include, without limitation, read-only access to NovaPay's customer relationship management systems, transaction processing platforms, onboarding databases, and compliance case management systems, as well as the ability to extract and analyze data in formats compatible with BRB's and Thornfield's analytical tools.
NovaPay must cooperate fully with Thornfield Consulting Group LLC's on-site assessment, which is scheduled to commence on March 1, 2025. The on-site assessment will involve review of NovaPay's systems, processes, and controls as they relate to the BaaS channel and BRB's compliance program. NovaPay must respond to all information requests and interview requests from Thornfield in a timely manner, and NovaPay must make its personnel — including members of its technology, operations, compliance, product, and executive teams — available for interviews and working sessions as requested.
NovaPay must maintain and provide to BRB complete records of all customer onboarding activities, transaction processing operations, and compliance-related activities conducted through BRB's charter. These records must be maintained in a manner that allows for efficient retrieval and production, and NovaPay must ensure that its record retention practices comply with the requirements of the BaaS Program Agreement and applicable law and regulation, including the recordkeeping requirements of the Bank Secrecy Act and its implementing regulations.
E. Compliance Program Enhancements
NovaPay must implement internal BSA/AML and OFAC compliance training for all NovaPay personnel involved in customer onboarding, transaction processing, customer service, and any other function that touches upon activities conducted through BRB's charter. This training must be conducted in coordination with BRB's enterprise-wide BSA/AML and OFAC training plan, and the training curriculum and materials must be reviewed and approved by BRB's BSA Officer, Thomas Ikeda, prior to deployment. Training must be completed by all relevant NovaPay personnel within sixty (60) days of BRB's approval of the training program, and NovaPay must maintain records of training completion and provide such records to BRB upon request.
NovaPay must adopt and comply with the enhanced compliance addendum to the BaaS Program Agreement (the "Compliance Addendum"), which will be provided to NovaPay separately by BRB. The Compliance Addendum will incorporate strengthened BSA/AML and OFAC obligations, enhanced audit rights for BRB and its designees, compliance performance standards and key performance indicators, escalation and notification requirements, and consequences for non-compliance. NovaPay's execution of the Compliance Addendum will be required as a condition of NovaPay's continued participation in BRB's BaaS program.
NovaPay must submit to periodic compliance testing and audits conducted by BRB or BRB's designees, including Caldera & Pope LLP (BRB's external BSA/AML testing firm) and Thornfield Consulting Group LLC, at such times and with such frequency as BRB determines to be appropriate. NovaPay must cooperate fully with such testing and audits, including by providing requested documentation, making personnel available for interviews, and granting system access as required. The results of such testing and audits may be shared with the OCC and other applicable regulators in connection with BRB's supervisory reporting obligations.
F. Reporting Obligations
NovaPay must provide BRB with monthly compliance status reports detailing, at a minimum, the following information for the applicable reporting period:
(i) total transaction volumes by transaction type (wire, ACH, card, P2P) processed through BRB's charter;
(ii) OFAC sanctions screening coverage rates, including the number and percentage of transactions screened and any identified screening gaps or exceptions;
(iii) customer onboarding metrics, including the number of new accounts opened, the completion rate for CDD and EDD documentation, and any identified onboarding deficiencies;
(iv) a summary of any compliance incidents, including potential OFAC matches, suspicious activity referrals, customer complaints related to compliance matters, and any operational errors affecting transaction processing or screening; and
(v) the status of NovaPay's implementation of the remediation measures and compliance commitments described in this letter.
These monthly reports must be submitted to BRB's BSA Officer, Thomas Ikeda, and BRB's Head of Fintech Partnerships, Warren Ashby, no later than the tenth (10th) calendar day of each month for the immediately preceding month, commencing with the report for March 2025 (due April 10, 2025).
In addition, NovaPay must immediately report to BRB — without delay and in no event later than twenty-four (24) hours after discovery — any known or suspected sanctions violations, suspicious activity, compliance failures, data breaches, or system malfunctions that may affect the integrity of BRB's compliance program or the processing of transactions through BRB's charter. Such immediate reports must be directed to Thomas Ikeda, BSA Officer, and Gregory Nardone, General Counsel, by both telephone and email.
V. Timeline and Deadlines
The remediation program operates under strict regulatory deadlines imposed by the Consent Order, and NovaPay's cooperation must be timely, consistent, and sustained throughout the remediation period. BRB requires NovaPay to adhere to the following timeline:
Written Confirmation of Commitment. NovaPay must confirm in writing its commitment to all cooperation and compliance requirements set forth in this letter within fifteen (15) business days of receipt of this letter. The written confirmation must be signed by NovaPay's Chief Executive Officer and must affirm NovaPay's understanding of and agreement to each of the obligations described herein.
Designation of Compliance Liaison. NovaPay must designate its dedicated compliance liaison — with the qualifications described in Section IV.B above — within ten (10) business days of receipt of this letter, and must provide the liaison's name, title, contact information, and relevant qualifications to BRB's BSA Officer and Head of Fintech Partnerships.
Key Remediation Milestones Requiring NovaPay Cooperation. The following milestones represent critical dates in BRB's remediation program, each of which requires NovaPay's active cooperation:
BRB expects NovaPay to work backward from each milestone to ensure that all prerequisites, technical work, data production, and coordination activities are completed well in advance of the applicable deadline. BRB will not accept last-minute cooperation or incomplete deliverables as a substitute for sustained, proactive engagement throughout the remediation period.
VI. Consequences of Non-Cooperation
BRB wishes to be transparent regarding the potential consequences of NovaPay's failure to provide the requested cooperation and comply with the commitments demanded in this letter. Failure to cooperate may result in actions by BRB including, but not limited to, the following:
(a) Suspension or Restriction of BaaS Activities. BRB may suspend or restrict NovaPay's ability to onboard new customers, launch new products or features, or process certain transaction types through BRB's charter. Such restrictions may be imposed immediately and without prior notice if BRB determines that continued unrestricted activity poses an unacceptable compliance or regulatory risk.
(b) Enhanced Oversight Measures. BRB may impose enhanced oversight measures on NovaPay's BaaS channel, including transaction volume limitations, mandatory pre-approval requirements for specified transaction types, enhanced monitoring and reporting requirements, and the placement of BRB compliance personnel within NovaPay's operations.
(c) Termination of the BaaS Program Agreement. BRB may terminate the BaaS Program Agreement between BRB and NovaPay, in accordance with the agreement's termination provisions, including any applicable cure periods and wind-down procedures. Termination of the BaaS Program Agreement would result in the orderly cessation of NovaPay's ability to operate through BRB's national bank charter.
(d) Regulatory Referral. BRB may refer compliance failures to the OCC and other applicable regulators, including the Financial Crimes Enforcement Network ("FinCEN") and OFAC. BRB is obligated to report to the OCC any material compliance issues involving its BaaS partners, and BRB will fulfill this obligation irrespective of the status of its commercial relationship with NovaPay.
BRB's regulatory obligations under the Consent Order are paramount. BRB will take all steps necessary to ensure compliance with the Consent Order and applicable law, including restructuring or terminating BaaS partner relationships where a partner's cooperation is insufficient to support BRB's remediation objectives. BRB urges NovaPay in the strongest terms to treat this matter with the seriousness it warrants and to commit fully to the cooperation and compliance measures described in this letter.
VII. Reservation of Rights
BRB expressly reserves all rights and remedies available to it under the BaaS Program Agreement, applicable law, and regulation, including but not limited to the right to exercise all contractual remedies, seek damages, and enforce all obligations of NovaPay under the BaaS Program Agreement and any amendments or addenda thereto. Nothing in this letter, or in BRB's forbearance in exercising any right or remedy, shall be construed as a waiver of any rights, claims, or defenses that BRB may have, whether arising under the BaaS Program Agreement, at law, in equity, or otherwise.
BRB reserves the right to seek indemnification from NovaPay for all costs, losses, expenses, fines, penalties, and liabilities attributable to compliance deficiencies in NovaPay's BaaS channel, to the extent provided for under the existing BaaS Program Agreement, including the indemnification provisions contained therein. BRB's costs associated with the remediation program — including, without limitation, fees and expenses of outside counsel, consultants, temporary compliance staff, and technology enhancements — are substantial and continue to accrue. BRB will look to all available sources of recovery, including indemnification from its BaaS partners, for costs attributable to partner-related compliance deficiencies.
This letter does not constitute legal advice to NovaPay, and nothing herein should be construed as legal guidance regarding NovaPay's own regulatory obligations or potential exposure. NovaPay is strongly advised to consult its own legal counsel regarding its obligations under this letter, the BaaS Program Agreement, and applicable law and regulation.
VIII. Point of Contact
All communications regarding the matters addressed in this letter should be directed to the following individuals:
Gregory Nardone General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Email: gnardone@belmontridgebank.com
Telephone: (212) 554-7100
With a copy to:
Warren Ashby Head of Fintech Partnerships / BaaS Division Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Email: washby@belmontridgebank.com
Telephone: (212) 554-7245
And to outside counsel:
Philip Hartmann Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
Email: phartmann@calderwoodharkness.com
Telephone: (212) 819-3000
NovaPay should ensure that all correspondence, notices, and deliverables submitted in connection with this letter are directed to all three of the above contacts simultaneously unless otherwise instructed.
IX. Closing
BRB requests NovaPay's prompt acknowledgment of receipt of this letter and a written response confirming NovaPay's commitment to the cooperation and compliance requirements described herein within the fifteen (15) business day period specified above. BRB expects NovaPay to treat this matter with the urgency that the regulatory context demands. The timelines set forth in this letter are driven by binding regulatory obligations, and any delay in NovaPay's response or cooperation will directly impair BRB's ability to meet its commitments to the OCC.
BRB values its partnership with NovaPay and recognizes that the BaaS relationship has been commercially significant for both parties. BRB looks forward to NovaPay's continued partnership and cooperation in achieving full compliance with the requirements of the Consent Order and in building a stronger, more resilient compliance infrastructure for the benefit of both organizations and the customers they serve. BRB is committed to working collaboratively with NovaPay throughout the remediation process, and BRB expects the same commitment from NovaPay.
Please do not hesitate to contact me directly should you have any questions regarding this letter or the matters described herein.
Very truly yours,
BELMONT RIDGE BANK NATIONAL ASSOCIATION
By: ________
Name: Gregory Nardone
Title: General Counsel & Corporate Secretary
Date: February 14, 2025
cc: (via email)
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA
Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA
Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA
Philip Hartmann, Calderwood & Harkness LLP
Yuki Nakamura, Calderwood & Harkness LLP
Date | Milestone
March 1, 2025 | Thornfield Consulting Group on-site assessment commences; NovaPay cooperation required, including system access, document production, and personnel availability for interviews
March 31, 2025 | Interim SAR backlog status report due to OCC; NovaPay must have provided all requested information for backlog clearance efforts to date
June 30, 2025 | SAR backlog clearance target — full clearance of approximately 2,400 backlogged potentially suspicious activity alerts
July 15, 2025 | CDD/EDD 50% remediation milestone — remediation of 23,500 of 47,000 identified deficient accounts across all BaaS channels
August 1, 2025 | Veridian TMS v.10.0 deployment, including integration of NovaPay transaction flows into BRB's upgraded transaction monitoring and sanctions screening platform
November 1, 2025 | Full OFAC screening operationalization for all BaaS channels, including NovaPay — achievement of 100% screening coverage
January 15, 2026 | CDD/EDD 100% remediation milestone — remediation of all 47,000 identified deficient accounts
February 15, 2026 | Full compliance program implementation and Consent Order self-certification to the OCC

CONFIDENTIAL

BELMONT RIDGE BANK NATIONAL ASSOCIATION

Record

Parties

Dates

Amounts