1045-00002 · Calderwood & Harkness LLP · documents

ofac-enforcement-risk-vsd-analysis-memo.docx DOCUMENT Antitrust

48 / 84 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019

Matter No.: 1045-00002 Date: March 2025

MEMORANDUM

TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association

FROM: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group Yuki Nakamura, Lead Associate, Litigation (General) Practice Group

RE: Analysis of OFAC Enforcement Risk and Evaluation of Voluntary Self-Disclosure Regarding NovaPay Sanctions Screening Gaps

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT. This memorandum was prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Belmont Ridge Bank National Association in anticipation of potential enforcement proceedings and for the purpose of providing legal advice. Do not distribute without prior authorization of counsel.

I. EXECUTIVE SUMMARY

This memorandum analyzes Belmont Ridge Bank National Association's ("BRB" or the "Bank") exposure to enforcement action by the Office of Foreign Assets Control ("OFAC") within the U.S. Department of the Treasury arising from the failure to screen approximately 3,800,000 NovaPay Technologies Inc. ("NovaPay") transactions against OFAC sanctions lists during calendar year 2023. The memorandum further assesses whether BRB should file a voluntary self-disclosure ("VSD") with OFAC and, based upon the analysis set forth herein, provides Calderwood & Harkness LLP's ("C&H") recommendation regarding the appropriate course of action.

The impetus for this analysis is Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025. The Consent Order identified, among other deficiencies, that BRB's OFAC sanctions screening system failed to screen one hundred percent of transactions processed through fintech Banking-as-a-Service ("BaaS") channels. Specifically, the screening gap affected approximately twelve percent (12%) of NovaPay wire and ACH transactions — approximately 3,800,000 of the 31,700,000 total NovaPay transactions processed through BRB's platform in calendar year 2023. The failure is attributable to a system integration deficiency in BRB's incumbent transaction monitoring and screening platform, Veridian TMS v.8.3, operated by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044.

The screening gap was not detected by BRB's internal controls. It was not identified by BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP. It was not adequately remediated following the OCC's issuance of a Matter Requiring Immediate Attention ("MRIA") in November 2023 specifically regarding OFAC screening gaps. The persistence of this deficiency — through a period during which BRB had received express regulatory notification of the risk — substantially heightens BRB's enforcement exposure and weighs heavily in the analysis that follows.

Bottom-Line Recommendation. Based on the analysis set forth in this memorandum, C&H recommends that BRB file a voluntary self-disclosure with OFAC as soon as practicable, subject to Board and management concurrence. This recommendation is grounded in the following principal considerations:

• The OFAC Enforcement Guidelines provide significant penalty mitigation benefits for entities that voluntarily self-disclose apparent violations, including a presumptive fifty percent (50%) reduction in the base penalty amount for non-egregious cases and the possibility of resolution through a cautionary letter or no-action determination rather than a civil monetary penalty.

• The Consent Order is a public document that specifically describes the OFAC sanctions screening gap affecting NovaPay transactions. Interagency information-sharing protocols between the OCC, OFAC, and the Financial Crimes Enforcement Network ("FinCEN") make it highly likely that OFAC is already aware of — or will soon become aware of — the screening deficiency. If OFAC initiates its own inquiry before BRB files a VSD, the Bank will lose the benefit of the voluntary self-disclosure framework, which represents the single most significant mitigating factor available under OFAC's enforcement paradigm.

• A proactive VSD filing demonstrates a culture of cooperation, transparency, and compliance commitment that is consistent with BRB's broader remediation posture and aligned with the expectations of the OCC under the Consent Order.

It is important to note that no criminal referral to the U.S. Department of Justice ("DOJ") has been made as of the date of C&H's engagement (February 10, 2025), and the Consent Order does not preclude future referral. FinCEN, through Associate Director Angela Drummond of the Enforcement Division, is separately monitoring BRB's Suspicious Activity Report ("SAR") filing remediation and has expressly reserved enforcement rights in coordination with the OCC. These parallel regulatory dynamics underscore the urgency of the VSD decision and the importance of demonstrating comprehensive cooperation across all regulatory touchpoints.

The sections that follow provide a detailed factual background, a comprehensive analysis of the OFAC enforcement framework as applied to BRB's circumstances, a risk assessment addressing potential penalty exposure under multiple scenarios, an evaluation of the factors favoring and weighing against a VSD filing, and C&H's strategic recommendation with proposed next steps and a target filing timeline.

II. BACKGROUND AND FACTUAL SUMMARY

A. Belmont Ridge Bank NA — Institutional Overview

Belmont Ridge Bank National Association is a nationally chartered commercial bank organized and existing under the laws of the United States, OCC Charter No. 48271, FDIC Certificate No. 31845. The Bank is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022, and is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."

As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. The Bank's core business lines encompass retail banking, commercial lending, wealth management, and — of particular relevance to this analysis — fintech Banking-as-a-Service partnerships. BRB currently maintains fourteen (14) active BaaS sponsor relationships, through which fintech companies access BRB's national bank charter and regulated infrastructure to offer financial products and services to their end users.

The BaaS segment has become an increasingly significant contributor to BRB's revenue and transaction volume. For calendar year 2024, total BaaS transaction volume processed through BRB's platform was approximately $74.3 billion, generating approximately $127.4 million in BaaS-related revenue to the Bank. This rapid growth in BaaS activity has placed corresponding demands on BRB's compliance infrastructure — demands that, as the facts recounted below demonstrate, the Bank's legacy systems and processes were not adequately positioned to meet.

BRB's scale, sophistication, and the volume and nature of its BaaS activities are directly relevant to OFAC's assessment of enforcement posture. Under the OFAC Enforcement Guidelines, the size, sophistication, and commercial activities of an entity are among the General Factors that OFAC considers in evaluating apparent violations. As a multi-billion-dollar nationally chartered bank with significant cross-border payment processing capabilities, BRB is expected to maintain a sanctions compliance program commensurate with its risk profile — an expectation that the screening gap at issue plainly failed to satisfy.

B. The NovaPay Sanctions Screening Gap

NovaPay Technologies Inc. is a Delaware corporation headquartered at 450 Mission Street, Suite 1200, San Francisco, California 94105. NovaPay operates a consumer payments and peer-to-peer transfer application that serves approximately 2.1 million end-user accounts. NovaPay's chief executive officer is Ethan Garrison. NovaPay was onboarded as a BaaS partner of BRB in 2021 and has since become the Bank's largest BaaS relationship by transaction volume, representing approximately forty-one percent (41%) of total BaaS transaction volume. For calendar year 2024, NovaPay's transaction volume processed through BRB was approximately $30.5 billion (41% of $74.3 billion total BaaS volume).

The central factual predicate for this memorandum is the sanctions screening gap affecting NovaPay transactions. During calendar year 2023, BRB's OFAC sanctions screening system — the Veridian TMS v.8.3 platform operated by Veridian Analytics Inc. — failed to screen approximately twelve percent (12%) of NovaPay wire and ACH transactions against applicable OFAC sanctions lists. This equates to approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed during the calendar year.

Root Cause. The root cause of the screening gap has been identified as a system integration deficiency between the NovaPay transaction feed and Veridian's OFAC screening module. Specifically, certain transaction types — batch ACH files and specific wire message formats — were routed through a processing pathway within the Veridian TMS v.8.3 architecture that bypassed the sanctions screening queue entirely. These transactions were processed, settled, and completed without any screening against the Specially Designated Nationals ("SDN") List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications ("SSI") List, or any other applicable OFAC non-SDN lists. The integration deficiency appears to have been present from the time of the initial NovaPay onboarding or shortly thereafter, though the precise onset date remains the subject of ongoing investigation by the Thornfield Consulting Group LLC as part of its independent assessment.

Failure to Detect. The screening gap was not detected by BRB's internal controls at any point during calendar year 2023. The Bank's BSA/AML compliance function, under BSA Officer Thomas Ikeda (who was appointed in March 2023), did not identify the routing deficiency through its routine quality assurance or monitoring processes. BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP, under engagement partner Franklin Dorsey, completed its most recent BSA/AML independent test in September 2024. While that engagement identified deficiencies that echoed the OCC's findings, the identification came after the relevant period and after the OCC's targeted examination was already well underway. The screening gap was also not adequately addressed following the OCC's issuance of the November 2023 MRIA, which specifically flagged OFAC screening gaps. At that time, BRB was represented by former outside counsel Drayton Mercer LLP, under lead partner Helen Frazier. The Drayton Mercer engagement was terminated in January 2025, and Calderwood & Harkness LLP was retained on February 10, 2025 to lead the Bank's legal response and remediation efforts.

The failure to remediate the screening gap after receipt of the November 2023 MRIA is a significant aggravating factor in the OFAC enforcement analysis. Under the Enforcement Guidelines, OFAC considers the entity's awareness of the conduct giving rise to the apparent violation and the entity's response to that awareness. BRB's receipt of a regulatory notice specifically identifying OFAC screening deficiencies, followed by the continued operation of a system that failed to screen 3.8 million transactions, creates a factual predicate that OFAC could characterize as reflecting recklessness or a lack of institutional commitment to compliance — notwithstanding the systems-based (rather than intentional) nature of the underlying deficiency.

C. Regulatory History Leading to discovery

The NovaPay sanctions screening gap was not an isolated event but rather the culmination of a series of regulatory interactions that reflected growing supervisory concern regarding BRB's BSA/AML and OFAC compliance posture. The following timeline summarizes the key regulatory milestones:

June 2022: OCC Matter Requiring Attention (MRA) — BSA/AML Transaction Monitoring. In June 2022, the OCC issued a Matter Requiring Attention to BRB regarding deficiencies in the Bank's BSA/AML transaction monitoring program. The MRA identified concerns with the Bank's transaction monitoring system coverage, alert disposition processes, and the adequacy of staffing devoted to BSA/AML compliance. While the June 2022 MRA did not specifically address OFAC sanctions screening, it signaled broader concerns with BRB's financial crimes compliance infrastructure that, in retrospect, were predictive of the more specific deficiencies that would be identified in subsequent supervisory actions.

November 2023: OCC Matter Requiring Immediate Attention (MRIA) — OFAC Screening Gaps. In November 2023, the OCC escalated its supervisory concern by issuing an MRIA specifically directed at OFAC screening gaps within BRB's BaaS transaction processing environment. The MRIA identified that BRB had not demonstrated that one hundred percent of BaaS-channel transactions were being screened against applicable OFAC sanctions lists. The MRIA required BRB to develop and implement a plan to ensure comprehensive OFAC screening coverage for all BaaS transaction flows. As noted above, the Bank's response to this MRIA — under the direction of its then-outside counsel, Drayton Mercer LLP — was inadequate, and the NovaPay screening gap persisted through the remainder of calendar year 2023 and, potentially, into calendar year 2024.

March 2024 – September 2024: OCC Targeted BSA/AML Examination. Beginning in March 2024, the OCC conducted a targeted BSA/AML examination of BRB, with a particular focus on the Bank's OFAC screening protocols for BaaS transaction flows. This examination was conducted by the OCC's Northeastern District Office, under the direction of Examiner-in-Charge Jonathan Frey, National Bank Examiner, stationed at 340 Madison Avenue, New York, New York 10017. The examination extended over approximately six months and involved extensive on-site review of BRB's screening systems, transaction records, and compliance documentation. It was during this examination that the full scope of the NovaPay screening gap was identified and quantified.

January 15, 2025: Consent Order No. OCC-2025-003. On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB. The Consent Order cited, among other deficiencies, BRB's inadequate OFAC screening protocols for fintech BaaS transaction flows and specifically identified the NovaPay screening gap. The Consent Order imposed a civil money penalty ("CMP") of $14,500,000, payable by March 16, 2025, and required BRB to undertake a comprehensive remediation program, including the engagement of an OCC-approved independent consultant, the development and submission of a comprehensive remediation action plan, and the establishment of a Board-level compliance committee, among other requirements.

The Consent Order is a public document. BRFG publicly disclosed the Consent Order on January 16, 2025, triggering a significant decline in BRFG's stock price and attracting shareholder and market scrutiny, as discussed further in Section IV.C below.

D. Current OFAC Screening Program Statistics

To provide context for the screening gap and BRB's overall OFAC compliance posture, the following statistics summarize the Bank's current OFAC screening program operations:

• OFAC Screening Hits, CY 2024: BRB's Veridian TMS v.8.3 system generated a total of 14,320 OFAC screening hits during calendar year 2024. Of those, twelve (12) were determined to be true matches requiring blocking action or transaction rejection. The remaining 14,308 hits were resolved as false positives, yielding a false-positive rate of approximately 99.9% ((14,320 − 12) ÷ 14,320).

• Last Independent Validation of Veridian TMS v.8.3: The most recent independent validation of BRB's Veridian TMS v.8.3 system was conducted in March 2021, more than three years prior to the OCC's targeted examination. OFAC expects financial institutions to conduct regular, independent testing and validation of their sanctions screening systems. A validation gap of this duration is a significant deficiency that OFAC would likely consider an aggravating factor.

• Last Tuning of Screening Parameters: The Veridian TMS v.8.3 screening parameters (including fuzzy-matching thresholds, alias configurations, and list-matching algorithms) were last tuned in October 2022. Given the dynamic nature of OFAC's sanctions lists — which are updated frequently — the extended interval between tuning cycles represents an additional compliance deficiency.

• BSA/AML Department Staffing: As of January 2025, BRB's BSA/AML department employed sixty-two (62) full-time equivalents, under the direction of BSA Officer Thomas Ikeda, who was appointed to the position in March 2023. As part of the remediation, BRB is increasing BSA/AML headcount to seventy-seven (77) permanent FTEs, supplemented by thirty (30) temporary analysts provided by Pinnacle Compliance Solutions to support the retroactive lookback and remediation surge.

• Remediation in Progress: BRB is currently undertaking an upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, at a total cost of approximately $2,800,000 for implementation and $1,900,000 per year in incremental licensing fees (bringing the total annual contract value to $6,000,000 per year). The upgraded system includes an enhanced OFAC screening module with dedicated BaaS transaction-flow coverage. Full operationalization of OFAC screening for all BaaS channels is targeted for November 1, 2025.

E. Scope of Potentially Affected Transactions

The approximately 3,800,000 NovaPay transactions that were not screened against OFAC sanctions lists in calendar year 2023 represent the core factual predicate of BRB's potential OFAC enforcement exposure. The affected transactions encompassed both wire transfers and ACH payments (including both credits and debits). These transactions were processed, settled, and completed through BRB's systems without any screening against the SDN List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications List, or any other applicable OFAC non-SDN sanctions lists.

It is not presently known whether any of the 3,800,000 unscreened transactions involved sanctioned parties, comprehensively sanctioned jurisdictions, or blocked property. A retroactive screening lookback is underway as part of BRB's remediation efforts. The lookback involves batch-processing the historical transaction records through the Veridian TMS screening engine (using the most current OFAC sanctions lists as well as historical list vintages corresponding to the dates on which the transactions were processed) to identify any transactions that would have generated a screening hit and, upon investigation, may constitute apparent OFAC violations. The results of this retroactive lookback will be critical to quantifying BRB's actual enforcement exposure and will form a central component of any supplemental VSD filing.

Additionally, it should be noted that the potential for OFAC screening gaps in BaaS channels beyond NovaPay has not yet been fully quantified. Thornfield Consulting Group LLC, engaged as the OCC-mandated independent consultant, commenced its on-site assessment on March 1, 2025. A preliminary gap assessment encompassing all fourteen BaaS partner channels is due on April 15, 2025. If the Thornfield assessment identifies screening gaps affecting other BaaS partners, BRB's OFAC enforcement exposure could expand significantly beyond the NovaPay-related transactions addressed in this memorandum. This possibility reinforces the urgency of the VSD filing, as discussed in Sections V through VII below.

III. OFAC ENFORCEMENT FRAMEWORK — LEGAL ANALYSIS

A. OFAC's Statutory Authority

OFAC administers and enforces comprehensive economic and trade sanctions programs based on U.S. foreign policy and national security objectives. OFAC's primary statutory authorities derive from two principal legislative frameworks:

The International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq. IEEPA authorizes the President, upon declaration of a national emergency with respect to any unusual or extraordinary threat to the national security, foreign policy, or economy of the United States, to impose broad economic sanctions, including blocking the property and interests in property of designated persons and prohibiting transactions with such persons. The majority of OFAC's currently active sanctions programs — including those targeting Iran, Russia, North Korea, Cuba, Syria, and various transnational criminal organizations and terrorist groups — are authorized under IEEPA. Executive orders issued under IEEPA authority are implemented by OFAC through regulations codified in 31 C.F.R. Chapter V.

The Trading with the Enemy Act (TWEA), 50 U.S.C. § 4301 et seq. TWEA provides the President with authority to regulate economic transactions during times of war or declared national emergency. While IEEPA has largely superseded TWEA for most sanctions programs, TWEA continues to serve as the statutory basis for certain legacy programs, including the Cuba sanctions program (31 C.F.R. Part 515).

As a U.S. financial institution, BRB is subject to the full scope of OFAC's sanctions requirements. The Bank is obligated to screen all transactions processed through its systems — including those processed on behalf of BaaS partners — against OFAC's sanctions lists to ensure that no transactions involve Specially Designated Nationals, blocked persons, or prohibited jurisdictions. When a transaction involves a blocked person or property, BRB is required to block the transaction and file a blocking report with OFAC within ten (10) business days. When a transaction involves a prohibited activity that does not require blocking, BRB is required to reject the transaction and maintain records of the rejection.

Strict Liability. A critical feature of the OFAC enforcement regime is its strict liability standard. Under IEEPA and the regulations implementing OFAC's sanctions programs, a person — including a financial institution — may be held liable for an apparent violation regardless of whether the person had knowledge of or intent to violate the applicable sanctions program. In other words, it is not a defense that BRB did not intend to process transactions involving sanctioned parties or that the screening failure was the result of a systems error rather than deliberate evasion. If any of the 3,800,000 unscreened NovaPay transactions involved sanctioned parties or blocked property, the fact that those transactions were processed without screening constitutes, in and of itself, a basis for enforcement action — without any requirement that OFAC prove knowledge, intent, or willfulness.

Civil Penalties. IEEPA authorizes civil penalties of up to the greater of $356,579 per violation (as adjusted for inflation pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015) or twice the amount of the underlying transaction that is the basis of the violation. The magnitude of potential civil liability under this framework is substantial. Even if only a small fraction of the 3,800,000 unscreened transactions constituted apparent violations, the per-violation penalty amounts — or, in the case of high-value transactions, twice the transaction amount — could aggregate to an extraordinarily large sum. We address illustrative penalty calculations in Section IV below.

Criminal Penalties. Willful violations of IEEPA can result in criminal fines of up to $1,000,000 per violation and imprisonment of up to twenty (20) years. However, the facts presently available do not suggest that BRB's screening gap arose from willful sanctions evasion. The deficiency appears to be a systems-based integration error that was compounded by inadequate internal controls and a failure to remediate after regulatory notification. While the failure to act after the November 2023 MRIA is troubling, it is more indicative of institutional negligence or, at worst, recklessness than of willful intent to circumvent sanctions requirements. Accordingly, while criminal exposure cannot be entirely ruled out — particularly if the retroactive lookback reveals evidence of actual sanctions violations involving significant transaction volumes or high-risk counterparties — the present facts do not support a conclusion that criminal prosecution is likely. This assessment should be revisited as additional facts become available.

B. OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A)

OFAC evaluates apparent violations and determines the appropriate enforcement response on a case-by-case basis, applying the framework set forth in its Economic Sanctions Enforcement Guidelines, published as Appendix A to 31 C.F.R. Part 501 (the "Enforcement Guidelines"). The Enforcement Guidelines identify a range of possible enforcement responses, from no action to the imposition of civil monetary penalties, and articulate the factors that OFAC considers in determining the appropriate response in a given case.

General Factors. The Enforcement Guidelines set forth a non-exhaustive list of General Factors that OFAC considers in evaluating apparent violations. These factors are directly applicable to BRB's circumstances and include the following:

1. Voluntary Self-Disclosure. Whether the entity voluntarily self-disclosed the apparent violation to OFAC. As discussed in detail in Section III.C below, a voluntary self-disclosure is the single most significant mitigating factor under the Enforcement Guidelines and results in a presumptive reduction in the base penalty amount.

2. Willfulness or Recklessness. Whether the apparent violation was the result of willful or reckless conduct, as opposed to negligence, an inadvertent error, or a systems-based deficiency. Willful or reckless conduct is an aggravating factor that weighs in favor of a more severe enforcement response, including potential classification of the case as "Egregious." The failure to remediate the NovaPay screening gap after receipt of the November 2023 MRIA could be characterized by OFAC as reflecting recklessness, though BRB would argue that the failure was attributable to the inadequacy of its then-outside counsel's response rather than a deliberate disregard of the regulatory directive.

3. Sanctions Compliance Program. The existence, nature, and adequacy of the entity's sanctions compliance program at the time of the apparent violation. OFAC expects U.S. financial institutions to maintain robust, risk-based sanctions compliance programs that include, at a minimum: (a) management commitment; (b) risk assessment; (c) internal controls (including sanctions screening); (d) testing and auditing; and (e) training. BRB's sanctions compliance program suffered from multiple deficiencies at the time of the screening gap, including the system integration error, the absence of independent validation since March 2021, and the failure to tune screening parameters since October 2022. These deficiencies undermine BRB's ability to argue that it maintained an adequate sanctions compliance program.

4. Remedial Response. The speed, effectiveness, and comprehensiveness of the entity's remedial response upon learning of the apparent violation. BRB's remediation efforts — including the engagement of Calderwood & Harkness LLP, the Thornfield independent assessment, the Veridian TMS upgrade, the increase in BSA/AML staffing, and the Board-approved $42.5 million remediation budget — are substantial and will be viewed favorably by OFAC. However, the lag between the November 2023 MRIA and the commencement of meaningful remediation (not until after the Consent Order in January 2025) is a negative factor that will require careful framing.

5. Individual Characteristics of the Entity. The size, sophistication, and commercial activities of the entity, as well as its transaction volume with sanctioned countries or parties and its prior enforcement history. BRB's status as a $38.7 billion national bank with significant BaaS-related cross-border payment processing capabilities places it in a category of institutions from which OFAC expects a high standard of compliance. BRB has no prior OFAC enforcement history, which is a mitigating factor.

6. Harm to Sanctions Program Objectives. Whether the apparent violation resulted in actual harm to the objectives of the applicable sanctions program — for example, whether sanctioned parties or jurisdictions actually benefited from the unscreened transactions. This factor cannot be fully evaluated until the retroactive screening lookback is complete. If the lookback reveals no actual sanctions violations, this factor will weigh strongly in BRB's favor. If actual violations are identified, the harm to sanctions program objectives will depend on the nature, volume, and value of the affected transactions.

7. Cooperation with OFAC. Whether the entity cooperated with OFAC's investigation, including the timeliness, completeness, and accuracy of information provided to OFAC. A VSD filing is the most concrete and significant form of cooperation BRB can demonstrate. Conversely, the failure to file a VSD — particularly where the apparent violation is likely already known to OFAC through interagency channels — could be characterized as a lack of cooperation.

Penalty Matrix. The Enforcement Guidelines establish a penalty matrix that categorizes cases along two dimensions: (i) whether the case is classified as "Egregious" or "Non-Egregious," and (ii) whether the entity filed a voluntary self-disclosure. This matrix produces four quadrants, each with its own penalty range and typical enforcement response:

• Non-Egregious + VSD: The base penalty is typically capped at one-half of the applicable Schedule amount (the Schedule amount being determined by reference to the transaction value and number of apparent violations). In practice, OFAC frequently resolves cases in this quadrant through the issuance of a cautionary letter, a Finding of Violation, or a no-action determination, particularly where the entity demonstrates a robust compliance program and genuine remediation. This is the most favorable quadrant for BRB.

• Non-Egregious + No VSD: The base penalty may be set at up to the full applicable Schedule amount. The absence of a VSD eliminates the presumptive fifty percent penalty reduction and may signal to OFAC a lack of proactive cooperation.

• Egregious + VSD: The base penalty may be set at up to one-half of the applicable statutory maximum per violation. While the VSD still provides meaningful mitigation, the Egregious classification reflects a more serious evaluation of the underlying conduct and results in significantly higher potential penalties.

• Egregious + No VSD: The base penalty may be set at up to the full statutory maximum per violation. This is the most adverse quadrant and is reserved for cases involving the most egregious conduct, coupled with a failure to self-disclose.

Analysis and Application to BRB. Based on the facts presently available, C&H assesses that the NovaPay sanctions screening gap is most likely classifiable as Non-Egregious under the Enforcement Guidelines. The screening failure arose from a systems integration error — not from intentional sanctions evasion, deliberate circumvention of screening protocols, or a pattern of willful misconduct. BRB's overall OFAC screening program was operational for the majority of its transaction volume; the gap was specific to certain NovaPay batch ACH and wire message formats routed through a processing pathway that bypassed the screening queue.

However, we must candidly acknowledge factors that could push the analysis toward a more serious posture. The scale of the screening gap — 3.8 million transactions representing twelve percent of BRB's largest BaaS partner's total volume — is substantial. The failure to remediate after the November 2023 MRIA, when BRB had been placed on specific notice of OFAC screening deficiencies, could be characterized by OFAC as reckless rather than merely negligent. The extended intervals between independent system validations (last conducted March 2021) and parameter tuning (last conducted October 2022) further undermine BRB's compliance posture. If the retroactive screening lookback reveals actual sanctions violations — particularly involving high-risk jurisdictions or SDN-listed counterparties — the risk of an Egregious classification increases meaningfully.

For these reasons, the VSD filing is all the more critical. In the Non-Egregious + VSD quadrant, BRB has the strongest prospect of a favorable resolution. If the case were to be classified as Egregious — a risk that cannot be fully mitigated but can be reduced through comprehensive remediation and cooperation — the VSD would still provide substantial penalty reduction benefits.

C. OFAC's Voluntary Self-Disclosure Policy

The voluntary self-disclosure framework is the centerpiece of OFAC's incentive structure for encouraging compliance and cooperation by regulated entities. Under the Enforcement Guidelines, a voluntary self-disclosure to OFAC of an apparent violation is treated as the single most significant mitigating factor in OFAC's determination of the appropriate enforcement response.

Penalty Mitigation Benefits. For non-egregious cases, a VSD results in a presumption of a fifty percent (50%) reduction in the base penalty amount. Moreover, for non-egregious cases involving a VSD, OFAC will generally not impose a civil monetary penalty and will instead issue a cautionary letter, a no-action determination, or a Finding of Violation — provided the entity demonstrates (a) a robust sanctions compliance program (or is credibly implementing one), (b) genuine remediation of the underlying deficiency, and (c) full cooperation with OFAC throughout the process.

For egregious cases, a VSD still provides meaningful mitigation: the base penalty is capped at one-half of the applicable statutory maximum, as opposed to the full statutory maximum that would apply in the absence of a VSD.

Definition of "Voluntary." The Enforcement Guidelines define the circumstances under which a disclosure qualifies as "voluntary." A disclosure is voluntary when it is made to OFAC:

(a) Before the entity has reason to believe that OFAC, or any other federal, state, or local government agency or official, has learned of the apparent violation or is likely to learn of the apparent violation through an independent source (including through a third-party complaint, media report, regulatory referral, or other means);

(b) The disclosure is made to OFAC directly (as opposed to a disclosure to another regulatory agency, such as the OCC or FinCEN, which does not, standing alone, constitute a VSD to OFAC); and

(c) The disclosure is substantive — that is, the entity provides OFAC with meaningful information about the nature, scope, and circumstances of the apparent violation, rather than merely notifying OFAC that a potential issue may exist without providing supporting details.

Timeliness. OFAC expects that an initial voluntary self-disclosure will be made promptly after the entity discovers the apparent violation or has reason to believe that a violation may have occurred. The Enforcement Guidelines recognize that a complete factual investigation may take time, and accordingly permit entities to make an initial disclosure with the information then available, followed by supplemental disclosures as additional facts are developed. However, unreasonable delay in making the initial disclosure — even if justified by the desire to complete a full investigation — may undermine the "voluntary" character of the filing and reduce the mitigating credit that OFAC is willing to extend.

Critical Timing Issue for BRB. The timeliness and voluntariness of any VSD that BRB might file present the central strategic question in this analysis. The relevant facts are as follows:

• The Consent Order was issued by the OCC on January 15, 2025, and is a public document filed with the OCC's public enforcement action database.

• BRFG publicly disclosed the Consent Order on January 16, 2025, through a press release and current report on Form 8-K filed with the Securities and Exchange Commission.

• The Consent Order specifically identifies the NovaPay OFAC screening gap, including the finding that BRB's OFAC sanctions screening system failed to screen one hundred percent of transactions processed through its BaaS channels.

• Federal regulators, including the OCC, OFAC, and FinCEN, routinely share examination findings and enforcement information through interagency coordination channels. As discussed in Section III.D below, it is highly likely that OFAC is already aware of the Consent Order and the OFAC-related findings contained therein.

The question, therefore, is whether a VSD filed by BRB at this stage would still be considered "voluntary" within the meaning of the Enforcement Guidelines — or whether OFAC would deem that it had already learned of the apparent violation through independent sources (i.e., the public Consent Order and/or interagency information sharing), such that BRB's subsequent disclosure would not qualify for VSD treatment.

C&H's assessment is that a VSD filed promptly — within the next approximately thirty days — retains a high probability of being treated as voluntary and receiving the associated mitigating credit. Our reasoning is as follows:

First, the Consent Order is an OCC enforcement action that addresses a broad range of BSA/AML deficiencies. While the Consent Order references the OFAC screening gap, it is not itself an OFAC enforcement action and does not constitute a disclosure to OFAC by BRB. OFAC's VSD framework requires a direct disclosure to OFAC, and the existence of a public OCC enforcement action does not, by itself, preclude a subsequent VSD to OFAC.

Second, while interagency information sharing may have alerted OFAC to the general nature of BRB's compliance deficiencies, OFAC may not yet have received the detailed, transaction-level information that would be provided in a substantive VSD filing. A proactive, detailed, and well-documented VSD from BRB would provide OFAC with significantly more information than it would have obtained from the Consent Order alone, and this informational value is likely to be credited by OFAC in its assessment.

Third, OFAC has historically taken a pragmatic approach to the voluntariness determination. In prior enforcement actions, OFAC has credited entities that filed VSD submissions even in circumstances where the underlying conduct was partially known to regulators, provided the entity's disclosure was proactive, substantive, and accompanied by evidence of genuine remediation. The totality of BRB's cooperative posture — including the VSD, the Consent Order compliance, the Thornfield independent assessment, and the comprehensive remediation program — will weigh in BRB's favor.

Fourth, the alternative — declining to file a VSD — carries far greater risk. If BRB does not file a VSD and OFAC subsequently initiates its own investigation (as it almost certainly will, given the public nature of the Consent Order), BRB will have lost the single most significant mitigating factor available under the Enforcement Guidelines. The downside of filing — drawing OFAC's attention to an issue it may already be aware of — is minimal compared to the downside of not filing and forfeiting VSD credit.

Notwithstanding this assessment, C&H acknowledges that there is some residual risk that OFAC could decline to treat BRB's filing as a qualifying VSD, particularly if OFAC determines that it had already initiated an investigation or received a formal referral from the OCC prior to BRB's submission. This risk reinforces the urgency of filing promptly; each day that passes without a VSD increases the probability that OFAC will have taken independent action that would preclude VSD treatment.

D. OFAC and OCC Information Sharing

Federal banking regulators and Treasury bureaus maintain robust interagency information-sharing mechanisms. The OCC, OFAC, and FinCEN regularly coordinate on BSA/AML and sanctions-related matters, particularly in the context of significant enforcement actions involving nationally chartered banks. Several specific information-sharing pathways are relevant to BRB's situation:

OCC-OFAC Coordination. The OCC's examination process for BSA/AML and OFAC compliance frequently generates findings that are shared with OFAC, either through formal referral processes or through routine interagency coordination. When an OCC examination identifies a systemic OFAC screening failure — as occurred here — it is standard practice for the OCC to notify OFAC of the deficiency, particularly when the failure involves a volume of unscreened transactions as large as that at issue in BRB's case. The Consent Order itself, as a public document, provides OFAC with notice of the screening gap even absent a formal referral.

FinCEN Coordination. FinCEN, as the administrator of the Bank Secrecy Act, coordinates closely with both the OCC and OFAC on matters involving financial institution compliance. FinCEN's Associate Director for Enforcement, Angela Drummond, is separately monitoring BRB's SAR filing remediation and has expressly reserved FinCEN's enforcement rights in coordination with the OCC. FinCEN and OFAC are both bureaus within the U.S. Department of the Treasury and share information internally. It is reasonable to assume that information regarding BRB's compliance deficiencies — including the OFAC screening gap — is being shared between FinCEN and OFAC through intra-Treasury coordination channels.

The Consent Order as Public Notice. The Consent Order is a public document that has been the subject of press coverage and securities filings. OFAC's enforcement staff routinely monitors public enforcement actions involving financial institutions for sanctions-related findings. The specific reference to OFAC screening deficiencies in the Consent Order makes it virtually certain that OFAC's Compliance and Enforcement Division is aware of BRB's screening gap, whether or not the OCC has made a formal referral.

Implications for VSD Timing. The interagency information-sharing dynamic underscores the urgency of BRB's VSD decision. The longer BRB waits to file a VSD, the greater the probability that OFAC will have initiated its own enforcement inquiry — either based on a formal OCC referral, FinCEN coordination, or the Compliance and Enforcement Division's own monitoring of public enforcement actions. Once OFAC initiates an inquiry, BRB's ability to file a qualifying VSD is effectively foreclosed. The window for a credible VSD is narrowing, and prompt action is essential to preserve the mitigating benefits of self-disclosure.

It bears emphasis that the Consent Order, while imposing a $14,500,000 CMP payable to the OCC, does not resolve or preclude separate enforcement action by OFAC. The OCC's enforcement authority over nationally chartered banks is distinct from OFAC's authority to enforce sanctions compliance. The $14,500,000 CMP addresses the OCC's findings regarding BRB's overall BSA/AML and OFAC compliance program deficiencies; it does not address potential apparent violations of OFAC sanctions programs that may be identified through the retroactive screening lookback. BRB must approach the OFAC enforcement risk as a separate and independent exposure that requires its own strategic response.

IV. RISK ASSESSMENT — POTENTIAL OFAC PENALTY EXPOSURE

A. Scenario Analysis

BRB's potential OFAC penalty exposure is contingent upon the results of the retroactive screening lookback currently being conducted on the approximately 3,800,000 unscreened NovaPay transactions. Until those results are available, the analysis must necessarily proceed on the basis of scenarios reflecting different possible outcomes. C&H has identified three principal scenarios, ranging from the most favorable to the most adverse.

Scenario 1: No Actual Sanctions Violations in Unscreened Transactions. Under this scenario, the retroactive screening lookback of the 3,800,000 unscreened NovaPay transactions reveals that none of the transactions involved sanctioned parties, comprehensively sanctioned jurisdictions, or blocked property. In this case, the screening gap represents a compliance program deficiency — a failure to screen — but not an actual facilitation of prohibited transactions. OFAC's enforcement posture would be significantly less aggressive under this scenario. The absence of actual harm to sanctions program objectives is a mitigating factor under the Enforcement Guidelines. OFAC could still address the compliance program deficiency through a cautionary letter, a Finding of Violation, or a modest civil penalty directed at the systemic screening failure itself. However, the absence of actual violations would substantially reduce the likelihood of a significant monetary penalty and would make it far more likely that a VSD would result in a no-action determination or cautionary letter resolution.

Scenario 2: De Minimis Actual Sanctions Violations. Under this scenario, the retroactive lookback reveals a small number of transactions — for example, single-digit — that involved parties on the SDN list or counterparties located in comprehensively sanctioned jurisdictions (e.g., Iran, North Korea, Syria, Cuba, or certain regions subject to comprehensive sanctions under the Russia/Ukraine-related programs). Each such transaction would constitute a separate apparent violation of the applicable sanctions program. Even a handful of violations, when combined with the systemic nature of the screening failure, could result in meaningful civil penalties. Under IEEPA, each violation can trigger a penalty of up to $356,579 or twice the transaction value, whichever is greater. However, with a VSD and a Non-Egregious classification, OFAC would likely resolve the matter with penalties substantially below the statutory maximum, reflecting the mitigating factors discussed in Section V below.

Scenario 3: Significant Actual Sanctions Violations. Under this scenario, a material number of the unscreened transactions involved sanctioned parties or jurisdictions. Given the volume of unscreened transactions (3.8 million) and the nature of the NovaPay consumer payments and P2P transfer platform (which processes transactions involving a diverse user base), it is not implausible that a non-trivial number of transactions could be flagged during the retroactive lookback. If, for example, even one-tenth of one percent (0.1%) of the unscreened transactions involved sanctioned parties, that would equate to approximately 3,800 apparent violations. At the per-violation maximum of $356,579, the theoretical maximum penalty exposure under IEEPA would exceed $1.3 billion. In practice, OFAC would not impose penalties at or near the theoretical maximum, particularly in a case involving a VSD and a financial institution demonstrating comprehensive remediation. However, even a deeply discounted penalty assessment in a case involving thousands of apparent violations could reach tens or hundreds of millions of dollars, representing a material financial exposure for BRB and BRFG.

B. Estimated Penalty Range (Illustrative)

The following illustrative penalty calculations are provided to frame the potential financial exposure under each scenario. These calculations are necessarily approximate and are subject to significant uncertainty, as the actual penalty amount in any OFAC enforcement action depends on the specific facts and OFAC's exercise of its discretion in applying the Enforcement Guidelines.

Important Caveats. The figures above are illustrative only and should not be relied upon as predictions of OFAC's enforcement response. OFAC exercises broad discretion in setting penalty amounts and routinely settles cases at amounts significantly below the theoretical statutory maximum, particularly in cases involving a VSD, remediation, and cooperation. The actual penalty, if any, will depend on factors including the number, value, and nature of the apparent violations; the sanctions programs involved; the counterparties and jurisdictions at issue; BRB's cooperation and remediation; and OFAC's assessment of the overall egregiousness of the conduct.

Independence of OFAC Liability. It bears repeating that the $14,500,000 CMP assessed by the OCC under the Consent Order is an OCC enforcement action and does not resolve, offset, or mitigate BRB's potential OFAC liability. OFAC enforcement is independent of the OCC's supervisory enforcement authority. BRB should not assume that the OCC CMP will be credited against any OFAC penalty. However, in practice, OFAC may take into account the penalties already paid to other agencies as a mitigating factor when determining the appropriate enforcement response — particularly where the underlying conduct is substantially similar. BRB's counsel should argue that the totality of the financial impact on BRB (the $14.5 million OCC CMP, the $42.5 million remediation budget, and any additional OFAC penalty) should be considered in assessing the proportionality of any OFAC enforcement action.

C. Collateral Consequences

Beyond the direct financial exposure associated with potential OFAC civil penalties, BRB faces significant collateral consequences that compound the urgency of the VSD decision and the importance of securing the most favorable possible resolution with OFAC.

Reputational Impact. A separate, public enforcement action by OFAC — on top of the existing OCC Consent Order — would inflict compounding reputational damage on BRB and BRFG. The Consent Order disclosure on January 16, 2025 already resulted in a significant decline in BRFG's stock price, from approximately $47.82 to $41.15 per share — a decline of approximately 13.9%. As of the date of this memorandum, BRFG's market capitalization stands at approximately $8.58 billion. A second enforcement action, particularly one from OFAC — a regulator whose actions carry connotations of national security implications — would amplify negative market and media attention and could trigger further stock price declines, rating agency scrutiny, and counterparty concerns.

Shareholder Pressure. BRB and BRFG are already facing shareholder pressure in connection with the Consent Order. Brindoval Capital Partners LP, an institutional investor controlled by Managing Partner Julian Whitmore, holds an approximately 8.3% ownership stake in BRFG (approximately 14.9 million shares). Brindoval's outside counsel, Steven Briggs of Amberly Knox LLP (600 Third Avenue, New York, New York 10016), has communicated concern regarding the cost of remediation, the potential for additional enforcement fines, and the reputational impact on BRFG's franchise value and earnings trajectory. An OFAC enforcement action would intensify this pressure and could catalyze more aggressive shareholder activism, including potential demands for Board-level changes or strategic alternatives.

Securities Disclosure Implications. An OFAC enforcement action — or even the filing of a VSD that discloses a potential OFAC enforcement risk — would likely constitute a material development requiring disclosure under BRB's and BRFG's SEC reporting obligations. BRFG would need to assess whether an 8-K filing is required upon the filing of the VSD, and the matter would need to be addressed in BRFG's annual report on Form 10-K and in its proxy statement. The total remediation and enforcement outlay to date — $42.5 million in remediation costs plus $14.5 million in the OCC CMP, totaling $57.0 million — already represents a material financial commitment. The addition of potential OFAC penalties could further impact BRFG's financial statements and require adjustments to loss reserves and contingent liability disclosures.

BaaS Partnership Risk. OFAC enforcement scrutiny could have cascading effects on BRB's BaaS partnerships. Fintech partners — particularly NovaPay, FairLend Digital, and VaultEdge — may face increased regulatory scrutiny by association or may seek to renegotiate or terminate their BaaS relationships with BRB in response to OFAC enforcement action. BRB's BaaS revenue of $127.4 million in calendar year 2024 is at risk if multiple partners pursue alternatives. The loss of NovaPay alone, which represents forty-one percent of BaaS transaction volume, would constitute a significant revenue event.

Potential DOJ Interest. While no criminal referral has been made to the Department of Justice as of the date of this memorandum, C&H must note that a separate OFAC enforcement action could attract DOJ attention, particularly if the retroactive screening lookback reveals actual sanctions violations involving material transaction volumes, high-risk counterparties, or comprehensively sanctioned jurisdictions. DOJ's National Security Division and the U.S. Attorney's Office for the Southern District of New York have actively prosecuted sanctions violations in recent years, and BRB's profile — a large national bank with a systemic screening failure affecting millions of transactions — could be of interest. The VSD filing, while directed to OFAC, also serves a defensive purpose in the DOJ context: a demonstrated pattern of proactive disclosure, cooperation, and remediation is inconsistent with the willfulness and intent elements that DOJ must prove in a criminal sanctions prosecution.

V. MITIGATING FACTORS FAVORING A VSD FILING

A. OFAC's Framework Rewards Self-Disclosure

As detailed in Section III above, a voluntary self-disclosure is the single most significant mitigating factor under OFAC's Enforcement Guidelines. The framework is explicitly designed to incentivize self-reporting: entities that come forward proactively receive substantially more favorable treatment than those whose violations are discovered through other means. This is not merely a theoretical benefit; it is a concrete, quantifiable advantage that has been consistently applied across OFAC's enforcement actions.

In the Non-Egregious + VSD quadrant — which, based on the facts presently available, is the most likely classification for BRB's case — the presumptive fifty percent penalty reduction is applied to the base penalty, and OFAC frequently resolves such cases without imposing any civil monetary penalty at all. In a significant number of Non-Egregious + VSD cases, OFAC has issued cautionary letters or no-action letters, effectively closing the matter without a public enforcement action. This outcome would be the most favorable possible resolution for BRB, as it would avoid the reputational and collateral consequences of a public OFAC penalty.

Even if OFAC is partially aware of the NovaPay screening gap through the Consent Order and interagency channels, a proactive, detailed, and substantive VSD filing demonstrates good faith, cooperation, and a genuine commitment to compliance. OFAC's enforcement staff have historically credited entities that take affirmative steps to come forward, even in circumstances where the underlying conduct was not entirely unknown to the government. The informational value of a well-prepared VSD submission — providing OFAC with detailed transaction data, root cause analysis, and remediation documentation — goes well beyond what OFAC would have learned from the Consent Order alone and constitutes a meaningful act of cooperation.

B. BRB's Remediation Efforts

BRB has commenced a comprehensive remediation program that, when viewed in its totality, demonstrates the institutional commitment to compliance that OFAC weighs heavily in its enforcement analysis. The key elements of this remediation include:

Engagement of Specialized Outside Counsel. Calderwood & Harkness LLP was engaged on February 10, 2025, to lead BRB's comprehensive BSA/AML and sanctions compliance-program uplift. C&H's Banking & Finance Practice Group and Litigation Practice Group bring deep experience in OFAC enforcement matters and regulatory remediation to the engagement. The engagement of experienced outside counsel is one of the first steps that OFAC expects an institution to take upon identifying a potential compliance failure.

Independent Consultant Engagement. Thornfield Consulting Group LLC was engaged as the OCC-mandated independent consultant pursuant to the terms of the Consent Order, with OCC non-objection received on February 5, 2025. The Thornfield engagement (reference TCG-BRB-2025-001) is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with sanctions-specific expertise provided through Jennifer Hwang, Director, Sanctions & OFAC Compliance. Thornfield commenced its on-site assessment on March 1, 2025, and its preliminary gap assessment is due April 15, 2025. The engagement of an independent consultant of Thornfield's caliber — with specific OFAC subject-matter expertise — demonstrates that BRB is taking the sanctions compliance deficiency seriously and has committed resources to an independent, objective assessment of the scope of the problem.

System Upgrade. BRB is undertaking a significant technology investment in the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, at a total implementation cost of approximately $2,800,000 and an incremental annual licensing cost of $1,900,000 (bringing the total annual contract value to $6,000,000). The upgraded system includes an enhanced OFAC screening module specifically designed to ensure comprehensive coverage of all BaaS transaction flows, including the batch ACH and wire message formats that bypassed the screening queue under the prior version. Full operationalization of the Veridian TMS v.10.0 OFAC screening capability for all BaaS channels is targeted for November 1, 2025, following a planned user acceptance testing ("UAT") completion date of August 1, 2025.

Board-Approved Remediation Budget. BRB's Board of Directors has approved a remediation budget of $42.5 million, exclusive of the $14.5 million OCC CMP, bringing the total remediation and enforcement outlay to $57.0 million. This level of financial commitment underscores the seriousness with which BRB's Board and senior management are approaching the remediation and provides tangible evidence of institutional resources being devoted to compliance enhancement.

Board-Level Governance Enhancements. In compliance with the Consent Order, BRB has established a dedicated Compliance Committee of the Board of Directors, chaired by James Rutherford. The Board Resolution establishing the Compliance Committee was required by February 28, 2025. The creation of a dedicated Board-level compliance committee is a governance best practice that OFAC recognizes as evidence of management commitment — one of the five essential components of an effective sanctions compliance program identified in OFAC's Framework for Compliance Commitments.

Organizational Enhancements. BRB is increasing its BSA/AML department staffing from sixty-two (62) to seventy-seven (77) permanent full-time equivalents. Additionally, thirty (30) temporary analysts from Pinnacle Compliance Solutions hav

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
Matter No.: 1045-00002 Date: March 2025
MEMORANDUM
TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
FROM: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group Yuki Nakamura, Lead Associate, Litigation (General) Practice Group
RE: Analysis of OFAC Enforcement Risk and Evaluation of Voluntary Self-Disclosure Regarding NovaPay Sanctions Screening Gaps
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT. This memorandum was prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Belmont Ridge Bank National Association in anticipation of potential enforcement proceedings and for the purpose of providing legal advice. Do not distribute without prior authorization of counsel.
I. EXECUTIVE SUMMARY
This memorandum analyzes Belmont Ridge Bank National Association's ("BRB" or the "Bank") exposure to enforcement action by the Office of Foreign Assets Control ("OFAC") within the U.S. Department of the Treasury arising from the failure to screen approximately 3,800,000 NovaPay Technologies Inc. ("NovaPay") transactions against OFAC sanctions lists during calendar year 2023. The memorandum further assesses whether BRB should file a voluntary self-disclosure ("VSD") with OFAC and, based upon the analysis set forth herein, provides Calderwood & Harkness LLP's ("C&H") recommendation regarding the appropriate course of action.
The impetus for this analysis is Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025. The Consent Order identified, among other deficiencies, that BRB's OFAC sanctions screening system failed to screen one hundred percent of transactions processed through fintech Banking-as-a-Service ("BaaS") channels. Specifically, the screening gap affected approximately twelve percent (12%) of NovaPay wire and ACH transactions — approximately 3,800,000 of the 31,700,000 total NovaPay transactions processed through BRB's platform in calendar year 2023. The failure is attributable to a system integration deficiency in BRB's incumbent transaction monitoring and screening platform, Veridian TMS v.8.3, operated by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044.
The screening gap was not detected by BRB's internal controls. It was not identified by BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP. It was not adequately remediated following the OCC's issuance of a Matter Requiring Immediate Attention ("MRIA") in November 2023 specifically regarding OFAC screening gaps. The persistence of this deficiency — through a period during which BRB had received express regulatory notification of the risk — substantially heightens BRB's enforcement exposure and weighs heavily in the analysis that follows.
Bottom-Line Recommendation. Based on the analysis set forth in this memorandum, C&H recommends that BRB file a voluntary self-disclosure with OFAC as soon as practicable, subject to Board and management concurrence. This recommendation is grounded in the following principal considerations:
• The OFAC Enforcement Guidelines provide significant penalty mitigation benefits for entities that voluntarily self-disclose apparent violations, including a presumptive fifty percent (50%) reduction in the base penalty amount for non-egregious cases and the possibility of resolution through a cautionary letter or no-action determination rather than a civil monetary penalty.
• The Consent Order is a public document that specifically describes the OFAC sanctions screening gap affecting NovaPay transactions. Interagency information-sharing protocols between the OCC, OFAC, and the Financial Crimes Enforcement Network ("FinCEN") make it highly likely that OFAC is already aware of — or will soon become aware of — the screening deficiency. If OFAC initiates its own inquiry before BRB files a VSD, the Bank will lose the benefit of the voluntary self-disclosure framework, which represents the single most significant mitigating factor available under OFAC's enforcement paradigm.
• A proactive VSD filing demonstrates a culture of cooperation, transparency, and compliance commitment that is consistent with BRB's broader remediation posture and aligned with the expectations of the OCC under the Consent Order.
It is important to note that no criminal referral to the U.S. Department of Justice ("DOJ") has been made as of the date of C&H's engagement (February 10, 2025), and the Consent Order does not preclude future referral. FinCEN, through Associate Director Angela Drummond of the Enforcement Division, is separately monitoring BRB's Suspicious Activity Report ("SAR") filing remediation and has expressly reserved enforcement rights in coordination with the OCC. These parallel regulatory dynamics underscore the urgency of the VSD decision and the importance of demonstrating comprehensive cooperation across all regulatory touchpoints.
The sections that follow provide a detailed factual background, a comprehensive analysis of the OFAC enforcement framework as applied to BRB's circumstances, a risk assessment addressing potential penalty exposure under multiple scenarios, an evaluation of the factors favoring and weighing against a VSD filing, and C&H's strategic recommendation with proposed next steps and a target filing timeline.
II. BACKGROUND AND FACTUAL SUMMARY
A. Belmont Ridge Bank NA — Institutional Overview
Belmont Ridge Bank National Association is a nationally chartered commercial bank organized and existing under the laws of the United States, OCC Charter No. 48271, FDIC Certificate No. 31845. The Bank is headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022, and is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."
As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. The Bank's core business lines encompass retail banking, commercial lending, wealth management, and — of particular relevance to this analysis — fintech Banking-as-a-Service partnerships. BRB currently maintains fourteen (14) active BaaS sponsor relationships, through which fintech companies access BRB's national bank charter and regulated infrastructure to offer financial products and services to their end users.
The BaaS segment has become an increasingly significant contributor to BRB's revenue and transaction volume. For calendar year 2024, total BaaS transaction volume processed through BRB's platform was approximately $74.3 billion, generating approximately $127.4 million in BaaS-related revenue to the Bank. This rapid growth in BaaS activity has placed corresponding demands on BRB's compliance infrastructure — demands that, as the facts recounted below demonstrate, the Bank's legacy systems and processes were not adequately positioned to meet.
BRB's scale, sophistication, and the volume and nature of its BaaS activities are directly relevant to OFAC's assessment of enforcement posture. Under the OFAC Enforcement Guidelines, the size, sophistication, and commercial activities of an entity are among the General Factors that OFAC considers in evaluating apparent violations. As a multi-billion-dollar nationally chartered bank with significant cross-border payment processing capabilities, BRB is expected to maintain a sanctions compliance program commensurate with its risk profile — an expectation that the screening gap at issue plainly failed to satisfy.
B. The NovaPay Sanctions Screening Gap
NovaPay Technologies Inc. is a Delaware corporation headquartered at 450 Mission Street, Suite 1200, San Francisco, California 94105. NovaPay operates a consumer payments and peer-to-peer transfer application that serves approximately 2.1 million end-user accounts. NovaPay's chief executive officer is Ethan Garrison. NovaPay was onboarded as a BaaS partner of BRB in 2021 and has since become the Bank's largest BaaS relationship by transaction volume, representing approximately forty-one percent (41%) of total BaaS transaction volume. For calendar year 2024, NovaPay's transaction volume processed through BRB was approximately $30.5 billion (41% of $74.3 billion total BaaS volume).
The central factual predicate for this memorandum is the sanctions screening gap affecting NovaPay transactions. During calendar year 2023, BRB's OFAC sanctions screening system — the Veridian TMS v.8.3 platform operated by Veridian Analytics Inc. — failed to screen approximately twelve percent (12%) of NovaPay wire and ACH transactions against applicable OFAC sanctions lists. This equates to approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed during the calendar year.
Root Cause. The root cause of the screening gap has been identified as a system integration deficiency between the NovaPay transaction feed and Veridian's OFAC screening module. Specifically, certain transaction types — batch ACH files and specific wire message formats — were routed through a processing pathway within the Veridian TMS v.8.3 architecture that bypassed the sanctions screening queue entirely. These transactions were processed, settled, and completed without any screening against the Specially Designated Nationals ("SDN") List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications ("SSI") List, or any other applicable OFAC non-SDN lists. The integration deficiency appears to have been present from the time of the initial NovaPay onboarding or shortly thereafter, though the precise onset date remains the subject of ongoing investigation by the Thornfield Consulting Group LLC as part of its independent assessment.
Failure to Detect. The screening gap was not detected by BRB's internal controls at any point during calendar year 2023. The Bank's BSA/AML compliance function, under BSA Officer Thomas Ikeda (who was appointed in March 2023), did not identify the routing deficiency through its routine quality assurance or monitoring processes. BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP, under engagement partner Franklin Dorsey, completed its most recent BSA/AML independent test in September 2024. While that engagement identified deficiencies that echoed the OCC's findings, the identification came after the relevant period and after the OCC's targeted examination was already well underway. The screening gap was also not adequately addressed following the OCC's issuance of the November 2023 MRIA, which specifically flagged OFAC screening gaps. At that time, BRB was represented by former outside counsel Drayton Mercer LLP, under lead partner Helen Frazier. The Drayton Mercer engagement was terminated in January 2025, and Calderwood & Harkness LLP was retained on February 10, 2025 to lead the Bank's legal response and remediation efforts.
The failure to remediate the screening gap after receipt of the November 2023 MRIA is a significant aggravating factor in the OFAC enforcement analysis. Under the Enforcement Guidelines, OFAC considers the entity's awareness of the conduct giving rise to the apparent violation and the entity's response to that awareness. BRB's receipt of a regulatory notice specifically identifying OFAC screening deficiencies, followed by the continued operation of a system that failed to screen 3.8 million transactions, creates a factual predicate that OFAC could characterize as reflecting recklessness or a lack of institutional commitment to compliance — notwithstanding the systems-based (rather than intentional) nature of the underlying deficiency.
C. Regulatory History Leading to discovery
The NovaPay sanctions screening gap was not an isolated event but rather the culmination of a series of regulatory interactions that reflected growing supervisory concern regarding BRB's BSA/AML and OFAC compliance posture. The following timeline summarizes the key regulatory milestones:
June 2022: OCC Matter Requiring Attention (MRA) — BSA/AML Transaction Monitoring. In June 2022, the OCC issued a Matter Requiring Attention to BRB regarding deficiencies in the Bank's BSA/AML transaction monitoring program. The MRA identified concerns with the Bank's transaction monitoring system coverage, alert disposition processes, and the adequacy of staffing devoted to BSA/AML compliance. While the June 2022 MRA did not specifically address OFAC sanctions screening, it signaled broader concerns with BRB's financial crimes compliance infrastructure that, in retrospect, were predictive of the more specific deficiencies that would be identified in subsequent supervisory actions.
November 2023: OCC Matter Requiring Immediate Attention (MRIA) — OFAC Screening Gaps. In November 2023, the OCC escalated its supervisory concern by issuing an MRIA specifically directed at OFAC screening gaps within BRB's BaaS transaction processing environment. The MRIA identified that BRB had not demonstrated that one hundred percent of BaaS-channel transactions were being screened against applicable OFAC sanctions lists. The MRIA required BRB to develop and implement a plan to ensure comprehensive OFAC screening coverage for all BaaS transaction flows. As noted above, the Bank's response to this MRIA — under the direction of its then-outside counsel, Drayton Mercer LLP — was inadequate, and the NovaPay screening gap persisted through the remainder of calendar year 2023 and, potentially, into calendar year 2024.
March 2024 – September 2024: OCC Targeted BSA/AML Examination. Beginning in March 2024, the OCC conducted a targeted BSA/AML examination of BRB, with a particular focus on the Bank's OFAC screening protocols for BaaS transaction flows. This examination was conducted by the OCC's Northeastern District Office, under the direction of Examiner-in-Charge Jonathan Frey, National Bank Examiner, stationed at 340 Madison Avenue, New York, New York 10017. The examination extended over approximately six months and involved extensive on-site review of BRB's screening systems, transaction records, and compliance documentation. It was during this examination that the full scope of the NovaPay screening gap was identified and quantified.
January 15, 2025: Consent Order No. OCC-2025-003. On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB. The Consent Order cited, among other deficiencies, BRB's inadequate OFAC screening protocols for fintech BaaS transaction flows and specifically identified the NovaPay screening gap. The Consent Order imposed a civil money penalty ("CMP") of $14,500,000, payable by March 16, 2025, and required BRB to undertake a comprehensive remediation program, including the engagement of an OCC-approved independent consultant, the development and submission of a comprehensive remediation action plan, and the establishment of a Board-level compliance committee, among other requirements.
The Consent Order is a public document. BRFG publicly disclosed the Consent Order on January 16, 2025, triggering a significant decline in BRFG's stock price and attracting shareholder and market scrutiny, as discussed further in Section IV.C below.
D. Current OFAC Screening Program Statistics
To provide context for the screening gap and BRB's overall OFAC compliance posture, the following statistics summarize the Bank's current OFAC screening program operations:
• OFAC Screening Hits, CY 2024: BRB's Veridian TMS v.8.3 system generated a total of 14,320 OFAC screening hits during calendar year 2024. Of those, twelve (12) were determined to be true matches requiring blocking action or transaction rejection. The remaining 14,308 hits were resolved as false positives, yielding a false-positive rate of approximately 99.9% ((14,320 − 12) ÷ 14,320).
• Last Independent Validation of Veridian TMS v.8.3: The most recent independent validation of BRB's Veridian TMS v.8.3 system was conducted in March 2021, more than three years prior to the OCC's targeted examination. OFAC expects financial institutions to conduct regular, independent testing and validation of their sanctions screening systems. A validation gap of this duration is a significant deficiency that OFAC would likely consider an aggravating factor.
• Last Tuning of Screening Parameters: The Veridian TMS v.8.3 screening parameters (including fuzzy-matching thresholds, alias configurations, and list-matching algorithms) were last tuned in October 2022. Given the dynamic nature of OFAC's sanctions lists — which are updated frequently — the extended interval between tuning cycles represents an additional compliance deficiency.
• BSA/AML Department Staffing: As of January 2025, BRB's BSA/AML department employed sixty-two (62) full-time equivalents, under the direction of BSA Officer Thomas Ikeda, who was appointed to the position in March 2023. As part of the remediation, BRB is increasing BSA/AML headcount to seventy-seven (77) permanent FTEs, supplemented by thirty (30) temporary analysts provided by Pinnacle Compliance Solutions to support the retroactive lookback and remediation surge.
• Remediation in Progress: BRB is currently undertaking an upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, at a total cost of approximately $2,800,000 for implementation and $1,900,000 per year in incremental licensing fees (bringing the total annual contract value to $6,000,000 per year). The upgraded system includes an enhanced OFAC screening module with dedicated BaaS transaction-flow coverage. Full operationalization of OFAC screening for all BaaS channels is targeted for November 1, 2025.
E. Scope of Potentially Affected Transactions
The approximately 3,800,000 NovaPay transactions that were not screened against OFAC sanctions lists in calendar year 2023 represent the core factual predicate of BRB's potential OFAC enforcement exposure. The affected transactions encompassed both wire transfers and ACH payments (including both credits and debits). These transactions were processed, settled, and completed through BRB's systems without any screening against the SDN List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications List, or any other applicable OFAC non-SDN sanctions lists.
It is not presently known whether any of the 3,800,000 unscreened transactions involved sanctioned parties, comprehensively sanctioned jurisdictions, or blocked property. A retroactive screening lookback is underway as part of BRB's remediation efforts. The lookback involves batch-processing the historical transaction records through the Veridian TMS screening engine (using the most current OFAC sanctions lists as well as historical list vintages corresponding to the dates on which the transactions were processed) to identify any transactions that would have generated a screening hit and, upon investigation, may constitute apparent OFAC violations. The results of this retroactive lookback will be critical to quantifying BRB's actual enforcement exposure and will form a central component of any supplemental VSD filing.
Additionally, it should be noted that the potential for OFAC screening gaps in BaaS channels beyond NovaPay has not yet been fully quantified. Thornfield Consulting Group LLC, engaged as the OCC-mandated independent consultant, commenced its on-site assessment on March 1, 2025. A preliminary gap assessment encompassing all fourteen BaaS partner channels is due on April 15, 2025. If the Thornfield assessment identifies screening gaps affecting other BaaS partners, BRB's OFAC enforcement exposure could expand significantly beyond the NovaPay-related transactions addressed in this memorandum. This possibility reinforces the urgency of the VSD filing, as discussed in Sections V through VII below.
III. OFAC ENFORCEMENT FRAMEWORK — LEGAL ANALYSIS
A. OFAC's Statutory Authority
OFAC administers and enforces comprehensive economic and trade sanctions programs based on U.S. foreign policy and national security objectives. OFAC's primary statutory authorities derive from two principal legislative frameworks:
The International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq. IEEPA authorizes the President, upon declaration of a national emergency with respect to any unusual or extraordinary threat to the national security, foreign policy, or economy of the United States, to impose broad economic sanctions, including blocking the property and interests in property of designated persons and prohibiting transactions with such persons. The majority of OFAC's currently active sanctions programs — including those targeting Iran, Russia, North Korea, Cuba, Syria, and various transnational criminal organizations and terrorist groups — are authorized under IEEPA. Executive orders issued under IEEPA authority are implemented by OFAC through regulations codified in 31 C.F.R. Chapter V.
The Trading with the Enemy Act (TWEA), 50 U.S.C. § 4301 et seq. TWEA provides the President with authority to regulate economic transactions during times of war or declared national emergency. While IEEPA has largely superseded TWEA for most sanctions programs, TWEA continues to serve as the statutory basis for certain legacy programs, including the Cuba sanctions program (31 C.F.R. Part 515).
As a U.S. financial institution, BRB is subject to the full scope of OFAC's sanctions requirements. The Bank is obligated to screen all transactions processed through its systems — including those processed on behalf of BaaS partners — against OFAC's sanctions lists to ensure that no transactions involve Specially Designated Nationals, blocked persons, or prohibited jurisdictions. When a transaction involves a blocked person or property, BRB is required to block the transaction and file a blocking report with OFAC within ten (10) business days. When a transaction involves a prohibited activity that does not require blocking, BRB is required to reject the transaction and maintain records of the rejection.
Strict Liability. A critical feature of the OFAC enforcement regime is its strict liability standard. Under IEEPA and the regulations implementing OFAC's sanctions programs, a person — including a financial institution — may be held liable for an apparent violation regardless of whether the person had knowledge of or intent to violate the applicable sanctions program. In other words, it is not a defense that BRB did not intend to process transactions involving sanctioned parties or that the screening failure was the result of a systems error rather than deliberate evasion. If any of the 3,800,000 unscreened NovaPay transactions involved sanctioned parties or blocked property, the fact that those transactions were processed without screening constitutes, in and of itself, a basis for enforcement action — without any requirement that OFAC prove knowledge, intent, or willfulness.
Civil Penalties. IEEPA authorizes civil penalties of up to the greater of $356,579 per violation (as adjusted for inflation pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015) or twice the amount of the underlying transaction that is the basis of the violation. The magnitude of potential civil liability under this framework is substantial. Even if only a small fraction of the 3,800,000 unscreened transactions constituted apparent violations, the per-violation penalty amounts — or, in the case of high-value transactions, twice the transaction amount — could aggregate to an extraordinarily large sum. We address illustrative penalty calculations in Section IV below.
Criminal Penalties. Willful violations of IEEPA can result in criminal fines of up to $1,000,000 per violation and imprisonment of up to twenty (20) years. However, the facts presently available do not suggest that BRB's screening gap arose from willful sanctions evasion. The deficiency appears to be a systems-based integration error that was compounded by inadequate internal controls and a failure to remediate after regulatory notification. While the failure to act after the November 2023 MRIA is troubling, it is more indicative of institutional negligence or, at worst, recklessness than of willful intent to circumvent sanctions requirements. Accordingly, while criminal exposure cannot be entirely ruled out — particularly if the retroactive lookback reveals evidence of actual sanctions violations involving significant transaction volumes or high-risk counterparties — the present facts do not support a conclusion that criminal prosecution is likely. This assessment should be revisited as additional facts become available.
B. OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A)
OFAC evaluates apparent violations and determines the appropriate enforcement response on a case-by-case basis, applying the framework set forth in its Economic Sanctions Enforcement Guidelines, published as Appendix A to 31 C.F.R. Part 501 (the "Enforcement Guidelines"). The Enforcement Guidelines identify a range of possible enforcement responses, from no action to the imposition of civil monetary penalties, and articulate the factors that OFAC considers in determining the appropriate response in a given case.
General Factors. The Enforcement Guidelines set forth a non-exhaustive list of General Factors that OFAC considers in evaluating apparent violations. These factors are directly applicable to BRB's circumstances and include the following:
1. Voluntary Self-Disclosure. Whether the entity voluntarily self-disclosed the apparent violation to OFAC. As discussed in detail in Section III.C below, a voluntary self-disclosure is the single most significant mitigating factor under the Enforcement Guidelines and results in a presumptive reduction in the base penalty amount.
2. Willfulness or Recklessness. Whether the apparent violation was the result of willful or reckless conduct, as opposed to negligence, an inadvertent error, or a systems-based deficiency. Willful or reckless conduct is an aggravating factor that weighs in favor of a more severe enforcement response, including potential classification of the case as "Egregious." The failure to remediate the NovaPay screening gap after receipt of the November 2023 MRIA could be characterized by OFAC as reflecting recklessness, though BRB would argue that the failure was attributable to the inadequacy of its then-outside counsel's response rather than a deliberate disregard of the regulatory directive.
3. Sanctions Compliance Program. The existence, nature, and adequacy of the entity's sanctions compliance program at the time of the apparent violation. OFAC expects U.S. financial institutions to maintain robust, risk-based sanctions compliance programs that include, at a minimum: (a) management commitment; (b) risk assessment; (c) internal controls (including sanctions screening); (d) testing and auditing; and (e) training. BRB's sanctions compliance program suffered from multiple deficiencies at the time of the screening gap, including the system integration error, the absence of independent validation since March 2021, and the failure to tune screening parameters since October 2022. These deficiencies undermine BRB's ability to argue that it maintained an adequate sanctions compliance program.
4. Remedial Response. The speed, effectiveness, and comprehensiveness of the entity's remedial response upon learning of the apparent violation. BRB's remediation efforts — including the engagement of Calderwood & Harkness LLP, the Thornfield independent assessment, the Veridian TMS upgrade, the increase in BSA/AML staffing, and the Board-approved $42.5 million remediation budget — are substantial and will be viewed favorably by OFAC. However, the lag between the November 2023 MRIA and the commencement of meaningful remediation (not until after the Consent Order in January 2025) is a negative factor that will require careful framing.
5. Individual Characteristics of the Entity. The size, sophistication, and commercial activities of the entity, as well as its transaction volume with sanctioned countries or parties and its prior enforcement history. BRB's status as a $38.7 billion national bank with significant BaaS-related cross-border payment processing capabilities places it in a category of institutions from which OFAC expects a high standard of compliance. BRB has no prior OFAC enforcement history, which is a mitigating factor.
6. Harm to Sanctions Program Objectives. Whether the apparent violation resulted in actual harm to the objectives of the applicable sanctions program — for example, whether sanctioned parties or jurisdictions actually benefited from the unscreened transactions. This factor cannot be fully evaluated until the retroactive screening lookback is complete. If the lookback reveals no actual sanctions violations, this factor will weigh strongly in BRB's favor. If actual violations are identified, the harm to sanctions program objectives will depend on the nature, volume, and value of the affected transactions.
7. Cooperation with OFAC. Whether the entity cooperated with OFAC's investigation, including the timeliness, completeness, and accuracy of information provided to OFAC. A VSD filing is the most concrete and significant form of cooperation BRB can demonstrate. Conversely, the failure to file a VSD — particularly where the apparent violation is likely already known to OFAC through interagency channels — could be characterized as a lack of cooperation.
Penalty Matrix. The Enforcement Guidelines establish a penalty matrix that categorizes cases along two dimensions: (i) whether the case is classified as "Egregious" or "Non-Egregious," and (ii) whether the entity filed a voluntary self-disclosure. This matrix produces four quadrants, each with its own penalty range and typical enforcement response:
• Non-Egregious + VSD: The base penalty is typically capped at one-half of the applicable Schedule amount (the Schedule amount being determined by reference to the transaction value and number of apparent violations). In practice, OFAC frequently resolves cases in this quadrant through the issuance of a cautionary letter, a Finding of Violation, or a no-action determination, particularly where the entity demonstrates a robust compliance program and genuine remediation. This is the most favorable quadrant for BRB.
• Non-Egregious + No VSD: The base penalty may be set at up to the full applicable Schedule amount. The absence of a VSD eliminates the presumptive fifty percent penalty reduction and may signal to OFAC a lack of proactive cooperation.
• Egregious + VSD: The base penalty may be set at up to one-half of the applicable statutory maximum per violation. While the VSD still provides meaningful mitigation, the Egregious classification reflects a more serious evaluation of the underlying conduct and results in significantly higher potential penalties.
• Egregious + No VSD: The base penalty may be set at up to the full statutory maximum per violation. This is the most adverse quadrant and is reserved for cases involving the most egregious conduct, coupled with a failure to self-disclose.
Analysis and Application to BRB. Based on the facts presently available, C&H assesses that the NovaPay sanctions screening gap is most likely classifiable as Non-Egregious under the Enforcement Guidelines. The screening failure arose from a systems integration error — not from intentional sanctions evasion, deliberate circumvention of screening protocols, or a pattern of willful misconduct. BRB's overall OFAC screening program was operational for the majority of its transaction volume; the gap was specific to certain NovaPay batch ACH and wire message formats routed through a processing pathway that bypassed the screening queue.
However, we must candidly acknowledge factors that could push the analysis toward a more serious posture. The scale of the screening gap — 3.8 million transactions representing twelve percent of BRB's largest BaaS partner's total volume — is substantial. The failure to remediate after the November 2023 MRIA, when BRB had been placed on specific notice of OFAC screening deficiencies, could be characterized by OFAC as reckless rather than merely negligent. The extended intervals between independent system validations (last conducted March 2021) and parameter tuning (last conducted October 2022) further undermine BRB's compliance posture. If the retroactive screening lookback reveals actual sanctions violations — particularly involving high-risk jurisdictions or SDN-listed counterparties — the risk of an Egregious classification increases meaningfully.
For these reasons, the VSD filing is all the more critical. In the Non-Egregious + VSD quadrant, BRB has the strongest prospect of a favorable resolution. If the case were to be classified as Egregious — a risk that cannot be fully mitigated but can be reduced through comprehensive remediation and cooperation — the VSD would still provide substantial penalty reduction benefits.
C. OFAC's Voluntary Self-Disclosure Policy
The voluntary self-disclosure framework is the centerpiece of OFAC's incentive structure for encouraging compliance and cooperation by regulated entities. Under the Enforcement Guidelines, a voluntary self-disclosure to OFAC of an apparent violation is treated as the single most significant mitigating factor in OFAC's determination of the appropriate enforcement response.
Penalty Mitigation Benefits. For non-egregious cases, a VSD results in a presumption of a fifty percent (50%) reduction in the base penalty amount. Moreover, for non-egregious cases involving a VSD, OFAC will generally not impose a civil monetary penalty and will instead issue a cautionary letter, a no-action determination, or a Finding of Violation — provided the entity demonstrates (a) a robust sanctions compliance program (or is credibly implementing one), (b) genuine remediation of the underlying deficiency, and (c) full cooperation with OFAC throughout the process.
For egregious cases, a VSD still provides meaningful mitigation: the base penalty is capped at one-half of the applicable statutory maximum, as opposed to the full statutory maximum that would apply in the absence of a VSD.
Definition of "Voluntary." The Enforcement Guidelines define the circumstances under which a disclosure qualifies as "voluntary." A disclosure is voluntary when it is made to OFAC:
(a) Before the entity has reason to believe that OFAC, or any other federal, state, or local government agency or official, has learned of the apparent violation or is likely to learn of the apparent violation through an independent source (including through a third-party complaint, media report, regulatory referral, or other means);
(b) The disclosure is made to OFAC directly (as opposed to a disclosure to another regulatory agency, such as the OCC or FinCEN, which does not, standing alone, constitute a VSD to OFAC); and
(c) The disclosure is substantive — that is, the entity provides OFAC with meaningful information about the nature, scope, and circumstances of the apparent violation, rather than merely notifying OFAC that a potential issue may exist without providing supporting details.
Timeliness. OFAC expects that an initial voluntary self-disclosure will be made promptly after the entity discovers the apparent violation or has reason to believe that a violation may have occurred. The Enforcement Guidelines recognize that a complete factual investigation may take time, and accordingly permit entities to make an initial disclosure with the information then available, followed by supplemental disclosures as additional facts are developed. However, unreasonable delay in making the initial disclosure — even if justified by the desire to complete a full investigation — may undermine the "voluntary" character of the filing and reduce the mitigating credit that OFAC is willing to extend.
Critical Timing Issue for BRB. The timeliness and voluntariness of any VSD that BRB might file present the central strategic question in this analysis. The relevant facts are as follows:
• The Consent Order was issued by the OCC on January 15, 2025, and is a public document filed with the OCC's public enforcement action database.
• BRFG publicly disclosed the Consent Order on January 16, 2025, through a press release and current report on Form 8-K filed with the Securities and Exchange Commission.
• The Consent Order specifically identifies the NovaPay OFAC screening gap, including the finding that BRB's OFAC sanctions screening system failed to screen one hundred percent of transactions processed through its BaaS channels.
• Federal regulators, including the OCC, OFAC, and FinCEN, routinely share examination findings and enforcement information through interagency coordination channels. As discussed in Section III.D below, it is highly likely that OFAC is already aware of the Consent Order and the OFAC-related findings contained therein.
The question, therefore, is whether a VSD filed by BRB at this stage would still be considered "voluntary" within the meaning of the Enforcement Guidelines — or whether OFAC would deem that it had already learned of the apparent violation through independent sources (i.e., the public Consent Order and/or interagency information sharing), such that BRB's subsequent disclosure would not qualify for VSD treatment.
C&H's assessment is that a VSD filed promptly — within the next approximately thirty days — retains a high probability of being treated as voluntary and receiving the associated mitigating credit. Our reasoning is as follows:
First, the Consent Order is an OCC enforcement action that addresses a broad range of BSA/AML deficiencies. While the Consent Order references the OFAC screening gap, it is not itself an OFAC enforcement action and does not constitute a disclosure to OFAC by BRB. OFAC's VSD framework requires a direct disclosure to OFAC, and the existence of a public OCC enforcement action does not, by itself, preclude a subsequent VSD to OFAC.
Second, while interagency information sharing may have alerted OFAC to the general nature of BRB's compliance deficiencies, OFAC may not yet have received the detailed, transaction-level information that would be provided in a substantive VSD filing. A proactive, detailed, and well-documented VSD from BRB would provide OFAC with significantly more information than it would have obtained from the Consent Order alone, and this informational value is likely to be credited by OFAC in its assessment.
Third, OFAC has historically taken a pragmatic approach to the voluntariness determination. In prior enforcement actions, OFAC has credited entities that filed VSD submissions even in circumstances where the underlying conduct was partially known to regulators, provided the entity's disclosure was proactive, substantive, and accompanied by evidence of genuine remediation. The totality of BRB's cooperative posture — including the VSD, the Consent Order compliance, the Thornfield independent assessment, and the comprehensive remediation program — will weigh in BRB's favor.
Fourth, the alternative — declining to file a VSD — carries far greater risk. If BRB does not file a VSD and OFAC subsequently initiates its own investigation (as it almost certainly will, given the public nature of the Consent Order), BRB will have lost the single most significant mitigating factor available under the Enforcement Guidelines. The downside of filing — drawing OFAC's attention to an issue it may already be aware of — is minimal compared to the downside of not filing and forfeiting VSD credit.
Notwithstanding this assessment, C&H acknowledges that there is some residual risk that OFAC could decline to treat BRB's filing as a qualifying VSD, particularly if OFAC determines that it had already initiated an investigation or received a formal referral from the OCC prior to BRB's submission. This risk reinforces the urgency of filing promptly; each day that passes without a VSD increases the probability that OFAC will have taken independent action that would preclude VSD treatment.
D. OFAC and OCC Information Sharing
Federal banking regulators and Treasury bureaus maintain robust interagency information-sharing mechanisms. The OCC, OFAC, and FinCEN regularly coordinate on BSA/AML and sanctions-related matters, particularly in the context of significant enforcement actions involving nationally chartered banks. Several specific information-sharing pathways are relevant to BRB's situation:
OCC-OFAC Coordination. The OCC's examination process for BSA/AML and OFAC compliance frequently generates findings that are shared with OFAC, either through formal referral processes or through routine interagency coordination. When an OCC examination identifies a systemic OFAC screening failure — as occurred here — it is standard practice for the OCC to notify OFAC of the deficiency, particularly when the failure involves a volume of unscreened transactions as large as that at issue in BRB's case. The Consent Order itself, as a public document, provides OFAC with notice of the screening gap even absent a formal referral.
FinCEN Coordination. FinCEN, as the administrator of the Bank Secrecy Act, coordinates closely with both the OCC and OFAC on matters involving financial institution compliance. FinCEN's Associate Director for Enforcement, Angela Drummond, is separately monitoring BRB's SAR filing remediation and has expressly reserved FinCEN's enforcement rights in coordination with the OCC. FinCEN and OFAC are both bureaus within the U.S. Department of the Treasury and share information internally. It is reasonable to assume that information regarding BRB's compliance deficiencies — including the OFAC screening gap — is being shared between FinCEN and OFAC through intra-Treasury coordination channels.
The Consent Order as Public Notice. The Consent Order is a public document that has been the subject of press coverage and securities filings. OFAC's enforcement staff routinely monitors public enforcement actions involving financial institutions for sanctions-related findings. The specific reference to OFAC screening deficiencies in the Consent Order makes it virtually certain that OFAC's Compliance and Enforcement Division is aware of BRB's screening gap, whether or not the OCC has made a formal referral.
Implications for VSD Timing. The interagency information-sharing dynamic underscores the urgency of BRB's VSD decision. The longer BRB waits to file a VSD, the greater the probability that OFAC will have initiated its own enforcement inquiry — either based on a formal OCC referral, FinCEN coordination, or the Compliance and Enforcement Division's own monitoring of public enforcement actions. Once OFAC initiates an inquiry, BRB's ability to file a qualifying VSD is effectively foreclosed. The window for a credible VSD is narrowing, and prompt action is essential to preserve the mitigating benefits of self-disclosure.
It bears emphasis that the Consent Order, while imposing a $14,500,000 CMP payable to the OCC, does not resolve or preclude separate enforcement action by OFAC. The OCC's enforcement authority over nationally chartered banks is distinct from OFAC's authority to enforce sanctions compliance. The $14,500,000 CMP addresses the OCC's findings regarding BRB's overall BSA/AML and OFAC compliance program deficiencies; it does not address potential apparent violations of OFAC sanctions programs that may be identified through the retroactive screening lookback. BRB must approach the OFAC enforcement risk as a separate and independent exposure that requires its own strategic response.
IV. RISK ASSESSMENT — POTENTIAL OFAC PENALTY EXPOSURE
A. Scenario Analysis
BRB's potential OFAC penalty exposure is contingent upon the results of the retroactive screening lookback currently being conducted on the approximately 3,800,000 unscreened NovaPay transactions. Until those results are available, the analysis must necessarily proceed on the basis of scenarios reflecting different possible outcomes. C&H has identified three principal scenarios, ranging from the most favorable to the most adverse.
Scenario 1: No Actual Sanctions Violations in Unscreened Transactions. Under this scenario, the retroactive screening lookback of the 3,800,000 unscreened NovaPay transactions reveals that none of the transactions involved sanctioned parties, comprehensively sanctioned jurisdictions, or blocked property. In this case, the screening gap represents a compliance program deficiency — a failure to screen — but not an actual facilitation of prohibited transactions. OFAC's enforcement posture would be significantly less aggressive under this scenario. The absence of actual harm to sanctions program objectives is a mitigating factor under the Enforcement Guidelines. OFAC could still address the compliance program deficiency through a cautionary letter, a Finding of Violation, or a modest civil penalty directed at the systemic screening failure itself. However, the absence of actual violations would substantially reduce the likelihood of a significant monetary penalty and would make it far more likely that a VSD would result in a no-action determination or cautionary letter resolution.
Scenario 2: De Minimis Actual Sanctions Violations. Under this scenario, the retroactive lookback reveals a small number of transactions — for example, single-digit — that involved parties on the SDN list or counterparties located in comprehensively sanctioned jurisdictions (e.g., Iran, North Korea, Syria, Cuba, or certain regions subject to comprehensive sanctions under the Russia/Ukraine-related programs). Each such transaction would constitute a separate apparent violation of the applicable sanctions program. Even a handful of violations, when combined with the systemic nature of the screening failure, could result in meaningful civil penalties. Under IEEPA, each violation can trigger a penalty of up to $356,579 or twice the transaction value, whichever is greater. However, with a VSD and a Non-Egregious classification, OFAC would likely resolve the matter with penalties substantially below the statutory maximum, reflecting the mitigating factors discussed in Section V below.
Scenario 3: Significant Actual Sanctions Violations. Under this scenario, a material number of the unscreened transactions involved sanctioned parties or jurisdictions. Given the volume of unscreened transactions (3.8 million) and the nature of the NovaPay consumer payments and P2P transfer platform (which processes transactions involving a diverse user base), it is not implausible that a non-trivial number of transactions could be flagged during the retroactive lookback. If, for example, even one-tenth of one percent (0.1%) of the unscreened transactions involved sanctioned parties, that would equate to approximately 3,800 apparent violations. At the per-violation maximum of $356,579, the theoretical maximum penalty exposure under IEEPA would exceed $1.3 billion. In practice, OFAC would not impose penalties at or near the theoretical maximum, particularly in a case involving a VSD and a financial institution demonstrating comprehensive remediation. However, even a deeply discounted penalty assessment in a case involving thousands of apparent violations could reach tens or hundreds of millions of dollars, representing a material financial exposure for BRB and BRFG.
B. Estimated Penalty Range (Illustrative)
The following illustrative penalty calculations are provided to frame the potential financial exposure under each scenario. These calculations are necessarily approximate and are subject to significant uncertainty, as the actual penalty amount in any OFAC enforcement action depends on the specific facts and OFAC's exercise of its discretion in applying the Enforcement Guidelines.
Important Caveats. The figures above are illustrative only and should not be relied upon as predictions of OFAC's enforcement response. OFAC exercises broad discretion in setting penalty amounts and routinely settles cases at amounts significantly below the theoretical statutory maximum, particularly in cases involving a VSD, remediation, and cooperation. The actual penalty, if any, will depend on factors including the number, value, and nature of the apparent violations; the sanctions programs involved; the counterparties and jurisdictions at issue; BRB's cooperation and remediation; and OFAC's assessment of the overall egregiousness of the conduct.
Independence of OFAC Liability. It bears repeating that the $14,500,000 CMP assessed by the OCC under the Consent Order is an OCC enforcement action and does not resolve, offset, or mitigate BRB's potential OFAC liability. OFAC enforcement is independent of the OCC's supervisory enforcement authority. BRB should not assume that the OCC CMP will be credited against any OFAC penalty. However, in practice, OFAC may take into account the penalties already paid to other agencies as a mitigating factor when determining the appropriate enforcement response — particularly where the underlying conduct is substantially similar. BRB's counsel should argue that the totality of the financial impact on BRB (the $14.5 million OCC CMP, the $42.5 million remediation budget, and any additional OFAC penalty) should be considered in assessing the proportionality of any OFAC enforcement action.
C. Collateral Consequences
Beyond the direct financial exposure associated with potential OFAC civil penalties, BRB faces significant collateral consequences that compound the urgency of the VSD decision and the importance of securing the most favorable possible resolution with OFAC.
Reputational Impact. A separate, public enforcement action by OFAC — on top of the existing OCC Consent Order — would inflict compounding reputational damage on BRB and BRFG. The Consent Order disclosure on January 16, 2025 already resulted in a significant decline in BRFG's stock price, from approximately $47.82 to $41.15 per share — a decline of approximately 13.9%. As of the date of this memorandum, BRFG's market capitalization stands at approximately $8.58 billion. A second enforcement action, particularly one from OFAC — a regulator whose actions carry connotations of national security implications — would amplify negative market and media attention and could trigger further stock price declines, rating agency scrutiny, and counterparty concerns.
Shareholder Pressure. BRB and BRFG are already facing shareholder pressure in connection with the Consent Order. Brindoval Capital Partners LP, an institutional investor controlled by Managing Partner Julian Whitmore, holds an approximately 8.3% ownership stake in BRFG (approximately 14.9 million shares). Brindoval's outside counsel, Steven Briggs of Amberly Knox LLP (600 Third Avenue, New York, New York 10016), has communicated concern regarding the cost of remediation, the potential for additional enforcement fines, and the reputational impact on BRFG's franchise value and earnings trajectory. An OFAC enforcement action would intensify this pressure and could catalyze more aggressive shareholder activism, including potential demands for Board-level changes or strategic alternatives.
Securities Disclosure Implications. An OFAC enforcement action — or even the filing of a VSD that discloses a potential OFAC enforcement risk — would likely constitute a material development requiring disclosure under BRB's and BRFG's SEC reporting obligations. BRFG would need to assess whether an 8-K filing is required upon the filing of the VSD, and the matter would need to be addressed in BRFG's annual report on Form 10-K and in its proxy statement. The total remediation and enforcement outlay to date — $42.5 million in remediation costs plus $14.5 million in the OCC CMP, totaling $57.0 million — already represents a material financial commitment. The addition of potential OFAC penalties could further impact BRFG's financial statements and require adjustments to loss reserves and contingent liability disclosures.
BaaS Partnership Risk. OFAC enforcement scrutiny could have cascading effects on BRB's BaaS partnerships. Fintech partners — particularly NovaPay, FairLend Digital, and VaultEdge — may face increased regulatory scrutiny by association or may seek to renegotiate or terminate their BaaS relationships with BRB in response to OFAC enforcement action. BRB's BaaS revenue of $127.4 million in calendar year 2024 is at risk if multiple partners pursue alternatives. The loss of NovaPay alone, which represents forty-one percent of BaaS transaction volume, would constitute a significant revenue event.
Potential DOJ Interest. While no criminal referral has been made to the Department of Justice as of the date of this memorandum, C&H must note that a separate OFAC enforcement action could attract DOJ attention, particularly if the retroactive screening lookback reveals actual sanctions violations involving material transaction volumes, high-risk counterparties, or comprehensively sanctioned jurisdictions. DOJ's National Security Division and the U.S. Attorney's Office for the Southern District of New York have actively prosecuted sanctions violations in recent years, and BRB's profile — a large national bank with a systemic screening failure affecting millions of transactions — could be of interest. The VSD filing, while directed to OFAC, also serves a defensive purpose in the DOJ context: a demonstrated pattern of proactive disclosure, cooperation, and remediation is inconsistent with the willfulness and intent elements that DOJ must prove in a criminal sanctions prosecution.
V. MITIGATING FACTORS FAVORING A VSD FILING
A. OFAC's Framework Rewards Self-Disclosure
As detailed in Section III above, a voluntary self-disclosure is the single most significant mitigating factor under OFAC's Enforcement Guidelines. The framework is explicitly designed to incentivize self-reporting: entities that come forward proactively receive substantially more favorable treatment than those whose violations are discovered through other means. This is not merely a theoretical benefit; it is a concrete, quantifiable advantage that has been consistently applied across OFAC's enforcement actions.
In the Non-Egregious + VSD quadrant — which, based on the facts presently available, is the most likely classification for BRB's case — the presumptive fifty percent penalty reduction is applied to the base penalty, and OFAC frequently resolves such cases without imposing any civil monetary penalty at all. In a significant number of Non-Egregious + VSD cases, OFAC has issued cautionary letters or no-action letters, effectively closing the matter without a public enforcement action. This outcome would be the most favorable possible resolution for BRB, as it would avoid the reputational and collateral consequences of a public OFAC penalty.
Even if OFAC is partially aware of the NovaPay screening gap through the Consent Order and interagency channels, a proactive, detailed, and substantive VSD filing demonstrates good faith, cooperation, and a genuine commitment to compliance. OFAC's enforcement staff have historically credited entities that take affirmative steps to come forward, even in circumstances where the underlying conduct was not entirely unknown to the government. The informational value of a well-prepared VSD submission — providing OFAC with detailed transaction data, root cause analysis, and remediation documentation — goes well beyond what OFAC would have learned from the Consent Order alone and constitutes a meaningful act of cooperation.
B. BRB's Remediation Efforts
BRB has commenced a comprehensive remediation program that, when viewed in its totality, demonstrates the institutional commitment to compliance that OFAC weighs heavily in its enforcement analysis. The key elements of this remediation include:
Engagement of Specialized Outside Counsel. Calderwood & Harkness LLP was engaged on February 10, 2025, to lead BRB's comprehensive BSA/AML and sanctions compliance-program uplift. C&H's Banking & Finance Practice Group and Litigation Practice Group bring deep experience in OFAC enforcement matters and regulatory remediation to the engagement. The engagement of experienced outside counsel is one of the first steps that OFAC expects an institution to take upon identifying a potential compliance failure.
Independent Consultant Engagement. Thornfield Consulting Group LLC was engaged as the OCC-mandated independent consultant pursuant to the terms of the Consent Order, with OCC non-objection received on February 5, 2025. The Thornfield engagement (reference TCG-BRB-2025-001) is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with sanctions-specific expertise provided through Jennifer Hwang, Director, Sanctions & OFAC Compliance. Thornfield commenced its on-site assessment on March 1, 2025, and its preliminary gap assessment is due April 15, 2025. The engagement of an independent consultant of Thornfield's caliber — with specific OFAC subject-matter expertise — demonstrates that BRB is taking the sanctions compliance deficiency seriously and has committed resources to an independent, objective assessment of the scope of the problem.
System Upgrade. BRB is undertaking a significant technology investment in the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, at a total implementation cost of approximately $2,800,000 and an incremental annual licensing cost of $1,900,000 (bringing the total annual contract value to $6,000,000). The upgraded system includes an enhanced OFAC screening module specifically designed to ensure comprehensive coverage of all BaaS transaction flows, including the batch ACH and wire message formats that bypassed the screening queue under the prior version. Full operationalization of the Veridian TMS v.10.0 OFAC screening capability for all BaaS channels is targeted for November 1, 2025, following a planned user acceptance testing ("UAT") completion date of August 1, 2025.
Board-Approved Remediation Budget. BRB's Board of Directors has approved a remediation budget of $42.5 million, exclusive of the $14.5 million OCC CMP, bringing the total remediation and enforcement outlay to $57.0 million. This level of financial commitment underscores the seriousness with which BRB's Board and senior management are approaching the remediation and provides tangible evidence of institutional resources being devoted to compliance enhancement.
Board-Level Governance Enhancements. In compliance with the Consent Order, BRB has established a dedicated Compliance Committee of the Board of Directors, chaired by James Rutherford. The Board Resolution establishing the Compliance Committee was required by February 28, 2025. The creation of a dedicated Board-level compliance committee is a governance best practice that OFAC recognizes as evidence of management commitment — one of the five essential components of an effective sanctions compliance program identified in OFAC's Framework for Compliance Commitments.
Organizational Enhancements. BRB is increasing its BSA/AML department staffing from sixty-two (62) to seventy-seven (77) permanent full-time equivalents. Additionally, thirty (30) temporary analysts from Pinnacle Compliance Solutions hav

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

I. EXECUTIVE SUMMARY

II. BACKGROUND AND FACTUAL SUMMARY

V. MITIGATING FACTORS FAVORING A VSD FILING

Record

Parties

Dates

Amounts