1045-00002 · Calderwood & Harkness LLP · documents

ofac-compliance-gap-analysis-memo.docx DOCUMENT Antitrust

47 / 84 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

This memorandum is protected by the attorney-client privilege and the work-product doctrine. It was prepared by counsel at the direction of and for the benefit of the client in connection with legal advice regarding pending regulatory matters. Unauthorized disclosure may result in waiver of applicable privileges. Do not copy, distribute, or disclose without prior written authorization from Calderwood & Harkness LLP.

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

MEMORANDUM

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to provide a comprehensive assessment of the Office of Foreign Assets Control ("OFAC") sanctions compliance program deficiencies at Belmont Ridge Bank National Association ("BRB" or the "Bank") across all business lines, as required under the Bank's remediation of OCC Consent Order No. OCC-2025-003 (the "Consent Order"). This assessment has been prepared by Calderwood & Harkness LLP ("C&H") at the direction of BRB's General Counsel and Chief Compliance Officer in order to identify, categorize, and prioritize gaps in the Bank's OFAC compliance infrastructure and to inform the development of the Comprehensive Remediation Action Plan to be submitted to the Office of the Comptroller of the Currency ("OCC") by May 15, 2025.

The context for this engagement is well known to the Bank's senior leadership. The OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024 (the "Targeted Examination"), during which examiners identified significant OFAC sanctions screening failures as one of five core deficiency categories ultimately cited in the Consent Order. The OFAC screening failures were not newly discovered during the Targeted Examination; rather, the OCC had previously identified concerns regarding the adequacy of BRB's sanctions screening integration within its transaction monitoring system in a Matter Requiring Attention ("MRA") issued in June 2022. Those concerns were subsequently escalated to a Matter Requiring Immediate Attention ("MRIA") in November 2023, which specifically cited OFAC screening gaps in BRB's Banking-as-a-Service ("BaaS") transaction flows and directed the Bank to ensure 100% screening of all transaction channels. BRB failed to adequately remediate the deficiencies identified in the MRIA under the guidance of its former outside counsel, Drayton Mercer LLP (Helen Frazier, Engagement Partner), whose engagement was terminated in January 2025.

The scope of this analysis encompasses BRB's OFAC program deficiencies across the Bank's four core business lines: retail banking, commercial lending, wealth management, and BaaS fintech partnership channels. The analysis evaluates the following program elements: screening coverage (including real-time and batch screening of all transaction types), OFAC list management (including update frequency, verification, and list coverage), interdiction and blocking procedures, escalation protocols for potential OFAC matches and violations, recordkeeping practices, governance and oversight structures, training programs, and the technology infrastructure supporting the sanctions screening program.

Key Finding. BRB's OFAC compliance program suffers from systemic deficiencies across all evaluated program elements, with deficiencies identified in all four business lines. The most critical finding is the failure to screen 100% of transactions processed through BaaS channels. Specifically, approximately 3,800,000 NovaPay Technologies Inc. wire and ACH transactions — representing approximately 12% of the 31,700,000 total NovaPay transactions processed in calendar year 2023 ("CY 2023") — were not screened against OFAC sanctions lists at any point during the transaction lifecycle. This screening gap resulted from an architectural deficiency in the API-based integration between BRB's core banking platform and NovaPay's transaction processing systems, which allowed certain transaction flows to bypass the Veridian Analytics Inc. ("Veridian") sanctions screening engine entirely. Similar, though less severe, screening gaps were identified in BRB's other BaaS partner channels, as well as in the retail banking, commercial lending, and wealth management business lines. Additional deficiencies were identified in list management, interdiction and blocking procedures, escalation protocols, recordkeeping, technology, and governance.

The Consent Order requires full OFAC screening operationalization for all BaaS channels by November 1, 2025. Meeting this deadline will require the successful completion of the planned upgrade to Veridian TMS v.10.0, as well as the implementation of interim manual screening procedures for all transaction flows currently bypassing the screening engine. C&H has identified significant execution risk associated with this deadline, as discussed in detail in Section IX of this memorandum.

This memorandum should be read in conjunction with the following companion documents, each of which addresses related aspects of BRB's regulatory remediation:

• Consent Order Analysis Memorandum (C&H, dated February 28, 2025), which provides a detailed analysis of each article of the Consent Order and the Bank's obligations thereunder;

• Regulatory Risk Assessment Memorandum (C&H, dated March 7, 2025), which addresses OFAC enforcement risk and contains a detailed analysis of whether BRB should submit a voluntary self-disclosure ("VSD") to OFAC;

• Workstream 1: OFAC Sanctions Screening Remediation Plan (C&H and Thornfield Consulting Group LLC, draft dated March 10, 2025, subject to revision); and

• Revised OFAC Compliance Policy (draft dated March 12, 2025, currently under review by C&H and BRB compliance).

Finally, we note that Thornfield Consulting Group LLC ("Thornfield") — the independent consultant retained by BRB as required by Article VII of the Consent Order — commenced its on-site assessment on March 1, 2025. The Thornfield engagement is being led by Dr. Vivian Castellano (Managing Director) and Jennifer Hwang (Director, Sanctions & OFAC Compliance). Thornfield is expected to deliver a preliminary gap assessment by April 15, 2025, which will supplement and potentially expand upon the findings in this memorandum. C&H has coordinated with Thornfield to ensure alignment of analytical frameworks and to avoid duplication of effort; however, Thornfield's assessment is independent and BRB should anticipate that Thornfield may identify additional deficiencies not addressed herein.

II. Background

A. BRB Institutional Profile

Belmont Ridge Bank National Association is a national banking association chartered by the OCC (OCC Charter No. 48271) and insured by the Federal Deposit Insurance Corporation (FDIC Certificate No. 31845). BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company listed on the New York Stock Exchange under the ticker symbol BRFG. BRFG is BRB's sole shareholder and parent company for purposes of the Bank Holding Company Act of 1956, as amended, and is subject to supervision by the Board of Governors of the Federal Reserve System.

BRB is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. The Bank employs approximately 5,800 full-time equivalent employees across its operating divisions.

BRB operates through four core business lines, each of which is relevant to the OFAC compliance program assessment:

Retail Banking. BRB operates a retail banking division that offers consumer deposit accounts, consumer lending products (including mortgage origination, home equity lines of credit, and personal loans), and related services. The retail banking division serves customers primarily through a network of 87 branches concentrated in the New York metropolitan area, as well as through digital banking channels (online banking portal and mobile application). Retail banking remains BRB's largest business line by deposit base but has been a declining share of overall revenue as the BaaS division has grown.

Commercial Lending. BRB's commercial lending division provides credit facilities, term loans, lines of credit, trade finance products, and related treasury management services to middle-market and mid-corporate borrowers. The commercial lending portfolio totaled approximately $12.3 billion in outstanding commitments as of December 31, 2024. Trade finance activities, which present elevated OFAC risk due to their cross-border nature, represent approximately $1.8 billion of the commercial lending portfolio.

Wealth Management. BRB's wealth management division provides investment advisory services, trust administration, estate planning, and custodial services to high-net-worth individuals, families, and institutional clients. Total assets under management as of December 31, 2024, were approximately $8.6 billion, across approximately 4,200 individual, trust, and entity accounts. The wealth management division includes a significant number of accounts with international beneficiaries or cross-border transaction activity.

Banking-as-a-Service (BaaS) Fintech Partnerships. BRB's BaaS division, which has experienced rapid growth since its establishment in 2021, provides banking infrastructure services — including deposit accounts, payment processing, card issuance, and lending capabilities — to fintech companies that operate consumer- and business-facing financial products under BRB's national bank charter. As of the date of this memorandum, BRB maintains 14 active BaaS fintech sponsor partnerships. BaaS division revenue for CY 2024 totaled $127.4 million, and total BaaS transaction volume for CY 2024 was approximately $74.3 billion. The BaaS division has been BRB's fastest-growing business line and a significant contributor to BRFG's overall revenue growth, but it is also the source of the most critical OFAC compliance deficiencies identified in the Consent Order and in this memorandum.

The relative scale of the BaaS division is important context for the findings in this memorandum. BRB onboarded its first BaaS partner in 2021 and expanded rapidly to 14 active partners within approximately three years. This pace of growth — which generated significant revenue and supported BRFG's stock valuation — substantially outpaced the development of the Bank's compliance infrastructure for BaaS-originated transactions, including OFAC sanctions screening capabilities.

B. Regulatory History Relevant to OFAC

The OFAC compliance deficiencies that are the subject of this memorandum have a regulatory history that predates the January 2025 Consent Order by more than two years. The following timeline summarizes the key supervisory actions and events:

June 2022 — OCC Matter Requiring Attention (MRA). In connection with a regularly scheduled BSA/AML supervisory review, the OCC issued an MRA to BRB regarding deficiencies in BSA/AML transaction monitoring. While the MRA was primarily focused on the adequacy of BRB's transaction monitoring system for suspicious activity detection, the OCC's supervisory letter included specific observations about the adequacy of sanctions screening integration within the transaction monitoring system. The MRA noted that the integration between the Veridian TMS platform and BRB's payment processing infrastructure had not been fully validated, and recommended that BRB conduct a comprehensive review of sanctions screening coverage across all transaction channels. BRB's management responded to the MRA with a corrective action plan that included a commitment to review sanctions screening coverage; however, as discussed below, the review was not completed in a manner that addressed the deficiencies later identified by the OCC.

November 2023 — OCC Matter Requiring Immediate Attention (MRIA). The OCC escalated its supervisory concerns by issuing an MRIA specifically directed at OFAC screening gaps in BRB's BaaS transaction flows. The MRIA cited evidence that certain BaaS partner transaction channels were not subject to comprehensive OFAC sanctions screening, and directed BRB to take immediate steps to ensure 100% screening of all transaction channels within 90 days. The MRIA represented a significant escalation from the June 2022 MRA and reflected the OCC's view that BRB had not adequately addressed the previously identified concerns. BRB's then-outside counsel, Drayton Mercer LLP (Helen Frazier, Engagement Partner), was engaged to assist with the remediation effort, but — as discussed further below — the remediation was not successful.

March 2024 – September 2024 — OCC Targeted BSA/AML Examination. The OCC commenced a targeted BSA/AML examination of BRB, during which the OFAC screening failures first identified in the November 2023 MRIA were confirmed and the scope of the screening gaps was expanded upon. The Targeted Examination revealed that the screening gaps in BaaS channels were more extensive than previously understood, and identified additional deficiencies in list management, interdiction procedures, escalation protocols, recordkeeping, technology, and governance. The examination results formed the factual basis for the Consent Order.

September 2024 — Caldera & Pope LLP Independent BSA/AML Test. Concurrently with the OCC's Targeted Examination, Caldera & Pope LLP (Franklin Dorsey, Engagement Partner) completed an independent BSA/AML test of BRB's compliance program, as required under BRB's existing BSA/AML independent testing obligations. The Caldera & Pope report identified multiple OFAC-related deficiencies that echoed the OCC's findings, including deficiencies in screening coverage for BaaS channels, list management practices, audit trail capabilities of the Veridian TMS platform, and recordkeeping standards for blocking and rejection events. The Caldera & Pope findings are referenced throughout this memorandum where relevant and are summarized in Appendix C.

January 15, 2025 — OCC Consent Order No. OCC-2025-003. The OCC issued the Consent Order, which cited OFAC sanctions screening failures as the first of five core deficiency categories. The Consent Order assessed a civil money penalty of $14.5 million (due March 16, 2025) and imposed detailed remediation requirements across all five deficiency categories, including specific deadlines for OFAC screening operationalization. Article III of the Consent Order addresses OFAC screening and list management requirements, and mandates full operationalization of OFAC screening for all BaaS channels by November 1, 2025. Article V addresses governance and oversight requirements, including the establishment of a Board-level Compliance Committee and OFAC-specific Board reporting. Article VII requires the engagement of an independent consultant to validate the Bank's remediation efforts.

January 2025 — Termination of Drayton Mercer LLP. Following the issuance of the Consent Order, BRB terminated the engagement of Drayton Mercer LLP (Helen Frazier, former lead partner) as outside regulatory counsel. The decision to terminate Drayton Mercer was based on BRB management's assessment that the prior firm had not effectively managed the remediation of the November 2023 MRIA or adequately prepared BRB for the Targeted Examination, contributing to the escalation from an MRIA to a Consent Order.

February 10, 2025 — Engagement of Calderwood & Harkness LLP. Calderwood & Harkness LLP was engaged as replacement outside counsel for BRB's regulatory remediation. C&H's engagement encompasses the full scope of the Consent Order remediation, with Philip Hartmann serving as Responsible Partner and Yuki Nakamura serving as Lead Associate. Carlos Espinoza (Of Counsel, Banking Regulation) and Marcus Delgado (Senior Associate, Financial Services Litigation) are also assigned to the matter.

C. Current OFAC Program Structure

The following describes BRB's current OFAC compliance program structure as of the date of this memorandum:

BSA Officer / AML Program Director. Thomas Ikeda was appointed BSA Officer and AML Program Director in March 2023. In this role, Mr. Ikeda has day-to-day responsibility for the administration of BRB's BSA/AML compliance program, including OFAC sanctions compliance. Mr. Ikeda reports to the Chief Compliance Officer. Prior to joining BRB, Mr. Ikeda served as Deputy BSA Officer at a mid-size regional bank in the southeastern United States. While Mr. Ikeda is experienced in BSA/AML compliance generally, he does not possess specialized OFAC sanctions expertise, which has contributed to certain of the deficiencies identified in this memorandum.

Chief Compliance Officer. Patricia Langston was appointed Chief Compliance Officer in January 2024. Ms. Langston has executive-level oversight of the sanctions program and is a member of BRB's Management Risk Committee. Ms. Langston's appointment was made, in part, in response to the November 2023 MRIA, as BRB's prior CCO (Robert Chambers) departed the Bank in November 2023.

Chief Risk Officer. Melissa Chu serves as BRB's Chief Risk Officer, with enterprise risk management oversight that encompasses compliance risk as a category. Ms. Chu chairs BRB's Management Risk Committee and reports to the Board Risk Committee (Arthur Connelly, Lead Independent Director and Chair).

BSA/AML Department. As of January 2025, BRB's BSA/AML department consists of 62 full-time equivalent employees, including analysts, investigators, quality assurance staff, and supervisory personnel. The department is responsible for all BSA/AML functions, including transaction monitoring, suspicious activity reporting, customer due diligence, and OFAC sanctions screening. There is no dedicated OFAC sanctions compliance team within the department; rather, OFAC screening responsibilities are distributed among general BSA/AML analysts. Under the remediation plan, the department is expected to grow to 77 FTEs post-remediation. In addition, BRB has engaged Pinnacle Compliance Solutions LLC to provide 30 temporary FTEs during the remediation period to supplement existing staff capacity, with an expected engagement period through December 2025.

OFAC Screening Technology. BRB's primary OFAC sanctions screening platform is the Veridian Analytics Inc. ("Veridian") sanctions screening module, which is integrated within the Veridian Transaction Monitoring System v.8.3 ("TMS v.8.3"). The Veridian platform is operated under Contract No. VA-BRB-2023-0044, which has a current annual contract value ("ACV") of $4.1 million per year under a three-year term ending December 2026. The Veridian TMS v.8.3 platform processes transaction data from BRB's core banking system and screens it against OFAC sanctions lists using fuzzy matching algorithms, name transliteration logic, and alias matching capabilities. As discussed in detail in Section IX of this memorandum, the platform has significant limitations that contribute to the identified deficiencies.

OFAC Screening Statistics (CY 2024). In CY 2024, BRB's OFAC screening system generated 14,320 screening hits (i.e., transactions or customers flagged as potential matches to OFAC sanctions lists). Of these 14,320 hits, 12 were confirmed as true matches requiring blocking or rejection actions. The remaining 14,308 hits were dispositioned as false positives after analyst review. This yields a false-positive rate of approximately 99.9% ((14,320 − 12) ÷ 14,320). As discussed further in Section IX.A, this extremely high false-positive rate is itself a deficiency, as it strains analyst resources and may contribute to alert fatigue that increases the risk of a true match being incorrectly cleared.

III. Methodology

Calderwood & Harkness's analysis of BRB's OFAC compliance program deficiencies was conducted over a period of approximately four weeks, from February 14, 2025 through March 12, 2025, and was based on the following sources and activities:

Documentary Review. C&H reviewed the following categories of documents and materials in connection with this analysis:

(a) OCC Consent Order No. OCC-2025-003, issued January 15, 2025, including the Statement of Facts and all articles and exhibits thereto.

(b) Underlying OCC examination workpapers from the Targeted Examination (March 2024 – September 2024), to the extent made available to counsel by the OCC and BRB.

(c) Prior OCC supervisory correspondence, including the June 2022 MRA, the November 2023 MRIA, and BRB's management responses thereto.

(d) Caldera & Pope LLP's September 2024 BSA/AML independent test report (Franklin Dorsey, Engagement Partner), including all OFAC-related findings, observations, and recommendations contained therein.

(e) BRB's existing OFAC compliance policies, procedures, and manuals, including the OFAC Compliance Policy (last revised 2020), the Sanctions Screening Procedures Manual (last revised 2022), and the BSA/AML Department Standard Operating Procedures.

(f) Technical documentation related to the Veridian TMS v.8.3 sanctions screening module, including the system configuration settings, screening algorithm parameters, list management configuration, API integration specifications, and system architecture documentation.

(g) BaaS partner agreements and related documentation for BRB's three largest BaaS partners: NovaPay Technologies Inc. (Master Services Agreement dated June 15, 2021, Ethan Garrison, CEO), FairLend Digital LLC (Sponsor Bank Agreement dated February 1, 2022, Aisha Okonkwo, CEO), and VaultEdge Inc. (BaaS Partnership Agreement dated March 10, 2023, Marcus Tan, CEO).

(h) Transaction flow documentation for BaaS partner channels, including API specifications, data flow diagrams, and integration architecture documentation.

(i) OFAC blocking and reject reports filed by BRB for CY 2023 and CY 2024, including 10-business-day blocking reports and annual blocked property reports.

(j) BRB's OFAC annual reports to regulators for CY 2023 and CY 2024.

(k) Transaction data and screening statistics for all business lines (retail banking, commercial lending, wealth management, and BaaS) for CY 2023 and CY 2024, including aggregate transaction volumes, screening hit volumes, true-match rates, and false-positive rates.

(l) Board of Directors meeting minutes, Audit Committee meeting minutes, and Risk Committee meeting minutes for the period January 2022 through February 2025.

(m) Organizational charts, position descriptions, and staffing plans for the BSA/AML department and the BaaS division.

(n) Training records and curricula for OFAC-related training programs for CY 2023 and CY 2024.

Personnel Interviews. C&H conducted in-person and videoconference interviews with the following BRB personnel over the course of the analysis period:

(a) Thomas Ikeda, BSA Officer / AML Program Director — interviewed on February 17, 2025 and March 3, 2025.

(b) Patricia Langston, Chief Compliance Officer — interviewed on February 18, 2025 and March 5, 2025.

(d) Linda Petrosian, Chief Information Officer / Chief Technology Officer — interviewed on February 21, 2025 and March 6, 2025.

(e) Members of the sanctions screening operations team within the BSA/AML department — group interview conducted on February 24, 2025, with individual follow-up interviews as needed.

Technical Assessment. With the assistance of BRB's IT department and in coordination with Veridian Analytics, C&H conducted a technical assessment of the Veridian TMS v.8.3 sanctions screening module configuration and integration architecture. This assessment included a review of the API endpoints through which BaaS partner transaction data is ingested into BRB's payment processing system, identification of the points at which screening is triggered (or fails to be triggered), and analysis of the screening engine's list management, alert generation, and dispositioning capabilities.

Transaction Data Analysis. C&H analyzed aggregate and sampled transaction data for all four business lines for CY 2023 and CY 2024. For the BaaS channel, the analysis included a partner-by-partner assessment of transaction volumes and screening coverage rates for BRB's three largest partners (NovaPay, FairLend Digital, and VaultEdge), as well as a preliminary assessment of the remaining 11 partners.

Limitations. This memorandum is based on information available to C&H as of the date hereof. Our analysis relied in significant part on data and documentation provided by BRB personnel and systems; we have not independently verified the accuracy or completeness of all underlying data. Thornfield Consulting Group LLC's independent assessment, which commenced on March 1, 2025 and is expected to yield preliminary findings by April 15, 2025, may identify additional deficiencies not addressed in this memorandum. To the extent Thornfield's findings expand upon or differ from the findings set forth herein, C&H will issue a supplemental memorandum addressing any material differences and their implications for the remediation plan.

IV. OFAC Sanctions Screening Coverage Deficiencies

Screening coverage — the extent to which BRB's OFAC sanctions screening system captures and screens all relevant transactions, customer records, and counterparty data against applicable OFAC sanctions lists — is the foundational element of an effective OFAC compliance program. OFAC's guidance makes clear that a screening program must be designed to ensure that all transactions are screened before they are processed and that screening must be conducted on a real-time or near-real-time basis for high-risk transaction types. The following subsections detail the screening coverage deficiencies identified by C&H across BRB's business lines.

A. BaaS Channel Screening Gaps — Overview

Critical finding: BRB's OFAC screening system failed to screen 100% of transactions processed through its BaaS fintech partner channels. This is the most significant deficiency identified in the Consent Order and in this analysis. The failure to achieve comprehensive screening coverage in BaaS channels is a systemic, architectural deficiency rather than an isolated incident or a processing error.

The root cause of the BaaS screening gap is straightforward to identify but reflects a fundamental failure of BRB's compliance infrastructure to keep pace with the growth of its BaaS business. BaaS partner transaction flows were integrated into BRB's core banking platform through a series of API-based connections that were designed to optimize transaction processing speed and throughput. In several instances, these API connections routed transactions directly from the partner's platform to BRB's payment processing system without triggering the Veridian sanctions screening engine. The screening architecture within Veridian TMS v.8.3 was originally designed for BRB's legacy retail and commercial banking channels, which utilize standardized transaction processing pathways that route all transactions through the screening queue. When BaaS partnerships were onboarded beginning in 2021, the integration specifications for each partner were developed by BRB's technology team in coordination with each partner's development team, but without adequate input from the BSA/AML department or a formal compliance review of the screening implications of the proposed integration architecture.

Compounding this architectural deficiency, the model validation for the Veridian TMS v.8.3 sanctions screening module had not been independently validated since March 2021 — more than three years prior to the commencement of the OCC's Targeted Examination. Tuning parameters for the screening algorithm (including fuzzy matching thresholds, name transliteration rules, and alias matching sensitivity) were last updated in October 2022. The absence of periodic model validation meant that the screening gap in BaaS channels was not detected by automated controls, quality assurance processes, or independent testing until the OCC's Targeted Examination and the Caldera & Pope independent test brought it to light. Had BRB conducted a comprehensive model validation at any point after the first BaaS partner (NovaPay) was onboarded in 2021, the screening bypass issue should have been identified and could have been remediated before it grew to the scale now documented.

The following subsections address the screening gaps identified for each of BRB's three largest BaaS partners — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — as well as a summary assessment of the remaining 11 BaaS partners and the screening deficiencies identified in BRB's legacy business lines (retail banking, commercial lending, and wealth management).

B. NovaPay Technologies Inc. — Detailed Screening Gap Analysis

NovaPay Technologies Inc. ("NovaPay") is BRB's largest BaaS partner by transaction volume, representing approximately 41% of total BaaS transaction volume. In CY 2024, NovaPay transactions processed through BRB totaled approximately $30.5 billion of the $74.3 billion in total BaaS transaction volume. NovaPay was the first BaaS partner onboarded to BRB's charter, with the initial partnership agreement executed in June 2021 and transaction processing commencing in September 2021.

NovaPay operates a consumer payments and peer-to-peer ("P2P") transfer application that enables its approximately 2.1 million end-user accountholders to conduct domestic and international wire transfers, ACH transfers, and real-time P2P payments. NovaPay's platform interfaces with BRB's core banking system through a suite of APIs that enable account opening, funding, payment initiation, and settlement. The high volume and velocity of NovaPay's transaction flows — particularly the P2P transfer feature, which processes a significant number of low-dollar, high-frequency transactions — make NovaPay's channel the most operationally complex and risk-intensive of BRB's BaaS partnerships from an OFAC screening perspective.

Screening Gap. C&H's analysis confirmed the findings of the OCC's Targeted Examination: approximately 3,800,000 NovaPay wire and ACH transactions were not screened against OFAC sanctions lists in CY 2023. This figure represents approximately 12% of the 31,700,000 total NovaPay transactions processed through BRB during that calendar year. The 3.8 million unscreened transactions include a mix of domestic ACH credit and debit transactions, domestic wire transfers, and international wire transfers. While the precise breakdown between transaction types within the 3.8 million unscreened transactions has not yet been fully disaggregated (and will be the subject of further analysis by Thornfield Consulting), C&H's preliminary assessment indicates that the unscreened transactions include a non-trivial number of international wire transfers, which present the highest inherent OFAC risk of any transaction type.

Cause. The screening gap resulted from a specific architectural deficiency in the integration between NovaPay's platform and BRB's payment processing system. NovaPay's ACH batch file processing and certain real-time wire initiation flows were routed through an API endpoint (designated in BRB's integration documentation as the "NP-FAST" endpoint) that connected directly to BRB's payment processing system without triggering the Veridian screening queue. The NP-FAST endpoint was designed to support NovaPay's requirement for high-speed, low-latency transaction processing, particularly for its P2P transfer feature, which NovaPay marketed to consumers as providing "instant" fund availability. The integration specification document for NovaPay, which C&H reviewed, confirmed that the screening bypass was present in the original integration architecture from the time of NovaPay's initial onboarding in 2021. There is no evidence in the available documentation that the screening bypass was a deliberate design decision by any individual at BRB; rather, it appears to have been an oversight resulting from the failure to include BSA/AML compliance personnel in the integration design process.

The screening bypass did not affect all NovaPay transactions. Transactions processed through other API endpoints (including the standard payment initiation endpoint used for scheduled ACH transfers and certain wire transfers) were routed through the Veridian screening queue as expected. The NP-FAST endpoint was used for a subset of NovaPay transactions — specifically, ACH batch files submitted during off-peak processing windows and real-time wire initiations processed through NovaPay's expedited transfer feature — which collectively accounted for the approximately 12% of NovaPay transactions that were not screened.

Impact. The 3.8 million unscreened NovaPay transactions in CY 2023 represent the single most significant gap in BRB's OFAC compliance program. These transactions were processed and settled without any OFAC screening, meaning that BRB has no assurance that none of these transactions involved sanctioned parties, sanctioned jurisdictions, or property subject to blocking requirements. The absence of screening creates potential liability for sanctions violations if retrospective analysis reveals that any of the unscreened transactions involved parties on OFAC sanctions lists or property in which blocked persons had an interest. The potential liability extends beyond OFAC civil penalties to include potential criminal liability under the International Emergency Economic Powers Act ("IEEPA") if any transactions involved willful sanctions violations.

NovaPay's 41% share of BaaS transaction volume makes this the single largest exposure point for OFAC risk at BRB. The concentration of the screening gap in BRB's largest BaaS partner amplifies both the quantitative scope of the deficiency and the regulatory and enforcement significance of the finding.

C&H notes that the CY 2023 screening gap figure of 3.8 million transactions is the figure confirmed by the OCC's Targeted Examination. Similar screening gaps likely existed in CY 2022 (from NovaPay's onboarding in September 2021 through December 2022) and in CY 2024 (prior to the implementation of interim remediation measures in late 2024). The full scope of unscreened NovaPay transactions across all periods is the subject of ongoing analysis and will be addressed in the Workstream 1 remediation plan.

C. FairLend Digital LLC — Screening Gap Assessment

FairLend Digital LLC ("FairLend") is BRB's second-largest BaaS partner, representing approximately 28% of total BaaS transaction volume in CY 2024. FairLend operates an online small-business lending platform that originates loans to small businesses through BRB's charter, with approximately $1.4 billion in loan originations processed through BRB in fiscal year 2024. FairLend was onboarded to BRB's charter in February 2022.

FairLend's platform enables small-business borrowers to apply for and receive loan products (including term loans, lines of credit, and merchant cash advance products) through an entirely digital application and funding process. When a borrower is approved for a loan, the loan disbursement is processed as an ACH credit from BRB's account to the borrower's designated bank account.

Screening Deficiency. The screening deficiency identified for FairLend is qualitatively different from the NovaPay gap. FairLend borrower customers are screened against OFAC sanctions lists at the point of customer onboarding — i.e., when the borrower first applies for and is approved for a FairLend loan product through BRB's charter. However, loan disbursement transactions processed through FairLend's origination platform are not re-screened at the time of each disbursement. This means that customers who were cleared at onboarding but were subsequently added to OFAC sanctions lists (or whose sanctions list status changed after onboarding due to new designations) would not be identified at the point of payment. This creates a temporal gap in screening coverage that is inconsistent with OFAC's expectation that screening be conducted both at the time of customer onboarding and on an ongoing, transaction-level basis.

The significance of this gap is heightened by the fact that the period between a borrower's initial onboarding and subsequent loan disbursements can span weeks or months, during which OFAC sanctions lists may be updated multiple times. For revolving credit facilities or lines of credit, the gap is particularly acute, as a borrower may draw on a credit facility over an extended period without triggering any re-screening.

Additional Concern — Beneficial Ownership Screening. C&H identified an additional concern related to FairLend's borrower customer base. FairLend originates loans to small businesses, many of which are structured as limited liability companies, partnerships, or other entity forms with one or more beneficial owners. BRB's screening of beneficial owners associated with FairLend-originated accounts was found to be inconsistent. In certain cases, the beneficial ownership information collected during FairLend's onboarding process was incomplete or was not transmitted to BRB in a format compatible with the Veridian screening system. As a result, beneficial owners of FairLend borrower entities were not consistently screened against OFAC sanctions lists, creating a risk that loans could be originated to entities whose beneficial owners are sanctioned persons.

D. VaultEdge Inc. — Screening Gap Assessment

VaultEdge Inc. ("VaultEdge") is BRB's third-largest BaaS partner, representing approximately 18% of total BaaS transaction volume in CY 2024. VaultEdge operates a digital savings and neobanking platform that offers deposit accounts, high-yield savings accounts, and basic payment services to consumers. VaultEdge has approximately 870,000 deposit accounts at BRB. VaultEdge was onboarded to BRB's charter in March 2023, making it the most recently onboarded of BRB's three largest partners.

Screening Deficiency. VaultEdge ACH credit and debit transactions — i.e., transactions between VaultEdge customer accounts and external bank accounts — are screened against OFAC sanctions lists through the Veridian screening queue. However, internal book transfers between VaultEdge customer accounts held within BRB's systems are not routed through the OFAC screening queue. These internal book transfers represent fund transfers between two VaultEdge customers who both hold accounts at BRB, where the transfer is effectuated as an internal ledger entry rather than through the ACH or wire transfer networks.

While internal book transfers present lower inherent OFAC risk than external transactions (because both the originator and beneficiary accounts are housed within BRB and were subject to screening at account opening), the complete absence of screening for this transaction type is inconsistent with regulatory expectations. OFAC does not distinguish between internal and external transactions for purposes of the sanctions screening obligation, and the OCC's examination workpapers indicate that the OCC views the failure to screen internal book transfers as a deficiency. Moreover, the risk associated with unscreened internal book transfers is not de minimis: if a VaultEdge customer is designated on an OFAC sanctions list after account opening, internal transfers to or from that customer's account would not be identified by the screening system, and the customer's property would not be blocked as required.

Because VaultEdge was onboarded in 2023 — the most recent of the three largest partners — its integration architecture reflects some improvements relative to the NovaPay integration. For example, VaultEdge's external ACH and wire transactions are routed through the standard payment initiation API endpoint that triggers the Veridian screening queue, rather than through a separate bypass endpoint like NovaPay's NP-FAST endpoint. However, the gap in internal book transfer screening demonstrates that even BRB's more recent integration designs continue to contain deficiencies.

E. Remaining 11 BaaS Partners — Summary Assessment

BRB's remaining 11 BaaS partners collectively represent approximately 13% of total BaaS transaction volume. These partners operate a range of financial products, including prepaid card programs, earned wage access products, student banking platforms, and specialized small-business financial management tools. While each of these partners has a significantly lower transaction volume than NovaPay, FairLend, or VaultEdge, the aggregate volume across the 11 smaller partners remains substantial.

C&H's preliminary review of the screening coverage for these 11 partners indicates that coverage varies significantly from partner to partner. The variation in coverage reflects the fact that each partner was onboarded through an individual integration process, with the specifics of the API connection architecture differing depending on the partner's platform requirements and the timing of onboarding. At least four of the 11 smaller partners utilize API endpoint configurations similar to NovaPay's NP-FAST endpoint and may have comparable screening bypass issues. Although these partners' lower transaction volumes result in smaller absolute numbers of unscreened transactions, the existence of any screening bypass in a BaaS partner channel is a deficiency that must be remediated.

Due to time constraints, C&H was unable to conduct a detailed, partner-by-partner screening coverage audit for all 11 smaller partners within the timeframe of this memorandum. A comprehensive, partner-by-partner screening coverage audit is recommended and is included as a priority action item in the Workstream 1 remediation plan. This audit should include a review of each partner's integration architecture, API endpoint configurations, transaction flow routing, and screening coverage rates, with the objective of identifying and cataloging all screening bypass points across the entire BaaS portfolio.

F. Retail Banking Channel

BRB's legacy retail banking channel encompasses branch-based and digital banking transactions, including consumer deposit transactions (branch deposits and withdrawals), domestic and international wire transfers, ACH transactions, consumer loan disbursements, and related payment activities. The retail banking channel utilizes standardized transaction processing pathways within BRB's core banking system that generally route all transactions through the Veridian screening engine. As a result, the retail banking channel has substantially better OFAC screening coverage than the BaaS channel.

However, C&H identified a specific screening gap in the retail channel related to the processing of certain outgoing international wire transfers initiated through BRB's online banking portal. BRB's online banking platform allows consumer customers to initiate outgoing international wire transfers through a self-service interface. When an international wire is initiated through this interface after 4:00 PM Eastern Time, the wire is queued for batch processing rather than processed in real time. Due to the configuration of the batch processing cycle, there is an approximately four- to six-hour delay between the time the wire is initiated by the customer and the time the transaction is routed to the Veridian screening queue for OFAC screening. During this window, the wire may be released to the correspondent bank or intermediary institution before OFAC screening has been completed.

While this is not a complete screening failure — the transactions are ultimately screened, albeit on a delayed basis — the delay creates a window during which an outgoing international wire could be released before a potential OFAC match is identified. This is inconsistent with OFAC's expectation of real-time, pre-release screening for high-risk transaction types such as international wire transfers. International wire transfers are among the highest-risk transaction types for OFAC compliance purposes due to their cross-border nature and the potential involvement of correspondents in sanctioned jurisdictions.

Retail channel wire volume is substantially lower risk and lower volume than BaaS channel activity, and the number of international wires affected by this delay is relatively small in the context of BRB's overall transaction volume. Nonetheless, the gap warrants remediation, and C&H recommends that BRB implement real-time screening for all outgoing international wire transfers regardless of the time of initiation. This remediation can likely be accomplished through a configuration change to the batch processing schedule for the online banking portal, which does not require the full TMS v.10.0 upgrade.

G. Commercial Lending Channel

BRB's commercial lending channel encompasses loan originations, draws on credit facilities, trade finance transactions, and related commercial banking activities. Commercial lending transactions are generally screened at the point of origination (i.e., when the borrower is first underwritten and the credit facility is established) and at each subsequent draw or disbursement. This screening approach is consistent with regulatory expectations for the origination and funding phases of the commercial lending lifecycle.

Deficiency Identified — Periodic Re-Screening. The deficiency identified in the commercial lending channel relates to the ongoing monitoring of existing commercial borrowers and their beneficial owners against updated OFAC sanctions lists. BRB's current process does not conduct systematic, automated re-screening of its commercial lending portfolio against OFAC sanctions lists on a periodic basis. Instead, BRB relies on manual, ad hoc re-screening that is triggered by credit review events (such as annual loan reviews, credit line renewals, or material adverse change events) rather than by the publication of updated OFAC sanctions lists. This means that if OFAC designates a person or entity that is an existing BRB commercial borrower or a beneficial owner of an existing borrower between credit review events, BRB may not identify the designation until the next scheduled credit review — which could be months or even a year later.

Industry best practice for institutions of BRB's size and complexity is to implement automated, list-update-driven re-screening of the entire customer base (or at minimum, the commercial lending and wealth management customer bases) each time OFAC publishes a list update. This approach ensures that newly designated persons and entities are identified promptly, regardless of the timing of the Bank's internal credit review cycle.

Trade Finance Transactions. An additional concern within the commercial lending channel relates to trade finance transactions, which represent approximately $1.8 billion of BRB's commercial lending portfolio. Trade finance transactions present elevated OFAC risk due to their inherent cross-border nature, the involvement of multiple parties (importers, exporters, correspondent banks, intermediary institutions, and transport companies), and the potential for goods in transit to involve sanctioned jurisdictions or end-users. Notwithstanding this elevated risk profile, BRB's current screening procedures do not differentiate trade finance transactions from domestic commercial lending transactions for purposes of screening intensity, frequency, or analytic scrutiny. Trade finance transactions are subject to the same screening protocols as a domestic term loan draw, without additional due diligence or enhanced screening specific to the cross-border and multi-party characteristics of trade finance. This one-size-fits-all approach does not reflect a risk-based screening framework and is inconsistent with OFAC's expectation that institutions calibrate their sanctions compliance programs to the risks presented by their specific business activities.

H. Wealth Management Channel

BRB's wealth management division serves high-net-worth individuals, families, and institutional clients through individual and trust accounts, investment advisory accounts, and custodial accounts. Wealth management accounts are screened against OFAC sanctions lists at the point of onboarding, consistent with BRB's general practice across all business lines.

Deficiency — Ongoing Transaction-Level Screening. The deficiency identified in the wealth management channel relates to ongoing transaction-level screening. Wire transfers, securities transactions, and distributions from wealth management accounts were found to be inconsistently screened. Specifically, certain custodial account transactions — including outgoing wire transfers of sale proceeds, dividend distributions, and transfers between custodial accounts — processed through BRB's wealth management platform bypass the Veridian screening queue. This appears to result from the fact that the wealth management platform utilizes a separate transaction processing module that was not fully integrated with the Veridian screening engine when the wealth management platform was last upgraded. The transactions are processed and settled without being screened against OFAC sanctions lists, creating a gap in coverage that is analogous (though smaller in scale) to the BaaS screening gaps described above.

Deficiency — Beneficial Ownership Screening. An additional deficiency was identified in the screening of beneficial owners associated with trust accounts and entity accounts in the wealth management book. BRB's wealth management division maintains a significant number of trust accounts and entity accounts with complex ownership and beneficiary structures. OFAC's screening requirements extend not only to the named accountholder but also to beneficial owners and beneficiaries of trust and entity accounts. C&H's review of a sample of wealth management trust accounts revealed that approximately 15% of the sampled accounts lacked complete beneficial owner identification for OFAC screening purposes. In some cases, the trust documentation on file with BRB identified the beneficial owners, but this information had not been entered into the Veridian screening system or had been entered incompletely (e.g., with only a name and no identifying information such as date of birth or address that would improve matching accuracy). In other cases, the beneficial ownership information on file was outdated and had not been refreshed to reflect changes in trust beneficiaries.

The incomplete beneficial ownership screening in the wealth management channel is a deficiency that implicates not only OFAC compliance but also BRB's customer due diligence and beneficial ownership identification obligations under FinCEN's Customer Due Diligence Rule. Remediation of this deficiency will require both a data remediation effort (to complete and update beneficial ownership records) and a systems remediation effort (to ensure that beneficial ownership data is integrated into the Veridian screening system in a format that enables effective screening).

V. OFAC List Management Deficiencies

Effective OFAC list management — the process by which BRB obtains, ingests, and maintains current OFAC sanctions lists within its screening system — is a prerequisite for effective screening. Even a screening system with comprehensive transaction coverage will fail to identify sanctioned parties if the underlying sanctions lists are not current, complete, or properly configured. C&H identified the following deficiencies in BRB's OFAC list management practices.

A. List Update Frequency and Coverage

BRB is required to screen transactions and customers against the OFAC Specially Designated Nationals and blocked Persons List (the "SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List (the "SSI List"), and other OFAC-administered lists, including the Foreign Sanctions Evaders List, the Palestine Legislative Council List, the Non-SDN Menu-Based Sanctions List (NS-MBS List), the Correspondent Account or Payable-Through Account Sanctions List (CAPTA List), and the Non-SDN Chinese Military-Industrial Complex Companies List (NS-CMIC List). BRB's screening system must incorporate all relevant OFAC lists and must be updated promptly when OFAC publishes new designations, amendments, or de-listings.

Current Configuration. BRB's Veridian TMS v.8.3 system is configured to update OFAC sanctions lists once daily via an automated data feed from Veridian's list management service. The daily update is scheduled to run at 6:00 AM Eastern Time each business day. On weekends and federal holidays, the update runs on the next business day.

Deficiency — Update Frequency. OFAC does not publish list updates on a fixed schedule. Designations, amendments, and de-listings may be published at any time during the business day, and OFAC occasionally publishes multiple updates in a single day. In certain cases, OFAC publishes designations with same-day effective dates, meaning that the obligation to block the designated person's property arises immediately upon publication. BRB's once-daily update cycle, which ingests list changes only at 6:00 AM each business day, means that there is a potential gap of up to 24 hours (or longer over weekends) between OFAC's publication of a new designation and BRB's implementation of that designation in its screening system. During this gap period, transactions involving newly designated persons could be processed by BRB without triggering a screening alert.

Industry best practice for institutions of BRB's size and complexity is to update OFAC sanctions lists multiple times daily — ideally upon notification of each OFAC list update, which can be achieved through OFAC's RSS feed, automated monitoring of the OFAC website, or subscription to third-party list management services that provide near-real-time update notifications. Many peer institutions update their sanctions lists at least twice daily (morning and afternoon) and have the capability to perform ad hoc updates within hours of an OFAC publication. BRB's once-daily update frequency falls below this standard and creates an unnecessary risk window.

Deficiency — Non-U.S. Sanctions Lists. BRB's list management configuration does not include non-OFAC sanctions lists that may be relevant to BRB's operations, such as European Union sanctions lists, United Kingdom sanctions lists administered by His Majesty's Treasury Office of Financial Sanctions Implementation ("OFSI"), and United Nations Security Council sanctions lists. While BRB's primary legal obligations relate to U.S. sanctions administered by OFAC, the absence of non-U.S. list screening represents a gap in BRB's overall sanctions program for several reasons. First, certain BaaS partner transactions and wealth management transactions involve cross-border activity that may touch jurisdictions where non-U.S. sanctions apply. Second, non-U.S. sanctions lists may include information about persons and entities that are relevant to OFAC compliance (e.g., persons designated by the EU or UK that have not yet been designated by OFAC, or persons whose designations on non-U.S. lists provide early warning of potential OFAC designation). Third, BRB's correspondent banking relationships may impose contractual obligations to screen against non-U.S. sanctions lists. C&H recommends that BRB evaluate the need for non-U.S. sanctions list screening based on a thorough analysis of its transaction volumes, geographic exposure, and counterparty relationships.

B. List Update Verification and Testing

Beyond the frequency of list updates, the integrity of the list management process depends on verification that list updates have been successfully ingested into the screening system. A list update that is published by OFAC but fails to load into the screening system due to a technical error is functionally equivalent to not having the update at all.

Deficiency — No Verification Procedure. BRB lacks a documented procedure for verifying that OFAC list updates have been successfully ingested into the Veridian screening system after each daily update cycle. The Veridian system generates a log entry indicating that the list update process has run, but there is no automated reconciliation between the OFAC list version published by OFAC (identifiable by date, time, and record count) and the list version actually loaded into the Veridian platform. In the absence of such reconciliation, BRB cannot confirm with certainty that its screening system is operating against the most current version of all applicable OFAC sanctions lists at any given time.

Deficiency — Historical Ingestion Failures. The absence of automated verification procedures was not merely a theoretical concern. The Caldera & Pope September 2024 independent test identified two instances in CY 2023 where OFAC list updates were delayed by more than 48 hours due to a system ingestion error. In both instances, the Veridian system's automated list update process failed to complete successfully, but the failure was not detected by BRB personnel until a manual review was conducted. During the 48+ hour delay period, BRB's screening system was operating against an outdated version of the OFAC sanctions lists, meaning that any persons designated by OFAC during that period would not have been flagged by the screening system. This finding was reported by Caldera & Pope and was subsequently cited in the OCC's examination workpapers as evidence of inadequate list management controls.

C&H recommends that BRB implement automated reconciliation procedures that compare the OFAC list version loaded into the Veridian system against the version published by OFAC after each update cycle, with automated alerts to the BSA Officer and designated IT support personnel in the event of a discrepancy or ingestion failure. This capability should be included in the specifications for the TMS v.10.0 upgrade and should also be implemented as an interim manual control for TMS v.8.3 pending the upgrade.

VI. Interdiction and blocking Procedure Deficiencies

Interdiction and blocking are the enforcement mechanisms of the OFAC compliance program — the processes by which BRB prevents transactions involving sanctioned parties from being completed and ensures that property of blocked persons is frozen and maintained in accordance with OFAC requirements. When the screening system identifies a true match to an OFAC sanctions list entry, BRB must take prompt action to block the transaction (for SDN matches and other programs requiring blocking) or reject the transaction (for programs requiring rejection rather than blocking), and must file appropriate reports with OFAC. The following deficiencies were identified in BRB's interdiction and blocking procedures.

A. Blocking and Rejecting Protocols

When a true OFAC match is identified, BRB is required to take immediate action. For transactions involving persons on the SDN List, BRB must block the transaction and freeze the property in an interest-bearing blocked account. For transactions involving persons subject to certain other sanctions programs (such as the Ukraine/Russia-related Sectoral Sanctions), BRB may be required to reject the transaction outright. In either case, BRB must file a blocking report or reject report with OFAC within 10 business days of the blocking or rejection action.

CY 2024 Statistics. In CY 2024, BRB's screening system generated 14,320 screening hits. Of these, 12 were confirmed as true matches requiring blocking or rejection. The 12 true ma

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
This memorandum is protected by the attorney-client privilege and the work-product doctrine. It was prepared by counsel at the direction of and for the benefit of the client in connection with legal advice regarding pending regulatory matters. Unauthorized disclosure may result in waiver of applicable privileges. Do not copy, distribute, or disclose without prior written authorization from Calderwood & Harkness LLP.
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
MEMORANDUM
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide a comprehensive assessment of the Office of Foreign Assets Control ("OFAC") sanctions compliance program deficiencies at Belmont Ridge Bank National Association ("BRB" or the "Bank") across all business lines, as required under the Bank's remediation of OCC Consent Order No. OCC-2025-003 (the "Consent Order"). This assessment has been prepared by Calderwood & Harkness LLP ("C&H") at the direction of BRB's General Counsel and Chief Compliance Officer in order to identify, categorize, and prioritize gaps in the Bank's OFAC compliance infrastructure and to inform the development of the Comprehensive Remediation Action Plan to be submitted to the Office of the Comptroller of the Currency ("OCC") by May 15, 2025.
The context for this engagement is well known to the Bank's senior leadership. The OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024 (the "Targeted Examination"), during which examiners identified significant OFAC sanctions screening failures as one of five core deficiency categories ultimately cited in the Consent Order. The OFAC screening failures were not newly discovered during the Targeted Examination; rather, the OCC had previously identified concerns regarding the adequacy of BRB's sanctions screening integration within its transaction monitoring system in a Matter Requiring Attention ("MRA") issued in June 2022. Those concerns were subsequently escalated to a Matter Requiring Immediate Attention ("MRIA") in November 2023, which specifically cited OFAC screening gaps in BRB's Banking-as-a-Service ("BaaS") transaction flows and directed the Bank to ensure 100% screening of all transaction channels. BRB failed to adequately remediate the deficiencies identified in the MRIA under the guidance of its former outside counsel, Drayton Mercer LLP (Helen Frazier, Engagement Partner), whose engagement was terminated in January 2025.
The scope of this analysis encompasses BRB's OFAC program deficiencies across the Bank's four core business lines: retail banking, commercial lending, wealth management, and BaaS fintech partnership channels. The analysis evaluates the following program elements: screening coverage (including real-time and batch screening of all transaction types), OFAC list management (including update frequency, verification, and list coverage), interdiction and blocking procedures, escalation protocols for potential OFAC matches and violations, recordkeeping practices, governance and oversight structures, training programs, and the technology infrastructure supporting the sanctions screening program.
Key Finding. BRB's OFAC compliance program suffers from systemic deficiencies across all evaluated program elements, with deficiencies identified in all four business lines. The most critical finding is the failure to screen 100% of transactions processed through BaaS channels. Specifically, approximately 3,800,000 NovaPay Technologies Inc. wire and ACH transactions — representing approximately 12% of the 31,700,000 total NovaPay transactions processed in calendar year 2023 ("CY 2023") — were not screened against OFAC sanctions lists at any point during the transaction lifecycle. This screening gap resulted from an architectural deficiency in the API-based integration between BRB's core banking platform and NovaPay's transaction processing systems, which allowed certain transaction flows to bypass the Veridian Analytics Inc. ("Veridian") sanctions screening engine entirely. Similar, though less severe, screening gaps were identified in BRB's other BaaS partner channels, as well as in the retail banking, commercial lending, and wealth management business lines. Additional deficiencies were identified in list management, interdiction and blocking procedures, escalation protocols, recordkeeping, technology, and governance.
The Consent Order requires full OFAC screening operationalization for all BaaS channels by November 1, 2025. Meeting this deadline will require the successful completion of the planned upgrade to Veridian TMS v.10.0, as well as the implementation of interim manual screening procedures for all transaction flows currently bypassing the screening engine. C&H has identified significant execution risk associated with this deadline, as discussed in detail in Section IX of this memorandum.
This memorandum should be read in conjunction with the following companion documents, each of which addresses related aspects of BRB's regulatory remediation:
• Consent Order Analysis Memorandum (C&H, dated February 28, 2025), which provides a detailed analysis of each article of the Consent Order and the Bank's obligations thereunder;
• Regulatory Risk Assessment Memorandum (C&H, dated March 7, 2025), which addresses OFAC enforcement risk and contains a detailed analysis of whether BRB should submit a voluntary self-disclosure ("VSD") to OFAC;
• Workstream 1: OFAC Sanctions Screening Remediation Plan (C&H and Thornfield Consulting Group LLC, draft dated March 10, 2025, subject to revision); and
• Revised OFAC Compliance Policy (draft dated March 12, 2025, currently under review by C&H and BRB compliance).
Finally, we note that Thornfield Consulting Group LLC ("Thornfield") — the independent consultant retained by BRB as required by Article VII of the Consent Order — commenced its on-site assessment on March 1, 2025. The Thornfield engagement is being led by Dr. Vivian Castellano (Managing Director) and Jennifer Hwang (Director, Sanctions & OFAC Compliance). Thornfield is expected to deliver a preliminary gap assessment by April 15, 2025, which will supplement and potentially expand upon the findings in this memorandum. C&H has coordinated with Thornfield to ensure alignment of analytical frameworks and to avoid duplication of effort; however, Thornfield's assessment is independent and BRB should anticipate that Thornfield may identify additional deficiencies not addressed herein.
II. Background
A. BRB Institutional Profile
Belmont Ridge Bank National Association is a national banking association chartered by the OCC (OCC Charter No. 48271) and insured by the Federal Deposit Insurance Corporation (FDIC Certificate No. 31845). BRB is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company listed on the New York Stock Exchange under the ticker symbol BRFG. BRFG is BRB's sole shareholder and parent company for purposes of the Bank Holding Company Act of 1956, as amended, and is subject to supervision by the Board of Governors of the Federal Reserve System.
BRB is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. The Bank employs approximately 5,800 full-time equivalent employees across its operating divisions.
BRB operates through four core business lines, each of which is relevant to the OFAC compliance program assessment:
Retail Banking. BRB operates a retail banking division that offers consumer deposit accounts, consumer lending products (including mortgage origination, home equity lines of credit, and personal loans), and related services. The retail banking division serves customers primarily through a network of 87 branches concentrated in the New York metropolitan area, as well as through digital banking channels (online banking portal and mobile application). Retail banking remains BRB's largest business line by deposit base but has been a declining share of overall revenue as the BaaS division has grown.
Commercial Lending. BRB's commercial lending division provides credit facilities, term loans, lines of credit, trade finance products, and related treasury management services to middle-market and mid-corporate borrowers. The commercial lending portfolio totaled approximately $12.3 billion in outstanding commitments as of December 31, 2024. Trade finance activities, which present elevated OFAC risk due to their cross-border nature, represent approximately $1.8 billion of the commercial lending portfolio.
Wealth Management. BRB's wealth management division provides investment advisory services, trust administration, estate planning, and custodial services to high-net-worth individuals, families, and institutional clients. Total assets under management as of December 31, 2024, were approximately $8.6 billion, across approximately 4,200 individual, trust, and entity accounts. The wealth management division includes a significant number of accounts with international beneficiaries or cross-border transaction activity.
Banking-as-a-Service (BaaS) Fintech Partnerships. BRB's BaaS division, which has experienced rapid growth since its establishment in 2021, provides banking infrastructure services — including deposit accounts, payment processing, card issuance, and lending capabilities — to fintech companies that operate consumer- and business-facing financial products under BRB's national bank charter. As of the date of this memorandum, BRB maintains 14 active BaaS fintech sponsor partnerships. BaaS division revenue for CY 2024 totaled $127.4 million, and total BaaS transaction volume for CY 2024 was approximately $74.3 billion. The BaaS division has been BRB's fastest-growing business line and a significant contributor to BRFG's overall revenue growth, but it is also the source of the most critical OFAC compliance deficiencies identified in the Consent Order and in this memorandum.
The relative scale of the BaaS division is important context for the findings in this memorandum. BRB onboarded its first BaaS partner in 2021 and expanded rapidly to 14 active partners within approximately three years. This pace of growth — which generated significant revenue and supported BRFG's stock valuation — substantially outpaced the development of the Bank's compliance infrastructure for BaaS-originated transactions, including OFAC sanctions screening capabilities.
B. Regulatory History Relevant to OFAC
The OFAC compliance deficiencies that are the subject of this memorandum have a regulatory history that predates the January 2025 Consent Order by more than two years. The following timeline summarizes the key supervisory actions and events:
June 2022 — OCC Matter Requiring Attention (MRA). In connection with a regularly scheduled BSA/AML supervisory review, the OCC issued an MRA to BRB regarding deficiencies in BSA/AML transaction monitoring. While the MRA was primarily focused on the adequacy of BRB's transaction monitoring system for suspicious activity detection, the OCC's supervisory letter included specific observations about the adequacy of sanctions screening integration within the transaction monitoring system. The MRA noted that the integration between the Veridian TMS platform and BRB's payment processing infrastructure had not been fully validated, and recommended that BRB conduct a comprehensive review of sanctions screening coverage across all transaction channels. BRB's management responded to the MRA with a corrective action plan that included a commitment to review sanctions screening coverage; however, as discussed below, the review was not completed in a manner that addressed the deficiencies later identified by the OCC.
November 2023 — OCC Matter Requiring Immediate Attention (MRIA). The OCC escalated its supervisory concerns by issuing an MRIA specifically directed at OFAC screening gaps in BRB's BaaS transaction flows. The MRIA cited evidence that certain BaaS partner transaction channels were not subject to comprehensive OFAC sanctions screening, and directed BRB to take immediate steps to ensure 100% screening of all transaction channels within 90 days. The MRIA represented a significant escalation from the June 2022 MRA and reflected the OCC's view that BRB had not adequately addressed the previously identified concerns. BRB's then-outside counsel, Drayton Mercer LLP (Helen Frazier, Engagement Partner), was engaged to assist with the remediation effort, but — as discussed further below — the remediation was not successful.
March 2024 – September 2024 — OCC Targeted BSA/AML Examination. The OCC commenced a targeted BSA/AML examination of BRB, during which the OFAC screening failures first identified in the November 2023 MRIA were confirmed and the scope of the screening gaps was expanded upon. The Targeted Examination revealed that the screening gaps in BaaS channels were more extensive than previously understood, and identified additional deficiencies in list management, interdiction procedures, escalation protocols, recordkeeping, technology, and governance. The examination results formed the factual basis for the Consent Order.
September 2024 — Caldera & Pope LLP Independent BSA/AML Test. Concurrently with the OCC's Targeted Examination, Caldera & Pope LLP (Franklin Dorsey, Engagement Partner) completed an independent BSA/AML test of BRB's compliance program, as required under BRB's existing BSA/AML independent testing obligations. The Caldera & Pope report identified multiple OFAC-related deficiencies that echoed the OCC's findings, including deficiencies in screening coverage for BaaS channels, list management practices, audit trail capabilities of the Veridian TMS platform, and recordkeeping standards for blocking and rejection events. The Caldera & Pope findings are referenced throughout this memorandum where relevant and are summarized in Appendix C.
January 15, 2025 — OCC Consent Order No. OCC-2025-003. The OCC issued the Consent Order, which cited OFAC sanctions screening failures as the first of five core deficiency categories. The Consent Order assessed a civil money penalty of $14.5 million (due March 16, 2025) and imposed detailed remediation requirements across all five deficiency categories, including specific deadlines for OFAC screening operationalization. Article III of the Consent Order addresses OFAC screening and list management requirements, and mandates full operationalization of OFAC screening for all BaaS channels by November 1, 2025. Article V addresses governance and oversight requirements, including the establishment of a Board-level Compliance Committee and OFAC-specific Board reporting. Article VII requires the engagement of an independent consultant to validate the Bank's remediation efforts.
January 2025 — Termination of Drayton Mercer LLP. Following the issuance of the Consent Order, BRB terminated the engagement of Drayton Mercer LLP (Helen Frazier, former lead partner) as outside regulatory counsel. The decision to terminate Drayton Mercer was based on BRB management's assessment that the prior firm had not effectively managed the remediation of the November 2023 MRIA or adequately prepared BRB for the Targeted Examination, contributing to the escalation from an MRIA to a Consent Order.
February 10, 2025 — Engagement of Calderwood & Harkness LLP. Calderwood & Harkness LLP was engaged as replacement outside counsel for BRB's regulatory remediation. C&H's engagement encompasses the full scope of the Consent Order remediation, with Philip Hartmann serving as Responsible Partner and Yuki Nakamura serving as Lead Associate. Carlos Espinoza (Of Counsel, Banking Regulation) and Marcus Delgado (Senior Associate, Financial Services Litigation) are also assigned to the matter.
C. Current OFAC Program Structure
The following describes BRB's current OFAC compliance program structure as of the date of this memorandum:
BSA Officer / AML Program Director. Thomas Ikeda was appointed BSA Officer and AML Program Director in March 2023. In this role, Mr. Ikeda has day-to-day responsibility for the administration of BRB's BSA/AML compliance program, including OFAC sanctions compliance. Mr. Ikeda reports to the Chief Compliance Officer. Prior to joining BRB, Mr. Ikeda served as Deputy BSA Officer at a mid-size regional bank in the southeastern United States. While Mr. Ikeda is experienced in BSA/AML compliance generally, he does not possess specialized OFAC sanctions expertise, which has contributed to certain of the deficiencies identified in this memorandum.
Chief Compliance Officer. Patricia Langston was appointed Chief Compliance Officer in January 2024. Ms. Langston has executive-level oversight of the sanctions program and is a member of BRB's Management Risk Committee. Ms. Langston's appointment was made, in part, in response to the November 2023 MRIA, as BRB's prior CCO (Robert Chambers) departed the Bank in November 2023.
Chief Risk Officer. Melissa Chu serves as BRB's Chief Risk Officer, with enterprise risk management oversight that encompasses compliance risk as a category. Ms. Chu chairs BRB's Management Risk Committee and reports to the Board Risk Committee (Arthur Connelly, Lead Independent Director and Chair).
BSA/AML Department. As of January 2025, BRB's BSA/AML department consists of 62 full-time equivalent employees, including analysts, investigators, quality assurance staff, and supervisory personnel. The department is responsible for all BSA/AML functions, including transaction monitoring, suspicious activity reporting, customer due diligence, and OFAC sanctions screening. There is no dedicated OFAC sanctions compliance team within the department; rather, OFAC screening responsibilities are distributed among general BSA/AML analysts. Under the remediation plan, the department is expected to grow to 77 FTEs post-remediation. In addition, BRB has engaged Pinnacle Compliance Solutions LLC to provide 30 temporary FTEs during the remediation period to supplement existing staff capacity, with an expected engagement period through December 2025.
OFAC Screening Technology. BRB's primary OFAC sanctions screening platform is the Veridian Analytics Inc. ("Veridian") sanctions screening module, which is integrated within the Veridian Transaction Monitoring System v.8.3 ("TMS v.8.3"). The Veridian platform is operated under Contract No. VA-BRB-2023-0044, which has a current annual contract value ("ACV") of $4.1 million per year under a three-year term ending December 2026. The Veridian TMS v.8.3 platform processes transaction data from BRB's core banking system and screens it against OFAC sanctions lists using fuzzy matching algorithms, name transliteration logic, and alias matching capabilities. As discussed in detail in Section IX of this memorandum, the platform has significant limitations that contribute to the identified deficiencies.
OFAC Screening Statistics (CY 2024). In CY 2024, BRB's OFAC screening system generated 14,320 screening hits (i.e., transactions or customers flagged as potential matches to OFAC sanctions lists). Of these 14,320 hits, 12 were confirmed as true matches requiring blocking or rejection actions. The remaining 14,308 hits were dispositioned as false positives after analyst review. This yields a false-positive rate of approximately 99.9% ((14,320 − 12) ÷ 14,320). As discussed further in Section IX.A, this extremely high false-positive rate is itself a deficiency, as it strains analyst resources and may contribute to alert fatigue that increases the risk of a true match being incorrectly cleared.
III. Methodology
Calderwood & Harkness's analysis of BRB's OFAC compliance program deficiencies was conducted over a period of approximately four weeks, from February 14, 2025 through March 12, 2025, and was based on the following sources and activities:
Documentary Review. C&H reviewed the following categories of documents and materials in connection with this analysis:
(a) OCC Consent Order No. OCC-2025-003, issued January 15, 2025, including the Statement of Facts and all articles and exhibits thereto.
(b) Underlying OCC examination workpapers from the Targeted Examination (March 2024 – September 2024), to the extent made available to counsel by the OCC and BRB.
(c) Prior OCC supervisory correspondence, including the June 2022 MRA, the November 2023 MRIA, and BRB's management responses thereto.
(d) Caldera & Pope LLP's September 2024 BSA/AML independent test report (Franklin Dorsey, Engagement Partner), including all OFAC-related findings, observations, and recommendations contained therein.
(e) BRB's existing OFAC compliance policies, procedures, and manuals, including the OFAC Compliance Policy (last revised 2020), the Sanctions Screening Procedures Manual (last revised 2022), and the BSA/AML Department Standard Operating Procedures.
(f) Technical documentation related to the Veridian TMS v.8.3 sanctions screening module, including the system configuration settings, screening algorithm parameters, list management configuration, API integration specifications, and system architecture documentation.
(g) BaaS partner agreements and related documentation for BRB's three largest BaaS partners: NovaPay Technologies Inc. (Master Services Agreement dated June 15, 2021, Ethan Garrison, CEO), FairLend Digital LLC (Sponsor Bank Agreement dated February 1, 2022, Aisha Okonkwo, CEO), and VaultEdge Inc. (BaaS Partnership Agreement dated March 10, 2023, Marcus Tan, CEO).
(h) Transaction flow documentation for BaaS partner channels, including API specifications, data flow diagrams, and integration architecture documentation.
(i) OFAC blocking and reject reports filed by BRB for CY 2023 and CY 2024, including 10-business-day blocking reports and annual blocked property reports.
(j) BRB's OFAC annual reports to regulators for CY 2023 and CY 2024.
(k) Transaction data and screening statistics for all business lines (retail banking, commercial lending, wealth management, and BaaS) for CY 2023 and CY 2024, including aggregate transaction volumes, screening hit volumes, true-match rates, and false-positive rates.
(l) Board of Directors meeting minutes, Audit Committee meeting minutes, and Risk Committee meeting minutes for the period January 2022 through February 2025.
(m) Organizational charts, position descriptions, and staffing plans for the BSA/AML department and the BaaS division.
(n) Training records and curricula for OFAC-related training programs for CY 2023 and CY 2024.
Personnel Interviews. C&H conducted in-person and videoconference interviews with the following BRB personnel over the course of the analysis period:
(a) Thomas Ikeda, BSA Officer / AML Program Director — interviewed on February 17, 2025 and March 3, 2025.
(b) Patricia Langston, Chief Compliance Officer — interviewed on February 18, 2025 and March 5, 2025.
(c) Warren Ashby, Head of Fintech Partnerships / BaaS Division — interviewed on February 20, 2025.
(d) Linda Petrosian, Chief Information Officer / Chief Technology Officer — interviewed on February 21, 2025 and March 6, 2025.
(e) Members of the sanctions screening operations team within the BSA/AML department — group interview conducted on February 24, 2025, with individual follow-up interviews as needed.
Technical Assessment. With the assistance of BRB's IT department and in coordination with Veridian Analytics, C&H conducted a technical assessment of the Veridian TMS v.8.3 sanctions screening module configuration and integration architecture. This assessment included a review of the API endpoints through which BaaS partner transaction data is ingested into BRB's payment processing system, identification of the points at which screening is triggered (or fails to be triggered), and analysis of the screening engine's list management, alert generation, and dispositioning capabilities.
Transaction Data Analysis. C&H analyzed aggregate and sampled transaction data for all four business lines for CY 2023 and CY 2024. For the BaaS channel, the analysis included a partner-by-partner assessment of transaction volumes and screening coverage rates for BRB's three largest partners (NovaPay, FairLend Digital, and VaultEdge), as well as a preliminary assessment of the remaining 11 partners.
Limitations. This memorandum is based on information available to C&H as of the date hereof. Our analysis relied in significant part on data and documentation provided by BRB personnel and systems; we have not independently verified the accuracy or completeness of all underlying data. Thornfield Consulting Group LLC's independent assessment, which commenced on March 1, 2025 and is expected to yield preliminary findings by April 15, 2025, may identify additional deficiencies not addressed in this memorandum. To the extent Thornfield's findings expand upon or differ from the findings set forth herein, C&H will issue a supplemental memorandum addressing any material differences and their implications for the remediation plan.
IV. OFAC Sanctions Screening Coverage Deficiencies
Screening coverage — the extent to which BRB's OFAC sanctions screening system captures and screens all relevant transactions, customer records, and counterparty data against applicable OFAC sanctions lists — is the foundational element of an effective OFAC compliance program. OFAC's guidance makes clear that a screening program must be designed to ensure that all transactions are screened before they are processed and that screening must be conducted on a real-time or near-real-time basis for high-risk transaction types. The following subsections detail the screening coverage deficiencies identified by C&H across BRB's business lines.
A. BaaS Channel Screening Gaps — Overview
Critical finding: BRB's OFAC screening system failed to screen 100% of transactions processed through its BaaS fintech partner channels. This is the most significant deficiency identified in the Consent Order and in this analysis. The failure to achieve comprehensive screening coverage in BaaS channels is a systemic, architectural deficiency rather than an isolated incident or a processing error.
The root cause of the BaaS screening gap is straightforward to identify but reflects a fundamental failure of BRB's compliance infrastructure to keep pace with the growth of its BaaS business. BaaS partner transaction flows were integrated into BRB's core banking platform through a series of API-based connections that were designed to optimize transaction processing speed and throughput. In several instances, these API connections routed transactions directly from the partner's platform to BRB's payment processing system without triggering the Veridian sanctions screening engine. The screening architecture within Veridian TMS v.8.3 was originally designed for BRB's legacy retail and commercial banking channels, which utilize standardized transaction processing pathways that route all transactions through the screening queue. When BaaS partnerships were onboarded beginning in 2021, the integration specifications for each partner were developed by BRB's technology team in coordination with each partner's development team, but without adequate input from the BSA/AML department or a formal compliance review of the screening implications of the proposed integration architecture.
Compounding this architectural deficiency, the model validation for the Veridian TMS v.8.3 sanctions screening module had not been independently validated since March 2021 — more than three years prior to the commencement of the OCC's Targeted Examination. Tuning parameters for the screening algorithm (including fuzzy matching thresholds, name transliteration rules, and alias matching sensitivity) were last updated in October 2022. The absence of periodic model validation meant that the screening gap in BaaS channels was not detected by automated controls, quality assurance processes, or independent testing until the OCC's Targeted Examination and the Caldera & Pope independent test brought it to light. Had BRB conducted a comprehensive model validation at any point after the first BaaS partner (NovaPay) was onboarded in 2021, the screening bypass issue should have been identified and could have been remediated before it grew to the scale now documented.
The following subsections address the screening gaps identified for each of BRB's three largest BaaS partners — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — as well as a summary assessment of the remaining 11 BaaS partners and the screening deficiencies identified in BRB's legacy business lines (retail banking, commercial lending, and wealth management).
B. NovaPay Technologies Inc. — Detailed Screening Gap Analysis
NovaPay Technologies Inc. ("NovaPay") is BRB's largest BaaS partner by transaction volume, representing approximately 41% of total BaaS transaction volume. In CY 2024, NovaPay transactions processed through BRB totaled approximately $30.5 billion of the $74.3 billion in total BaaS transaction volume. NovaPay was the first BaaS partner onboarded to BRB's charter, with the initial partnership agreement executed in June 2021 and transaction processing commencing in September 2021.
NovaPay operates a consumer payments and peer-to-peer ("P2P") transfer application that enables its approximately 2.1 million end-user accountholders to conduct domestic and international wire transfers, ACH transfers, and real-time P2P payments. NovaPay's platform interfaces with BRB's core banking system through a suite of APIs that enable account opening, funding, payment initiation, and settlement. The high volume and velocity of NovaPay's transaction flows — particularly the P2P transfer feature, which processes a significant number of low-dollar, high-frequency transactions — make NovaPay's channel the most operationally complex and risk-intensive of BRB's BaaS partnerships from an OFAC screening perspective.
Screening Gap. C&H's analysis confirmed the findings of the OCC's Targeted Examination: approximately 3,800,000 NovaPay wire and ACH transactions were not screened against OFAC sanctions lists in CY 2023. This figure represents approximately 12% of the 31,700,000 total NovaPay transactions processed through BRB during that calendar year. The 3.8 million unscreened transactions include a mix of domestic ACH credit and debit transactions, domestic wire transfers, and international wire transfers. While the precise breakdown between transaction types within the 3.8 million unscreened transactions has not yet been fully disaggregated (and will be the subject of further analysis by Thornfield Consulting), C&H's preliminary assessment indicates that the unscreened transactions include a non-trivial number of international wire transfers, which present the highest inherent OFAC risk of any transaction type.
Cause. The screening gap resulted from a specific architectural deficiency in the integration between NovaPay's platform and BRB's payment processing system. NovaPay's ACH batch file processing and certain real-time wire initiation flows were routed through an API endpoint (designated in BRB's integration documentation as the "NP-FAST" endpoint) that connected directly to BRB's payment processing system without triggering the Veridian screening queue. The NP-FAST endpoint was designed to support NovaPay's requirement for high-speed, low-latency transaction processing, particularly for its P2P transfer feature, which NovaPay marketed to consumers as providing "instant" fund availability. The integration specification document for NovaPay, which C&H reviewed, confirmed that the screening bypass was present in the original integration architecture from the time of NovaPay's initial onboarding in 2021. There is no evidence in the available documentation that the screening bypass was a deliberate design decision by any individual at BRB; rather, it appears to have been an oversight resulting from the failure to include BSA/AML compliance personnel in the integration design process.
The screening bypass did not affect all NovaPay transactions. Transactions processed through other API endpoints (including the standard payment initiation endpoint used for scheduled ACH transfers and certain wire transfers) were routed through the Veridian screening queue as expected. The NP-FAST endpoint was used for a subset of NovaPay transactions — specifically, ACH batch files submitted during off-peak processing windows and real-time wire initiations processed through NovaPay's expedited transfer feature — which collectively accounted for the approximately 12% of NovaPay transactions that were not screened.
Impact. The 3.8 million unscreened NovaPay transactions in CY 2023 represent the single most significant gap in BRB's OFAC compliance program. These transactions were processed and settled without any OFAC screening, meaning that BRB has no assurance that none of these transactions involved sanctioned parties, sanctioned jurisdictions, or property subject to blocking requirements. The absence of screening creates potential liability for sanctions violations if retrospective analysis reveals that any of the unscreened transactions involved parties on OFAC sanctions lists or property in which blocked persons had an interest. The potential liability extends beyond OFAC civil penalties to include potential criminal liability under the International Emergency Economic Powers Act ("IEEPA") if any transactions involved willful sanctions violations.
NovaPay's 41% share of BaaS transaction volume makes this the single largest exposure point for OFAC risk at BRB. The concentration of the screening gap in BRB's largest BaaS partner amplifies both the quantitative scope of the deficiency and the regulatory and enforcement significance of the finding.
C&H notes that the CY 2023 screening gap figure of 3.8 million transactions is the figure confirmed by the OCC's Targeted Examination. Similar screening gaps likely existed in CY 2022 (from NovaPay's onboarding in September 2021 through December 2022) and in CY 2024 (prior to the implementation of interim remediation measures in late 2024). The full scope of unscreened NovaPay transactions across all periods is the subject of ongoing analysis and will be addressed in the Workstream 1 remediation plan.
C. FairLend Digital LLC — Screening Gap Assessment
FairLend Digital LLC ("FairLend") is BRB's second-largest BaaS partner, representing approximately 28% of total BaaS transaction volume in CY 2024. FairLend operates an online small-business lending platform that originates loans to small businesses through BRB's charter, with approximately $1.4 billion in loan originations processed through BRB in fiscal year 2024. FairLend was onboarded to BRB's charter in February 2022.
FairLend's platform enables small-business borrowers to apply for and receive loan products (including term loans, lines of credit, and merchant cash advance products) through an entirely digital application and funding process. When a borrower is approved for a loan, the loan disbursement is processed as an ACH credit from BRB's account to the borrower's designated bank account.
Screening Deficiency. The screening deficiency identified for FairLend is qualitatively different from the NovaPay gap. FairLend borrower customers are screened against OFAC sanctions lists at the point of customer onboarding — i.e., when the borrower first applies for and is approved for a FairLend loan product through BRB's charter. However, loan disbursement transactions processed through FairLend's origination platform are not re-screened at the time of each disbursement. This means that customers who were cleared at onboarding but were subsequently added to OFAC sanctions lists (or whose sanctions list status changed after onboarding due to new designations) would not be identified at the point of payment. This creates a temporal gap in screening coverage that is inconsistent with OFAC's expectation that screening be conducted both at the time of customer onboarding and on an ongoing, transaction-level basis.
The significance of this gap is heightened by the fact that the period between a borrower's initial onboarding and subsequent loan disbursements can span weeks or months, during which OFAC sanctions lists may be updated multiple times. For revolving credit facilities or lines of credit, the gap is particularly acute, as a borrower may draw on a credit facility over an extended period without triggering any re-screening.
Additional Concern — Beneficial Ownership Screening. C&H identified an additional concern related to FairLend's borrower customer base. FairLend originates loans to small businesses, many of which are structured as limited liability companies, partnerships, or other entity forms with one or more beneficial owners. BRB's screening of beneficial owners associated with FairLend-originated accounts was found to be inconsistent. In certain cases, the beneficial ownership information collected during FairLend's onboarding process was incomplete or was not transmitted to BRB in a format compatible with the Veridian screening system. As a result, beneficial owners of FairLend borrower entities were not consistently screened against OFAC sanctions lists, creating a risk that loans could be originated to entities whose beneficial owners are sanctioned persons.
D. VaultEdge Inc. — Screening Gap Assessment
VaultEdge Inc. ("VaultEdge") is BRB's third-largest BaaS partner, representing approximately 18% of total BaaS transaction volume in CY 2024. VaultEdge operates a digital savings and neobanking platform that offers deposit accounts, high-yield savings accounts, and basic payment services to consumers. VaultEdge has approximately 870,000 deposit accounts at BRB. VaultEdge was onboarded to BRB's charter in March 2023, making it the most recently onboarded of BRB's three largest partners.
Screening Deficiency. VaultEdge ACH credit and debit transactions — i.e., transactions between VaultEdge customer accounts and external bank accounts — are screened against OFAC sanctions lists through the Veridian screening queue. However, internal book transfers between VaultEdge customer accounts held within BRB's systems are not routed through the OFAC screening queue. These internal book transfers represent fund transfers between two VaultEdge customers who both hold accounts at BRB, where the transfer is effectuated as an internal ledger entry rather than through the ACH or wire transfer networks.
While internal book transfers present lower inherent OFAC risk than external transactions (because both the originator and beneficiary accounts are housed within BRB and were subject to screening at account opening), the complete absence of screening for this transaction type is inconsistent with regulatory expectations. OFAC does not distinguish between internal and external transactions for purposes of the sanctions screening obligation, and the OCC's examination workpapers indicate that the OCC views the failure to screen internal book transfers as a deficiency. Moreover, the risk associated with unscreened internal book transfers is not de minimis: if a VaultEdge customer is designated on an OFAC sanctions list after account opening, internal transfers to or from that customer's account would not be identified by the screening system, and the customer's property would not be blocked as required.
Because VaultEdge was onboarded in 2023 — the most recent of the three largest partners — its integration architecture reflects some improvements relative to the NovaPay integration. For example, VaultEdge's external ACH and wire transactions are routed through the standard payment initiation API endpoint that triggers the Veridian screening queue, rather than through a separate bypass endpoint like NovaPay's NP-FAST endpoint. However, the gap in internal book transfer screening demonstrates that even BRB's more recent integration designs continue to contain deficiencies.
E. Remaining 11 BaaS Partners — Summary Assessment
BRB's remaining 11 BaaS partners collectively represent approximately 13% of total BaaS transaction volume. These partners operate a range of financial products, including prepaid card programs, earned wage access products, student banking platforms, and specialized small-business financial management tools. While each of these partners has a significantly lower transaction volume than NovaPay, FairLend, or VaultEdge, the aggregate volume across the 11 smaller partners remains substantial.
C&H's preliminary review of the screening coverage for these 11 partners indicates that coverage varies significantly from partner to partner. The variation in coverage reflects the fact that each partner was onboarded through an individual integration process, with the specifics of the API connection architecture differing depending on the partner's platform requirements and the timing of onboarding. At least four of the 11 smaller partners utilize API endpoint configurations similar to NovaPay's NP-FAST endpoint and may have comparable screening bypass issues. Although these partners' lower transaction volumes result in smaller absolute numbers of unscreened transactions, the existence of any screening bypass in a BaaS partner channel is a deficiency that must be remediated.
Due to time constraints, C&H was unable to conduct a detailed, partner-by-partner screening coverage audit for all 11 smaller partners within the timeframe of this memorandum. A comprehensive, partner-by-partner screening coverage audit is recommended and is included as a priority action item in the Workstream 1 remediation plan. This audit should include a review of each partner's integration architecture, API endpoint configurations, transaction flow routing, and screening coverage rates, with the objective of identifying and cataloging all screening bypass points across the entire BaaS portfolio.
F. Retail Banking Channel
BRB's legacy retail banking channel encompasses branch-based and digital banking transactions, including consumer deposit transactions (branch deposits and withdrawals), domestic and international wire transfers, ACH transactions, consumer loan disbursements, and related payment activities. The retail banking channel utilizes standardized transaction processing pathways within BRB's core banking system that generally route all transactions through the Veridian screening engine. As a result, the retail banking channel has substantially better OFAC screening coverage than the BaaS channel.
However, C&H identified a specific screening gap in the retail channel related to the processing of certain outgoing international wire transfers initiated through BRB's online banking portal. BRB's online banking platform allows consumer customers to initiate outgoing international wire transfers through a self-service interface. When an international wire is initiated through this interface after 4:00 PM Eastern Time, the wire is queued for batch processing rather than processed in real time. Due to the configuration of the batch processing cycle, there is an approximately four- to six-hour delay between the time the wire is initiated by the customer and the time the transaction is routed to the Veridian screening queue for OFAC screening. During this window, the wire may be released to the correspondent bank or intermediary institution before OFAC screening has been completed.
While this is not a complete screening failure — the transactions are ultimately screened, albeit on a delayed basis — the delay creates a window during which an outgoing international wire could be released before a potential OFAC match is identified. This is inconsistent with OFAC's expectation of real-time, pre-release screening for high-risk transaction types such as international wire transfers. International wire transfers are among the highest-risk transaction types for OFAC compliance purposes due to their cross-border nature and the potential involvement of correspondents in sanctioned jurisdictions.
Retail channel wire volume is substantially lower risk and lower volume than BaaS channel activity, and the number of international wires affected by this delay is relatively small in the context of BRB's overall transaction volume. Nonetheless, the gap warrants remediation, and C&H recommends that BRB implement real-time screening for all outgoing international wire transfers regardless of the time of initiation. This remediation can likely be accomplished through a configuration change to the batch processing schedule for the online banking portal, which does not require the full TMS v.10.0 upgrade.
G. Commercial Lending Channel
BRB's commercial lending channel encompasses loan originations, draws on credit facilities, trade finance transactions, and related commercial banking activities. Commercial lending transactions are generally screened at the point of origination (i.e., when the borrower is first underwritten and the credit facility is established) and at each subsequent draw or disbursement. This screening approach is consistent with regulatory expectations for the origination and funding phases of the commercial lending lifecycle.
Deficiency Identified — Periodic Re-Screening. The deficiency identified in the commercial lending channel relates to the ongoing monitoring of existing commercial borrowers and their beneficial owners against updated OFAC sanctions lists. BRB's current process does not conduct systematic, automated re-screening of its commercial lending portfolio against OFAC sanctions lists on a periodic basis. Instead, BRB relies on manual, ad hoc re-screening that is triggered by credit review events (such as annual loan reviews, credit line renewals, or material adverse change events) rather than by the publication of updated OFAC sanctions lists. This means that if OFAC designates a person or entity that is an existing BRB commercial borrower or a beneficial owner of an existing borrower between credit review events, BRB may not identify the designation until the next scheduled credit review — which could be months or even a year later.
Industry best practice for institutions of BRB's size and complexity is to implement automated, list-update-driven re-screening of the entire customer base (or at minimum, the commercial lending and wealth management customer bases) each time OFAC publishes a list update. This approach ensures that newly designated persons and entities are identified promptly, regardless of the timing of the Bank's internal credit review cycle.
Trade Finance Transactions. An additional concern within the commercial lending channel relates to trade finance transactions, which represent approximately $1.8 billion of BRB's commercial lending portfolio. Trade finance transactions present elevated OFAC risk due to their inherent cross-border nature, the involvement of multiple parties (importers, exporters, correspondent banks, intermediary institutions, and transport companies), and the potential for goods in transit to involve sanctioned jurisdictions or end-users. Notwithstanding this elevated risk profile, BRB's current screening procedures do not differentiate trade finance transactions from domestic commercial lending transactions for purposes of screening intensity, frequency, or analytic scrutiny. Trade finance transactions are subject to the same screening protocols as a domestic term loan draw, without additional due diligence or enhanced screening specific to the cross-border and multi-party characteristics of trade finance. This one-size-fits-all approach does not reflect a risk-based screening framework and is inconsistent with OFAC's expectation that institutions calibrate their sanctions compliance programs to the risks presented by their specific business activities.
H. Wealth Management Channel
BRB's wealth management division serves high-net-worth individuals, families, and institutional clients through individual and trust accounts, investment advisory accounts, and custodial accounts. Wealth management accounts are screened against OFAC sanctions lists at the point of onboarding, consistent with BRB's general practice across all business lines.
Deficiency — Ongoing Transaction-Level Screening. The deficiency identified in the wealth management channel relates to ongoing transaction-level screening. Wire transfers, securities transactions, and distributions from wealth management accounts were found to be inconsistently screened. Specifically, certain custodial account transactions — including outgoing wire transfers of sale proceeds, dividend distributions, and transfers between custodial accounts — processed through BRB's wealth management platform bypass the Veridian screening queue. This appears to result from the fact that the wealth management platform utilizes a separate transaction processing module that was not fully integrated with the Veridian screening engine when the wealth management platform was last upgraded. The transactions are processed and settled without being screened against OFAC sanctions lists, creating a gap in coverage that is analogous (though smaller in scale) to the BaaS screening gaps described above.
Deficiency — Beneficial Ownership Screening. An additional deficiency was identified in the screening of beneficial owners associated with trust accounts and entity accounts in the wealth management book. BRB's wealth management division maintains a significant number of trust accounts and entity accounts with complex ownership and beneficiary structures. OFAC's screening requirements extend not only to the named accountholder but also to beneficial owners and beneficiaries of trust and entity accounts. C&H's review of a sample of wealth management trust accounts revealed that approximately 15% of the sampled accounts lacked complete beneficial owner identification for OFAC screening purposes. In some cases, the trust documentation on file with BRB identified the beneficial owners, but this information had not been entered into the Veridian screening system or had been entered incompletely (e.g., with only a name and no identifying information such as date of birth or address that would improve matching accuracy). In other cases, the beneficial ownership information on file was outdated and had not been refreshed to reflect changes in trust beneficiaries.
The incomplete beneficial ownership screening in the wealth management channel is a deficiency that implicates not only OFAC compliance but also BRB's customer due diligence and beneficial ownership identification obligations under FinCEN's Customer Due Diligence Rule. Remediation of this deficiency will require both a data remediation effort (to complete and update beneficial ownership records) and a systems remediation effort (to ensure that beneficial ownership data is integrated into the Veridian screening system in a format that enables effective screening).
V. OFAC List Management Deficiencies
Effective OFAC list management — the process by which BRB obtains, ingests, and maintains current OFAC sanctions lists within its screening system — is a prerequisite for effective screening. Even a screening system with comprehensive transaction coverage will fail to identify sanctioned parties if the underlying sanctions lists are not current, complete, or properly configured. C&H identified the following deficiencies in BRB's OFAC list management practices.
A. List Update Frequency and Coverage
BRB is required to screen transactions and customers against the OFAC Specially Designated Nationals and blocked Persons List (the "SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List (the "SSI List"), and other OFAC-administered lists, including the Foreign Sanctions Evaders List, the Palestine Legislative Council List, the Non-SDN Menu-Based Sanctions List (NS-MBS List), the Correspondent Account or Payable-Through Account Sanctions List (CAPTA List), and the Non-SDN Chinese Military-Industrial Complex Companies List (NS-CMIC List). BRB's screening system must incorporate all relevant OFAC lists and must be updated promptly when OFAC publishes new designations, amendments, or de-listings.
Current Configuration. BRB's Veridian TMS v.8.3 system is configured to update OFAC sanctions lists once daily via an automated data feed from Veridian's list management service. The daily update is scheduled to run at 6:00 AM Eastern Time each business day. On weekends and federal holidays, the update runs on the next business day.
Deficiency — Update Frequency. OFAC does not publish list updates on a fixed schedule. Designations, amendments, and de-listings may be published at any time during the business day, and OFAC occasionally publishes multiple updates in a single day. In certain cases, OFAC publishes designations with same-day effective dates, meaning that the obligation to block the designated person's property arises immediately upon publication. BRB's once-daily update cycle, which ingests list changes only at 6:00 AM each business day, means that there is a potential gap of up to 24 hours (or longer over weekends) between OFAC's publication of a new designation and BRB's implementation of that designation in its screening system. During this gap period, transactions involving newly designated persons could be processed by BRB without triggering a screening alert.
Industry best practice for institutions of BRB's size and complexity is to update OFAC sanctions lists multiple times daily — ideally upon notification of each OFAC list update, which can be achieved through OFAC's RSS feed, automated monitoring of the OFAC website, or subscription to third-party list management services that provide near-real-time update notifications. Many peer institutions update their sanctions lists at least twice daily (morning and afternoon) and have the capability to perform ad hoc updates within hours of an OFAC publication. BRB's once-daily update frequency falls below this standard and creates an unnecessary risk window.
Deficiency — Non-U.S. Sanctions Lists. BRB's list management configuration does not include non-OFAC sanctions lists that may be relevant to BRB's operations, such as European Union sanctions lists, United Kingdom sanctions lists administered by His Majesty's Treasury Office of Financial Sanctions Implementation ("OFSI"), and United Nations Security Council sanctions lists. While BRB's primary legal obligations relate to U.S. sanctions administered by OFAC, the absence of non-U.S. list screening represents a gap in BRB's overall sanctions program for several reasons. First, certain BaaS partner transactions and wealth management transactions involve cross-border activity that may touch jurisdictions where non-U.S. sanctions apply. Second, non-U.S. sanctions lists may include information about persons and entities that are relevant to OFAC compliance (e.g., persons designated by the EU or UK that have not yet been designated by OFAC, or persons whose designations on non-U.S. lists provide early warning of potential OFAC designation). Third, BRB's correspondent banking relationships may impose contractual obligations to screen against non-U.S. sanctions lists. C&H recommends that BRB evaluate the need for non-U.S. sanctions list screening based on a thorough analysis of its transaction volumes, geographic exposure, and counterparty relationships.
B. List Update Verification and Testing
Beyond the frequency of list updates, the integrity of the list management process depends on verification that list updates have been successfully ingested into the screening system. A list update that is published by OFAC but fails to load into the screening system due to a technical error is functionally equivalent to not having the update at all.
Deficiency — No Verification Procedure. BRB lacks a documented procedure for verifying that OFAC list updates have been successfully ingested into the Veridian screening system after each daily update cycle. The Veridian system generates a log entry indicating that the list update process has run, but there is no automated reconciliation between the OFAC list version published by OFAC (identifiable by date, time, and record count) and the list version actually loaded into the Veridian platform. In the absence of such reconciliation, BRB cannot confirm with certainty that its screening system is operating against the most current version of all applicable OFAC sanctions lists at any given time.
Deficiency — Historical Ingestion Failures. The absence of automated verification procedures was not merely a theoretical concern. The Caldera & Pope September 2024 independent test identified two instances in CY 2023 where OFAC list updates were delayed by more than 48 hours due to a system ingestion error. In both instances, the Veridian system's automated list update process failed to complete successfully, but the failure was not detected by BRB personnel until a manual review was conducted. During the 48+ hour delay period, BRB's screening system was operating against an outdated version of the OFAC sanctions lists, meaning that any persons designated by OFAC during that period would not have been flagged by the screening system. This finding was reported by Caldera & Pope and was subsequently cited in the OCC's examination workpapers as evidence of inadequate list management controls.
C&H recommends that BRB implement automated reconciliation procedures that compare the OFAC list version loaded into the Veridian system against the version published by OFAC after each update cycle, with automated alerts to the BSA Officer and designated IT support personnel in the event of a discrepancy or ingestion failure. This capability should be included in the specifications for the TMS v.10.0 upgrade and should also be implemented as an interim manual control for TMS v.8.3 pending the upgrade.
VI. Interdiction and blocking Procedure Deficiencies
Interdiction and blocking are the enforcement mechanisms of the OFAC compliance program — the processes by which BRB prevents transactions involving sanctioned parties from being completed and ensures that property of blocked persons is frozen and maintained in accordance with OFAC requirements. When the screening system identifies a true match to an OFAC sanctions list entry, BRB must take prompt action to block the transaction (for SDN matches and other programs requiring blocking) or reject the transaction (for programs requiring rejection rather than blocking), and must file appropriate reports with OFAC. The following deficiencies were identified in BRB's interdiction and blocking procedures.
A. Blocking and Rejecting Protocols
When a true OFAC match is identified, BRB is required to take immediate action. For transactions involving persons on the SDN List, BRB must block the transaction and freeze the property in an interest-bearing blocked account. For transactions involving persons subject to certain other sanctions programs (such as the Ukraine/Russia-related Sectoral Sanctions), BRB may be required to reject the transaction outright. In either case, BRB must file a blocking report or reject report with OFAC within 10 business days of the blocking or rejection action.
CY 2024 Statistics. In CY 2024, BRB's screening system generated 14,320 screening hits. Of these, 12 were confirmed as true matches requiring blocking or rejection. The 12 true ma

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts