CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum was prepared by Calderwood & Harkness LLP at the request of counsel for Belmont Ridge Bank National Association and Belmont Ridge Financial Group, Inc. It contains confidential attorney-client communications and attorney work product. Any disclosure, copying, distribution, or use of the contents of this memorandum without the express written consent of Calderwood & Harkness LLP is strictly prohibited.
MEMORANDUM
February 20, 2025
PRIVILEGE DESIGNATION: ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
Right-click to update Table of Contents
I. Purpose and Executive Summary
The purpose of this memorandum is to track and analyze the escalation of supervisory findings issued by the Office of the Comptroller of the Currency ("OCC") against Belmont Ridge Bank National Association ("BRB" or the "Bank") across three distinct supervisory actions: (i) the June 2022 Matter Requiring Attention ("MRA") concerning BSA/AML transaction monitoring deficiencies; (ii) the November 2023 Matter Requiring Immediate Attention ("MRIA") concerning OFAC sanctions screening gaps in the Bank's Banking-as-a-Service ("BaaS") fintech partnership channel; and (iii) Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order"), which encompasses and expands upon the prior findings while imposing formal enforcement remedies. This memorandum analyzes BRB's remediation efforts — and failures — at each stage of the supervisory escalation and identifies the systemic root causes that permitted a routine supervisory finding to escalate, over a period of approximately thirty months, into a formal enforcement action carrying a significant civil money penalty and comprehensive remediation mandate.
This memorandum is prepared in connection with Calderwood & Harkness LLP's ("C&H") engagement as successor outside regulatory counsel to Belmont Ridge Bank National Association and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG"). C&H was retained on February 10, 2025, replacing Drayton Mercer LLP ("Drayton Mercer"), which served as BRB's primary outside regulatory counsel from 2019 through 2024. Drayton Mercer, under the direction of lead partner Helen Frazier, represented BRB during both the June 2022 MRA response and the November 2023 MRIA response, as well as throughout the March through September 2024 OCC targeted BSA/AML examination cycle that culminated in the issuance of the Consent Order. Drayton Mercer's engagement was terminated by BRB in January 2025, promptly following issuance of the Consent Order. As successor counsel, C&H has undertaken a comprehensive review of the prior supervisory record, BRB's remediation submissions, internal compliance documentation, and the Consent Order itself to inform the development of a remediation strategy that avoids the deficiencies of prior remediation efforts.
Key Conclusion. The progression from MRA to MRIA to Consent Order reflects a pattern of incomplete and superficial remediation responses, inadequate board-level oversight of compliance functions, insufficient investment in technology and personnel, and a fundamental failure to adapt the Bank's compliance infrastructure to the rapid growth of BRB's BaaS/fintech partnership channel. As of the date of this memorandum, BRB maintains fourteen (14) active BaaS fintech partners, processed approximately $74.3 billion in BaaS transaction volume during calendar year 2024, and generated $127.4 million in BaaS revenue during the same period. The compliance apparatus supporting this business line was designed for a substantially smaller and less complex operation, and the escalation of OCC findings is a direct consequence of the failure to scale compliance capabilities in parallel with business growth.
The Consent Order imposes the following principal requirements and obligations:
• A civil money penalty ("CMP") of $14.5 million, payable to the United States Treasury within sixty (60) days of the Consent Order's effective date (payment due by March 16, 2025);
• Engagement of an independent consultant to assess the adequacy of BRB's BSA/AML program and oversee remediation. Thornfield Consulting Group LLC ("Thornfield"), under the leadership of Dr. Vivian Castellano, was engaged by BRB on February 10, 2025, following receipt of OCC non-objection on February 5, 2025;
• Submission of a Comprehensive Remediation Action Plan to the OCC by May 15, 2025;
• Full program implementation and remediation completion by February 15, 2026, at which time BRB must submit a self-certification of compliance.
The total estimated remediation budget is $42.5 million, exclusive of the $14.5 million CMP. Accordingly, total projected financial outlay attributable to the Consent Order and associated remediation is approximately $57.0 million. This figure encompasses technology upgrades, staffing additions, consulting fees, legal fees, independent testing, and related implementation costs, as further detailed in this memorandum and in the forthcoming budget analysis.
II. Background: Belmont Ridge Bank NA — Institutional Profile and Regulatory Context
A. Entity Overview
Belmont Ridge Bank National Association is a nationally chartered commercial bank organized under the laws of the United States, operating under OCC Charter No. 48271 and FDIC Certificate No. 31845. The Bank is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."
As of December 31, 2024, BRB reported total consolidated assets of $38.7 billion, total deposits of $29.4 billion, and net income for fiscal year 2024 of approximately $412 million. The Bank's Tier 1 capital ratio stood at 11.2%, which is above the regulatory minimum required for a "well-capitalized" institution under the OCC's prompt corrective action framework. BRB's core business lines encompass retail banking, commercial lending, wealth management, and its rapidly growing fintech Banking-as-a-Service partnership division. The Bank employs approximately 5,800 individuals and currently maintains fourteen (14) active BaaS fintech partnerships. BRB received a Community Reinvestment Act ("CRA") rating of "Satisfactory" from the OCC in June 2023.
The Bank's headquarters are located at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. BRB operates branch locations across the Northeastern United States and serves a nationwide customer base through its BaaS partner network.
B. BSA/AML Program Overview (Pre-Remediation)
The Bank's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program, as structured prior to the commencement of Consent Order remediation, was organized under the following leadership and operational parameters:
BSA Officer. Thomas Ikeda has served as BRB's BSA Officer and AML Program Director since his appointment in March 2023. Mr. Ikeda reports to the Chief Compliance Officer and is responsible for the day-to-day administration of the Bank's BSA/AML program, including oversight of transaction monitoring, suspicious activity reporting, OFAC sanctions compliance, and customer due diligence functions.
Chief Compliance Officer. Patricia Langston was appointed Chief Compliance Officer in January 2024, replacing a predecessor whose employment was terminated. Ms. Langston's appointment occurred approximately two months after the issuance of the November 2023 MRIA, and her relatively brief tenure at the time of the March 2024 examination commencement (approximately two months) limited her ability to effect meaningful programmatic changes before the examination cycle began.
Staffing. The BSA/AML department comprised sixty-two (62) full-time equivalent employees ("FTEs") as of January 2025. As discussed in detail below, this staffing level was identified by the OCC as inadequate relative to the scale and complexity of BRB's operations, particularly its BaaS transaction volume.
Budget. The BSA/AML program budget for fiscal year 2024 was $18.2 million, inclusive of personnel costs, technology licensing, training, and external testing. As discussed further below, this budget was insufficient to support the compliance infrastructure required for an institution processing $74.3 billion in annual BaaS transaction volume across fourteen fintech partnerships.
Transaction Monitoring System. BRB utilizes Veridian Analytics Inc.'s Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"), pursuant to Contract No. VA-BRB-2023-0044. The annual contract value is approximately $4.1 million, under a three-year term expiring in December 2026. As discussed extensively in this memorandum, the Veridian TMS v.8.3 system has been the subject of repeated OCC criticism. The last independent model validation of the system was conducted in March 2021, and the most recent parameter tuning occurred in October 2022. The system has not been upgraded, and the Consent Order requires migration to Veridian TMS v.10.0.
C. OCC Supervisory Relationship
BRB's primary federal regulator is the Office of the Comptroller of the Currency, which supervises BRB through the OCC's Northeastern District Office, located at 340 Madison Avenue, New York, New York 10017. The Examiner-in-Charge ("EIC") assigned to BRB is Jonathan Frey, National Bank Examiner. BRB is assigned to the OCC's midsize bank supervision program under the supervisory chain of the Deputy Comptroller for Large Bank Supervision, reflecting the Bank's asset size and complexity profile.
The OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024, a six-month examination cycle that was more extended and intensive than a routine supervisory contact. This targeted examination was prompted by the persistence of deficiencies previously identified in the June 2022 MRA and November 2023 MRIA, and it culminated in the issuance of the Consent Order on January 15, 2025. The examination scope encompassed transaction monitoring, suspicious activity reporting, OFAC sanctions screening, customer due diligence, enhanced due diligence, BSA/AML governance, board oversight, and specific review of the compliance infrastructure supporting BRB's BaaS/fintech partnership channel.
D. External Counsel History
Drayton Mercer LLP, a New York law firm located at 55 East 52nd Street, Suite 3100, New York, New York 10055, served as BRB's outside regulatory counsel from 2019 through 2024. The engagement was led by Helen Frazier, a partner in Drayton Mercer's financial services regulatory practice. During the period relevant to this memorandum, Drayton Mercer advised BRB on the following matters:
• Preparation and submission of BRB's written response to the June 2022 MRA, including the formulation of remediation commitments;
• Preparation and submission of BRB's response to the November 2023 MRIA, including the articulation of corrective action plans;
• Representation of BRB during the March through September 2024 OCC targeted BSA/AML examination, including document production, examiner interactions, and pre-issuance negotiations relating to the Consent Order; and
• General ongoing BSA/AML regulatory advisory services throughout the engagement period.
Drayton Mercer's engagement was terminated by BRB in January 2025, following the issuance of the Consent Order. The decision to terminate prior counsel and retain successor counsel reflects BRB management's assessment — shared by this firm — that fresh advisory perspective was needed to address the compliance failures that culminated in the Consent Order. Calderwood & Harkness LLP was engaged on February 10, 2025, as BRB's successor outside regulatory counsel for all matters arising from the Consent Order and associated remediation efforts.
E. Independent Testing
Caldera & Pope LLP, a professional services firm located at 311 South Wacker Drive, Suite 5400, Chicago, Illinois 60606, serves as BRB's external auditor and has been contracted to perform BSA/AML independent testing pursuant to the regulatory requirement for annual independent testing of the BSA/AML program. The engagement partner is Franklin Dorsey, CPA. The annual external audit fee is approximately $3.4 million, and the BSA/AML independent testing engagement for calendar year 2024 was billed at approximately $1.1 million.
The most recent BSA/AML independent test was completed by Caldera & Pope in September 2024, contemporaneous with the conclusion of the OCC's targeted examination. Caldera & Pope's independent testing report identified multiple deficiencies in BRB's BSA/AML program that are closely aligned with — and in certain instances directly mirror — the findings set forth in the Consent Order. As discussed further in Section VI.F below, the timing and content of independent testing during earlier periods raise questions about whether more rigorous and timely testing could have prompted earlier remediation and averted the escalation to formal enforcement.
III. June 2022 MRA — BSA/AML Transaction Monitoring
A. Findings
In June 2022, the OCC issued a Matter Requiring Attention directed to BRB concerning deficiencies in the Bank's BSA/AML transaction monitoring program. A Matter Requiring Attention is a supervisory finding that, while serious, is not escalated to the level of an MRIA or a formal enforcement action. An MRA identifies practices that deviate from sound compliance standards and require corrective action by the institution within a reasonable period. While an MRA does not carry the urgency designation or enforcement implications associated with an MRIA, institutions are expected to address MRA findings promptly and substantively. Failure to do so may result in escalation to more severe supervisory actions, as occurred here.
The core finding of the June 2022 MRA was that BRB's BSA/AML transaction monitoring program was inadequate. Specifically, the OCC identified the following deficiencies:
Transaction Monitoring System Deficiencies. The OCC determined that BRB's transaction monitoring system — Veridian Analytics Inc. TMS v.8.3 — exhibited deficiencies in alert generation, scenario coverage, and parameter tuning. The system's alert scenarios were not calibrated to detect the full range of suspicious transaction patterns associated with the Bank's product mix and customer base, including the emerging BaaS transaction flows. Alert thresholds had not been reviewed or adjusted to account for changes in transaction volume, customer demographics, or product offerings.
Model Validation Gap. The MRA noted that the Veridian TMS v.8.3 had not been subjected to independent model validation since March 2021, more than fifteen months prior to the issuance of the MRA. Independent model validation is a critical component of an effective transaction monitoring program, serving to verify that the system's scenarios, thresholds, and logic remain appropriate and effective in light of the institution's risk profile and transaction patterns. The absence of timely validation raised concerns about the ongoing adequacy and reliability of the system's alert generation capabilities.
Alert Backlog Concerns. The MRA raised concerns about a growing backlog of transaction monitoring alerts that had not been reviewed and dispositioned in a timely manner. While the alert backlog in 2022 was substantially smaller than the approximately 2,400-alert backlog subsequently identified in the September 2024 examination, the MRA recognized the emergence of a trend that, if unaddressed, would impair the Bank's ability to identify and report suspicious activity in a timely manner.
Staffing Insufficiency. The OCC flagged that the BSA/AML department's staffing levels were insufficient relative to the Bank's growing transaction volumes. This concern was particularly acute in light of the expansion of BRB's BaaS partnership channel, which had recently onboarded NovaPay Technologies Inc. ("NovaPay") in 2021 and FairLend Digital LLC ("FairLend Digital") in 2022. The addition of these fintech partnerships introduced substantial new transaction volumes and customer populations that required monitoring, investigation, and reporting capabilities beyond the existing staffing levels.
SAR Filing Timeliness. The MRA noted concerns regarding the timeliness of Suspicious Activity Report ("SAR") filings. While the specific metrics cited in the MRA were less severe than the 78-day average filing time later identified in the Consent Order examination, the OCC observed that SAR filings were not consistently meeting the regulatory expectation of timely filing, typically understood to mean filing within thirty (30) days of the determination that an activity is suspicious.
B. BRB's Response Under Drayton Mercer LLP
Following the issuance of the June 2022 MRA, BRB engaged Drayton Mercer LLP — its then-outside regulatory counsel — to advise on the formulation and submission of a written response to the OCC. The response was prepared under the direction of Helen Frazier, Drayton Mercer's lead partner on the BRB engagement.
BRB's written response to the OCC acknowledged the findings set forth in the MRA and committed to a series of specific remediation actions. The remediation commitments articulated in the response included:
(i) Conducting an independent model validation of the Veridian TMS v.8.3 to assess the adequacy of the system's scenarios, thresholds, and alert generation logic in light of BRB's current risk profile and transaction patterns;
(ii) Retuning the transaction monitoring scenarios within the Veridian TMS v.8.3 to address the parameter deficiencies identified in the MRA, including adjustments to alert thresholds, scenario coverage, and detection logic;
(iii) Hiring additional BSA/AML staff to address the identified staffing shortfall and to ensure adequate capacity for alert review, investigation, and SAR filing in light of increasing transaction volumes; and
(iv) Improving the SAR filing process to reduce filing times and ensure consistency with regulatory expectations for timely filing.
The actual remediation actions taken by BRB following submission of its MRA response were materially incomplete relative to the commitments made:
Veridian TMS v.8.3 Parameter Retuning. BRB's compliance team, working with Veridian Analytics, performed a parameter retuning of the Veridian TMS v.8.3 in October 2022. This tuning adjusted certain alert thresholds and scenario parameters and represented a partial, good-faith response to the MRA's concerns about outdated tuning. However, as discussed below, this October 2022 tuning was the last tuning performed on the system before the March 2024 OCC examination — a gap of approximately seventeen months during which the BaaS transaction environment continued to evolve significantly.
Independent Model Validation — Not Completed. Despite the explicit commitment in BRB's MRA response to conduct an independent model validation of the Veridian TMS v.8.3, no such validation was undertaken. The last independent model validation remained the March 2021 validation. This means that as of the commencement of the OCC's targeted examination in March 2024, the Veridian TMS v.8.3 had not been independently validated in approximately three years — a period during which BRB's transaction volume, customer base, and product mix had changed dramatically due to BaaS expansion. The failure to complete the promised model validation is perhaps the single most consequential remediation failure in this sequence, as it directly enabled the persistence of monitoring deficiencies that the validation was designed to identify and address.
Staffing Increases — Inadequate. BRB implemented limited staffing increases in the BSA/AML department following the MRA. However, the pace and scale of hiring did not keep pace with the rapid expansion of BaaS transaction volumes that occurred between 2022 and 2024. The department's headcount of 62 FTEs as of January 2025 was inadequate relative to the processing, investigation, and reporting workload generated by $74.3 billion in annual BaaS transaction volume across fourteen partnerships. The OCC's Consent Order findings effectively confirm that the staffing levels maintained by BRB throughout this period were insufficient.
SAR Process Improvements — Formalistic. BRB documented SAR process improvements on paper, including revised procedures, updated workflow documentation, and enhanced tracking mechanisms. However, these procedural improvements were not effectively operationalized. The underlying capacity constraints — insufficient staff, unvalidated monitoring systems, growing alert backlogs — undermined the practical effectiveness of the documented process changes. The gap between documented procedures and operational reality is a recurring theme throughout this escalation history.
C. Assessment of Remediation Adequacy
The June 2022 MRA response represents the first instance in the escalation sequence of what would become a recurring pattern: BRB's compliance function produced written documentation and policy updates sufficient to create an appearance of responsiveness, but failed to execute the substantive operational changes necessary to address the underlying deficiencies.
The October 2022 retuning of the Veridian TMS v.8.3 was a partial and narrowly targeted response that, while responsive to the tuning-specific component of the MRA, was not accompanied by the independent model validation that BRB had committed to perform. The significance of this omission cannot be overstated. Independent model validation serves a fundamentally different purpose than parameter tuning: while tuning adjusts system parameters within the existing model framework, validation assesses whether the model framework itself remains appropriate and effective. By performing tuning without validation, BRB addressed the symptoms of the monitoring deficiency without examining whether the underlying model architecture — the scenarios, the detection logic, the threshold methodology — remained fit for purpose in the context of a rapidly evolving transaction environment.
The absence of independent model validation for a period exceeding three years (from March 2021 through at least March 2024) directly contributed to the Consent Order's Finding No. 4, which identified the model validation gap as a standalone deficiency. Had BRB fulfilled its remediation commitment and conducted a validation in late 2022 or early 2023, it is reasonable to expect that the validation would have identified the scenario coverage gaps and alert generation deficiencies that the OCC later cited in the Consent Order, providing BRB with an opportunity to remediate before the deficiencies escalated.
At the board level, the June 2022 MRA received minimal attention. BRB did not have a dedicated Compliance Committee of the Board of Directors, and BSA/AML matters were reported to the full Board on a quarterly basis through generalized compliance reports that lacked the granular metrics necessary for directors to assess the adequacy of remediation efforts. Board members were not positioned to identify that a committed remediation action — the model validation — had not been performed, because the reporting framework did not track individual remediation commitments against milestones and completion dates.
Drayton Mercer's advisory role during this period merits note. The firm advised BRB on the formulation of remediation commitments that included the model validation. However, the record does not reflect that Drayton Mercer implemented any mechanism to monitor or verify BRB's completion of the committed remediation actions, or that the firm alerted BRB management or the Board to the non-completion of the model validation in the months following the MRA response. The firm's approach appears to have been oriented toward documentary compliance — the production of written responses and policies — rather than the verification of substantive implementation.
IV. November 2023 MRIA — OFAC Screening Gaps
A. Findings
In November 2023, approximately seventeen months after the issuance of the June 2022 MRA, the OCC issued a Matter Requiring Immediate Attention directed to BRB concerning deficiencies in the Bank's OFAC sanctions screening protocols, with particular emphasis on the BaaS/fintech partnership channel. The escalation from MRA to MRIA represented a significant supervisory intensification and signaled the OCC's increasing concern about the adequacy of BRB's compliance posture.
A Matter Requiring Immediate Attention is the OCC's most serious informal supervisory action. It denotes a deficiency of such severity or urgency that it requires immediate corrective action by the institution. An MRIA is distinguishable from an MRA in both the gravity of the finding and the regulatory expectation for the speed and completeness of remediation. The escalation from MRA to MRIA — particularly in a related compliance area — Signals that the OCC views the institution's compliance trajectory as deteriorating rather than improving. For BRB, this escalation was a clear warning that the agency's patience with incremental or incomplete remediation was exhausted.
The core finding of the November 2023 MRIA was that BRB's OFAC sanctions screening protocols were inadequate, with specific deficiencies concentrated in the screening of transactions processed through fintech BaaS channels. The MRIA identified the following:
Incomplete Screening Coverage. The OCC determined that BRB's OFAC screening system was not screening 100% of transactions flowing through BaaS partners. Specific gaps were identified in wire transfer and Automated Clearing House ("ACH") transactions processed through NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner, which was onboarded in 2021 and accounted for approximately 41% of all BaaS transaction volume. The MRIA foreshadowed what the subsequent targeted examination would quantify: approximately 3.8 million NovaPay transactions went unscreened during calendar year 2023 out of 31.7 million total NovaPay transactions, representing an approximately 12.0% screening gap.
Inadequate Hit Disposition Process. The MRIA noted that BRB's process for reviewing and dispositioning OFAC screening hits — instances where a transaction or party name triggered a potential match against the OFAC Specially Designated Nationals and blocked Persons ("SDN") list — was not adequately documented. Analysts responsible for reviewing screening hits were not maintaining sufficient records of their disposition decisions, making it difficult for supervisory personnel, internal audit, or regulators to verify that hits were being reviewed with appropriate diligence and that true matches were being identified and escalated.
Excessive False-Positive Rate. The MRIA observed that the false-positive rate in BRB's OFAC screening system was extremely high, suggesting that the screening filters were poorly tuned and generating a volume of alerts that overwhelmed the review capacity of the compliance staff. The subsequent targeted examination quantified this deficiency: in calendar year 2024, BRB's screening system generated 14,320 OFAC hits, of which only 12 were determined to be true matches — a false-positive rate of approximately 99.9%. While a high false-positive rate is inherent in sanctions screening due to the nature of name-matching algorithms, a rate of this magnitude indicates that the screening parameters were not appropriately calibrated, resulting in wasted review effort and increased risk that true matches could be missed amid the volume of false positives.
Expansion of Compliance Deficiency Categories. Critically, the OFAC screening deficiency was a new category of finding not previously cited in the June 2022 MRA. The June 2022 MRA had focused on transaction monitoring (BSA/AML alert generation, model validation, and SAR filing timeliness). The emergence of an OFAC screening deficiency in the November 2023 MRIA indicated that BRB's compliance problems were expanding into new areas rather than contracting under remediation pressure — a deeply unfavorable signal from the OCC's perspective and one that would inform the agency's decision to escalate to formal enforcement.
B. Context: BaaS Program Growth During the MRA-to-MRIA Period
The period between the June 2022 MRA and the November 2023 MRIA was marked by significant expansion of BRB's BaaS fintech partnership program. This growth is essential context for understanding both the emergence of new compliance deficiencies (OFAC screening gaps) and the worsening of previously identified deficiencies (transaction monitoring, SAR timeliness).
Between mid-2022 and late 2023, BRB's BaaS partnership portfolio grew as follows:
• NovaPay Technologies Inc. was onboarded in 2021 and continued to grow as BRB's largest BaaS partner, ultimately representing approximately 41% of total BaaS transaction volume. NovaPay facilitates payment processing, money transfer, and prepaid card services through BRB's banking charter, and in calendar year 2024, NovaPay-related transactions totaled approximately $30.5 billion.
• FairLend Digital LLC was onboarded in 2022 and grew to represent approximately 28% of BaaS transaction volume. FairLend Digital operates a digital lending platform that originates consumer and small business loans through BRB's charter. In fiscal year 2024, FairLend Digital originated approximately $1.4 billion in loans through BRB.
• VaultEdge Inc. was onboarded in 2023 and grew to represent approximately 18% of BaaS volume. VaultEdge offers digital deposit and savings products through BRB's charter and had onboarded approximately 870,000 deposit accounts as of the examination date.
• Additional BaaS partnerships grew the total active partner count toward fourteen (14) relationships, each introducing additional transaction flows, customer populations, and compliance complexity.
By calendar year 2024, BRB's total BaaS transaction volume reached $74.3 billion, generating revenue of $127.4 million. The BaaS channel had become a material business line for BRB, contributing significantly to the Bank's revenue base and growth trajectory. However, this rapid expansion in BaaS activity was not matched by commensurate investment in compliance infrastructure. Specifically:
• OFAC screening system integration for BaaS transaction flows was not completed for all partners and transaction types. The NovaPay screening gaps that formed the basis of the November 2023 MRIA reflected an integration failure that had persisted since NovaPay's 2021 onboarding — meaning BRB operated for approximately two years with known or discoverable screening gaps in its largest BaaS partnership before the OCC formally identified the deficiency.
• CDD/EDD processes for customers onboarded through fintech BaaS partners were not adapted to the unique risks and data limitations inherent in technology-mediated customer acquisition. As discussed further below, this gap would later manifest as the 47,000-account CDD/EDD deficiency cited in the Consent Order.
• The BSA/AML budget of $18.2 million for fiscal year 2024, while a meaningful expenditure in absolute terms, was inadequate relative to the scale and complexity of operations it was intended to support. For an institution processing $74.3 billion in annual BaaS transaction volume across fourteen fintech partners, with 41,500 transaction monitoring alerts and 14,320 OFAC screening hits annually, the compliance budget was materially underfunded.
C. BRB's Response Under Drayton Mercer LLP
Following issuance of the November 2023 MRIA, BRB again engaged Drayton Mercer LLP to advise on the formulation and submission of a response to the OCC. As with the prior MRA response, Helen Frazier served as the lead partner on the engagement. Given the elevated severity of an MRIA, BRB's response was framed as an urgent corrective action plan requiring immediate implementation.
BRB submitted a response to the OCC committing to the following remediation actions:
(i) Conducting a comprehensive review of OFAC screening coverage across all BaaS channels, including a transaction-level analysis to identify and quantify screening gaps;
(ii) Working with Veridian Analytics Inc. — specifically Priya Subramanian, Vice President of Client Solutions — to develop and implement a system patch or upgrade to close identified screening gaps and ensure 100% screening coverage for all BaaS transaction flows;
(iii) Implementing enhanced OFAC hit review and escalation procedures, including standardized disposition documentation, quality assurance reviews, and clear escalation pathways for potential true matches; and
(iv) Conducting a lookback review of potentially unscreened transactions to identify any instances in which sanctions violations may have occurred and, if applicable, to make appropriate regulatory filings.
The actual remediation actions taken by BRB following submission of its MRIA response were, once again, materially incomplete relative to the commitments made:
Veridian Analytics Discussions — No System Remediation. BRB's compliance team initiated discussions with Veridian Analytics (specifically with Priya Subramanian) regarding the screening coverage gaps identified in the MRIA. These discussions involved preliminary scoping of system modifications that could address the gaps. However, no formal system upgrade, patch, or configuration change was implemented before the OCC commenced its targeted examination in March 2024 — approximately four months after the MRIA was issued. The screening gaps that prompted the MRIA therefore remained open and unresolved when the OCC examiners arrived for the targeted review.
No Comprehensive Lookback. BRB did not complete a comprehensive lookback of unscreened transactions as committed in its MRIA response. A lookback is a critical remediation tool in the sanctions screening context, as it enables the institution to determine whether any transactions that bypassed screening involved sanctioned parties, and to make appropriate OFAC reports if violations are identified. The failure to complete a lookback left BRB unable to demonstrate to the OCC that the screening gaps had not resulted in sanctions violations — a significant remediation failure that contributed to the severity of the Consent Order.
Procedural Updates Without Operational Change. BRB's compliance team updated written OFAC screening procedures and hit review protocols, but the underlying system architecture — the technical integration between BaaS partner transaction flows and BRB's screening system — remained unchanged. The procedural improvements were therefore divorced from the operational reality of how transactions were actually being screened (or not screened). This pattern mirrors the MRA response approach: documented procedures were updated to create an appearance of remediation, while the substantive system and operational deficiencies persisted.
CDD/EDD Deficiencies Unaddressed. The MRIA response did not address CDD/EDD deficiencies for fintech-onboarded customers, despite the clear functional linkage between inadequate customer identification and the effectiveness of sanctions screening. OFAC screening is only as effective as the customer data against which transactions are matched; if CDD/EDD processes do not capture accurate and complete customer identification information, screening systems cannot effectively match transaction parties against sanctions lists. The failure to address CDD/EDD as part of the OFAC remediation represented a missed opportunity to address a systemic vulnerability that the OCC would later cite as a standalone Consent Order finding (the 47,000-account CDD/EDD deficiency).
It is noted that Patricia Langston was appointed Chief Compliance Officer in January 2024, approximately two months after the issuance of the MRIA, replacing a predecessor whose employment was terminated. The termination of the prior CCO and Ms. Langston's appointment suggest that BRB management recognized the inadequacy of existing compliance leadership. However, the timing of the appointment — only two months before the OCC commenced its targeted examination in March 2024 — provided Ms. Langston with insufficient time to assess the state of the compliance program, identify unremediated deficiencies, and implement meaningful corrective actions before the examination began. The leadership transition, while directionally appropriate, came too late to change the outcome of the examination cycle.
D. Assessment of Remediation Adequacy
The November 2023 MRIA response was substantively inadequate. None of the four principal remediation commitments was fulfilled before the OCC commenced its targeted examination in March 2024. The failure to close the OFAC screening gap, conduct a lookback, implement system modifications, or address underlying CDD/EDD deficiencies after receiving an MRIA — the OCC's most serious informal supervisory action — was a critical factor in the agency's decision to escalate to formal enforcement.
The significance of the escalation from MRA to MRIA cannot be overstated in the context of OCC supervisory practice. An MRIA is reserved for deficiencies of such severity or urgency that they require the institution's immediate and undivided attention. When an institution fails to remediate an MRIA finding, the OCC interprets this failure as evidence either of institutional incapacity or institutional unwillingness to comply — either of which justifies escalation to a formal enforcement action. In BRB's case, the failure to remediate the November 2023 MRIA removed any remaining buffer of supervisory goodwill and made formal enforcement virtually inevitable.
Drayton Mercer's advisory role during the MRIA response period is particularly notable. The firm represented BRB during the formulation of the MRIA response, during the interval between the MRIA and the March 2024 examination, and throughout the examination itself. Drayton Mercer was therefore positioned to monitor the status of BRB's remediation commitments and to alert BRB management and the Board if commitments were not being fulfilled on schedule. The record does not reflect that Drayton Mercer took effective action to ensure substantive remediation during this critical period. The firm was unable to prevent the escalation from MRIA to Consent Order.
Board-level awareness of the MRIA appears to have been limited by the same structural deficiencies that hampered oversight of the MRA response. No dedicated Compliance Committee existed to provide focused board attention to compliance matters. BSA/AML reporting to the Board remained quarterly and generalized, without inclusion of key risk metrics such as OFAC screening hit rates, screening coverage percentages, or risk ratings broken down by BaaS partner. Directors were not receiving the information necessary to independently assess whether MRIA remediation commitments were being fulfilled, and the absence of a dedicated committee meant that no subset of directors bore specific accountability for compliance oversight.
V. January 15, 2025 Consent Order — OCC-2025-003
A. Examination and Consent Order Overview
The OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024, a comprehensive six-month examination cycle that encompassed all aspects of BRB's BSA/AML program with particular emphasis on the areas previously identified in the June 2022 MRA and November 2023 MRIA. The examination was led by Examiner-in-Charge Jonathan Frey and was conducted by a team of national bank examiners from the OCC's Northeastern District Office.
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 (the "Consent Order"), a formal enforcement action against Belmont Ridge Bank National Association. The Consent Order represents the culmination of the supervisory escalation sequence documented in this memorandum and imposes comprehensive remediation obligations and a civil money penalty.
The principal terms of the Consent Order include:
Civil Money Penalty. The OCC assessed a civil money penalty of $14,500,000 ($14.5 million), payable to the United States Treasury within sixty (60) calendar days of the Consent Order's effective date. The CMP payment is therefore due by March 16, 2025. The CMP reflects the OCC's assessment of the severity and duration of the identified deficiencies, the institution's failure to remediate previously identified findings, and the potential harm to the financial system from BSA/AML compliance failures in BRB's BaaS channel.
Independent Consultant. The Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to assess the adequacy of BRB's BSA/AML program and to oversee and validate remediation efforts. Thornfield Consulting Group LLC ("Thornfield"), under the leadership of Dr. Vivian Castellano, was selected by BRB and submitted for OCC review. The OCC provided written non-objection to Thornfield's engagement on February 5, 2025. The Thornfield engagement was formally executed on February 10, 2025. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, with a preliminary gap assessment due by April 15, 2025.
Comprehensive Remediation Action Plan. BRB is required to submit a Comprehensive Remediation Action Plan to the OCC by May 15, 2025. The Plan must address all deficiency categories identified in the Consent Order, set forth specific remediation actions with timelines, assign accountability to named individuals, and establish verification mechanisms.
Full Program Implementation. The Consent Order requires full implementation of all required corrective actions by February 15, 2026, at which time BRB must submit a written self-certification of compliance to the OCC.
No Criminal Referral (As of Memo Date). As of the date of this memorandum (February 20, 2025), the OCC has not made a criminal referral to the United States Department of Justice in connection with the findings in the Consent Order. However, the Consent Order does not contain a non-referral provision, and the OCC retains the right to refer the matter for criminal investigation at any time. Additionally, the Financial Crimes Enforcement Network ("FinCEN") is independently monitoring BRB's SAR filing remediation. C&H understands from informal communications that Associate Director Angela Drummond of FinCEN's Enforcement Division is the senior FinCEN official overseeing BRB-related matters. FinCEN has reserved its independent enforcement authority and has not waived any rights in connection with the OCC's Consent Order.
Public disclosure of the Consent Order occurred on January 16, 2025, when BRFG filed a Current Report on Form 8-K with the Securities and Exchange Commission and issued a corresponding press release. The market reaction was significant: BRFG common stock declined from a closing price of approximately $47.82 per share on January 15, 2025, to approximately $41.15 per share on January 16, 2025, a decline of approximately $6.67 per share, or approximately 13.9%. By February 7, 2025, the stock had partially recovered to approximately $47.82 per share, though the Consent Order and its associated remediation costs continue to represent material considerations for the Company's market valuation, investor relations, and earnings outlook.
B. Core Deficiency Categories — Detailed Comparison to Prior Findings
The Consent Order identifies five core deficiency categories. Two of these (OFAC screening and SAR filing) represent direct escalations of findings previously identified in the MRA and/or MRIA. One (model validation) represents a chronic deficiency first identified in the MRA that persisted unremediated through the Consent Order. Two (CDD/EDD failures and board oversight deficiencies) are new findings not specifically cited in prior supervisory actions, though both are functionally related to the previously identified deficiencies and represent consequences of the same systemic root causes.
Finding 1: OFAC Sanctions Screening (Escalation from November 2023 MRIA)
November 2023 MRIA Finding. The MRIA identified gaps in BRB's OFAC screening coverage for transactions processed through fintech BaaS channels, with particular concern regarding NovaPay-related wire and ACH transactions. The MRIA was a qualitative finding — it described the nature of the deficiency without providing precise quantification of the scope of unscreened transactions.
January 2025 Consent Order Finding. The Consent Order, informed by the OCC's six-month targeted examination, quantified the OFAC screening deficiency with specificity. The OCC determined that BRB's OFAC screening system failed to screen 100% of transactions flowing through fintech BaaS channels. Approximately 3.8 million NovaPay wire and ACH transactions were unscreened in calendar year 2023, out of approximately 31.7 million total NovaPay transactions processed during the same period. This represents an approximately 12.0% screening gap (3.8 million ÷ 31.7 million ≈ 12.0%). The unscreened transactions include both wire transfers and ACH transactions, two of the highest-risk payment channels from a sanctions compliance perspective.
Escalation Analysis. The OFAC screening deficiency identified in the November 2023 MRIA persisted unabated for over fourteen months through the examination period. The remediation commitments made by BRB in its MRIA response — system patches, comprehensive coverage review, lookback review — were not fulfilled before the targeted examination commenced in March 2024 and had not been fulfilled by the time the examination concluded in September 2024. The scope of the screening gap was larger than initially suspected when the MRIA was issued: the 12.0% gap, applied to 31.7 million NovaPay transactions, meant that millions of individual transactions were processed without sanctions screening — a finding of extraordinary severity in the current sanctions enforcement environment.
Consent Order Requirement. BRB is required to achieve full OFAC screening operationalization for all BaaS channels, including all transaction types processed through all fourteen BaaS fintech partners, by November 1, 2025.
Finding 2: SAR Filing Deficiencies (Escalation from June 2022 MRA)
June 2022 MRA Finding. The MRA flagged concerns about SAR filing timeliness and the emergence of alert backlogs within BRB's transaction monitoring function. At the time of the MRA, the specific metrics were less severe than those later identified in the Consent Order examination, but the trend was unfavorable.
January 2025 Consent Order Finding. The Consent Order documented that BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the September 2024 examination date. Each unreviewed alert represents a transaction or series of transactions that the monitoring system flagged for potential suspicious activity but that a human analyst had not yet reviewed, investigated, and dispositioned. The average time from alert generation to SAR filing was 78 days — more than 2.5 times the regulatory expectation of timely filing within 30 days.
Supporting data from the examination further illustrates the scale of the deficiency:
• Total SARs Filed (CY 2024): 3,847 (up from 2,914 in CY 2023, reflecting a year-over-year increase of approximately 32%)
• Total Transaction Monitoring Alerts (CY 2024): 41,500
• SAR Conversion Rate: 3,847 SARs ÷ 41,500 alerts ≈ 9.3%
• BaaS-Related SARs: 2,108 of 3,847 total SARs, or approximately 54.8% of all SARs filed
Escalation Analysis. The June 2022 MRA identified the early stages of a SAR filing timeliness problem that, by 2024, had grown substantially in both severity and scope. The alert backlog expanded from a smaller number in 2022 to 2,400 open alerts by September 2024. Filing times deteriorated from concerning (in 2022) to 78 days — a level that is unambiguously deficient under BSA regulatory standards. The growth in BaaS transaction volumes was a primary driver: BaaS-related SARs accounted for 54.8% of all SARs filed, reflecting the disproportionate compliance burden generated by the BaaS channel. An inadequately resourced BSA/AML department, operating with only 62 FTEs and an $18.2 million budget, was unable to keep pace with the monitoring, investigation, and reporting workload generated by a $74.3 billion BaaS transaction operation.
Consent Order Requirements. BRB must submit an interim SAR backlog status report to the OCC by March 31, 2025. The 2,400-alert backlog must be fully cleared — meaning all alerts must be reviewed, investigated, and dispositioned, with SARs filed as appropriate — by June 30, 2025.
Finding 3: CDD/EDD Failures (New Finding — Not Cited in Prior MRA/MRIA)
June 2022 MRA. Customer Due Diligence and Enhanced Due Diligence deficiencies were not specifically addressed in the June 2022 MRA, which focused on transaction monitoring, model validation, and SAR filing timeliness.
November 2023 MRIA. CDD/EDD deficiencies were not specifically addressed as a standalone finding in the November 2023 MRIA. However, the CDD/EDD failures are functionally related to the OFAC screening gaps identified in the MRIA, because inadequate customer identification undermines the effectiveness of sanctions screening. If an institution does not maintain accurate and complete information about its customers' identities, beneficial ownership, and risk profiles, its ability to match transaction parties against sanctions lists is impaired. The MRIA's OFAC findings therefore implicitly signaled the presence of underlying CDD/EDD weaknesses.
January 2025 Consent Order Finding. The Consent Order identified that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through fintech BaaS partners — lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation. The deficiencies encompass incomplete identity verification, missing beneficial ownership information, inadequate risk assessments, and failure to apply enhanced due diligence procedures to customers whose risk profiles warranted heightened scrutiny.
Escalation Analysis. The CDD/EDD finding represents a new deficiency category that, while not previously cited as a standalone concern, is a direct consequence of the rapid BaaS growth that also gave rise to the OFAC screening and SAR filing deficiencies. The 47,000-account figure is a systemic failure, not an isolated gap. It reflects a fundamental inadequacy in BRB's process for onboarding and monitoring customers acquired through technology-mediated channels. The failure to address CDD/EDD as part of the MRIA remediation response — despite its clear connection to the OFAC screening deficiency — was a missed opportunity that permitted the problem to grow to a scale that attracted standalone enforcement attention.
Consent Order Requirements. BRB must remediate 50% of the identified CDD/EDD-deficient accounts (approximately 23,500 accounts) by July 15, 2025, and must achieve 100% remediation (all 47,000 accounts) by January 15, 2026. Remediation includes completing identity verification, obtaining beneficial ownership information, conducting risk assessments, and applying EDD procedures to accounts that meet the applicable risk criteria.
Finding 4: Model Validation (Escalation from June 2022 MRA)
June 2022 MRA Finding. The MRA identified that BRB's Veridian TMS v.8.3 had not been independently validated since March 2021 — more than fifteen months prior to the MRA — and recommended that BRB conduct an independent validation and retune the system's parameters.
January 2025 Consent Order Finding. The Consent Order documented that the Veridian TMS v.8.3 still had not been independently validated since March 2021 — more than three years prior to the commencement of the targeted examination in March 2024 and nearly four years prior to the issuance of the Consent Order. Tuning parameters were last updated in October 2022 (in response to the MRA) and had not been validated or updated thereafter. The system had therefore been operating for over two years without tuning and over three years without validation during a period of unprecedented transaction volume growth driven by BaaS expansion.
Escalation Analysis. The model validation finding is perhaps the most clear-cut example of a broken remediation commitment in the entire escalation sequence. BRB committed, in writing, in its June 2022 MRA response to conduct an independent model validation of the Veridian TMS v.8.3. That validation was never performed. The October 2022 parameter retuning was the only responsive action, and while it represented a partial effort to address the tuning component of the MRA finding, it was insufficient without accompanying validation. The commitment to validate was explicit, specific, and unambiguous. Its non-fulfillment over a period of nearly three years represents a fundamental failure of remediation execution that no supervisory agency could overlook.
Consent Order Requirements. BRB must complete the upgrade of the Veridian TMS from version 8.3 to version 10.0, with User Acceptance Testing ("UAT") completed by August 1, 2025. An independent model validation of the upgraded system must be completed by October 1, 2025. The upgrade represents a significant technology investment — $2.8 million in implementation costs plus $1.9 million per year in incremental licensing fees — that was not prioritized until the Consent Order forced the issue.
Finding 5: Board Oversight Deficiencies (New Finding — Not Cited in Prior MRA/MRIA)
June 2022 MRA. Board oversight deficiencies were not specifically cited as a standalone finding in the June 2022 MRA.
November 2023 MRIA. Board oversight deficiencies were not specifically cited as a standalone finding in the November 2023 MRIA.
January 2025 Consent Order Finding. The Consent Order identified that BRB's Board of Directors did not have a dedicated Compliance Committee and that BSA/AML reporting to the Board was limited to quarterly presentations that did not include key operational and risk metrics. Specifically, Board reporting did not include SAR volumes and trends, OFAC screening hit rates and disposition outcomes, transaction monitoring alert volumes and backlog levels, or risk ratings and compliance assessments for individual BaaS partners. The Board was therefore unable to exercise meaningful oversight of the Bank's BSA/AML program or to independently assess the adequacy of management's remediation efforts.
Escalation Analysis. While board oversight was not previously cited as a standalone finding, the Consent Order identifies it as a systemic root cause that enabled the persistence of the other four deficiency categories. The Board's lack of a dedicated Compliance Committee meant that no subset of directors bore specific accountability for compliance oversight. The quarterly reporting frequency and lack of granular metrics meant that directors were dependent on management's characterizations of compliance status, without independent data points against which to evaluate those characterizations. Had the Board received monthly or quarterly dashboards showing, for example, that the promised model validation had not been completed, that the OFAC screening gap persisted, or that the SAR backlog was growing, directors would have been positioned to demand corrective action at a much earlier stage. The absence of effective board oversight is both a standalone deficiency and a meta-cause of the other deficiencies' persistence.
Consent Order Requirements. BRB must adopt a Board Resolution acknowledging the Consent Order and establishing a dedicated Compliance Committee within forty-five (45) days of the Consent Order's effective date — by February 28, 2025. James Rutherford has been designated as Chair of the newly established Compliance Committee. The Committee is required to receive regular, detailed reporting on all aspects of BSA/AML compliance, including progress against Consent Order milestones.
C. Summary Comparison Table
The following table provides a consolidated comparison of all five deficiency categories across the three supervisory actions:
VI. Systemic Root Causes for Escalation
The escalation from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) was driven by a confluence of systemic failures that, individually and collectively, prevented effective remediation and permitted compliance deficiencies to grow rather than diminish over time. This section identifies and analyzes six root causes for the escalation.
A. Failure of Substantive Remediation
The most significant root cause is the repeated pattern of documentary compliance without substantive implementation. At each stage of the supervisory escalation, BRB produced written responses, updated policies, and documented procedures that, on their face, appeared responsive to the OCC's findings. However, in each instance, the underlying system deficiencies, staffing shortfalls, and operational gaps that gave rise to the findings persisted.
The pattern is consistent and readily identifiable. In response to the June 2022 MRA, BRB committed to independent model validation but never performed it, while producing a parameter retuning that addressed only part of the finding. In response to the November 2023 MRIA, BRB committed to system remediation, a lookback review, and enhanced procedures, but implemented none of these before the targeted examination commenced. In both instances, written procedures were updated, policies were revised, and documented responses were submitted to the OCC — but the substance behind the documentation was absent.
The model validation commitment is the starkest example. BRB made an explicit, specific, written commitment to the OCC to conduct an independent model validation of the Veridian TMS v.8.3. That commitment was never fulfilled over a span of nearly three years, from the June 2022 MRA response through at least March 2024 (when the targeted examination commenced). The OFAC screening remediation is an equally egregious example: a system gap identified in an MRIA — the OCC's most urgent informal supervisory action — was not closed in the four-month window between the November 2023 MRIA and the March 2024 examination, and had still not been closed by the time the examination concluded in September 2024.
This pattern suggests a fundamental orientation within BRB's compliance function — and within the advisory approach of prior counsel — toward the production of responsive documentation rather than the execution of responsive action. Going forward, the remediation program must be designed with this historical tendency in mind, incorporating verification mechanisms that distinguish between documentary completion and substantive operational implementation.
B. Inadequate Investment in Compliance Infrastructure
The second root cause is the persistent underinvestment in compliance infrastructure relative to the scale and complexity of BRB's operations. This underinvestment manifested in three dimensions: budget, personnel, and technology.
Budget. BRB's BSA/AML program budget of $18.2 million for fiscal year 2024 was insufficient relative to the Bank's $38.7 billion in total assets, $74.3 billion in BaaS transaction volume, and fourteen active BaaS partnerships. While there is no bright-line regulatory standard for BSA/AML spending as a percentage of assets or revenue, the OCC's findings — and the $57.0 million total remediation cost now being incurred — confirm that the historical bud