PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT WORK PRODUCT

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT WORK PRODUCT
OFAC SANCTIONS SCREENING PROCEDURES MANUAL
Belmont Ridge Bank National Association
Operational Procedures for OFAC Sanctions Screening
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No.: 1045-00002
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
OCC Charter No.: 48271 FDIC Certificate No.: 31845
March 2025
Version 1.0 (Draft for Internal Review)
Prepared in connection with: Remediation of OCC Consent Order No. OCC-2025-003 (January 15, 2025)
Primary Authors: Philip Hartmann (Responsible Partner), Yuki Nakamura (Lead Associate), Carlos Espinoza (Working Associate)
Distribution: Gregory Nardone (General Counsel, BRB); Patricia Langston (Chief Compliance Officer, BRB); Thomas Ikeda (BSA Officer / AML Program Director, BRB); Linda Petrosian (CIO/CTO, BRB); Warren Ashby (Head of Fintech Partnerships / BaaS Division, BRB)
This document is protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Belmont Ridge Bank National Association in connection with the provision of legal advice. This document should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Belmont Ridge Bank National Association. Inadvertent disclosure of this document does not constitute a waiver of any applicable privilege or protection.
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose
This OFAC Sanctions Screening Procedures Manual (the "Manual") establishes the comprehensive operational procedures governing the screening of all transactions, customers, and counterparties against sanctions lists administered by the Office of Foreign Assets Control ("OFAC") of the United States Department of the Treasury at Belmont Ridge Bank National Association ("BRB" or "Belmont Ridge" or the "Bank"). This Manual is designed to ensure that 100% of all transactions, customers, and counterparties are screened against all applicable OFAC-administered sanctions lists across all BRB business lines and channels, without exception.
This Manual has been developed by Calderwood & Harkness LLP ("C&H") as part of the comprehensive Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025. The Consent Order identified significant deficiencies in BRB's OFAC sanctions screening program, including the core deficiency described below, and required the Bank to develop and implement enhanced sanctions screening procedures within prescribed timeframes.
This Manual replaces all prior OFAC screening procedures, policies, desk procedures, and operational guidelines effective upon formal adoption by the Bank's BSA Officer and Chief Compliance Officer. All prior OFAC screening procedures are hereby superseded in their entirety. To the extent any previously existing procedure conflicts with the provisions of this Manual, the provisions of this Manual shall control.
The core deficiency identified in the Consent Order that this Manual is designed to remediate is as follows: BRB's OFAC screening system failed to screen 100% of transactions processed through the Bank's fintech Banking-as-a-Service ("BaaS") channels. Specifically, the OCC examination determined that approximately 12% of transactions originated by NovaPay Technologies Inc. ("NovaPay"), the Bank's largest BaaS partner by transaction volume, were not screened against OFAC sanctions lists during calendar year 2023. This represented approximately 3,800,000 of the approximately 31,700,000 total NovaPay transactions processed through BRB's charter in CY 2023. The failure to screen these transactions constituted a significant violation of BRB's obligations under applicable sanctions laws and regulations and exposed the Bank to material regulatory, legal, and reputational risk.
This Manual is intended to ensure that such screening gaps are identified, remediated, and prevented from recurring. It establishes the operational framework, technical requirements, staffing allocations, oversight mechanisms, escalation protocols, and reporting obligations necessary to achieve and maintain full OFAC sanctions screening compliance.
1.2 Scope
This Manual applies to all BRB business lines, divisions, and operating units, including but not limited to:
1.  Retail Banking — All consumer deposit accounts, consumer lending, and consumer payment services offered directly by BRB.
2.  Commercial Lending — All commercial and industrial lending, commercial real estate lending, and treasury management services offered by BRB to business customers.
3.  Wealth Management — All investment advisory, trust, and fiduciary services offered by BRB's wealth management division.
4.  Banking-as-a-Service (BaaS) Fintech Partnerships — All transactions, accounts, and services originated or processed through BRB's 14 active BaaS fintech partners operating under BRB's national banking charter.
This Manual covers all transaction types processed by or through BRB, including:
•  Wire transfers, both domestic (Fedwire) and international (SWIFT/CHIPS);
•  Automated Clearing House ("ACH") transactions, including both originations and receipts;
•  Card transactions, including debit card and credit card authorizations and settlements;
•  Check processing, including check deposits and check disbursements;
•  Loan originations and disbursements, including both direct BRB lending and lending originated through BaaS partners; and
•  All BaaS partner transaction flows, regardless of transaction type, product, or channel.
With respect to BaaS partner transaction flows, this Manual applies to all 14 active BaaS fintech partners, with particular attention to the three largest partners by transaction volume:
•  NovaPay Technologies Inc. — Representing approximately 41% of total BaaS transaction volume, with approximately $30.5 billion in transactions processed through BRB's charter in CY 2024;
•  FairLend Digital LLC — Representing approximately 28% of total BaaS transaction volume; and
•  VaultEdge Inc. — Representing approximately 18% of total BaaS transaction volume.
These three partners collectively account for approximately 87% of BRB's total BaaS transaction volume. Total BaaS transaction volume in CY 2024 was approximately $74.3 billion.
This Manual encompasses all stages and types of OFAC sanctions screening, including:
•  Customer onboarding screening (at account opening or establishment of the customer relationship);
•  Transaction screening (real-time screening at the point of transaction initiation);
•  Recurring and periodic re-screening of the Bank's existing customer database;
•  Event-driven re-screening triggered by changes in customer information, sanctions lists, or other circumstances; and
•  Name screening for all parties to a transaction, including originators, beneficiaries, intermediary banks, and any other parties whose names or identifying information are available.
1.3 Regulatory Framework
BRB's OFAC sanctions screening program is governed by the following laws, regulations, executive orders, and regulatory guidance:
Federal Statutes:
•  International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, which provides the President with broad authority to impose economic sanctions in response to national security threats;
•  Trading with the Enemy Act ("TWEA"), 50 U.S.C. §§ 4301–4341, which authorizes sanctions with respect to countries and nationals with which the United States is at war or in a declared national emergency;
•  Bank Secrecy Act ("BSA"), 31 U.S.C. § 5311 et seq., and its implementing regulations, which establish the framework for BSA/AML compliance programs at financial institutions;
•  Various executive orders imposing sanctions against specific countries, regions, persons, and entities, as administered by OFAC.
Federal Regulations and Guidance:
•  OFAC regulations codified in 31 C.F.R. Chapter V, including country-specific and program-specific sanctions regulations;
•  OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. Part 501, Appendix A, which set forth the framework OFAC uses in determining appropriate enforcement responses to apparent sanctions violations;
•  OCC regulations and supervisory guidance on sanctions compliance, including OCC Bulletin 2002-16 and subsequent guidance;
•  Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual, specifically the OFAC Procedures section, which provides the examination framework used by the OCC in evaluating financial institutions' sanctions compliance programs.
Consent Order:
•  OCC Consent Order No. OCC-2025-003, issued January 15, 2025, specifically Article III (OFAC Sanctions Screening Remediation), which requires BRB to develop, implement, and maintain enhanced OFAC screening procedures addressing the identified deficiencies.
BRB is subject to strict liability for apparent violations of OFAC sanctions, meaning that sanctions violations may result in enforcement action regardless of whether the Bank had knowledge of or intent to violate sanctions laws. This strict liability standard underscores the critical importance of maintaining comprehensive and effective OFAC screening procedures.
1.4 Relationship to Other BRB Policies and Documents
This Manual is part of a suite of interrelated BSA/AML and sanctions compliance documents developed or revised as part of the comprehensive compliance-program uplift mandated by the Consent Order. This Manual provides operational-level procedures implementing the enterprise-wide OFAC Compliance Policy and should be read in conjunction with the following documents:
•  Revised OFAC Compliance Policy (Enterprise-Wide): The overarching policy document establishing BRB's commitment to OFAC compliance, governance framework, and risk appetite for sanctions risk. This Manual operationalizes that policy.
•  Revised SAR Policy & Procedures: Procedures governing the identification, investigation, and filing of Suspicious Activity Reports, including SARs related to OFAC screening activity and potential sanctions evasion.
•  Revised CDD/EDD Policy: Procedures governing Customer Due Diligence and Enhanced Due Diligence, including the collection and verification of customer identifying information that is essential for effective OFAC screening.
•  BaaS Compliance Oversight Framework: The comprehensive framework governing BRB's compliance oversight of all BaaS fintech partners, including OFAC screening obligations, data-sharing requirements, and escalation protocols.
•  BaaS Partner CDD/EDD Responsibility Matrix: The document delineating the allocation of CDD/EDD responsibilities between BRB and each BaaS partner, with particular relevance to the collection of customer data necessary for OFAC screening.
This Manual is subject to review and validation by Thornfield Consulting Group LLC ("Thornfield"), the independent consultant retained by BRB pursuant to the Consent Order (engagement reference TCG-BRB-2025-001). The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director, with OFAC-specific review conducted by Jennifer Hwang, Director, Sanctions & OFAC Compliance. Thornfield's validation of this Manual and the underlying screening procedures is a required deliverable under the Consent Order.
SECTION 2: DEFINITIONS AND KEY TERMS
2.1 Glossary
The following terms, when used in this Manual, have the meanings set forth below:
BaaS (Banking-as-a-Service): The business model through which BRB provides its national banking charter, regulatory infrastructure, and banking services to fintech partners, who in turn offer financial products and services to their end customers. BRB currently maintains 14 active BaaS fintech partnerships.
Batch Screening: OFAC sanctions screening performed on accumulated transactions, customer records, or other data sets at scheduled intervals, as distinguished from real-time screening. Batch screening is used for periodic re-screening of the customer database and for retroactive screening in the event of system outages or list update delays.
blocking: The freezing of assets, funds, or other property interests of persons or entities identified on the Specially Designated Nationals and blocked Persons List ("SDN List") or otherwise subject to blocking under applicable OFAC sanctions programs. Blocked property must be segregated and may not be released, transferred, or otherwise dealt in without specific authorization (license) from OFAC.
BSA Officer: Thomas Ikeda, BRB's BSA Officer and AML Program Director, who serves as the designated individual with overall responsibility for the Bank's BSA/AML and OFAC compliance programs, including the OFAC screening program governed by this Manual.
CCO (Chief Compliance Officer): Patricia Langston, BRB's Chief Compliance Officer, who exercises executive oversight of the OFAC compliance program and reports to the Compliance Committee and Board of Directors on sanctions compliance matters.
Consolidated Sanctions List: The aggregated list maintained by OFAC that combines the SDN List, the Sectoral Sanctions Identifications List, and other OFAC-administered lists into a single searchable resource. BRB screens against the full Consolidated Sanctions List and its component parts.
False Positive: A screening hit that, upon investigation and review, is determined not to be a match to an OFAC-listed person, entity, vessel, or aircraft. In CY 2024, BRB experienced a false-positive rate of approximately 99.9%, with 14,308 false positives out of 14,320 total OFAC screening hits. The calculation is as follows: (14,320 total hits minus 12 confirmed true matches) divided by 14,320 total hits equals approximately 99.9%.
Non-SDN Lists: OFAC-administered lists other than the SDN List, including but not limited to the Non-SDN Palestinian Legislative Council List, the Non-SDN Menu-Based Sanctions List ("NS-MBS List"), the Foreign Sanctions Evaders List ("FSE List"), the Correspondent Account or Payable-Through Account Sanctions List ("CAPTA List"), and the Non-SDN Communist Chinese Military Companies List ("NS-CMIC List").
OFAC (Office of Foreign Assets Control): The office within the United States Department of the Treasury responsible for administering and enforcing economic and trade sanctions based on U.S. foreign policy and national security goals.
Real-Time Screening: OFAC sanctions screening performed at the point of transaction initiation, before the transaction is completed, settled, or released. Real-time screening is the primary screening methodology for transaction screening under this Manual.
Rejection: The denial and non-processing of a transaction that cannot be completed due to the involvement of a sanctioned party or prohibited jurisdiction, where blocking is not applicable (e.g., transactions involving comprehensively sanctioned countries where the transaction does not involve an interest in property that can be blocked).
Screening Hit: Any potential match identified by the automated screening system between a screened name or other data element and an entry on an OFAC-administered sanctions list. A screening hit requires investigation and disposition by a trained OFAC analyst.
SDN List (Specially Designated Nationals and blocked Persons List): The primary OFAC sanctions list identifying individuals, entities, vessels, and aircraft whose property and interests in property are blocked, and with whom U.S. persons are generally prohibited from dealing.
SSI List (Sectoral Sanctions Identifications List): The OFAC list identifying persons operating in certain sectors of the Russian economy, subject to specific prohibitions under Executive Order 13662 and related directives.
TMS (Transaction Monitoring System): BRB's transaction monitoring system, provided by Veridian Analytics Inc. The current version is Veridian TMS v.8.3 with an integrated OFAC screening module; the system is being upgraded to Veridian TMS v.10.0 with an enhanced OFAC screening module as part of the remediation program.
True Match: A screening hit that, upon investigation and review, is confirmed to be a match to an OFAC-listed person, entity, vessel, or aircraft. True matches require immediate blocking or rejection action and regulatory reporting.
2.2 Acronyms
The following acronyms are used throughout this Manual:
SECTION 3: OFAC SANCTIONS LIST MANAGEMENT
3.1 List Sources and Updates
BRB screens all transactions, customers, and counterparties against the following OFAC-administered sanctions lists:
1.  Specially Designated Nationals and blocked Persons List (SDN List) — The primary OFAC list identifying individuals, entities, vessels, and aircraft whose property and interests in property are blocked.
2.  Consolidated Sanctions List — The aggregated list combining the SDN List and other OFAC-administered lists.
3.  Sectoral Sanctions Identifications List (SSI List) — Identifying persons operating in specified sectors of the Russian economy subject to sectoral sanctions.
4.  Foreign Sanctions Evaders List (FSE List) — Identifying foreign persons who have been determined to have violated, attempted to violate, conspired to violate, or caused a violation of U.S. sanctions against specified countries.
5.  Non-SDN Palestinian Legislative Council List (NS-PLC List) — Identifying members of the Palestinian Legislative Council who were combatants or combatants in the January 2006 elections.
6.  Correspondent Account or Payable-Through Account Sanctions List (CAPTA List) — Identifying foreign financial institutions subject to correspondent or payable-through account sanctions.
7.  Non-SDN Communist Chinese Military Companies List (NS-CMIC List) — Identifying Communist Chinese military companies subject to certain prohibitions on securities transactions.
8.  Non-SDN Menu-Based Sanctions List (NS-MBS List) — Identifying persons subject to certain menu-based sanctions imposed under various executive orders.
OFAC publishes updates to these lists on a rolling basis, without a fixed or predictable schedule. List updates may occur at any time, including additions of new designations, modifications to existing entries, and removals (delistings). It is imperative that BRB's screening system incorporate all list updates on a timely basis to ensure that screening is conducted against the most current available information.
BRB's primary screening platform, the Veridian Analytics Inc. Transaction Monitoring System ("Veridian TMS"), must incorporate all OFAC list updates within 24 hours of publication by OFAC. This 24-hour standard applies to the current system (Veridian TMS v.8.3) and will continue to apply to the upgraded system (Veridian TMS v.10.0). Veridian Analytics Inc., located at 1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303, is responsible for providing automated list update feeds to BRB's screening system. The key Veridian contact for list management and system support is Priya Subramanian, Vice President of Client Solutions.
The contractual basis for Veridian's list update obligations is set forth in Veridian Contract No. VA-BRB-2023-0044. The current annual contract value under this agreement is $4,100,000 per year. Following the planned upgrade to Veridian TMS v.10.0 with the enhanced OFAC screening module, the annual contract value will increase to $6,000,000 per year, reflecting the incremental annual licensing cost of $1,900,000 associated with the enhanced module.
3.2 List Update Verification Procedures
The OFAC Screening Unit, which operates within the BSA/AML department under the supervision of BSA Officer Thomas Ikeda, is responsible for verifying the timely and accurate ingestion of all OFAC list updates into the Veridian screening system. Verification must be performed daily and must include the following steps:
1.  List Version Number Confirmation: The OFAC Screening Unit verifies that the list version number reflected in the Veridian system matches the most recently published version number on OFAC's website (OFAC.gov).
2.  Date Stamp Verification: The OFAC Screening Unit confirms that the list date stamp in the Veridian system reflects the most recent OFAC publication date.
3.  Record Count Comparison: The OFAC Screening Unit compares the total number of records in the ingested list against the record count published by OFAC to ensure completeness. Any discrepancy in record count triggers an immediate investigation.
4.  System Log Review: The OFAC Screening Unit reviews the Veridian system's automated list update logs to confirm successful ingestion, including the timestamp of the update, any error messages, and confirmation of list activation within the screening engine.
Any list update delay exceeding 24 hours from the time of OFAC publication constitutes a critical compliance event and triggers immediate escalation to the BSA Officer (Thomas Ikeda) and the CIO/CTO (Linda Petrosian). The escalation must include an assessment of whether any transactions were processed during the delay period that should have been screened against the updated list, and if so, the initiation of retroactive batch screening procedures in accordance with Section 6.2 of this Manual.
A comprehensive log of all list updates, including the date and time of OFAC publication, the date and time of ingestion into the Veridian system, the list version number, the record count, and the identity of the OFAC Screening Unit analyst who performed the verification, must be maintained in the OFAC screening system and archived for a minimum of five years from the date of each entry.
3.3 Supplemental and Internal Watchlists
In addition to the OFAC-administered sanctions lists described in Section 3.1, BRB maintains an internal supplemental watchlist that is screened in conjunction with the OFAC lists. The internal supplemental watchlist incorporates intelligence derived from the following sources:
•  Suspicious Activity Reports ("SARs") filed by BRB, including SARs identifying individuals or entities suspected of sanctions evasion or other financial crimes with a potential nexus to sanctioned parties or jurisdictions;
•  Law enforcement inquiries and subpoenas received by BRB, to the extent that such inquiries identify persons or entities of interest in the sanctions context;
•  Negative media reports and adverse information identified through BRB's ongoing monitoring and due diligence processes; and
•  Reports, alerts, and intelligence provided by BaaS partners regarding their customers or transaction activity that may be relevant to sanctions compliance.
The internal supplemental watchlist is not a substitute for OFAC-administered lists but serves as an additional screening layer to identify potential sanctions risks that may not yet be reflected in OFAC designations. Entries on the internal watchlist are screened using the same fuzzy matching algorithms and match-score thresholds applicable to OFAC list screening.
Maintenance of the internal supplemental watchlist is the responsibility of the OFAC Screening Unit, under the oversight of the BSA Officer. Additions to and removals from the internal watchlist must be documented with a supporting rationale and approved by a Senior OFAC Analyst. The internal watchlist is reviewed quarterly by the BSA Officer to ensure its continued accuracy and relevance.
SECTION 4: SCREENING TECHNOLOGY PLATFORM
4.1 Current System
BRB's primary OFAC sanctions screening platform is the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"), with an integrated OFAC screening module. The Veridian TMS serves as the enterprise-wide platform for both transaction monitoring (BSA/AML) and OFAC sanctions screening.
The OCC examination that resulted in the Consent Order identified critical deficiencies in the Veridian TMS v.8.3 OFAC screening module. Specifically, the system failed to screen 100% of transactions processed through BRB's BaaS channels. The most significant gap involved NovaPay Technologies Inc., BRB's largest BaaS partner by transaction volume. Approximately 12% of NovaPay wire transfer and ACH transactions — representing approximately 3,800,000 of 31,700,000 total NovaPay transactions in CY 2023 — were processed through BRB's charter without being screened against OFAC sanctions lists. This screening gap was attributable to a combination of system integration deficiencies, incomplete API connectivity between the NovaPay transaction platform and the Veridian OFAC screening module, and inadequate monitoring controls that failed to detect the coverage shortfall.
In addition to the screening coverage gap, the OCC examination identified that the last independent model validation of the Veridian TMS (including its OFAC screening module) was performed in March 2021, more than three years prior to the examination. This exceeded the maximum three-year validation cycle recommended by OCC supervisory guidance and the FFIEC BSA/AML Examination Manual. Furthermore, the match-score thresholds and fuzzy-matching tuning parameters within the OFAC screening module had not been updated since October 2022, raising questions about the continued appropriateness of the system's screening sensitivity.
These deficiencies are the subject of active remediation under the Consent Order, as described in Section 4.2 below.
4.2 Planned System Upgrade
As a central component of the OFAC screening remediation program, BRB is upgrading its screening platform to Veridian TMS version 10.0 ("Veridian TMS v.10.0") with an enhanced OFAC screening module. The enhanced module includes improved fuzzy matching algorithms, expanded data-field screening capabilities, real-time API integration architecture designed to support 100% coverage of all BaaS partner transaction flows, and enhanced audit trail and reporting functionality.
The financial parameters of the upgrade are as follows:
•  One-time implementation cost: $2,800,000
•  Incremental annual licensing cost: $1,900,000 per year (increasing the total annual contract value from $4,100,000 to $6,000,000 per year)
The remediation timeline for the system upgrade is as follows:
These milestones are aligned with the deadlines established in the Consent Order, Article III (OFAC Sanctions Screening Remediation), and any delay in meeting these milestones must be immediately escalated to the BSA Officer, CCO, General Counsel, and outside counsel (Calderwood & Harkness LLP).
As a contingency measure, BRB has engaged in preliminary evaluation of an alternative screening platform offered by Ridgeline Data Systems LLC, located at 500 West Monroe Street, Suite 2800, Chicago, IL 60661. The key contact at Ridgeline is David Marchetti, Chief Revenue Officer. The proposed Ridgeline platform would carry an annual cost of approximately $7,200,000 per year under a five-year term. This contingency evaluation is ongoing and would be activated only if the Veridian upgrade fails to meet the prescribed remediation milestones.
4.3 System Configuration Requirements
Whether operating under the current Veridian TMS v.8.3 or the upgraded Veridian TMS v.10.0, BRB's OFAC screening system must meet the following minimum configuration requirements:
Matching Algorithm: The system must employ a fuzzy matching algorithm with configurable match-score thresholds for name screening. The fuzzy matching algorithm must be capable of identifying potential matches despite variations in spelling, transliteration, abbreviation, name order, and the use of aliases or alternative names.
Data Field Screening: The system must support screening across multiple data fields, including but not limited to: full legal name, all known aliases and alternative names (AKAs, DBAs, formerly known as), country of citizenship, residence, or incorporation, date of birth (for individuals), identification numbers (passport numbers, national identification numbers, tax identification numbers), vessel names and identification numbers, and physical addresses.
Real-Time API Integration: The system must provide real-time API integration with all transaction processing platforms used by BRB, including BRB's direct banking systems and all 14 BaaS partner transaction platforms. The API integration must ensure that every transaction is submitted to the OFAC screening engine before it is processed, settled, or released.
Batch Screening Capabilities: The system must support batch screening for periodic re-screening of customer databases and retroactive screening of transactions processed during any period of system outage or list update delay.
Audit Trail: The system must generate and retain a complete audit trail for every screening event, including: the unique transaction or customer identifier, the lists screened and list version, the match score, the disposition (if a hit was generated), the identity of the reviewing analyst, and a precise timestamp for each event.
Zero-Bypass Architecture: The system must be configured to ensure that no transaction can proceed to settlement without OFAC screening confirmation. The system architecture must include technical controls that prevent any transaction from bypassing the OFAC screening queue, regardless of transaction type, channel, or BaaS partner.
4.4 System Monitoring and Performance
Continuous monitoring of the OFAC screening system is essential to ensure uninterrupted screening coverage and to detect any system issues that could result in screening gaps.
Daily Monitoring: The IT department, under the direction of CIO/CTO Linda Petrosian, and the OFAC Screening Unit, under the direction of BSA Officer Thomas Ikeda, jointly perform daily system health monitoring. Daily monitoring includes review of system uptime logs, screening queue status (to confirm no backlogs or bypasses), error logs, and list update ingestion status.
Transaction Throughput Monitoring: The OFAC Screening Unit monitors transaction throughput on a daily basis to ensure that the volume of transactions screened matches the volume of transactions processed across all channels. Any discrepancy between transactions processed and transactions screened is treated as a potential screening coverage gap and is investigated immediately.
Monthly Reporting: The OFAC Screening Unit prepares monthly system performance reports for the BSA Officer and CCO. Monthly reports include the following metrics:
•  Total volume of transactions screened, by channel and transaction type;
•  Percentage screening coverage by channel (target: 100%);
•  Total number of OFAC screening hits generated;
•  Hit disposition metrics (false positives, escalated cases, true matches);
•  System errors, downtime incidents, and resolution timeframes; and
•  List update timeliness metrics.
Quarterly Reporting: OFAC screening metrics are reported quarterly to the Compliance Committee, chaired by James Rutherford. Quarterly reports include cumulative metrics, trend analysis, and any significant issues or escalations during the reporting period.
SECTION 5: REAL-TIME TRANSACTION SCREENING PROCEDURES
5.1 Overview of Real-Time Screening
All transactions processed by or through BRB must be screened against all applicable OFAC sanctions lists in real time at the point of initiation, before the transaction is completed, settled, or released. Real-time screening is the primary screening methodology under this Manual and is essential to preventing prohibited transactions from being executed through BRB's systems and charter.
Real-time screening applies to all of the following transaction types:
•  Domestic and international wire transfers (Fedwire, SWIFT, CHIPS);
•  ACH originations and receipts;
•  Card authorization requests (debit and credit);
•  Loan disbursements (consumer, commercial, and BaaS partner originations);
•  Check processing (as applicable); and
•  All BaaS partner-originated transactions, regardless of type.
The total BaaS transaction volume in CY 2024 was approximately $74.3 billion across all 14 active BaaS partners. Every dollar of this volume must be screened in real time through BRB's OFAC screening system. The system must be capable of processing this volume without delays, backlogs, or bypasses. Screening latency targets are established in coordination with the CIO/CTO and are monitored as part of the daily system health review described in Section 4.4.
5.2 Wire Transfer Screening
All outbound and inbound wire transfers processed through BRB, whether transmitted via Fedwire, SWIFT, or CHIPS, must be screened against OFAC sanctions lists at the point of entry into BRB's wire transfer system. No wire transfer may be released for settlement if a screening hit is pending review.
The following data points are screened for each wire transfer:
•  Originator name and address;
•  Beneficiary name and address;
•  Intermediary bank names;
•  Reference fields and narrative text (for potential identification of sanctioned persons, entities, or jurisdictions); and
•  Country codes associated with all parties and routing information.
When a screening hit is generated on a wire transfer, the transaction is automatically placed in a hold queue within the OFAC screening system. The OFAC Screening Unit is immediately notified of the hold. The following review timeframes apply:
•  Priority Wire Transfers (international wires, wires above $50,000, and wires involving high-risk jurisdictions): Review and disposition must be completed within 2 hours of hit generation.
•  Standard Wire Transfers (all other wires): Review and disposition must be completed within 4 hours of hit generation.
If the hit is dispositioned as a false positive, the wire transfer is released from the hold queue and processed. If the hit is escalated or confirmed as a true match, the transaction remains held and the escalation and blocking/rejection procedures set forth in Sections 7, 9, and 11 of this Manual are followed.
5.3 ACH Transaction Screening
All ACH originations and incoming ACH transactions processed through BRB must be screened against OFAC sanctions lists before processing. Given the Consent Order's specific finding that NovaPay's peer-to-peer and payment transactions transmitted via ACH were inadequately screened in CY 2023, ACH screening procedures require particular rigor and attention.
NovaPay Technologies Inc., located at 450 Mission Street, Suite 1200, San Francisco, CA 94105, under the leadership of CEO Ethan Garrison, processes approximately 41% of BRB's total BaaS transaction volume, which equated to approximately $30.5 billion in CY 2024. A significant portion of NovaPay's transaction volume consists of ACH-originated peer-to-peer payments and bill payments. All ACH files received from NovaPay — and from every other BaaS partner — must pass through BRB's OFAC screening system prior to submission to the ACH network. No batch ACH file may be released to the ACH operator without screening confirmation.
The following data points are screened for each ACH transaction:
•  Originator/receiver name;
•  Account number, cross-referenced to BRB's customer database to obtain additional identifying information;
•  Routing number;
•  Transaction description and addenda records; and
•  Any additional identifying information available in the ACH file.
ACH screening hits are queued for review in the same manner as wire transfer hits, with the following review timeframes:
•  ACH originations: Review and disposition within 4 hours of hit generation (to accommodate ACH processing windows).
•  ACH receipts: Review and disposition within 4 hours of hit generation.
During the remediation period, NovaPay ACH files are subject to enhanced monitoring, including daily reconciliation of transaction count processed versus transaction count screened, to confirm 100% screening coverage with zero bypass.
5.4 Card Transaction Screening
Debit and credit card authorization requests processed through BRB are screened against OFAC sanctions lists at the point of authorization. Given the real-time nature of card authorization processing, the screening system must be capable of returning screening results within the card network's authorization response timeframe.
Card screening includes:
•  Cardholder name screening: The name associated with the card account is screened against OFAC lists.
•  Merchant name screening: The merchant name associated with the transaction is screened, where available.
•  Country-based screening: For international card transactions, the country code associated with the merchant or point of sale is screened against the list of comprehensively sanctioned countries and regions under applicable OFAC sanctions programs.
Card transactions that generate OFAC screening hits are declined at the point of authorization pending review. The OFAC Screening Unit reviews card hits within 8 hours. If the hit is dispositioned as a false positive, the cardholder's account is unflagged for future transactions with the same merchant (subject to whitelist procedures described in Section 8.2). If the hit is confirmed as a potential or true match, escalation and blocking/rejection procedures are followed.
5.5 BaaS Partner Transaction Screening — Special Procedures
This subsection establishes the enhanced screening procedures applicable to all transactions originated or processed through BRB's 14 active BaaS fintech partners. These procedures are of central importance given the Consent Order's focus on BaaS-related OFAC screening deficiencies.
Fundamental Principle: BRB Screens All BaaS Transactions. All transactions originated or processed through any BaaS partner must be screened by BRB's OFAC screening system, regardless of whether the BaaS partner has performed its own OFAC screening at the partner platform level. BRB retains ultimate responsibility for OFAC compliance as the OCC-chartered national bank through which these transactions are processed. Any screening performed by a BaaS partner at its own level is supplementary only and does not relieve BRB of its independent obligation to screen.
Standardized Data Transmission. Each BaaS partner must transmit complete and accurate transaction and customer data to BRB in a standardized format that enables comprehensive OFAC screening. The required data fields include, at a minimum: originator/sender full legal name, beneficiary/receiver full legal name, all known aliases and DBAs, date of birth (for individuals), country of incorporation or residence, physical address, transaction amount, currency, purpose or description of the transaction, and any available identification numbers (such as passport numbers, national identification numbers, or tax identification numbers). Specific data field specifications for each BaaS partner are set forth in Appendix F to this Manual.
Top Three BaaS Partners — Enhanced Oversight. The three largest BaaS partners by transaction volume — NovaPay Technologies Inc. (41% of BaaS volume), FairLend Digital LLC (28% of BaaS volume), and VaultEdge Inc. (18% of BaaS volume) — collectively account for approximately 87% of total BaaS transaction volume and are subject to enhanced OFAC screening monitoring and oversight, including daily screening coverage verification.
•  NovaPay Technologies Inc.: Given NovaPay's status as BRB's largest BaaS partner and the specific Consent Order finding regarding unscreened NovaPay transactions, NovaPay is subject to the highest level of screening oversight. All NovaPay wire and ACH files must be confirmed as 100% screened before release. The Veridian system generates daily screening coverage reports specifically for NovaPay transactions, which are reviewed by the OFAC Screening Unit and reported to the BSA Officer. BRB has sent a formal compliance remediation letter to NovaPay (attention: Ethan Garrison, CEO) demanding enhanced cooperation and data-sharing commitments in support of the screening remediation program.
•  FairLend Digital LLC: FairLend Digital, located at 100 Summer Street, Suite 800, Boston, MA 02110, under the leadership of CEO Aisha Okonkwo, processed approximately $1.4 billion in loan originations through BRB in FY 2024. All loan disbursements and borrower payments processed through FairLend must be screened at both the point of origination and the point of disbursement. Screening includes all borrower names, guarantor names, co-borrower names, and beneficial owner names. A compliance remediation letter has been sent to FairLend (attention: Aisha Okonkwo, CEO).
•  VaultEdge Inc.: VaultEdge, located at 2200 Ross Avenue, Suite 3600, Dallas, TX 75201, under the leadership of CEO Marcus Tan, operates approximately 870,000 deposit accounts through BRB's charter. All deposit and withdrawal transactions on these accounts are screened in real time. Account-holder re-screening is performed upon each OFAC list update in accordance with the batch screening procedures set forth in Section 6.
•  Remaining 11 BaaS Partners: The remaining 11 active BaaS partners collectively represent approximately 13% of total BaaS transaction volume. These partners are screened under the standard procedures set forth in this Manual and are subject to the same 100% screening coverage requirement as the top three partners. No partner, regardless of volume, is exempt from any provision of this Manual.
Integration Testing. Integration testing for each BaaS partner channel must confirm 100% transaction coverage with no bypass capability. Integration testing is performed as part of the Veridian TMS v.10.0 upgrade and must be completed for all 14 BaaS partners by the UAT completion date of August 1, 2025. Post-upgrade, the Veridian TMS v.10.0 will provide real-time API integration with each BaaS partner's transaction platform, validated through UAT and operationalized by the November 1, 2025 full OFAC screening operationalization date.
5.6 Loan Origination and Disbursement Screening
All loan applicants — whether applying through BRB's direct lending channels or through BaaS partner platforms (including FairLend Digital originations) — must be screened against OFAC sanctions lists at the following stages:
1.  At Application: OFAC screening is performed upon receipt of the loan application, using the applicant's name and identifying information.
2.  At Disbursement: OFAC screening is performed again immediately prior to loan disbursement, to capture any changes to OFAC lists that may have occurred between application and disbursement.
Screening at both the application and disbursement stages is required for all loan types, including commercial loans, consumer loans, residential mortgage loans, and BaaS partner-originated loans.
In addition to screening the primary borrower, the following parties must also be screened:
•  All guarantors;
•  All co-borrowers; and
•  All beneficial owners of entity borrowers (applying the 25% or greater ownership threshold under the CDD Rule).
Any OFAC screening hit generated during the loan origination or disbursement process halts further processing of the loan application or disbursement pending investigation and disposition in accordance with the hit review procedures set forth in Section 7 of this Manual.
SECTION 6: BATCH PROCESSING SCREENING PROCEDURES
6.1 Periodic Customer Database Re-Screening
In addition to real-time transaction screening, BRB performs batch re-screening of its entire customer database against all applicable OFAC sanctions lists on a periodic basis. The purpose of customer database re-screening is to identify existing customers who may have been newly designated by OFAC since the customer's last screening event.
Customer database re-screening is triggered by the following events:
•  List Update Trigger: The entire BRB customer database is re-screened following every OFAC list update. Because OFAC publishes list updates on a rolling and unpredictable basis, this re-screening occurs as frequently as list updates are published. Batch re-screening following a list update must be completed within 24 hours of list update ingestion into the Veridian system.
•  Quarterly Validation Screening: In addition to list-update-triggered re-screening, a full customer database re-screening is performed on a quarterly basis as an independent validation control. This quarterly screening is performed regardless of whether any list updates have occurred during the quarter and serves as a secondary assurance that all customers have been screened against the most current list data.
All hits generated through batch customer database re-screening are queued for review by the OFAC Screening Unit and are investigated and dispositioned in accordance with the hit review procedures set forth in Section 7 of this Manual. The same disposition standards, documentation requirements, and escalation protocols apply to batch screening hits as to real-time screening hits.
6.2 Retroactive Transaction Screening
In the event of a list update delay (i.e., a delay exceeding 24 hours in ingesting an OFAC list update into the Veridian system) or a system outage affecting OFAC screening capability, all transactions processed during the gap period must be retroactively screened via batch processing. Retroactive batch screening must be completed within 48 hours of system restoration or list update ingestion, whichever is applicable.
The OFAC Screening Unit, in coordination with the IT department, is responsible for identifying all transactions processed during the gap period and submitting them for retroactive batch screening. The scope of retroactive screening includes all transaction types and all channels, including BaaS partner transactions.
Retroactive screening results are treated with the same level of urgency as real-time screening hits. If retroactive screening identifies a potential or confirmed match to an OFAC-listed party, the transaction that has already settled is immediately escalated for blocking action (if the transaction involved an interest in property of a blocked person) and regulatory reporting. The BSA Officer and General Counsel are immediately notified of any true matches identified through retroactive screening, given the heightened regulatory and enforcement significance of transactions that were processed without screening.
6.3 BaaS Partner Customer Re-Screening
BaaS partner customer databases are re-screened on the same schedule and to the same standards as BRB's direct customer base. This includes both list-update-triggered re-screening and quarterly validation re-screening.
Each BaaS partner is required, under the terms of its BaaS Program Agreement and Compliance Addendum, to provide updated customer data files to BRB in the required standardized format and at the required frequency to enable timely re-screening. Any failure by a BaaS partner to provide timely and complete customer data constitutes a compliance deficiency and triggers escalation to the Head of Fintech Partnerships / BaaS Division (Warren Ashby) and the BSA Officer.
Re-screening of BaaS partner customers is of particular importance in light of the identification of approximately 47,000 high-risk customer accounts — primarily fintech-onboarded accounts — that were found to lack adequate CDD/EDD documentation. These 47,000 accounts are being subjected to enhanced OFAC re-screening as part of the broader CDD/EDD remediation project, which carries a budget of $4,300,000 and is subject to the following milestones: 50% completion by July 15, 2025, and 100% completion by January 15, 2026. Until CDD/EDD remediation is complete for a given account, the account is flagged for enhanced OFAC screening scrutiny, including manual review of any screening hits (rather than automated disposition) and lower match-score escalation thresholds.
6.4 Batch Screening Scheduling and Documentation
All batch screening activities are scheduled, documented, and maintained by the OFAC Screening Unit. Batch screening completion logs include the following information for each batch run:
•  Date and time of the batch screening run (start and completion);
•  OFAC list version number against which the screening was performed;
•  Total number of records processed;
•  Total number of hits generated;
•  Confirmation of successful completion (or, if applicable, documentation of any errors or incomplete runs); and
•  Identity of the OFAC Screening Unit analyst who initiated and verified the batch run.
A monthly summary of all batch screening activity, including volumes, hits, and any issues, is provided to the BSA Officer and included in the monthly OFAC screening performance report described in Section 4.4.
SECTION 7: HIT REVIEW AND DISPOSITION PROCEDURES
7.1 Overview of the Hit Review Process
All OFAC screening hits — that is, all potential matches identified by the automated screening system between a screened name or data element and an OFAC list entry — must be reviewed, investigated, and dispositioned by trained OFAC analysts within BRB's BSA/AML department. No screening hit may be disregarded, auto-cleared, or dispositioned without human review, regardless of the match score or the nature of the transaction.
The following statistics from CY 2024 illustrate the volume and composition of OFAC screening hits at BRB:
•  Total OFAC screening hits generated: 14,320
•  Confirmed true matches: 12
•  False positives: 14,308
•  False-positive rate: (14,320 – 12) ÷ 14,320 ≈ 99.9%
The high false-positive rate reflects the inherent challenge of name-based screening in a large and diverse customer and transaction population. While maintaining a low match-score threshold is appropriate for compliance purposes — and indeed is required to minimize the risk of missing true matches — the volume of false positives creates a significant operational burden and poses a risk of reviewer fatigue. If analysts are overwhelmed by false positives, the risk of inadvertently clearing a true match increases. The hit review and disposition procedures set forth in this Section are designed to balance thoroughness with operational efficiency, ensuring that true matches are identified and acted upon promptly while false positives are resolved without undue delay.
BRB is actively addressing the resource challenges associated with hit review volume. The current BSA/AML department headcount is 62 full-time equivalents ("FTEs"). This headcount is planned to increase to 77 FTEs through the hiring of 15 new permanent employees, at a fully loaded annual cost of approximately $2,250,000. In addition, during the remediation period, BRB has engaged 30 temporary FTEs from Pinnacle Compliance Solutions LLC ("Pinnacle") to supplement the OFAC screening and hit review workforce. The Pinnacle engagement is governed by Statement of Work Reference PCS-BRB-2025-0012, with a total cost of $3,600,000 for a 12-month engagement period. The key Pinnacle contact is Andrea Solis.
7.2 Hit Queuing and Assignment
Upon generation by the screening system, all OFAC screening hits are automatically queued in the Veridian system's case management module. Hits are assigned to OFAC Screening Analysts on a rotating basis, with priority assignment determined by the following criteria:
1.  Transaction Type: Wire transfer hits receive the highest priority, followed by ACH transaction hits, followed by card transaction and other transaction type hits. The priority order reflects the relative speed of settlement and the greater difficulty of recovering funds once a wire transfer has been executed.
2.  Dollar Amount: Transactions above $50,000 are prioritized over lower-value transactions, reflecting the greater potential sanctions compliance impact of higher-value transactions.
3.  Country Risk: Transactions involving countries or jurisdictions identified as high-risk for sanctions purposes — including comprehensively sanctioned countries and countries with significant sanctions evasion risks — are prioritized for review.
4.  BaaS Partner Risk Tier: Hits associated with the top three BaaS partners by volume — NovaPay, FairLend Digital, and VaultEdge — are flagged for priority review. This prioritization reflects the volume concentration of these partners and the heightened regulatory focus on BaaS-related screening following the Consent Order.
All hits must be assigned to an analyst within 1 hour of generation during normal business hours (Monday through Friday, 8:00 a.m. to 6:00 p.m. Eastern Time). Hits generated outside of normal business hours are assigned at the start of the next business day, except that wire transfer hits and hits involving transactions above $100,000 are assigned to the on-call OFAC analyst for after-hours review.
7.3 Analyst Review Steps
The following step-by-step review process must be followed for every OFAC screening hit:
Step 1: Initial Data Comparison. The analyst compares the screened name and available data elements against the OFAC list entry that triggered the hit. The comparison includes examination of: full name spelling and name variants, aliases and alternative names, date of birth (for individuals), country of citizenship, residence, or incorporation, identification numbers, and any additional identifying information available in both the screening record and the OFAC list entry. The analyst assesses whether the screened party's identifying information is consistent with or distinguishable from the OFAC list entry.
Step 2: Customer/Counterparty Database Check. The analyst accesses BRB's customer information system and CDD/KYC records for the screened party (if the party is a BRB customer or a customer of a BaaS partner) to gather additional identifying information for comparison against the OFAC list entry. This step is particularly important where the initial screening data is limited (e.g., a wire transfer with only a name and country, without date of birth or identification number).
Step 3: Match-Score Evaluation. The analyst reviews the system-generated match score and identifies the specific data points that contributed to the score. High match scores (above the threshold set for mandatory escalation) are given additional scrutiny. The analyst also considers whether the match was triggered by an exact name match, a fuzzy name match, a partial name match, or a match on non-name data elements.
Step 4: Open-Source Research. If the initial review is inconclusive — that is, if the available data is insufficient to definitively determine whether the screened party is or is not the OFAC-listed party — the analyst conducts additional research using publicly available information sources. These sources may include internet search engines, public records databases, corporate registry filings, negative media databases, and other open-source intelligence tools. The analyst documents all sources consulted and the results of the research.
Step 5: Disposition Determination. Based on the totality of the review, the analyst makes one of the following disposition determinations:
•  False Positive: The analyst has determined, based on a preponderance of the available evidence, that the screened party is not the same person or entity as the OFAC list entry. The hit is dispositioned as a false positive, and the underlying transaction may proceed (subject to any other applicable holds or restrictions). The analyst documents the basis for the false-positive determination in the case management system.
•  Potential Match — Escalation Required: The analyst has identified sufficient indicators of a potential match that further investigation is warranted, but the analyst cannot definitively confirm or rule out a match based on the available information. The hit is escalated to the Senior OFAC Analyst and, if necessary, the BSA Officer for further investigation and determination.
•  True Match — Block/Reject: The analyst has confirmed, based on the available evidence, that the screened party is the same person or entity as the OFAC list entry. The transaction is immediately blocked or rejected, and the case is escalated to the BSA Officer for authorization of the blocking/rejection and initiation of OFAC reporting. The procedures for true match handling are set forth in Section 9 of this Manual.
7.4 Disposition Timeframes
The following disposition timeframes apply to OFAC screening hit reviews:
These timeframes are targets and should be met in the ordinary course. However, in no case may a transaction subject to a pending screening hit be released for settlement until the hit has been dispositioned. If an analyst is unable to complete a disposition within the target timeframe, the matter must be escalated to the Senior OFAC Analyst for expedited handling.
7.5 Documentation Requirements
Thorough and contemporaneous documentation of every hit disposition is essential for both compliance and audit purposes. Every hit disposition must be documented in the Veridian case management system and must include the following elements:
•  Hit Identifier: The unique system-generated identifier for the screening hit.
•  Match Score: The system-generated match score and identification of the data elements that contributed to the score.
•  Transaction Details: The type of transaction, dollar amount, currency, transaction date, and the identities of all parties (originator, beneficiary, intermediary).
•  Analyst Identity: The name and employee identifier of the OFAC Screening Analyst who performed the review.
•  Review Date and Duration: The date on which the review was performed and the total elapsed time from hit assignment to disposition.
•  Data Comparison Analysis: A narrative description of the analyst's comparison of the screened party's identifying information against the OFAC list entry, including identification of consistent and inconsistent data points.
•  Research Conducted: A summary of any additional research performed (open-source searches, customer database review, etc.) and the results.
•  Disposition Decision: The analyst's disposition determination (false positive, escalation, or true match) and a clear statement of the rationale supporting the determination.
•  Supervisor Approval: For true match dispositions and escalated cases, the identity and approval of the supervising Senior OFAC Analyst and/or BSA Officer.
All hit disposition documentation must be retained for a minimum of five years from the date of the disposition, in accordance with the recordkeeping requirements set forth in Section 15 of this Manual.
SECTION 8: FALSE-POSITIVE MANAGEMENT AND OPTIMIZATION
8.1 False-Positive Challenge
As noted in Section 7.1, BRB's OFAC screening program generated a false-positive rate of approximately 99.9% in CY 2024, with 14,308 false positives out of 14,320 total screening hits. Only 12 of the 14,320 hits were confirmed as true matches requiring blocking or rejection action.
While a high false-positive rate is a common and expected characteristic of name-based OFAC screening at financial institutions — particularly institutions with large and diverse customer bases and high transaction volumes — the sheer volume of false positives creates significant operational challenges. Specifically:
•  Analyst Resource Consumption: Each false-positive hit requires human review, investigation, and documentation, consuming analyst time and resources that could otherwise be directed toward higher-risk activities.
•  Reviewer Fatigue: The repeated processing of false positives may lead to "alert fatigue," a well-documented phenomenon in which analysts become desensitized to screening alerts over time, potentially increasing the risk of inadvertently clearing a true match as a false positive.
•  Transaction Process