STATEMENT OF WORK AND STAFFING PLAN
Appendix A to Managed Services Agreement
between
Belmont Ridge Bank National Association
and
Pinnacle Compliance Solutions LLC
SOW Reference Number: PCS-BRB-2025-0012
Effective Date: February 10, 2025
Prepared by:
Pinnacle Compliance Solutions LLC 90 Broad Street, 20th Floor New York, NY 10004
Key Contact: Andrea Solis, Director of Managed Services Telephone: (212) 555-7840
Email: asolis@pinnaclecompliance.com
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
BRB Contact: Thomas Ikeda, BSA Officer / AML Program Director Telephone: (212) 555-6200
Email: tikeda@belmontridgebank.com
BRB Supervising Contact: Patricia Langston, Chief Compliance Officer Telephone: (212) 555-6205
Email: plangston@belmontridgebank.com
Outside Counsel Reference:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No. 1045-00002 Responsible Partner: Philip Hartmann Telephone: (212) 555-9100
Email: phartmann@calderwoodharkness.com
Right-click to update Table of Contents
SECTION 1: BACKGROUND AND PURPOSE
1.1 Regulatory Context
On January 15, 2025, the Office of the Comptroller of the Currency ("OCC") issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of an extensive supervisory review conducted during the second and third quarters of 2024, including targeted examinations of the Bank's Bank Secrecy Act and Anti-Money Laundering ("BSA/AML") compliance program, with particular attention to BRB's banking-as-a-service ("BaaS") partner channels and associated compliance infrastructure.
The Consent Order identified significant deficiencies in BRB's BSA/AML compliance program across multiple areas, including the following:
(i) SAR Filing Deficiencies. The OCC identified a backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024. Additionally, BRB's average Suspicious Activity Report ("SAR") filing time had deteriorated to approximately 78 days from the date of alert generation, substantially exceeding the regulatory expectation of approximately 30 days. The OCC concluded that this backlog posed a material risk that potentially reportable suspicious activity was not being timely identified, investigated, or reported to the Financial Crimes Enforcement Network ("FinCEN"), in violation of 31 U.S.C. § 5318(g) and 12 C.F.R. Part 21.
(ii) CDD/EDD Failures. The OCC identified failures in Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes affecting approximately 47,000 high-risk customer accounts. These deficiencies were concentrated in accounts onboarded through BRB's fintech BaaS partner channels, where inadequate CDD/EDD documentation, incomplete beneficial ownership verification, and inconsistent risk rating practices were widespread. The OCC concluded that BRB failed to maintain adequate policies and procedures to comply with the CDD Rule, 31 C.F.R. § 1010.230, and applicable provisions of 31 C.F.R. Part 1020.
(iii) Inadequate OFAC Sanctions Screening. The OCC identified material gaps in BRB's Office of Foreign Assets Control ("OFAC") sanctions screening processes, particularly with respect to transactions processed through BaaS channels. The OCC noted that BRB's existing screening infrastructure did not consistently apply to all transaction types and customer populations associated with its fintech partner relationships, creating a risk that prohibited transactions or blocked persons could be processed without adequate review.
(iv) Model Validation Deficiencies. The OCC identified deficiencies in the model validation process for BRB's transaction monitoring system, Veridian TMS v.8.3. Specifically, the OCC found that the model had not been independently validated within the required timeframe, that certain detection scenarios were not calibrated to adequately capture suspicious activity patterns associated with BaaS partner transaction flows, and that above-the-line and below-the-line testing had not been conducted in accordance with OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management).
(v) Board-Level Oversight Deficiencies. The OCC concluded that BRB's Board of Directors had not exercised adequate oversight of the Bank's BSA/AML compliance program, including failing to ensure that the BSA/AML department was adequately staffed and resourced to manage the risks associated with the Bank's rapidly expanding BaaS partner program. The Board had not received timely or adequate reporting on the growing SAR backlog, the CDD/EDD deficiencies, or the OFAC screening gaps.
The Consent Order requires BRB to undertake comprehensive remediation of these deficiencies. Among other requirements, the Consent Order mandates that BRB submit a Comprehensive Remediation Action Plan (the "RAP") to the OCC by May 15, 2025, and that BRB achieve full program implementation and compliance by February 15, 2026, at which time BRB must file a written self-certification of compliance with the OCC.
In response to the Consent Order, BRB's Board of Directors approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty imposed under the Consent Order. This remediation budget encompasses staffing augmentation (including the engagement described herein), technology upgrades, policy and procedure revisions, independent consulting and testing, and outside legal counsel fees.
To support the remediation effort, BRB has engaged the following external parties:
• Calderwood & Harkness LLP ("C&H"), engaged as outside regulatory counsel effective February 10, 2025, under C&H Matter No. 1045-00002, with Philip Hartmann serving as the responsible partner. C&H is advising BRB on all aspects of the Consent Order response, including the preparation and filing of the RAP, coordination with the OCC and other regulatory bodies, privilege management, and oversight of the remediation program.
• Thornfield Consulting Group LLC ("Thornfield"), engaged as the OCC-mandated independent consultant effective February 10, 2025, following receipt of OCC non-objection on February 5, 2025. Thornfield's mandate includes conducting an independent assessment of BRB's BSA/AML compliance program, validating the adequacy and effectiveness of remediation activities, and issuing periodic reports to the OCC on the progress and sufficiency of the Bank's corrective actions. Key Thornfield contacts include Dr. Vivian Castellano, Managing Director, who is serving as the engagement lead.
• Pinnacle Compliance Solutions LLC ("Pinnacle"), engaged to provide temporary BSA/AML compliance staffing resources as described in this Statement of Work.
1.2 Purpose of Statement of Work
This Statement of Work and Staffing Plan (this "SOW") sets forth the terms under which Pinnacle Compliance Solutions LLC ("Pinnacle") will provide temporary BSA/AML compliance analysts, investigators, and related compliance staff to support BRB's remediation program in response to Consent Order No. OCC-2025-003.
The temporary staffing engagement described herein is designed to supplement BRB's existing BSA/AML department, which as of the date of this SOW consists of sixty-two (62) full-time equivalent employees ("FTEs"). BRB has recognized that its current permanent staffing levels are insufficient to simultaneously address the SAR backlog, conduct the required CDD/EDD remediation across approximately 47,000 accounts, maintain ongoing transaction monitoring and alert review operations, and support the various other remediation workstreams mandated by the Consent Order. Accordingly, BRB has determined that temporary staffing augmentation through Pinnacle is a critical component of the Bank's overall remediation strategy during the twelve (12)-month remediation period.
Concurrently with the Pinnacle engagement, BRB is conducting an active recruitment effort to hire fifteen (15) additional permanent FTE positions within the BSA/AML department, bringing BRB's target post-remediation headcount to seventy-seven (77) FTEs. The Pinnacle engagement is intended to bridge the gap between BRB's current staffing capacity and the levels required to meet the Consent Order's remediation timeline, while BRB's permanent hires are recruited, onboarded, and trained.
The engagement addresses three primary remediation workstreams:
(a) SAR Backlog Clearance and Lookback Review. Pinnacle will provide SAR investigators to review and disposition the approximately 2,400 unreviewed suspicious activity alerts constituting the SAR backlog, as well as to support the broader SAR lookback project covering historical transactions within the defined lookback period.
(b) CDD/EDD Account Remediation. Pinnacle will provide KYC/CDD analysts to conduct customer due diligence and enhanced due diligence remediation across the approximately 47,000 high-risk customer accounts identified as having inadequate documentation.
(c) Transaction Monitoring Alert Review Support. Pinnacle will provide transaction monitoring reviewers to supplement BRB's permanent staff in reviewing and dispositioning ongoing daily alert queues generated by the Veridian TMS, preventing future backlog accumulation during the remediation period.
The total contract value for the engagement is Three Million Six Hundred Thousand Dollars ($3,600,000), calculated as thirty (30) full-time-equivalent analysts at a rate of Ten Thousand Dollars ($10,000) per month per FTE over a twelve (12)-month engagement term. The engagement term runs from February 2025 through February 2026, coterminous with the Consent Order compliance self-certification deadline of February 15, 2026.
1.3 Relationship to Managed Services Agreement
This SOW constitutes Appendix A to the Managed Services Agreement between BRB and Pinnacle, dated February 10, 2025 (the "MSA"). All terms and conditions set forth in the MSA apply to this SOW with equal force and effect, including but not limited to the MSA's provisions regarding representations and warranties, indemnification, limitation of liability, dispute resolution, insurance, intellectual property, and governing law.
In the event of any conflict or inconsistency between the terms of this SOW and the terms of the MSA, the terms of the MSA shall govern and control. To the extent that any term of this SOW addresses a subject matter not addressed by the MSA, the terms of this SOW shall apply.
This SOW is designated as SOW number PCS-BRB-2025-0012 for administrative and reference purposes.
SECTION 2: SCOPE OF SERVICES
2.1 Service Category 1: SAR Investigation and Filing Support
Pinnacle will provide SAR Investigators to support BRB's BSA/AML department in the investigation and disposition of the approximately 2,400 unreviewed suspicious activity alerts identified as of September 2024 (the "SAR Backlog"), as well as ongoing SAR investigation and filing activities during the engagement term. The services under this category shall include, without limitation, the following:
(a) SAR Backlog Review and Disposition. Pinnacle SAR Investigators will conduct a comprehensive review and disposition of each of the approximately 2,400 alerts comprising the SAR Backlog. This review will include retrieving the underlying alert data from BRB's transaction monitoring system (initially Veridian TMS v.8.3, with a planned transition to Veridian TMS v.10.0 upon deployment, targeted for August 1, 2025), reviewing relevant customer account information and transaction history through BRB's core banking systems, and accessing all available customer records, correspondence, and prior investigation notes relevant to each alert.
(b) SAR Investigation and Narrative Preparation. For each alert determined to warrant a SAR filing, Pinnacle SAR Investigators will conduct a thorough investigation in accordance with BRB's revised SAR Policy and Procedures and applicable FinCEN filing standards. Investigations will include, as appropriate, analysis of customer transaction patterns, identification of suspicious activity typologies, review of customer identification and due diligence documentation, and assessment of information obtained from BaaS partner records and third-party databases. Pinnacle investigators will prepare complete SAR narratives meeting all FinCEN filing requirements, including accurate descriptions of the suspicious activity, the subjects involved, the financial instruments and transactions at issue, and any supporting documentation.
(c) SAR Lookback Project Support. Pinnacle SAR Investigators will support the broader SAR lookback project, which involves the re-review of historical alerts and transactions within the defined lookback period established by BRB in consultation with C&H and Thornfield. The SAR lookback project has an estimated project budget of $5,500,000, which is managed separately from the Pinnacle staffing engagement. Pinnacle's role in the lookback project is limited to providing investigator labor as directed by BRB's BSA/AML department and the lookback project manager; Pinnacle does not manage or direct the lookback project independently.
(d) Timeliness Targets. The primary performance targets for this service category are:
(i) The complete disposition of all 2,400 alerts in the SAR Backlog by June 30, 2025; and
(ii) The reduction of BRB's average SAR filing time from the current 78 days to within 30 days of alert generation, consistent with the regulatory expectation and the timeframes specified in the Consent Order and BRB's revised SAR Policy and Procedures.
(e) BaaS-Related SAR Volume. BRB's fintech BaaS partner channels represent a significant portion of the Bank's overall SAR filing volume. In calendar year 2024, BaaS-related SARs accounted for 2,108 of the 3,847 total SARs filed by BRB, representing approximately 54.8% of the Bank's total SAR volume. Pinnacle staff should anticipate that a significant proportion of the SAR Backlog alerts and ongoing SAR investigations will involve transactions and customer activity associated with BRB's fintech partners, including NovaPay Technologies Inc. ("NovaPay"), FairLend Digital LLC ("FairLend Digital"), VaultEdge Inc. ("VaultEdge"), and other BaaS partner entities. Pinnacle investigators assigned to BaaS-channel-related investigations will be expected to develop working familiarity with the operational models, customer bases, and transaction patterns associated with each fintech partner, as directed by BRB's BSA/AML management.
2.2 Service Category 2: CDD/EDD Account Remediation
Pinnacle will provide KYC/CDD Analysts to support BRB's BSA/AML department in conducting customer due diligence and enhanced due diligence remediation for the approximately 47,000 high-risk customer accounts identified by the OCC as lacking adequate CDD/EDD documentation. The services under this category shall include, without limitation, the following:
(a) Account Remediation Activities. Pinnacle KYC/CDD Analysts will perform the full range of CDD and EDD remediation activities for each assigned account, including: collecting missing identification documents and verifying the identity of account holders; verifying beneficial ownership information and ensuring that all required beneficial ownership certifications are on file in accordance with 31 C.F.R. § 1010.230; applying or updating risk ratings based on BRB's revised risk rating methodology; documenting EDD findings for accounts classified as high-risk; and flagging accounts that present indicators of potential suspicious activity for referral to the SAR investigation team, or that present indicators warranting account restriction, suspension, or closure for referral to the appropriate BRB decision-makers.
(b) Prioritization of BaaS Partner Channel Accounts. Pinnacle KYC/CDD Analysts will prioritize the remediation of accounts onboarded through BRB's BaaS fintech partner channels, consistent with the risk-based triage methodology established by BRB's BSA/AML department. Particular focus will be given to accounts associated with the following fintech partners:
(i) NovaPay Technologies Inc. — NovaPay operates a digital payments and money transfer platform with approximately 2.1 million end-user accounts at BRB. Given the high volume of accounts and the nature of money transfer services, NovaPay-associated accounts present elevated BSA/AML risk and are expected to constitute a substantial portion of the CDD/EDD remediation workload.
(ii) FairLend Digital LLC — FairLend Digital operates a digital lending platform that originated approximately $1.4 billion in loans through BRB in fiscal year 2024. CDD/EDD remediation for FairLend-associated accounts will include verification of borrower identity, source of funds documentation, and beneficial ownership analysis for business borrowers.
(iii) VaultEdge Inc. — VaultEdge operates a digital deposit and savings platform with approximately 870,000 deposit accounts at BRB. CDD/EDD remediation for VaultEdge-associated accounts will focus on identity verification, risk rating, and EDD documentation for accounts exhibiting high-risk characteristics.
(c) Milestones. The CDD/EDD account remediation milestones are as follows:
(i) Fifty percent (50%) of the approximately 47,000 accounts — representing approximately 23,500 accounts — to be remediated by July 15, 2025; and
(ii) One hundred percent (100%) of the approximately 47,000 accounts to be remediated by January 15, 2026.
(d) Governing Policies and Frameworks. All CDD/EDD remediation work performed by Pinnacle KYC/CDD Analysts will be conducted in accordance with BRB's revised CDD/EDD Policy and the BaaS Partner CDD/EDD Responsibility Matrix, which delineates the respective CDD/EDD obligations of BRB and each of its fintech partners. Pinnacle staff will be trained on both documents during the onboarding process described in Section 6 of this SOW.
2.3 Service Category 3: Transaction Monitoring Alert Review Support
Pinnacle will provide Transaction Monitoring Reviewers to supplement BRB's permanent staff in the ongoing review and disposition of new transaction monitoring alerts generated by the Veridian TMS. The services under this category shall include, without limitation, the following:
(a) Daily Alert Queue Management. Pinnacle Transaction Monitoring Reviewers will be integrated into BRB's daily alert review workflow and will review, escalate, and disposition transaction monitoring alerts as assigned by BRB's designated BSA/AML managers. The objective is to prevent future backlog accumulation by ensuring that all alerts are reviewed and dispositioned within the timeliness standards established by BRB's revised BSA/AML policies and procedures.
(b) Alert Volume Context. For planning purposes, BRB generated a total of approximately 41,500 transaction monitoring alerts in calendar year 2024, with a SAR conversion rate of approximately 9.3% (3,847 SARs filed from 41,500 alerts). On a monthly basis, this equates to approximately 3,458 alerts per month, or approximately 115 alerts per business day. Pinnacle's four (4) Transaction Monitoring Reviewers will supplement BRB's permanent monitoring staff to ensure adequate capacity to handle daily alert volumes, with the understanding that alert volumes may fluctuate and may increase during the transition to Veridian TMS v.10.0.
(c) TMS Transition Support. Pinnacle Transaction Monitoring Reviewers will support the transition from Veridian TMS v.8.3 to Veridian TMS v.10.0, with User Acceptance Testing ("UAT") completion targeted for August 1, 2025. Following the deployment of Veridian TMS v.10.0, re-tuned detection scenarios and new detection models are expected to generate increased alert volumes during the initial calibration and stabilization period. Pinnacle reviewers will be trained on the v.10.0 platform and will assist BRB in managing the anticipated increase in alert volumes associated with the transition.
2.4 Service Category 4: OFAC Screening Support (As Needed)
On an as-needed basis, and as directed by BRB's BSA/AML department, Pinnacle will provide analysts trained in OFAC sanctions screening to support BRB's remediation of sanctions screening gaps, particularly for BaaS channel transactions. The services under this category shall include, without limitation, the following:
(a) OFAC Screening Hit Review. Pinnacle analysts may be assigned to review OFAC screening hits generated by BRB's sanctions screening systems. For context, BRB recorded 14,320 OFAC screening hits in calendar year 2024, of which only twelve (12) were determined to be true matches, yielding a false-positive rate of approximately 99.9%. Pinnacle analysts will assist in the efficient review and disposition of screening hits to support timely processing of transactions while ensuring that true matches are identified and appropriately escalated.
(b) BaaS Channel OFAC Operationalization. Full OFAC screening remediation for all BaaS channels is targeted for operationalization by November 1, 2025. Pinnacle analysts may be requested to support the testing, validation, and initial operations of expanded OFAC screening capabilities for BaaS partner transactions during and following the operationalization milestone.
(c) Resource Allocation. OFAC screening support is provided on an as-needed basis and is not subject to a dedicated FTE allocation. If BRB determines that dedicated OFAC screening resources are required on a sustained basis, BRB and Pinnacle will discuss whether reallocation of existing FTEs or augmentation of the staffing plan is appropriate, subject to the terms of this SOW and the MSA.
2.5 Exclusions
The following activities and responsibilities are expressly excluded from the scope of Pinnacle's services under this SOW:
(a) No Legal Advice. Pinnacle does not provide legal advice. All services performed by Pinnacle under this SOW are compliance support services performed under the direction and supervision of BRB's BSA/AML department. Nothing in this SOW or the MSA shall be construed to create an attorney-client relationship between Pinnacle (or any Pinnacle employee or contractor) and BRB or any other party.
(b) No Final SAR Filing Authority. Pinnacle staff are not authorized to make final SAR filing decisions. All SAR narratives prepared by Pinnacle investigators are subject to review and approval by a BRB supervisor at the minimum level of BSA/AML Manager or above, reporting to Thomas Ikeda, BSA Officer. Final SAR submission to FinCEN via the BSA E-Filing system is the exclusive responsibility of BRB's permanent staff.
(c) No Technology Implementation. Pinnacle is not responsible for the implementation, configuration, deployment, or technical management of the Veridian TMS v.10.0 upgrade or any other technology platform. Pinnacle's role with respect to the TMS transition is limited to providing analysts who will be trained on and work within the upgraded system.
(d) No Model Validation. Pinnacle is not responsible for the validation of BRB's transaction monitoring models or any other quantitative models. Model validation activities are being conducted separately by qualified third parties under BRB's model risk management framework.
(e) No Policy Drafting or Regulatory Correspondence. Pinnacle is not responsible for drafting or revising BRB's BSA/AML policies and procedures, the Comprehensive Remediation Action Plan, or any correspondence or filings with the OCC, FinCEN, OFAC, or any other regulatory body. Pinnacle may provide data, metrics, and operational information to support BRB's preparation of such documents as described in this SOW.
(f) No Replacement of Independent Consultant. Pinnacle services do not replace or substitute for the independent assessment and validation activities being conducted by Thornfield Consulting Group LLC under the terms of the Consent Order and Thornfield's engagement by BRB. Pinnacle and Thornfield operate independently, and Pinnacle's work product is subject to review by Thornfield as directed by BRB.
SECTION 3: STAFFING PLAN
3.1 Total Staffing Commitment
Pinnacle will deploy a total of thirty (30) full-time-equivalent analysts for the twelve (12)-month engagement term, subject to the phased deployment schedule set forth in Section 4 of this SOW and the wind-down provisions set forth therein.
All thirty (30) FTEs will be dedicated full-time to BRB remediation activities, with each FTE committed to a minimum of forty (40) hours of work per week. Pinnacle staff will adhere to BRB's standard business hours and holiday schedule, unless alternative arrangements are approved in writing by BRB's BSA Officer.
The monthly cost per FTE is Ten Thousand Dollars ($10,000), which is fully inclusive of all Pinnacle overhead, recruiting costs, employee benefits, management and supervision costs, and any other expenses incurred by Pinnacle in connection with the deployment of staff. The total monthly staffing cost is calculated as follows:
30 FTEs × $10,000 per FTE per month = $300,000 per month
The total twelve (12)-month contract value is calculated as follows:
$300,000 per month × 12 months = $3,600,000
3.2 Role Descriptions and Allocation
3.2.1 SAR Investigators (14 FTEs)
Primary Responsibilities. Pinnacle SAR Investigators are responsible for the day-to-day investigation and documentation of suspicious activity alerts. Specific responsibilities include, but are not limited to: triaging alerts from the SAR Backlog and ongoing alert queues; conducting thorough investigations using available data sources, including the Veridian TMS, core banking systems, customer records, and BaaS partner data; preparing comprehensive SAR narratives that meet FinCEN filing standards and BRB's revised SAR Policy and Procedures; documenting investigation findings and case disposition rationale; and supporting the SAR lookback project as directed by BRB's BSA/AML management.
Qualifications. All Pinnacle SAR Investigators must meet the following minimum qualifications:
• A minimum of two (2) years of BSA/AML compliance experience in a banking, financial services, or regulated financial institution environment;
• Demonstrated experience with SAR investigation and narrative drafting;
• Familiarity with FinCEN SAR filing requirements, including the content and format requirements for SAR narratives and the BSA E-Filing system;
• Experience with transaction monitoring platforms, with experience using Veridian TMS or comparable systems (e.g., Bramwell Solutions, NICE Bramwell Solutions, Mantas, Norkom) strongly preferred;
• Certified Anti-Money Laundering Specialist ("CAMS") certification from the Association of Certified Anti-Money Laundering Specialists ("ACAMS") preferred; and
• Strong analytical, written communication, and organizational skills.
Allocation. Fourteen (14) FTEs are assigned as SAR Investigators. During Phases 1 through 2 (February 10 – June 30, 2025), all fourteen (14) SAR Investigators will be assigned to the SAR Backlog Clearance and SAR Lookback workstreams. Following the achievement of the June 30, 2025 SAR backlog clearance target, SAR Investigators will be redeployed as described in Section 4.3 of this SOW, with eight (8) FTEs redeployed to ongoing transaction monitoring alert review and SAR lookback project support, and six (6) FTEs redeployed to supplement the CDD/EDD remediation effort.
3.2.2 KYC/CDD Analysts (10 FTEs)
Primary Responsibilities. Pinnacle KYC/CDD Analysts are responsible for conducting customer due diligence and enhanced due diligence remediation activities. Specific responsibilities include, but are not limited to: collecting missing identification documents from customers and BaaS partners; verifying customer identity information against reliable sources; analyzing and verifying beneficial ownership structures and certifications in accordance with 31 C.F.R. § 1010.230; assigning or updating customer risk ratings based on BRB's revised risk rating methodology; documenting EDD findings for high-risk accounts; and identifying accounts that warrant referral for SAR investigation or potential account closure.
Qualifications. All Pinnacle KYC/CDD Analysts must meet the following minimum qualifications:
• A minimum of two (2) years of KYC/CDD experience in a banking, financial services, or regulated financial institution environment;
• Demonstrated knowledge of Customer Identification Program ("CIP") requirements, CDD requirements, and beneficial ownership rules under 31 C.F.R. § 1010.230 and applicable FinCEN guidance;
• Experience with customer onboarding, identity verification, and risk rating processes;
• Experience with fintech or BaaS customer onboarding processes preferred, given the significant concentration of remediation accounts in BaaS partner channels;
• CAMS certification or Certified Know Your Customer Associate ("CKYCA") certification preferred; and
• Strong attention to detail, documentation skills, and ability to manage high-volume workflows.
Allocation. Ten (10) FTEs are assigned as KYC/CDD Analysts. All ten (10) KYC/CDD Analysts will be assigned to the CDD/EDD Remediation workstream targeting the approximately 47,000 high-risk accounts. Deployment will be prioritized to BaaS-onboarded accounts in accordance with BRB's risk-based triage methodology, with initial focus on the highest-risk account populations associated with NovaPay, FairLend Digital, and VaultEdge.
3.2.3 Transaction Monitoring Reviewers (4 FTEs)
Primary Responsibilities. Pinnacle Transaction Monitoring Reviewers are responsible for the review and disposition of daily transaction monitoring alerts generated by the Veridian TMS. Specific responsibilities include, but are not limited to: reviewing assigned alerts from the daily alert queue; analyzing transaction data and customer information to assess alert validity; escalating alerts that present indicators of suspicious activity to the SAR investigation team for further review; documenting case disposition rationale for alerts closed without escalation; and supporting BRB's permanent monitoring staff during the transition to Veridian TMS v.10.0.
Qualifications. All Pinnacle Transaction Monitoring Reviewers must meet the following minimum qualifications:
• A minimum of one (1) year of transaction monitoring experience in a banking, financial services, or regulated financial institution environment;
• Familiarity with common AML typologies, including but not limited to structuring, layering, third-party money laundering, funnel accounts, trade-based money laundering, and virtual currency-related suspicious activity;
• Experience with transaction monitoring platforms, with experience using Veridian TMS or comparable systems preferred; and
• Strong analytical skills and the ability to work efficiently in a high-volume alert review environment.
Allocation. Four (4) FTEs are assigned as Transaction Monitoring Reviewers. These analysts will be assigned to ongoing alert queue management throughout the engagement term to prevent future backlog accumulation. Transaction Monitoring Reviewers will also support the transition to Veridian TMS v.10.0, including reviewing alerts generated by re-tuned detection scenarios and new detection models following the UAT completion targeted for August 1, 2025.
3.2.4 Team Leads / Quality Reviewers (2 FTEs)
Primary Responsibilities. Pinnacle Team Leads serve as intermediate supervisors and quality control checkpoints between the Pinnacle analyst team and BRB's BSA/AML management. Specific responsibilities include, but are not limited to: supervising the work product of all Pinnacle analysts in their assigned workstreams; conducting quality assurance reviews of SAR narratives and CDD/EDD documentation prepared by Pinnacle analysts; serving as the primary Pinnacle liaison to BRB management (Thomas Ikeda and designated BRB supervisors) for day-to-day operational matters; tracking and reporting on productivity metrics, quality standards, and staffing status; conducting error tracking and root cause analysis; facilitating training and onboarding activities for new and replacement Pinnacle analysts; and coordinating with Andrea Solis on escalation matters, reporting, and engagement governance.
Qualifications. All Pinnacle Team Leads must meet the following minimum qualifications:
• A minimum of five (5) years of BSA/AML compliance experience in a banking, financial services, or regulated financial institution environment;
• Prior supervisory or team lead experience in a BSA/AML compliance function, including demonstrated experience managing teams of five (5) or more analysts;
• CAMS certification required;
• Familiarity with OCC examination standards, consent order remediation engagements, and regulatory reporting requirements preferred;
• Strong leadership, communication, and organizational skills; and
• Ability to serve as an effective liaison between Pinnacle's managed services team and BRB's senior BSA/AML leadership.
Allocation. Two (2) FTEs are assigned as Team Leads. One (1) Team Lead will be assigned to the SAR/Transaction Monitoring workstreams, overseeing the work of the SAR Investigators and Transaction Monitoring Reviewers. One (1) Team Lead will be assigned to the CDD/EDD workstream, overseeing the work of the KYC/CDD Analysts. The Team Leads serve as the primary Pinnacle points of contact for day-to-day operational matters; Andrea Solis, Director of Managed Services, remains the senior relationship contact for BRB and Calderwood & Harkness LLP for all strategic, contractual, and escalation matters.
3.3 Staffing Allocation Summary Table
The following table summarizes the staffing allocation and associated monthly costs under this SOW:
Total annual contract value: $300,000 per month × 12 months = $3,600,000.
SECTION 4: DEPLOYMENT SCHEDULE AND RAMP-UP TIMELINE
4.1 Phase 1: Ramp-Up (February 10 – March 1, 2025)
Pinnacle will deploy its full complement of thirty (30) FTEs in three successive weekly waves during the Phase 1 Ramp-Up period, as follows:
Week 1 (February 10–14, 2025): Initial Wave — 10 FTEs. Pinnacle will deploy the first wave of ten (10) FTEs, comprising six (6) SAR Investigators, two (2) KYC/CDD Analysts, and two (2) Team Leads. The immediate priority for this initial deployment wave is to establish the operational foundation for the SAR Backlog clearance effort, including initiating triage of the 2,400 backlog alerts in accordance with BRB's SAR Backlog Triage Protocol. The two (2) Team Leads will focus on completing initial orientation to BRB's systems, policies, and organizational structure, and on establishing working relationships with Thomas Ikeda, Patricia Langston, and the designated BRB BSA/AML managers who will provide day-to-day supervision of the Pinnacle team.
All Week 1 personnel will participate in BRB-specific onboarding training covering BRB's BSA/AML policies and procedures, system access and navigation, and the specific requirements and expectations of Consent Order No. OCC-2025-003. Materials for the consent order briefing will be supplied by BRB and Calderwood & Harkness LLP, and the briefing will be delivered by the Pinnacle Team Leads in coordination with BRB and C&H representatives.
Pinnacle will also coordinate with Thornfield Consulting Group in advance of Thornfield's on-site assessment, which is scheduled to commence on March 1, 2025. Pinnacle staff will cooperate fully with Dr. Vivian Castellano's Thornfield team as directed by BRB during the assessment period and throughout the engagement.
Week 2 (February 17–21, 2025): Second Wave — 10 FTEs. Pinnacle will deploy the second wave of ten (10) FTEs, comprising four (4) additional SAR Investigators, four (4) additional KYC/CDD Analysts, and two (2) Transaction Monitoring Reviewers. Week 2 personnel will complete the same BRB-specific onboarding training program and will be integrated into the operational workflow established during Week 1. The addition of the four (4) KYC/CDD Analysts will allow for the initiation of CDD/EDD remediation activities, beginning with the highest-priority BaaS-channel accounts as identified by BRB's risk-based triage methodology. The two (2) Transaction Monitoring Reviewers will begin supporting BRB's permanent monitoring staff in managing the daily alert queue.
Week 3 (February 24–28, 2025): Final Wave — 10 FTEs. Pinnacle will deploy the third and final wave of ten (10) FTEs, comprising four (4) additional SAR Investigators, four (4) additional KYC/CDD Analysts, and two (2) additional Transaction Monitoring Reviewers. Upon completion of the Week 3 deployment, Pinnacle will have the full complement of thirty (30) FTEs operational and integrated into BRB's remediation workflows.
The full complement of thirty (30) FTEs is expected to be operational no later than March 1, 2025.
4.2 Phase 2: Steady-State Operations (March 1 – June 30, 2025)
During Phase 2, the full thirty (30)-FTE Pinnacle team will operate at steady-state capacity, with the primary focus on SAR Backlog clearance and the initiation of the CDD/EDD remediation program.
SAR Backlog Clearance. The fourteen (14) SAR Investigators will focus on the disposition of the 2,400 SAR Backlog alerts, with the target of completing all dispositions by June 30, 2025. Phase 2 spans approximately four (4) months (March through June), requiring an average throughput of approximately 600 alert dispositions per month across the fourteen (14) investigators. This equates to approximately forty-three (43) alert dispositions per investigator per month, or approximately ten (10) to eleven (11) alert dispositions per investigator per week, consistent with the KPI targets set forth in Section 8.2 of this SOW. Actual throughput will vary based on alert complexity, the proportion of alerts that require SAR filing versus closure without filing, and the availability of supporting documentation and customer records.
CDD/EDD Remediation Initiation. The ten (10) KYC/CDD Analysts will commence remediation of the 47,000 high-risk accounts, with initial throughput supporting the July 15, 2025 milestone of 23,500 accounts (50% completion). This requires the KYC/CDD team to remediate approximately 5,222 accounts per month over the approximately four-and-a-half-month period from mid-February through mid-July 2025, or approximately 522 accounts per analyst per month. Actual throughput will depend on the complexity of each account, the availability of required documentation from customers and BaaS partners, and the volume of accounts requiring referral for SAR investigation or account closure.
Interim Regulatory Reporting Support. An interim SAR backlog status report is due to the OCC by March 31, 2025. Pinnacle Team Leads will provide Thomas Ikeda and Patricia Langston with the data, metrics, and case-level information needed to support BRB's preparation and filing of this interim report. Pinnacle will not prepare or file the report directly; the report remains the responsibility of BRB's permanent BSA/AML leadership and, as appropriate, Calderwood & Harkness LLP.
Ongoing Transaction Monitoring. The four (4) Transaction Monitoring Reviewers will manage daily alert queues in coordination with BRB's permanent monitoring staff. Based on BRB's calendar year 2024 alert volume of approximately 41,500 alerts (approximately 3,458 per month or approximately 115 per business day), the Pinnacle reviewers will supplement BRB's permanent staff to ensure that current alerts are reviewed and dispositioned within BRB's revised timeliness standards. The objective during Phase 2 is to prevent any new backlog from accumulating while the SAR Investigators focus on clearing the existing 2,400-alert backlog.
4.3 Phase 3: Redeployment and Continued Operations (July 1 – November 30, 2025)
Upon the anticipated completion of the SAR Backlog clearance by June 30, 2025, Pinnacle will redeploy its SAR Investigators to other remediation workstreams as follows:
(a) Eight (8) SAR Investigators will be redeployed to ongoing transaction monitoring alert review support and SAR lookback project support. These analysts will supplement BRB's permanent monitoring staff and the four (4) Pinnacle Transaction Monitoring Reviewers in managing daily alert queues, and will provide investigative support for the SAR lookback project as directed by BRB.
(b) Six (6) SAR Investigators will be redeployed to supplement the CDD/EDD remediation effort. These analysts will be cross-trained on CDD/EDD remediation procedures and will work alongside the ten (10) Pinnacle KYC/CDD Analysts to meet the remaining 50% target of 23,500 additional accounts, to be remediated by January 15, 2026.
The ten (10) KYC/CDD Analysts will continue their CDD/EDD remediation work throughout Phase 3, with the addition of the six (6) redeployed SAR Investigators providing additional capacity to support the January 15, 2026 completion milestone.
Veridian TMS v.10.0 Transition. During Phase 3, BRB is expected to complete User Acceptance Testing for Veridian TMS v.10.0, with UAT completion targeted for August 1, 2025. Following deployment of the upgraded platform, Pinnacle analysts assigned to transaction monitoring activities will be trained on the v.10.0 system. It is anticipated that re-tuned detection scenarios and new detection models in v.10.0 will generate increased alert volumes during the initial calibration and stabilization period. Pinnacle will work with BRB's BSA/AML management and IT department to manage the expected alert volume increase and to ensure that new alerts generated by the upgraded system are reviewed and dispositioned within applicable timeliness standards.
OFAC Screening Support. During Phase 3, Pinnacle will provide OFAC screening support on an as-needed basis, particularly in support of the November 1, 2025 milestone for full operationalization of OFAC screening across all BaaS channels. If dedicated OFAC support is required, Pinnacle and BRB will determine the appropriate resource allocation, which may involve temporary reassignment of existing Pinnacle FTEs.
4.4 Phase 4: Wind-Down (December 1, 2025 – February 15, 2026)
Phase 4 covers the final wind-down of the Pinnacle engagement, coinciding with the final push to meet the Consent Order's compliance self-certification deadline of February 15, 2026.
Staffing Reduction. As BRB's fifteen (15) new permanent FTE hires are recruited, onboarded, and reach full productivity during the engagement period (with BRB's target post-remediation headcount of 77 FTEs), the need for Pinnacle's temporary staffing resources will decrease. During Phase 4, Pinnacle staffing will be gradually reduced from thirty (30) FTEs to approximately fifteen (15) FTEs by December 15, 2025, concurrent with BRB's second quarterly progress report to the OCC. The specific analysts to be off-boarded during this period will be determined by BRB and Pinnacle based on workstream requirements, the progress of BRB's permanent hiring, and the status of remaining remediation activities.
Final CDD/EDD Remediation. Remaining Pinnacle KYC/CDD Analysts and redeployed SAR Investigators will make a final push to achieve 100% remediation of the 47,000 high-risk accounts by the January 15, 2026 milestone.
Knowledge Transfer. During Phase 4, Pinnacle will conduct structured knowledge transfer sessions with BRB's permanent BSA/AML staff to ensure continuity of all workstream activities. Knowledge transfer will include documentation of processes, procedures, and institutional knowledge accumulated during the engagement, as well as hand-off of open cases, pending investigations, and in-progress remediation files.
Final Off-Boarding. All Pinnacle staff will complete the engagement and off-board from BRB by February 15, 2026, coinciding with the Consent Order's full compliance self-certification deadline and the anticipated delivery of Thornfield Consulting Group's final validation report.
4.5 Deployment Schedule Summary Table
SECTION 5: ON-SITE AND REMOTE WORK ALLOCATION
5.1 On-Site Requirements
The primary work location for all Pinnacle analysts deployed under this SOW shall be Belmont Ridge Bank NA, 680 Lexington Avenue, 22nd Floor, New York, NY 10022.
A minimum of twenty (20) of the thirty (30) deployed FTEs (representing approximately 67% of the total Pinnacle team) must be deployed on-site at BRB premises at all times during Phases 1 through 3 of the engagement. On-site presence is required to ensure that Pinnacle analysts have direct access to BRB systems, physical records, and documents that may not be accessible through remote channels, and to facilitate in-person coordination with BRB supervisors, the Thornfield Consulting Group assessment team, and Calderwood & Harkness representatives as needed.
During Phase 2 (Steady-State Operations — March 1 through June 30, 2025), all fourteen (14) SAR Investigators must be on-site at BRB premises. This requirement reflects the critical nature of the SAR Backlog clearance effort and the need for SAR Investigators to have immediate access to BRB's transaction monitoring system, core banking platform, customer files, and physical records, as well as the ability to coordinate directly with BRB's permanent SAR filing staff and BSA/AML managers. Both (2) Team Leads are required to be on-site full-time throughout the entire engagement term, from the initial deployment in Phase 1 through the final off-boarding in Phase 4.
BRB will provide dedicated workspace, workstations, and system access credentials for all on-site Pinnacle personnel. Coordination of workspace allocation, IT provisioning, and building access will be managed through Linda Petrosian, BRB's Chief Information Officer / Chief Technology Officer, and BRB's facilities management team. Pinnacle will coordinate with BRB's IT department to ensure that all system access and hardware requirements are identified and addressed in advance of each deployment wave.
5.2 Remote Work Eligibility
Up to ten (10) of the thirty (30) FTEs may work remotely on any given business day, subject to BRB's information security policies and remote access protocols. Remote work eligibility is governed by the following parameters:
(a) Remote work is available primarily for KYC/CDD Analysts performing document collection and verification tasks that can be executed through BRB's secure remote access platform without the need for physical presence at BRB's offices. Many CDD/EDD remediation activities — including electronic document collection from customers and BaaS partners, identity verification against online databases, and risk rating documentation — can be effectively performed in a secure remote environment.
(b) Transaction Monitoring Reviewers may work remotely if specifically approved by Thomas Ikeda, BSA Officer, and provided that secure VPN access to the Veridian TMS is available and operational. Remote Transaction Monitoring Reviewers must demonstrate the ability to maintain the same alert review throughput and quality standards as on-site reviewers.
(c) All remote work arrangements are subject to prior written approval by BRB's BSA Officer and must comply with BRB's data security and privacy requirements. Remote workers must access BRB systems exclusively through BRB-approved VPN connections and must use BRB-issued or BRB-approved endpoint devices that meet BRB's endpoint security standards. No BRB data may be stored on personal devices, external storage media, or non-BRB systems at any time.
BRB reserves the right to revoke remote work authorization for any Pinnacle analyst at any time if BRB determines that remote work is creating security risks, quality concerns, or operational inefficiencies.
5.3 Phase 4 Wind-Down Remote Transition
During Phase 4 (December 1, 2025 – February 15, 2026), as Pinnacle staffing is gradually reduced, the remaining Pinnacle analysts may transition to primarily remote work arrangements, subject to BRB's approval. This transition is intended to facilitate the orderly completion of knowledge transfer activities, documentation finalization, and any residual remediation tasks while accommodating the reduced on-site space needs as the Pinnacle team scales down. All Phase 4 remote work arrangements remain subject to BRB's information security policies and the prior written approval of BRB's BSA Officer.
SECTION 6: ONBOARDING, TRAINING, AND SYSTEM ACCESS
6.1 Pre-Deployment Training (Pinnacle-Provided)
Prior to deployment to BRB, all Pinnacle analysts assigned to this engagement will complete Pinnacle's internal BSA/AML fundamentals training and assessment program. This program covers core BSA/AML concepts, SAR and CTR filing requirements, CDD/EDD principles, OFAC sanctions screening fundamentals, and relevant federal regulatory requirements. The training includes a written assessment component, and all analysts must achieve a passing score before being cleared for deployment.
In addition, all Pinnacle staff assigned to this engagement will receive a briefing on the terms and requirements of OCC Consent Order No. OCC-2025-003 prior to or during their first week of deployment. This briefing will be provided by the Pinnacle Team Leads, utilizing materials supplied by BRB and Calderwood & Harkness LLP. The briefing will cover the specific deficiencies identified in the Consent Order, the required remediation actions and timelines, the roles and responsibilities of the various parties involved in the remediation program, and the expectations for Pinnacle staff conduct and performance in the context of a regulatory enforcement action.
As set forth in Section 3.2.4, CAMS certification is required for both Team Leads. CAMS or equivalent professional certification is preferred for all other Pinnacle analysts and will be a factor in Pinnacle's selection and assignment of personnel to this engagement.
6.2 BRB-Specific Onboarding (BRB-Provided, Pinnacle-Coordinated)
BRB will provide institution-specific onboarding training for all Pinnacle analysts, covering the following topics:
(a) BSA/AML Policies and Procedures. BRB will provide access to and training on BRB's existing BSA/AML policies and procedures, as well as any revised drafts that have been or are being prepared in response to the Consent Order. Pinnacle analysts are expected to be familiar with and comply with all applicable BRB policies and procedures throughout the engagement.
(b) Veridian TMS Training. BRB will provide system-specific training on Veridian TMS v.8.3, including navigation, alert review workflows, case management functionality, documentation requirements, and reporting capabilities. Upon the deployment of Veridian TMS v.10.0 (UAT completion targeted for August 1, 2025), BRB will provide updated training on the v.10.0 platform, including any changes to alert review workflows, new detection scenarios, and updated case management features.
(c) Core Banking System Navigation. BRB will provide training on the core banking platform to the extent necessary for Pinnacle analysts to access customer account information, transaction histories, and other data required for SAR investigation and CDD/EDD remediation activities. Pinnacle analysts will have read-only access to the core banking platform, as specified in Section 6.3.
(d) SAR Backlog Triage Protocol and SAR Filing Standards. BRB will provide detailed training on the SAR Backlog Triage Protocol, which establishes the methodology and prioritization framework for reviewing and dispositioning the 2,400 SAR Backlog alerts, as well as BRB's revised SAR filing standards and narrative quality requirements.
(e) CDD/EDD Remediation Methodology and Prioritization Framework. BRB will provide training on the CDD/EDD remediation methodology, including the specific documentation requirements, identity verification procedures, beneficial ownership analysis standards, risk rating criteria, and account prioritization framework applicable to the 47,000 high-risk accounts.
(f) BaaS Partner Structure and Key Fintech Relationships. BRB will provide an overview of its BaaS partner program, including the organizational structure, operational models, customer bases, and transaction flows associated with NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., and other fintech partners. This training will include a review of the BaaS Partner CDD/EDD Responsibility Matrix and any other governing agreements or protocols relevant to Pinnacle's remediation activities.
(g) Confidentiality and Privilege Protocol Requirements. BRB and Calderwood & Harkness LLP will provide training on the confidentiality and privilege protocols applicable to the engagement, including the C&H Privilege Protocol Memorandum. Pinnacle analysts will be instructed on the proper handling of attorney-client privileged materials, the boundaries between compliance work product and privileged communications, and the procedures for escalating privilege-related questions.
(h) Information Security and Acceptable Use Policies. BRB will provide training on the Bank's information security policies, acceptable use policies, data handling procedures, and remote access protocols. Pinnacle analysts must demonstrate understanding of and compliance with these policies as a condition of continued system access.
The estimated onboarding period is three (3) to five (5) business days per wave of deployment. Pinnacle will coordinate the onboarding schedule with BRB's training and IT departments to minimize disruption and ensure that each deployment wave is fully trained and operational before the next wave arrives.
6.3 System Access