rap-executive-summary.docx

1045-00002 · Calderwood & Harkness LLP · documents

rap-executive-summary.docx DOCUMENT Antitrust

57 / 84 ← → ✕

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL NOT FOR DISTRIBUTION WITHOUT PRIOR WRITTEN AUTHORIZATION OF CALDERWOOD & HARKNESS LLP

REMEDIATION ACTION PLAN

EXECUTIVE SUMMARY

Prepared for: Board of Directors and Compliance Committee of Belmont Ridge Financial Group, Inc.

Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

C&H Matter No. 1045-00002

May 15, 2025

ATTENTION:

Mr. James Rutherford, Chair, Compliance Committee Mr. Arthur Connelly, Lead Independent Director and Chair, Risk Committee Ms. Margaret Dao, Chair, Audit Committee Ms. Diane Whitford, Chair and Chief Executive Officer

Re: Remediation Action Plan — Executive Summary — OCC Consent Order No. OCC-2025-003

Designation: ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL / ATTORNEY WORK PRODUCT

C&H Matter No.: 1045-00002

Consent Order Reference: OCC Consent Order No. OCC-2025-003 (effective January 15, 2025)

Principal Authors:

Philip Hartmann, Partner (Responsible Partner) Yuki Nakamura, Counsel (Lead Associate)

Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Tel: (212) 555-7800

Right-click to update Table of Contents

I. PURPOSE AND BACKGROUND

A. Purpose of This Executive Summary

This Executive Summary has been prepared by Calderwood & Harkness LLP ("C&H") for the Board of Directors (the "Board") and the Compliance Committee of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") to serve as a board-level summary of the Comprehensive Remediation Action Plan (the "RAP") prepared for submission to the Office of the Comptroller of the Currency (the "OCC") by the May 15, 2025 filing deadline established under OCC Consent Order No. OCC-2025-003 (the "Consent Order"). The RAP addresses the deficiencies identified by the OCC in its Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance examination of Belmont Ridge Bank National Association ("BRB" or the "Bank"), the Company's wholly owned national bank subsidiary.

This Executive Summary is designed for presentation to the Board alongside the full RAP and is intended to facilitate informed Board-level discussion, deliberation, and approval of the remediation program. In particular, this document has been prepared to assist the newly established Compliance Committee, chaired by Mr. James Rutherford, in discharging its oversight responsibilities under the Compliance Committee Charter adopted on February 28, 2025. It is also intended for the use of Mr. Arthur Connelly, Lead Independent Director and Chair of the Risk Committee, and Ms. Margaret Dao, Chair of the Audit Committee, each of whom plays a critical role in the governance framework surrounding the remediation effort.

This Executive Summary provides an integrated overview of the following elements of the RAP:

1. The five remediation workstreams, each of which corresponds to a deficiency category identified in the Consent Order;

2. Key milestones, deadlines, and the master remediation timeline;

3. The aggregate remediation budget, inclusive of outside counsel fees, independent consultant costs, technology expenditures, temporary and permanent staffing, and ancillary costs;

4. Accountability assignments for each workstream at the executive, management, and external advisor levels; and

5. Material risk factors that may affect the execution, timing, or cost of the remediation program.

This document is protected by the attorney-client privilege and the work product doctrine. It has been prepared at the direction of counsel in anticipation of continued regulatory engagement and reflects the mental impressions, legal conclusions, and strategic assessments of C&H. It should not be shared with any third party — including the OCC, FinCEN, any other regulatory agency, or any external stakeholder — without the prior written authorization of C&H and BRB's General Counsel, Gregory Nardone.

B. Regulatory Context

On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association, a national banking association organized and existing under the laws of the United States (OCC Charter No. 48271; FDIC Certificate No. 31845). BRB is a wholly owned subsidiary of BRFG, a bank holding company incorporated in Delaware with its principal executive offices in New York, New York.

The Examination. The Consent Order arose from a targeted BSA/AML examination conducted by the OCC's Northeastern District Office between March 2024 and September 2024. The examination was led by OCC Examiner-in-Charge Jonathan Frey and focused on BRB's BSA/AML compliance program, including its transaction monitoring capabilities, suspicious activity reporting processes, sanctions screening systems, customer due diligence and enhanced due diligence procedures, and board-level governance and oversight. The examination placed particular emphasis on BRB's Banking-as-a-Service ("BaaS") business line, through which BRB provides banking services to third-party fintech companies utilizing BRB's OCC charter.

Escalating Supervisory History. The Consent Order did not arise in a vacuum. Rather, it represents the culmination of an escalating series of supervisory findings that BRB failed to adequately address over a multi-year period:

• In June 2022, the OCC issued a Matter Requiring Attention ("MRA") regarding deficiencies in BRB's BSA/AML transaction monitoring system, including concerns about the adequacy of tuning parameters and the coverage of BaaS-related transaction flows. The MRA directed BRB to take specific corrective actions within defined timeframes.

• In November 2023, the OCC escalated its supervisory concern by issuing a Matter Requiring Immediate Attention ("MRIA") regarding gaps in BRB's OFAC sanctions screening processes. The MRIA identified specific deficiencies in the screening of transactions processed through fintech BaaS partner channels, particularly those associated with NovaPay Technologies Inc.

• Neither the June 2022 MRA nor the November 2023 MRIA was adequately remediated by BRB under the direction of its prior outside regulatory counsel, Drayton Mercer LLP. BRB terminated its engagement with Drayton Mercer in January 2025, following the issuance of the Consent Order. The Board's decision to engage new outside counsel reflected its determination that a fundamentally different approach to regulatory remediation was required.

Independent BSA/AML Testing. In addition to the OCC's examination findings, Caldera & Pope LLP — BRB's external auditor — conducted independent BSA/AML testing through its forensic and compliance advisory practice, completing its assessment in September 2024. The Caldera & Pope independent testing identified multiple deficiencies that were substantially consistent with and echoed the findings reflected in the Consent Order. These included, among other things, gaps in OFAC screening coverage for BaaS transactions, a significant backlog of unreviewed suspicious activity alerts, and widespread deficiencies in CDD/EDD documentation for high-risk BaaS-onboarded accounts. The alignment between the OCC's examination findings and the independent testing results underscores the systemic nature of the compliance deficiencies at issue.

Civil Money Penalty. As part of the Consent Order, the OCC assessed a civil money penalty ("CMP") of $14,500,000 against BRB. The CMP was payable within sixty (60) days of the Consent Order's effective date, i.e., by March 16, 2025. BRB paid the CMP in full by the due date. As discussed in Section VI.B below, the CMP is non-deductible for federal income tax purposes under 26 U.S.C. § 162(f).

FinCEN Monitoring. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. C&H understands, based on communications with the OCC and FinCEN, that Associate Director Angela Drummond of FinCEN's Enforcement Division has been assigned to oversee FinCEN's monitoring. To date, FinCEN has not filed a separate enforcement action against BRB. However, FinCEN has expressly reserved its enforcement rights in coordination with the OCC. The possibility of a separate FinCEN enforcement action — including the assessment of additional civil money penalties — remains a material risk factor and is discussed further in Section VIII.A below.

DOJ Status. As of the date of this Executive Summary, no criminal referral has been made to the U.S. Department of Justice ("DOJ"). The Consent Order does not contain any provision precluding a future criminal referral, and the OCC's standard practice is to reserve the right to make such referrals at any time. The risk of a DOJ referral is mitigated — though not eliminated — by demonstrating prompt, comprehensive, and good-faith remediation. C&H is monitoring this risk factor on an ongoing basis, as discussed in Section VIII.A.

C. Engagement of Outside Counsel and Independent Consultant

Calderwood & Harkness LLP. C&H was engaged on February 10, 2025 as outside regulatory counsel to BRB and BRFG for the purpose of advising on BSA/AML and sanctions compliance-program design, remediation strategy, regulatory submissions, and ongoing engagement with the OCC and FinCEN. The engagement was authorized by BRB's General Counsel, Gregory Nardone, and approved by the Board. C&H's engagement is led by Philip Hartmann, Partner, who serves as the Responsible Partner, and Yuki Nakamura, Counsel, who serves as the Lead Associate. Additional C&H team members include associates from the firm's Financial Institutions Regulation, White Collar Defense and Investigations, and Technology Transactions practices. The terms of C&H's engagement, including the fee collar mechanism and budget controls, are described in Section VI.D below.

Thornfield Consulting Group LLC. Pursuant to Article VII of the Consent Order, BRB was required to retain an independent consultant acceptable to the OCC to conduct a comprehensive assessment of BRB's BSA/AML and sanctions compliance program and to validate the adequacy of BRB's remediation efforts. BRB proposed Thornfield Consulting Group LLC ("Thornfield") as the independent consultant, and the OCC communicated its non-objection on February 5, 2025. The Thornfield engagement (reference TCG-BRB-2025-001) was executed on February 10, 2025, the same date as the C&H engagement.

The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director of Thornfield's Financial Crimes Advisory practice, who brings more than twenty years of experience in BSA/AML regulatory compliance and enforcement matters. Dr. Castellano is supported by a team of senior subject-matter specialists, including:

• Robert Eastman — AML Transaction Monitoring, responsible for assessing BRB's transaction monitoring system, including the Veridian TMS platform, alert management processes, and SAR filing procedures;

• Jennifer Hwang — Sanctions & OFAC Compliance, responsible for evaluating BRB's OFAC screening infrastructure, list management, interdiction protocols, and BaaS-channel screening coverage; and

• Nathaniel Burgess — Fintech & Payments Compliance, responsible for assessing BRB's BaaS partner oversight framework, fintech-related CDD/EDD processes, and the integration of fintech-originated transactions into BRB's compliance program.

Thornfield commenced its on-site assessment at BRB's principal offices on March 1, 2025. On April 15, 2025, Thornfield delivered its preliminary gap assessment to C&H and BRB management. The Thornfield preliminary gap assessment identified numerous specific deficiencies, control weaknesses, and remediation priorities that are consistent with and supplementary to the findings in the Consent Order. The findings of the Thornfield preliminary gap assessment have been fully incorporated into the RAP. A summary of the Thornfield preliminary gap assessment is included as Appendix F to this Executive Summary.

Thornfield's engagement will continue through the remediation period. Thornfield will conduct periodic assessments of BRB's remediation progress, validate the effectiveness of remediation measures, and deliver a final validation report in support of BRB's compliance self-certification, which is due to the OCC on February 15, 2026.

II. SUMMARY OF CONSENT ORDER DEFICIENCY CATEGORIES

The Consent Order identifies five principal categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each deficiency category has been mapped to a dedicated remediation workstream within the RAP. The following subsections summarize the nature and scope of each deficiency as articulated in the Consent Order and corroborated by the Thornfield preliminary gap assessment and the Caldera & Pope independent testing.

A. Deficiency 1 — OFAC Sanctions Screening

The Consent Order found that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through its fintech Banking-as-a-Service channels. This deficiency was first identified in the November 2023 MRIA but was not adequately remediated prior to the targeted examination.

Specifically, the OCC determined that approximately 12% of transactions processed on behalf of NovaPay Technologies Inc. — BRB's largest BaaS partner by transaction volume — were not screened against OFAC sanctions lists during calendar year 2023. This gap encompassed approximately 3,800,000 of the 31,700,000 total NovaPay-originated wire transfer and Automated Clearing House ("ACH") transactions processed through BRB's systems during that period.

The root cause of the screening gap was the incomplete integration of BaaS transaction flows into BRB's sanctions screening platform, the Veridian Analytics Inc. Veridian Transaction Monitoring System v.8.3 ("Veridian TMS v.8.3"). Certain NovaPay transaction types — particularly certain ACH credit originations and specific wire transfer message formats utilized by NovaPay's mobile payment application — were not properly mapped to the Veridian TMS input schema, resulting in those transactions bypassing the screening engine entirely. The Thornfield preliminary gap assessment confirmed this root cause and identified similar, though less severe, integration gaps affecting three additional BaaS partners.

The magnitude of the OFAC screening gap — approximately 3.8 million unscreened transactions in a single calendar year from a single BaaS partner — represents a serious compliance failure. The failure to screen transactions against OFAC sanctions lists exposes BRB to potential violations of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act ("TWEA"), and related Executive Orders, each of which carries significant penalties, including potential criminal liability.

B. Deficiency 2 — SAR Filing Deficiencies

The Consent Order identified significant deficiencies in BRB's suspicious activity reporting processes. At the time of the September 2024 examination, BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned by BRB's BSA/AML compliance staff. These alerts had been generated by BRB's transaction monitoring system but had accumulated without action due to insufficient staffing levels and inadequate alert management processes.

In addition to the backlog itself, the OCC found that BRB's average time from alert generation to SAR filing was approximately 78 days — significantly longer than the regulatory expectation of timely filing, which is generally understood to require completion of the investigation and filing of the SAR within 30 days of the initial detection of facts that may constitute a basis for filing. The extended filing timelines reflected systemic deficiencies in BRB's alert triage, investigation, quality review, and filing processes.

The Consent Order also noted the following relevant metrics regarding BRB's SAR filing activity:

• Total SARs filed in CY 2024: 3,847 (an increase from 2,914 SARs filed in CY 2023, reflecting both growth in BaaS-related activity and an effort to address previously identified backlogs);

• BaaS-related SARs in CY 2024: 2,108, representing approximately 54.8% of all SARs filed — an indicator of the disproportionate concentration of suspicious activity risk in BRB's BaaS channels;

• Total transaction monitoring alerts generated in CY 2024: 41,500;

• SAR conversion rate (CY 2024): Approximately 9.3% (3,847 SARs filed from 41,500 alerts generated).

The SAR backlog and filing delays represent violations of the BSA's suspicious activity reporting requirements under 31 U.S.C. § 5318(g) and its implementing regulations at 31 C.F.R. § 1020.320. The backlog also drew the specific attention of FinCEN, which, as noted above, is actively monitoring BRB's SAR filing remediation through Associate Director Angela Drummond.

C. Deficiency 3 — CDD/EDD Failures

The Consent Order found that approximately 47,000 high-risk customer accounts maintained by BRB lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. These accounts were predominantly onboarded through BRB's fintech BaaS partner channels, where the customer-facing onboarding process is performed by the fintech partner rather than directly by BRB, creating inherent risk that CDD/EDD requirements may be inconsistently applied or inadequately documented.

The deficient accounts were concentrated in the customer populations associated with BRB's three largest BaaS partners:

• NovaPay Technologies Inc.: Approximately 2.1 million end-user accounts. NovaPay operates a consumer-facing digital payments platform and mobile wallet product that utilizes BRB's charter for deposit-taking and payment processing.

• FairLend Digital LLC: Approximately $1.4 billion in loan originations during FY 2024. FairLend Digital operates a digital lending platform for personal and small business loans, with BRB serving as the originating bank of record.

• VaultEdge Inc.: Approximately 870,000 deposit accounts. VaultEdge operates a high-yield savings platform marketed to retail consumers, with deposits held at BRB.

The CDD/EDD failures extended across multiple dimensions, including inadequate customer identification program ("CIP") documentation, missing or incomplete beneficial ownership certifications for entity accounts, failure to assign or update customer risk ratings, incomplete or absent EDD documentation for accounts identified as high-risk, and failure to conduct periodic reviews of high-risk customer relationships as required by BRB's own policies. The deficiencies were compounded by the absence of a clear responsibility matrix delineating BRB's retained CDD/EDD obligations versus those delegated to BaaS partners.

These failures constitute violations of the CDD requirements under 31 C.F.R. § 1020.210 and the beneficial ownership requirements under 31 C.F.R. § 1010.230, as well as the OCC's enhanced due diligence expectations set forth in the OCC's BSA/AML Examination Manual.

D. Deficiency 4 — Transaction Monitoring Model Validation

The Consent Order found that BRB's transaction monitoring system — the Veridian TMS v.8.3 — had not been independently validated since March 2021, a period of more than three years prior to the commencement of the targeted examination in March 2024. This extended period without independent validation is inconsistent with regulatory expectations and supervisory guidance, which generally require model validation at least annually or upon any material change to the model's inputs, parameters, or operating environment.

The OCC also found that the tuning parameters governing the Veridian TMS's alert generation logic had not been updated since October 2022. During the intervening period, BRB's transaction volumes and risk profile had changed dramatically, driven primarily by the rapid growth of BRB's BaaS business line. Total BaaS transaction volume reached approximately $74.3 billion in CY 2024, representing a substantial increase from the volumes that prevailed when the tuning parameters were last calibrated. As a result, the transaction monitoring system's thresholds and detection scenarios were materially misaligned with BRB's current transaction environment and risk profile.

The combination of outdated model validation and stale tuning parameters created a significant risk that BRB's transaction monitoring system was failing to detect genuinely suspicious transactions — a risk that is particularly acute in the high-volume, fast-moving BaaS transaction environment. The model inadequacies are directly linked to the SAR backlog and filing deficiencies described in Deficiency 2, as an improperly tuned model may simultaneously generate an excessive volume of low-value alerts (contributing to backlog) while failing to flag transactions that warrant investigation and reporting.

E. Deficiency 5 — Board-Level Oversight

The Consent Order found that the BRFG Board of Directors lacked a dedicated Compliance Committee, resulting in insufficient board-level oversight of BRB's BSA/AML and sanctions compliance program. Prior to the issuance of the Consent Order, BSA/AML and sanctions compliance matters were addressed by the full Board on a quarterly basis, without the benefit of a standing committee with the dedicated expertise, authority, and meeting frequency necessary to exercise effective oversight over a compliance program of the scope and complexity required for an institution of BRB's size and risk profile.

The OCC further found that the BSA/AML reporting provided to the Board was deficient in both content and frequency. The quarterly reports did not include key performance indicators and risk metrics such as SAR filing volumes and timeliness, OFAC screening hit rates and disposition outcomes, CDD/EDD remediation status, risk ratings by BaaS partner, or transaction monitoring alert volumes and SAR conversion rates. The absence of these metrics deprived the Board of the information necessary to exercise informed oversight and to identify emerging risks in a timely manner.

In response to the Consent Order, the BRFG Board adopted a Board Resolution dated February 28, 2025 that formally acknowledged the Consent Order, established the Compliance Committee as a standing committee of the Board, appointed Mr. James Rutherford as Chair of the Compliance Committee, and authorized the remediation program and its associated budget. The Board Resolution represented an important initial step, but the Consent Order requires a comprehensive and sustained enhancement of board-level governance, as addressed in Workstream 5 of the RAP.

III. REMEDIATION WORKSTREAMS — SUMMARY

The RAP is organized into five remediation workstreams, each corresponding to one of the deficiency categories identified in the Consent Order. The workstreams are designed to be executed in parallel, with interdependencies managed through a centralized program management function overseen by Patricia Langston, CCO, and coordinated by C&H. The following subsections provide a summary of each workstream, including its objective, key activities, milestones, budget, accountability assignments, and related documentation.

Workstream 1: OFAC Sanctions Screening Remediation

Objective. The objective of Workstream 1 is to achieve 100% screening of all transactions across all BRB business lines and all fourteen (14) active BaaS partner channels against all applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List ("SSI List"), and all other non-SDN sanctions lists maintained by OFAC.

Key Activities. Workstream 1 encompasses the following principal activities:

1. Veridian TMS Upgrade — OFAC Module Enhancement. BRB will upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, which includes an enhanced OFAC screening module capable of real-time and batch screening integration for all BaaS transaction flows, including wire transfers, ACH originations and receipts, card transactions, and partner-specific transaction flows. The upgrade will address the fundamental root cause of the screening gap identified in the Consent Order — the incomplete integration of BaaS transaction flows into the screening engine. The upgrade will be implemented pursuant to an amended Master Services Agreement and a new Statement of Work for the OFAC Module Enhancement, as described more fully in the Workstream 1 detailed plan.

2. BaaS Partner Screening Workflow Redesign. BRB will redesign its sanctions screening workflows for each of the fourteen (14) active BaaS partners to ensure that all transaction types originated through each partner's platform are properly mapped, ingested, and screened by the Veridian TMS v.10.0 OFAC module. Particular focus will be placed on NovaPay Technologies Inc., which accounts for approximately 41% of total BaaS transaction volume (approximately $30.5 billion in CY 2024) and was the partner most directly affected by the screening gap identified in the Consent Order.

3. OFAC List Management. BRB will implement enhanced OFAC list management procedures to ensure timely ingestion of all OFAC list updates, including same-day updates for changes to the SDN List and other high-priority sanctions lists. The list management procedures will include automated update verification, reconciliation protocols, and escalation procedures for list ingestion failures.

4. Interdiction, Escalation, and Reporting Protocols. BRB will implement revised interdiction, escalation, and reporting protocols, including procedures for blocking or rejecting transactions that generate true OFAC matches, escalation procedures for potential matches requiring further investigation, and reporting protocols for the filing of OFAC blocking reports within the required ten (10) business day timeframe.

5. Remediation Testing. BRB will conduct comprehensive remediation testing, including end-to-end testing of all BaaS partner transaction flows, to validate that 100% of transactions are being screened by the upgraded OFAC module. The remediation testing will be conducted in coordination with Thornfield's Jennifer Hwang and will be subject to independent validation by Thornfield as part of its overall assessment.

Milestone Deadlines.

• August 1, 2025: Veridian TMS v.10.0 User Acceptance Testing ("UAT") complete and system deployed to production environment.

• October 1, 2025: Independent model validation of the upgraded Veridian TMS v.10.0 OFAC screening module completed by Thornfield.

• November 1, 2025: OFAC screening fully operational for all BRB business lines and all fourteen (14) BaaS partner channels, with 100% transaction screening coverage confirmed through remediation testing.

CY 2024 OFAC Screening Metrics

For context, BRB's OFAC screening operations in CY 2024 (under the legacy Veridian TMS v.8.3 configuration) generated the following metrics:

• Total screening hits: 14,320

• True matches requiring blocking or rejection: 12

• False-positive rate: Approximately 99.9%

The high false-positive rate underscores the importance of the tuning and calibration activities included in Workstream 4, which will recalibrate both the transaction monitoring and OFAC screening parameters to optimize the balance between detection effectiveness and operational efficiency.

OFAC Voluntary Self-Disclosure

C&H is currently conducting an analysis regarding whether BRB should file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gaps identified in the Consent Order. The approximately 3.8 million unscreened NovaPay transactions in CY 2023 represent a potentially significant number of apparent violations, and OFAC's enforcement guidelines provide that voluntary self-disclosure is a significant mitigating factor in the determination of enforcement responses. The decision regarding whether to file a VSD — and the timing and scope of any such disclosure — remains pending and will be the subject of a separate privileged memorandum to the Board and the Compliance Committee. C&H will present its recommendation on the VSD question at the June 2025 Compliance Committee meeting.

Accountability.

• Thomas Ikeda — BSA Officer: Operational lead for OFAC screening remediation; responsible for screening workflow redesign, list management, and interdiction protocols.

• Linda Petrosian — CIO/CTO: Responsible for Veridian TMS v.10.0 technology implementation, system integration, and UAT.

• Warren Ashby — Head of BaaS Division: Responsible for BaaS partner coordination, partner-specific workflow mapping, and partner compliance cooperation.

• Jennifer Hwang (Thornfield): Independent oversight and validation of OFAC screening remediation.

Related Documents.

• Workstream 1 OFAC Sanctions Screening Remediation Plan

• Revised OFAC Compliance Policy

• OFAC Screening Procedures Manual

• OFAC Remediation Testing Plan

• Veridian MSA Amendment and SOW for OFAC Module Enhancement

Workstream 2: SAR Backlog Clearance & Process Improvement

Objective. The objective of Workstream 2 is to fully disposition the existing backlog of approximately 2,400 unreviewed suspicious activity alerts and to reduce BRB's average SAR filing time from 78 days to within 30 days from alert generation on a sustainable, ongoing basis. This workstream encompasses both the immediate backlog clearance effort and the design and implementation of revised SAR filing processes intended to prevent the recurrence of backlog accumulation.

Key Activities. Workstream 2 encompasses the following principal activities:

1. SAR Backlog Triage and Risk-Ranking. BRB has developed and is implementing a SAR Backlog Triage Protocol under which each of the 2,400 unreviewed alerts is being triaged and risk-ranked based on a multi-factor prioritization methodology. The prioritization factors include transaction amount, customer risk rating, alert type and detection scenario, BaaS partner association, and the length of time the alert has been pending. Alerts associated with the highest-risk factors are being reviewed and dispositioned first.

2. Temporary Analyst Deployment. To provide the human resources necessary to clear the backlog on an accelerated timeline while simultaneously maintaining ongoing alert review operations, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy thirty (30) full-time-equivalent temporary BSA/AML analysts. The Pinnacle engagement (SOW Ref: PCS-BRB-2025-0012; key contact: Andrea Solis) provides for a twelve (12)-month staffing period at an estimated cost of $3,600,000 (30 FTE × $10,000 per FTE per month × 12 months). The Pinnacle analysts are operating under the direct supervision of BRB's BSA/AML department and are subject to the same quality standards and procedural requirements as BRB's permanent staff. Pinnacle analysts began on-site deployment in March 2025 and are currently ramping to full capacity.

3. Comprehensive SAR Lookback Project. In addition to clearing the pending backlog of 2,400 unreviewed alerts, BRB is conducting a comprehensive SAR lookback project to identify and report any additional suspicious activity that may have been missed during the period when BRB's transaction monitoring system and SAR processes were deficient. The lookback project encompasses a defined lookback period, specific transaction types, and customer populations to be determined in consultation with C&H and Thornfield. The estimated budget for the SAR lookback project is $5,500,000, inclusive of internal and external resources.

4. Revised SAR Filing Standards. BRB is implementing revised SAR filing standards that incorporate a 30-day timeliness benchmark measured from alert generation to SAR filing, clearly defined escalation protocols for complex or high-priority cases, and quality review requirements including supervisory review of all SAR narratives prior to filing. The revised standards have been documented in updated SAR policies and procedures that will be effective upon deployment and completion of associated training.

5. Post-Remediation SAR Quality Assurance Framework. To ensure the sustainability of the remediation and prevent recurrence, BRB is establishing a comprehensive SAR quality assurance ("QA") framework that includes regular QA sampling of filed SARs, error tracking and trending analysis, root cause analysis for identified deficiencies, and a continuous improvement feedback loop to drive ongoing process refinement.

6. Interim SAR Backlog Status Report. As required by the Consent Order, BRB filed an interim SAR backlog status report with the OCC on March 31, 2025. The interim report detailed the status of the backlog clearance effort, the deployment of Pinnacle temporary analysts, and BRB's projected timeline for full clearance of the backlog.

Milestone Deadlines.

• June 30, 2025: SAR backlog of 2,400 alerts fully cleared — i.e., all alerts reviewed, investigated, and dispositioned (either filed as SARs, closed with documented rationale, or escalated as appropriate).

• Ongoing thereafter: Revised SAR filing processes operational on a sustained basis, with average filing timeliness within 30 days and continuous QA monitoring in place.

Accountability.

• Thomas Ikeda — BSA Officer / AML Program Director: Operational lead for SAR backlog clearance and process improvement; direct supervision of Pinnacle temporary analysts.

• Patricia Langston — CCO: Overall workstream leadership; SAR policy ownership.

• Robert Eastman (Thornfield): Independent oversight and validation of SAR backlog clearance and process improvement.

Related Documents.

• Workstream 2 SAR Backlog Clearance & Process Improvement Plan

• SAR Lookback Scope & Methodology Memorandum

• SAR Backlog Triage Protocol

• Revised SAR Policy & Procedures

• SAR Quality Assurance Framework Memorandum

• Pinnacle Managed Services Agreement and SOW

Workstream 3: CDD/EDD Remediation

Objective. The objective of Workstream 3 is to remediate 100% of the approximately 47,000 high-risk customer accounts identified as lacking adequate CDD or EDD documentation. The remediation effort will collect, verify, and document the required CDD/EDD information for each affected account and will implement revised CDD/EDD policies and procedures designed to prevent recurrence and ensure sustainable compliance across all customer channels, including BaaS.

Key Activities. Workstream 3 encompasses the following principal activities:

1. Risk-Based Account Prioritization. The 47,000 accounts requiring remediation have been prioritized using a risk-based methodology that assigns the highest priority to BaaS-onboarded accounts associated with NovaPay Technologies, FairLend Digital LLC, and VaultEdge Inc. Within this population, further prioritization is based on individual account risk scores, transaction volumes, and the risk profile of the associated BaaS partner. The prioritization methodology is designed to ensure that the highest-risk accounts are remediated first, reducing residual risk exposure as rapidly as possible.

2. Phased Remediation Timeline. The account remediation will be executed on a phased basis:

• Phase 1 (by July 15, 2025): Remediation of 50% of the affected accounts, or approximately 23,500 accounts. Phase 1 will focus on the highest-risk accounts, including those associated with NovaPay and FairLend Digital.

• Phase 2 (by January 15, 2026): Remediation of the remaining 50%, achieving 100% completion — or the full population of 47,000 accounts.

3. Revised CDD/EDD Policy. BRB is implementing a comprehensive revised CDD/EDD policy that addresses all elements of customer due diligence, including the customer identification program, risk rating methodology, beneficial ownership identification and verification, ongoing monitoring, periodic reviews for high-risk accounts, and specific requirements for all customer channels, with particular attention to BaaS-originated accounts. The revised policy incorporates regulatory requirements under 31 C.F.R. § 1020.210 and 31 C.F.R. § 1010.230, as well as OCC supervisory expectations.

4. BaaS Partner CDD/EDD Responsibility Matrix. A critical component of the CDD/EDD remediation is the development and implementation of a BaaS Partner CDD/EDD Responsibility Matrix using a RACI framework (Responsible, Accountable, Consulted, Informed). The matrix delineates, for each BaaS partner, the specific CDD/EDD responsibilities retained by BRB and those delegated to the partner, with clear accountability and escalation procedures. This matrix is designed to eliminate the ambiguity that contributed to the CDD/EDD failures identified in the Consent Order.

5. CDD/EDD Progress Tracking Dashboard. BRB is developing a CDD/EDD progress tracking dashboard that will provide real-time visibility into the status of the remediation effort, including accounts remediated, accounts pending, accounts approaching deadline, and accounts presenting remediation challenges. The dashboard will be used for internal management reporting, Compliance Committee reporting, and OCC reporting.

6. BaaS Partner Compliance Remediation Letters. BRB has issued formal compliance remediation letters to the CEOs of its top BaaS partners demanding enhanced cooperation and data sharing in support of the CDD/EDD remediation:

• A letter was sent to Ethan Garrison, CEO of NovaPay Technologies Inc., on March 15, 2025.

• A letter was sent to Aisha Okonkwo, CEO of FairLend Digital LLC, on March 15, 2025.

These letters set forth BRB's expectation that the partners will cooperate fully with the remediation effort, provide requested customer documentation in a timely manner, and implement process enhancements to prevent future CDD/EDD deficiencies. C&H reviewed and approved the letters prior to issuance.

Milestone Deadlines.

• July 15, 2025: 50% of affected accounts remediated (approximately 23,500 accounts).

• January 15, 2026: 100% of affected accounts remediated (47,000 accounts).

Budget. The estimated budget for Workstream 3 is $4,300,000, inclusive of internal resources, external staffing support, technology tools for document collection and management, and associated overhead.

Accountability.

• Patricia Langston — CCO: Overall workstream leadership and CDD/EDD policy ownership.

• Warren Ashby — Head of BaaS Division: BaaS partner coordination, cooperation enforcement, and partner-specific remediation management.

• Thomas Ikeda — BSA Officer: CDD/EDD documentation standards and quality assurance.

• Nathaniel Burgess (Thornfield): Independent oversight and validation of fintech-related CDD/EDD remediation.

Related Documents.

• Workstream 3 CDD/EDD Remediation Plan

• CDD/EDD Remediation Methodology & Prioritization Memorandum

• Revised CDD/EDD Policy

• BaaS Partner CDD/EDD Responsibility Matrix

• CDD/EDD Progress Tracking Dashboard Specifications

• NovaPay Compliance Remediation Letter

• FairLend Digital Compliance Remediation Letter

Workstream 4: Transaction Monitoring Model Validation & Tuning

Objective. The objective of Workstream 4 is to upgrade BRB's transaction monitoring system, conduct an independent model validation, and properly tune the system's detection parameters to ensure effective and risk-appropriate detection of suspicious activity across all business lines and BaaS channels. This workstream addresses the Consent Order's finding that the Veridian TMS had not been independently validated in more than three years and that tuning parameters were materially stale.

Key Activities. Workstream 4 encompasses the following principal activities:

1. Veridian TMS Upgrade to v.10.0. BRB will upgrade from Veridian TMS v.8.3 to v.10.0 pursuant to an amended Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044). The upgrade includes enhanced transaction monitoring capabilities, improved BaaS transaction integration, expanded detection scenario libraries, enhanced case management functionality, and the upgraded OFAC screening module discussed in Workstream 1. The commercial terms of the upgrade are as follows:

• One-time implementation fee: $2,800,000

• Incremental annual licensing cost: $1,900,000 per year

• New total annual contract value (post-upgrade): $6,000,000 per year

• Key Veridian contact: Priya Subramanian, Vice President, Client Solutions

2. User Acceptance Testing. UAT for the Veridian TMS v.10.0 is targeted for completion by August 1, 2025. The UAT will encompass functional testing, integration testing across all BaaS partner transaction flows, performance testing under production-scale transaction volumes, and validation of detection scenario logic and alert generation.

3. Independent Model Validation. Upon successful deployment of Veridian TMS v.10.0, an independent model validation will be conducted and completed by October 1, 2025. The model validation will be performed by Thornfield under the direction of Robert Eastman and will assess the adequacy of the model's design, the appropriateness of tuning parameters and thresholds, the completeness of transaction coverage, the effectiveness of detection scenarios, and the model's overall fitness for BRB's current risk profile and transaction environment.

4. Tuning Parameter Recalibration. Following the model validation, BRB will recalibrate all tuning parameters, including above-the-line and below-the-line thresholds, based on the model validation findings and BRB's updated risk profile. The recalibration will specifically address the growth in BaaS transaction volume and the associated changes in transaction typologies and risk patterns.

5. Ongoing Periodic Validation Schedule. BRB will establish an ongoing periodic validation schedule requiring independent model validation of the transaction monitoring system at least annually, with additional validations required upon any material change to the model, its inputs, or the operating environment.

6. Contingency Vendor Evaluation. BRB has evaluated Ridgeline Data Systems LLC as a contingency alternative to the Veridian TMS v.10.0 upgrade. The Ridgeline platform would involve the following commercial terms:

• Annual contract value: $7,200,000 per year

• Contract term: 5 years

• Total contract value: $36,000,000

• Key Ridgeline contact: David Marchetti, Chief Revenue Officer

C&H's recommendation is to proceed with the Veridian TMS v.10.0 upgrade as the primary solution, with Ridgeline maintained as a fallback option in the event that the Veridian implementation proves insufficient or falls materially behind schedule. The Veridian vs. Ridgeline Vendor Comparison Memorandum, prepared by C&H and BRB's technology team, details the relative merits of each platform and provides the basis for this recommendation. BRB has executed a non-disclosure agreement with Ridgeline and has reviewed a preliminary term sheet to ensure that the contingency option can be activated expeditiously if needed.

Milestone Deadlines.

• August 1, 2025: Veridian TMS v.10.0 UAT complete and system deployed to production.

• October 1, 2025: Independent model validation of the upgraded Veridian TMS v.10.0 completed by Thornfield.

Accountability.

• Linda Petrosian — CIO/CTO: Responsible for Veridian TMS v.10.0 technology implementation, system integration, UAT, and production deployment.

• Thomas Ikeda — BSA Officer: Responsible for tuning parameter recalibration, detection scenario review, and coordination with Thornfield on model validation.

• Robert Eastman (Thornfield): Independent oversight and conduct of model validation.

Related Documents.

• Workstream 4 TM Model Validation & Tuning Plan

• Veridian MSA Amendment

• Technology Implementation Timeline & Risk Assessment Memorandum

• Veridian vs. Ridgeline Vendor Comparison Memorandum

• Ridgeline NDA and Term Sheet Review

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL NOT FOR DISTRIBUTION WITHOUT PRIOR WRITTEN AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
REMEDIATION ACTION PLAN
EXECUTIVE SUMMARY
Prepared for: Board of Directors and Compliance Committee of Belmont Ridge Financial Group, Inc.
Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No. 1045-00002
May 15, 2025
May 15, 2025
ATTENTION:
Mr. James Rutherford, Chair, Compliance Committee Mr. Arthur Connelly, Lead Independent Director and Chair, Risk Committee Ms. Margaret Dao, Chair, Audit Committee Ms. Diane Whitford, Chair and Chief Executive Officer
Re: Remediation Action Plan — Executive Summary — OCC Consent Order No. OCC-2025-003
Designation: ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL / ATTORNEY WORK PRODUCT
C&H Matter No.: 1045-00002
Consent Order Reference: OCC Consent Order No. OCC-2025-003 (effective January 15, 2025)
Principal Authors:
Philip Hartmann, Partner (Responsible Partner) Yuki Nakamura, Counsel (Lead Associate)
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Tel: (212) 555-7800
TABLE OF CONTENTS
Right-click to update Table of Contents
I. PURPOSE AND BACKGROUND
A. Purpose of This Executive Summary
This Executive Summary has been prepared by Calderwood & Harkness LLP ("C&H") for the Board of Directors (the "Board") and the Compliance Committee of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") to serve as a board-level summary of the Comprehensive Remediation Action Plan (the "RAP") prepared for submission to the Office of the Comptroller of the Currency (the "OCC") by the May 15, 2025 filing deadline established under OCC Consent Order No. OCC-2025-003 (the "Consent Order"). The RAP addresses the deficiencies identified by the OCC in its Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance examination of Belmont Ridge Bank National Association ("BRB" or the "Bank"), the Company's wholly owned national bank subsidiary.
This Executive Summary is designed for presentation to the Board alongside the full RAP and is intended to facilitate informed Board-level discussion, deliberation, and approval of the remediation program. In particular, this document has been prepared to assist the newly established Compliance Committee, chaired by Mr. James Rutherford, in discharging its oversight responsibilities under the Compliance Committee Charter adopted on February 28, 2025. It is also intended for the use of Mr. Arthur Connelly, Lead Independent Director and Chair of the Risk Committee, and Ms. Margaret Dao, Chair of the Audit Committee, each of whom plays a critical role in the governance framework surrounding the remediation effort.
This Executive Summary provides an integrated overview of the following elements of the RAP:
1. The five remediation workstreams, each of which corresponds to a deficiency category identified in the Consent Order;
2. Key milestones, deadlines, and the master remediation timeline;
3. The aggregate remediation budget, inclusive of outside counsel fees, independent consultant costs, technology expenditures, temporary and permanent staffing, and ancillary costs;
4. Accountability assignments for each workstream at the executive, management, and external advisor levels; and
5. Material risk factors that may affect the execution, timing, or cost of the remediation program.
This document is protected by the attorney-client privilege and the work product doctrine. It has been prepared at the direction of counsel in anticipation of continued regulatory engagement and reflects the mental impressions, legal conclusions, and strategic assessments of C&H. It should not be shared with any third party — including the OCC, FinCEN, any other regulatory agency, or any external stakeholder — without the prior written authorization of C&H and BRB's General Counsel, Gregory Nardone.
B. Regulatory Context
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association, a national banking association organized and existing under the laws of the United States (OCC Charter No. 48271; FDIC Certificate No. 31845). BRB is a wholly owned subsidiary of BRFG, a bank holding company incorporated in Delaware with its principal executive offices in New York, New York.
The Examination. The Consent Order arose from a targeted BSA/AML examination conducted by the OCC's Northeastern District Office between March 2024 and September 2024. The examination was led by OCC Examiner-in-Charge Jonathan Frey and focused on BRB's BSA/AML compliance program, including its transaction monitoring capabilities, suspicious activity reporting processes, sanctions screening systems, customer due diligence and enhanced due diligence procedures, and board-level governance and oversight. The examination placed particular emphasis on BRB's Banking-as-a-Service ("BaaS") business line, through which BRB provides banking services to third-party fintech companies utilizing BRB's OCC charter.
Escalating Supervisory History. The Consent Order did not arise in a vacuum. Rather, it represents the culmination of an escalating series of supervisory findings that BRB failed to adequately address over a multi-year period:
• In June 2022, the OCC issued a Matter Requiring Attention ("MRA") regarding deficiencies in BRB's BSA/AML transaction monitoring system, including concerns about the adequacy of tuning parameters and the coverage of BaaS-related transaction flows. The MRA directed BRB to take specific corrective actions within defined timeframes.
• In November 2023, the OCC escalated its supervisory concern by issuing a Matter Requiring Immediate Attention ("MRIA") regarding gaps in BRB's OFAC sanctions screening processes. The MRIA identified specific deficiencies in the screening of transactions processed through fintech BaaS partner channels, particularly those associated with NovaPay Technologies Inc.
• Neither the June 2022 MRA nor the November 2023 MRIA was adequately remediated by BRB under the direction of its prior outside regulatory counsel, Drayton Mercer LLP. BRB terminated its engagement with Drayton Mercer in January 2025, following the issuance of the Consent Order. The Board's decision to engage new outside counsel reflected its determination that a fundamentally different approach to regulatory remediation was required.
Independent BSA/AML Testing. In addition to the OCC's examination findings, Caldera & Pope LLP — BRB's external auditor — conducted independent BSA/AML testing through its forensic and compliance advisory practice, completing its assessment in September 2024. The Caldera & Pope independent testing identified multiple deficiencies that were substantially consistent with and echoed the findings reflected in the Consent Order. These included, among other things, gaps in OFAC screening coverage for BaaS transactions, a significant backlog of unreviewed suspicious activity alerts, and widespread deficiencies in CDD/EDD documentation for high-risk BaaS-onboarded accounts. The alignment between the OCC's examination findings and the independent testing results underscores the systemic nature of the compliance deficiencies at issue.
Civil Money Penalty. As part of the Consent Order, the OCC assessed a civil money penalty ("CMP") of $14,500,000 against BRB. The CMP was payable within sixty (60) days of the Consent Order's effective date, i.e., by March 16, 2025. BRB paid the CMP in full by the due date. As discussed in Section VI.B below, the CMP is non-deductible for federal income tax purposes under 26 U.S.C. § 162(f).
FinCEN Monitoring. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. C&H understands, based on communications with the OCC and FinCEN, that Associate Director Angela Drummond of FinCEN's Enforcement Division has been assigned to oversee FinCEN's monitoring. To date, FinCEN has not filed a separate enforcement action against BRB. However, FinCEN has expressly reserved its enforcement rights in coordination with the OCC. The possibility of a separate FinCEN enforcement action — including the assessment of additional civil money penalties — remains a material risk factor and is discussed further in Section VIII.A below.
DOJ Status. As of the date of this Executive Summary, no criminal referral has been made to the U.S. Department of Justice ("DOJ"). The Consent Order does not contain any provision precluding a future criminal referral, and the OCC's standard practice is to reserve the right to make such referrals at any time. The risk of a DOJ referral is mitigated — though not eliminated — by demonstrating prompt, comprehensive, and good-faith remediation. C&H is monitoring this risk factor on an ongoing basis, as discussed in Section VIII.A.
C. Engagement of Outside Counsel and Independent Consultant
Calderwood & Harkness LLP. C&H was engaged on February 10, 2025 as outside regulatory counsel to BRB and BRFG for the purpose of advising on BSA/AML and sanctions compliance-program design, remediation strategy, regulatory submissions, and ongoing engagement with the OCC and FinCEN. The engagement was authorized by BRB's General Counsel, Gregory Nardone, and approved by the Board. C&H's engagement is led by Philip Hartmann, Partner, who serves as the Responsible Partner, and Yuki Nakamura, Counsel, who serves as the Lead Associate. Additional C&H team members include associates from the firm's Financial Institutions Regulation, White Collar Defense and Investigations, and Technology Transactions practices. The terms of C&H's engagement, including the fee collar mechanism and budget controls, are described in Section VI.D below.
Thornfield Consulting Group LLC. Pursuant to Article VII of the Consent Order, BRB was required to retain an independent consultant acceptable to the OCC to conduct a comprehensive assessment of BRB's BSA/AML and sanctions compliance program and to validate the adequacy of BRB's remediation efforts. BRB proposed Thornfield Consulting Group LLC ("Thornfield") as the independent consultant, and the OCC communicated its non-objection on February 5, 2025. The Thornfield engagement (reference TCG-BRB-2025-001) was executed on February 10, 2025, the same date as the C&H engagement.
The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director of Thornfield's Financial Crimes Advisory practice, who brings more than twenty years of experience in BSA/AML regulatory compliance and enforcement matters. Dr. Castellano is supported by a team of senior subject-matter specialists, including:
• Robert Eastman — AML Transaction Monitoring, responsible for assessing BRB's transaction monitoring system, including the Veridian TMS platform, alert management processes, and SAR filing procedures;
• Jennifer Hwang — Sanctions & OFAC Compliance, responsible for evaluating BRB's OFAC screening infrastructure, list management, interdiction protocols, and BaaS-channel screening coverage; and
• Nathaniel Burgess — Fintech & Payments Compliance, responsible for assessing BRB's BaaS partner oversight framework, fintech-related CDD/EDD processes, and the integration of fintech-originated transactions into BRB's compliance program.
Thornfield commenced its on-site assessment at BRB's principal offices on March 1, 2025. On April 15, 2025, Thornfield delivered its preliminary gap assessment to C&H and BRB management. The Thornfield preliminary gap assessment identified numerous specific deficiencies, control weaknesses, and remediation priorities that are consistent with and supplementary to the findings in the Consent Order. The findings of the Thornfield preliminary gap assessment have been fully incorporated into the RAP. A summary of the Thornfield preliminary gap assessment is included as Appendix F to this Executive Summary.
Thornfield's engagement will continue through the remediation period. Thornfield will conduct periodic assessments of BRB's remediation progress, validate the effectiveness of remediation measures, and deliver a final validation report in support of BRB's compliance self-certification, which is due to the OCC on February 15, 2026.
II. SUMMARY OF CONSENT ORDER DEFICIENCY CATEGORIES
The Consent Order identifies five principal categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each deficiency category has been mapped to a dedicated remediation workstream within the RAP. The following subsections summarize the nature and scope of each deficiency as articulated in the Consent Order and corroborated by the Thornfield preliminary gap assessment and the Caldera & Pope independent testing.
A. Deficiency 1 — OFAC Sanctions Screening
The Consent Order found that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through its fintech Banking-as-a-Service channels. This deficiency was first identified in the November 2023 MRIA but was not adequately remediated prior to the targeted examination.
Specifically, the OCC determined that approximately 12% of transactions processed on behalf of NovaPay Technologies Inc. — BRB's largest BaaS partner by transaction volume — were not screened against OFAC sanctions lists during calendar year 2023. This gap encompassed approximately 3,800,000 of the 31,700,000 total NovaPay-originated wire transfer and Automated Clearing House ("ACH") transactions processed through BRB's systems during that period.
The root cause of the screening gap was the incomplete integration of BaaS transaction flows into BRB's sanctions screening platform, the Veridian Analytics Inc. Veridian Transaction Monitoring System v.8.3 ("Veridian TMS v.8.3"). Certain NovaPay transaction types — particularly certain ACH credit originations and specific wire transfer message formats utilized by NovaPay's mobile payment application — were not properly mapped to the Veridian TMS input schema, resulting in those transactions bypassing the screening engine entirely. The Thornfield preliminary gap assessment confirmed this root cause and identified similar, though less severe, integration gaps affecting three additional BaaS partners.
The magnitude of the OFAC screening gap — approximately 3.8 million unscreened transactions in a single calendar year from a single BaaS partner — represents a serious compliance failure. The failure to screen transactions against OFAC sanctions lists exposes BRB to potential violations of the International Emergency Economic Powers Act ("IEEPA"), the Trading with the Enemy Act ("TWEA"), and related Executive Orders, each of which carries significant penalties, including potential criminal liability.
B. Deficiency 2 — SAR Filing Deficiencies
The Consent Order identified significant deficiencies in BRB's suspicious activity reporting processes. At the time of the September 2024 examination, BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned by BRB's BSA/AML compliance staff. These alerts had been generated by BRB's transaction monitoring system but had accumulated without action due to insufficient staffing levels and inadequate alert management processes.
In addition to the backlog itself, the OCC found that BRB's average time from alert generation to SAR filing was approximately 78 days — significantly longer than the regulatory expectation of timely filing, which is generally understood to require completion of the investigation and filing of the SAR within 30 days of the initial detection of facts that may constitute a basis for filing. The extended filing timelines reflected systemic deficiencies in BRB's alert triage, investigation, quality review, and filing processes.
The Consent Order also noted the following relevant metrics regarding BRB's SAR filing activity:
• Total SARs filed in CY 2024: 3,847 (an increase from 2,914 SARs filed in CY 2023, reflecting both growth in BaaS-related activity and an effort to address previously identified backlogs);
• BaaS-related SARs in CY 2024: 2,108, representing approximately 54.8% of all SARs filed — an indicator of the disproportionate concentration of suspicious activity risk in BRB's BaaS channels;
• Total transaction monitoring alerts generated in CY 2024: 41,500;
• SAR conversion rate (CY 2024): Approximately 9.3% (3,847 SARs filed from 41,500 alerts generated).
The SAR backlog and filing delays represent violations of the BSA's suspicious activity reporting requirements under 31 U.S.C. § 5318(g) and its implementing regulations at 31 C.F.R. § 1020.320. The backlog also drew the specific attention of FinCEN, which, as noted above, is actively monitoring BRB's SAR filing remediation through Associate Director Angela Drummond.
C. Deficiency 3 — CDD/EDD Failures
The Consent Order found that approximately 47,000 high-risk customer accounts maintained by BRB lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. These accounts were predominantly onboarded through BRB's fintech BaaS partner channels, where the customer-facing onboarding process is performed by the fintech partner rather than directly by BRB, creating inherent risk that CDD/EDD requirements may be inconsistently applied or inadequately documented.
The deficient accounts were concentrated in the customer populations associated with BRB's three largest BaaS partners:
• NovaPay Technologies Inc.: Approximately 2.1 million end-user accounts. NovaPay operates a consumer-facing digital payments platform and mobile wallet product that utilizes BRB's charter for deposit-taking and payment processing.
• FairLend Digital LLC: Approximately $1.4 billion in loan originations during FY 2024. FairLend Digital operates a digital lending platform for personal and small business loans, with BRB serving as the originating bank of record.
• VaultEdge Inc.: Approximately 870,000 deposit accounts. VaultEdge operates a high-yield savings platform marketed to retail consumers, with deposits held at BRB.
The CDD/EDD failures extended across multiple dimensions, including inadequate customer identification program ("CIP") documentation, missing or incomplete beneficial ownership certifications for entity accounts, failure to assign or update customer risk ratings, incomplete or absent EDD documentation for accounts identified as high-risk, and failure to conduct periodic reviews of high-risk customer relationships as required by BRB's own policies. The deficiencies were compounded by the absence of a clear responsibility matrix delineating BRB's retained CDD/EDD obligations versus those delegated to BaaS partners.
These failures constitute violations of the CDD requirements under 31 C.F.R. § 1020.210 and the beneficial ownership requirements under 31 C.F.R. § 1010.230, as well as the OCC's enhanced due diligence expectations set forth in the OCC's BSA/AML Examination Manual.
D. Deficiency 4 — Transaction Monitoring Model Validation
The Consent Order found that BRB's transaction monitoring system — the Veridian TMS v.8.3 — had not been independently validated since March 2021, a period of more than three years prior to the commencement of the targeted examination in March 2024. This extended period without independent validation is inconsistent with regulatory expectations and supervisory guidance, which generally require model validation at least annually or upon any material change to the model's inputs, parameters, or operating environment.
The OCC also found that the tuning parameters governing the Veridian TMS's alert generation logic had not been updated since October 2022. During the intervening period, BRB's transaction volumes and risk profile had changed dramatically, driven primarily by the rapid growth of BRB's BaaS business line. Total BaaS transaction volume reached approximately $74.3 billion in CY 2024, representing a substantial increase from the volumes that prevailed when the tuning parameters were last calibrated. As a result, the transaction monitoring system's thresholds and detection scenarios were materially misaligned with BRB's current transaction environment and risk profile.
The combination of outdated model validation and stale tuning parameters created a significant risk that BRB's transaction monitoring system was failing to detect genuinely suspicious transactions — a risk that is particularly acute in the high-volume, fast-moving BaaS transaction environment. The model inadequacies are directly linked to the SAR backlog and filing deficiencies described in Deficiency 2, as an improperly tuned model may simultaneously generate an excessive volume of low-value alerts (contributing to backlog) while failing to flag transactions that warrant investigation and reporting.
E. Deficiency 5 — Board-Level Oversight
The Consent Order found that the BRFG Board of Directors lacked a dedicated Compliance Committee, resulting in insufficient board-level oversight of BRB's BSA/AML and sanctions compliance program. Prior to the issuance of the Consent Order, BSA/AML and sanctions compliance matters were addressed by the full Board on a quarterly basis, without the benefit of a standing committee with the dedicated expertise, authority, and meeting frequency necessary to exercise effective oversight over a compliance program of the scope and complexity required for an institution of BRB's size and risk profile.
The OCC further found that the BSA/AML reporting provided to the Board was deficient in both content and frequency. The quarterly reports did not include key performance indicators and risk metrics such as SAR filing volumes and timeliness, OFAC screening hit rates and disposition outcomes, CDD/EDD remediation status, risk ratings by BaaS partner, or transaction monitoring alert volumes and SAR conversion rates. The absence of these metrics deprived the Board of the information necessary to exercise informed oversight and to identify emerging risks in a timely manner.
In response to the Consent Order, the BRFG Board adopted a Board Resolution dated February 28, 2025 that formally acknowledged the Consent Order, established the Compliance Committee as a standing committee of the Board, appointed Mr. James Rutherford as Chair of the Compliance Committee, and authorized the remediation program and its associated budget. The Board Resolution represented an important initial step, but the Consent Order requires a comprehensive and sustained enhancement of board-level governance, as addressed in Workstream 5 of the RAP.
III. REMEDIATION WORKSTREAMS — SUMMARY
The RAP is organized into five remediation workstreams, each corresponding to one of the deficiency categories identified in the Consent Order. The workstreams are designed to be executed in parallel, with interdependencies managed through a centralized program management function overseen by Patricia Langston, CCO, and coordinated by C&H. The following subsections provide a summary of each workstream, including its objective, key activities, milestones, budget, accountability assignments, and related documentation.
Workstream 1: OFAC Sanctions Screening Remediation
Objective. The objective of Workstream 1 is to achieve 100% screening of all transactions across all BRB business lines and all fourteen (14) active BaaS partner channels against all applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List ("SSI List"), and all other non-SDN sanctions lists maintained by OFAC.
Key Activities. Workstream 1 encompasses the following principal activities:
1. Veridian TMS Upgrade — OFAC Module Enhancement. BRB will upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, which includes an enhanced OFAC screening module capable of real-time and batch screening integration for all BaaS transaction flows, including wire transfers, ACH originations and receipts, card transactions, and partner-specific transaction flows. The upgrade will address the fundamental root cause of the screening gap identified in the Consent Order — the incomplete integration of BaaS transaction flows into the screening engine. The upgrade will be implemented pursuant to an amended Master Services Agreement and a new Statement of Work for the OFAC Module Enhancement, as described more fully in the Workstream 1 detailed plan.
2. BaaS Partner Screening Workflow Redesign. BRB will redesign its sanctions screening workflows for each of the fourteen (14) active BaaS partners to ensure that all transaction types originated through each partner's platform are properly mapped, ingested, and screened by the Veridian TMS v.10.0 OFAC module. Particular focus will be placed on NovaPay Technologies Inc., which accounts for approximately 41% of total BaaS transaction volume (approximately $30.5 billion in CY 2024) and was the partner most directly affected by the screening gap identified in the Consent Order.
3. OFAC List Management. BRB will implement enhanced OFAC list management procedures to ensure timely ingestion of all OFAC list updates, including same-day updates for changes to the SDN List and other high-priority sanctions lists. The list management procedures will include automated update verification, reconciliation protocols, and escalation procedures for list ingestion failures.
4. Interdiction, Escalation, and Reporting Protocols. BRB will implement revised interdiction, escalation, and reporting protocols, including procedures for blocking or rejecting transactions that generate true OFAC matches, escalation procedures for potential matches requiring further investigation, and reporting protocols for the filing of OFAC blocking reports within the required ten (10) business day timeframe.
5. Remediation Testing. BRB will conduct comprehensive remediation testing, including end-to-end testing of all BaaS partner transaction flows, to validate that 100% of transactions are being screened by the upgraded OFAC module. The remediation testing will be conducted in coordination with Thornfield's Jennifer Hwang and will be subject to independent validation by Thornfield as part of its overall assessment.
Milestone Deadlines.
• August 1, 2025: Veridian TMS v.10.0 User Acceptance Testing ("UAT") complete and system deployed to production environment.
• October 1, 2025: Independent model validation of the upgraded Veridian TMS v.10.0 OFAC screening module completed by Thornfield.
• November 1, 2025: OFAC screening fully operational for all BRB business lines and all fourteen (14) BaaS partner channels, with 100% transaction screening coverage confirmed through remediation testing.
CY 2024 OFAC Screening Metrics
For context, BRB's OFAC screening operations in CY 2024 (under the legacy Veridian TMS v.8.3 configuration) generated the following metrics:
• Total screening hits: 14,320
• True matches requiring blocking or rejection: 12
• False-positive rate: Approximately 99.9%
The high false-positive rate underscores the importance of the tuning and calibration activities included in Workstream 4, which will recalibrate both the transaction monitoring and OFAC screening parameters to optimize the balance between detection effectiveness and operational efficiency.
OFAC Voluntary Self-Disclosure
C&H is currently conducting an analysis regarding whether BRB should file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gaps identified in the Consent Order. The approximately 3.8 million unscreened NovaPay transactions in CY 2023 represent a potentially significant number of apparent violations, and OFAC's enforcement guidelines provide that voluntary self-disclosure is a significant mitigating factor in the determination of enforcement responses. The decision regarding whether to file a VSD — and the timing and scope of any such disclosure — remains pending and will be the subject of a separate privileged memorandum to the Board and the Compliance Committee. C&H will present its recommendation on the VSD question at the June 2025 Compliance Committee meeting.
Accountability.
• Thomas Ikeda — BSA Officer: Operational lead for OFAC screening remediation; responsible for screening workflow redesign, list management, and interdiction protocols.
• Linda Petrosian — CIO/CTO: Responsible for Veridian TMS v.10.0 technology implementation, system integration, and UAT.
• Warren Ashby — Head of BaaS Division: Responsible for BaaS partner coordination, partner-specific workflow mapping, and partner compliance cooperation.
• Jennifer Hwang (Thornfield): Independent oversight and validation of OFAC screening remediation.
Related Documents.
• Workstream 1 OFAC Sanctions Screening Remediation Plan
• Revised OFAC Compliance Policy
• OFAC Screening Procedures Manual
• OFAC Remediation Testing Plan
• Veridian MSA Amendment and SOW for OFAC Module Enhancement
Workstream 2: SAR Backlog Clearance & Process Improvement
Objective. The objective of Workstream 2 is to fully disposition the existing backlog of approximately 2,400 unreviewed suspicious activity alerts and to reduce BRB's average SAR filing time from 78 days to within 30 days from alert generation on a sustainable, ongoing basis. This workstream encompasses both the immediate backlog clearance effort and the design and implementation of revised SAR filing processes intended to prevent the recurrence of backlog accumulation.
Key Activities. Workstream 2 encompasses the following principal activities:
1. SAR Backlog Triage and Risk-Ranking. BRB has developed and is implementing a SAR Backlog Triage Protocol under which each of the 2,400 unreviewed alerts is being triaged and risk-ranked based on a multi-factor prioritization methodology. The prioritization factors include transaction amount, customer risk rating, alert type and detection scenario, BaaS partner association, and the length of time the alert has been pending. Alerts associated with the highest-risk factors are being reviewed and dispositioned first.
2. Temporary Analyst Deployment. To provide the human resources necessary to clear the backlog on an accelerated timeline while simultaneously maintaining ongoing alert review operations, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy thirty (30) full-time-equivalent temporary BSA/AML analysts. The Pinnacle engagement (SOW Ref: PCS-BRB-2025-0012; key contact: Andrea Solis) provides for a twelve (12)-month staffing period at an estimated cost of $3,600,000 (30 FTE × $10,000 per FTE per month × 12 months). The Pinnacle analysts are operating under the direct supervision of BRB's BSA/AML department and are subject to the same quality standards and procedural requirements as BRB's permanent staff. Pinnacle analysts began on-site deployment in March 2025 and are currently ramping to full capacity.
3. Comprehensive SAR Lookback Project. In addition to clearing the pending backlog of 2,400 unreviewed alerts, BRB is conducting a comprehensive SAR lookback project to identify and report any additional suspicious activity that may have been missed during the period when BRB's transaction monitoring system and SAR processes were deficient. The lookback project encompasses a defined lookback period, specific transaction types, and customer populations to be determined in consultation with C&H and Thornfield. The estimated budget for the SAR lookback project is $5,500,000, inclusive of internal and external resources.
4. Revised SAR Filing Standards. BRB is implementing revised SAR filing standards that incorporate a 30-day timeliness benchmark measured from alert generation to SAR filing, clearly defined escalation protocols for complex or high-priority cases, and quality review requirements including supervisory review of all SAR narratives prior to filing. The revised standards have been documented in updated SAR policies and procedures that will be effective upon deployment and completion of associated training.
5. Post-Remediation SAR Quality Assurance Framework. To ensure the sustainability of the remediation and prevent recurrence, BRB is establishing a comprehensive SAR quality assurance ("QA") framework that includes regular QA sampling of filed SARs, error tracking and trending analysis, root cause analysis for identified deficiencies, and a continuous improvement feedback loop to drive ongoing process refinement.
6. Interim SAR Backlog Status Report. As required by the Consent Order, BRB filed an interim SAR backlog status report with the OCC on March 31, 2025. The interim report detailed the status of the backlog clearance effort, the deployment of Pinnacle temporary analysts, and BRB's projected timeline for full clearance of the backlog.
Milestone Deadlines.
• June 30, 2025: SAR backlog of 2,400 alerts fully cleared — i.e., all alerts reviewed, investigated, and dispositioned (either filed as SARs, closed with documented rationale, or escalated as appropriate).
• Ongoing thereafter: Revised SAR filing processes operational on a sustained basis, with average filing timeliness within 30 days and continuous QA monitoring in place.
Accountability.
• Thomas Ikeda — BSA Officer / AML Program Director: Operational lead for SAR backlog clearance and process improvement; direct supervision of Pinnacle temporary analysts.
• Patricia Langston — CCO: Overall workstream leadership; SAR policy ownership.
• Robert Eastman (Thornfield): Independent oversight and validation of SAR backlog clearance and process improvement.
Related Documents.
• Workstream 2 SAR Backlog Clearance & Process Improvement Plan
• SAR Lookback Scope & Methodology Memorandum
• SAR Backlog Triage Protocol
• Revised SAR Policy & Procedures
• SAR Quality Assurance Framework Memorandum
• Pinnacle Managed Services Agreement and SOW
Workstream 3: CDD/EDD Remediation
Objective. The objective of Workstream 3 is to remediate 100% of the approximately 47,000 high-risk customer accounts identified as lacking adequate CDD or EDD documentation. The remediation effort will collect, verify, and document the required CDD/EDD information for each affected account and will implement revised CDD/EDD policies and procedures designed to prevent recurrence and ensure sustainable compliance across all customer channels, including BaaS.
Key Activities. Workstream 3 encompasses the following principal activities:
1. Risk-Based Account Prioritization. The 47,000 accounts requiring remediation have been prioritized using a risk-based methodology that assigns the highest priority to BaaS-onboarded accounts associated with NovaPay Technologies, FairLend Digital LLC, and VaultEdge Inc. Within this population, further prioritization is based on individual account risk scores, transaction volumes, and the risk profile of the associated BaaS partner. The prioritization methodology is designed to ensure that the highest-risk accounts are remediated first, reducing residual risk exposure as rapidly as possible.
2. Phased Remediation Timeline. The account remediation will be executed on a phased basis:
• Phase 1 (by July 15, 2025): Remediation of 50% of the affected accounts, or approximately 23,500 accounts. Phase 1 will focus on the highest-risk accounts, including those associated with NovaPay and FairLend Digital.
• Phase 2 (by January 15, 2026): Remediation of the remaining 50%, achieving 100% completion — or the full population of 47,000 accounts.
3. Revised CDD/EDD Policy. BRB is implementing a comprehensive revised CDD/EDD policy that addresses all elements of customer due diligence, including the customer identification program, risk rating methodology, beneficial ownership identification and verification, ongoing monitoring, periodic reviews for high-risk accounts, and specific requirements for all customer channels, with particular attention to BaaS-originated accounts. The revised policy incorporates regulatory requirements under 31 C.F.R. § 1020.210 and 31 C.F.R. § 1010.230, as well as OCC supervisory expectations.
4. BaaS Partner CDD/EDD Responsibility Matrix. A critical component of the CDD/EDD remediation is the development and implementation of a BaaS Partner CDD/EDD Responsibility Matrix using a RACI framework (Responsible, Accountable, Consulted, Informed). The matrix delineates, for each BaaS partner, the specific CDD/EDD responsibilities retained by BRB and those delegated to the partner, with clear accountability and escalation procedures. This matrix is designed to eliminate the ambiguity that contributed to the CDD/EDD failures identified in the Consent Order.
5. CDD/EDD Progress Tracking Dashboard. BRB is developing a CDD/EDD progress tracking dashboard that will provide real-time visibility into the status of the remediation effort, including accounts remediated, accounts pending, accounts approaching deadline, and accounts presenting remediation challenges. The dashboard will be used for internal management reporting, Compliance Committee reporting, and OCC reporting.
6. BaaS Partner Compliance Remediation Letters. BRB has issued formal compliance remediation letters to the CEOs of its top BaaS partners demanding enhanced cooperation and data sharing in support of the CDD/EDD remediation:
• A letter was sent to Ethan Garrison, CEO of NovaPay Technologies Inc., on March 15, 2025.
• A letter was sent to Aisha Okonkwo, CEO of FairLend Digital LLC, on March 15, 2025.
These letters set forth BRB's expectation that the partners will cooperate fully with the remediation effort, provide requested customer documentation in a timely manner, and implement process enhancements to prevent future CDD/EDD deficiencies. C&H reviewed and approved the letters prior to issuance.
Milestone Deadlines.
• July 15, 2025: 50% of affected accounts remediated (approximately 23,500 accounts).
• January 15, 2026: 100% of affected accounts remediated (47,000 accounts).
Budget. The estimated budget for Workstream 3 is $4,300,000, inclusive of internal resources, external staffing support, technology tools for document collection and management, and associated overhead.
Accountability.
• Patricia Langston — CCO: Overall workstream leadership and CDD/EDD policy ownership.
• Warren Ashby — Head of BaaS Division: BaaS partner coordination, cooperation enforcement, and partner-specific remediation management.
• Thomas Ikeda — BSA Officer: CDD/EDD documentation standards and quality assurance.
• Nathaniel Burgess (Thornfield): Independent oversight and validation of fintech-related CDD/EDD remediation.
Related Documents.
• Workstream 3 CDD/EDD Remediation Plan
• CDD/EDD Remediation Methodology & Prioritization Memorandum
• Revised CDD/EDD Policy
• BaaS Partner CDD/EDD Responsibility Matrix
• CDD/EDD Progress Tracking Dashboard Specifications
• NovaPay Compliance Remediation Letter
• FairLend Digital Compliance Remediation Letter
Workstream 4: Transaction Monitoring Model Validation & Tuning
Objective. The objective of Workstream 4 is to upgrade BRB's transaction monitoring system, conduct an independent model validation, and properly tune the system's detection parameters to ensure effective and risk-appropriate detection of suspicious activity across all business lines and BaaS channels. This workstream addresses the Consent Order's finding that the Veridian TMS had not been independently validated in more than three years and that tuning parameters were materially stale.
Key Activities. Workstream 4 encompasses the following principal activities:
1. Veridian TMS Upgrade to v.10.0. BRB will upgrade from Veridian TMS v.8.3 to v.10.0 pursuant to an amended Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044). The upgrade includes enhanced transaction monitoring capabilities, improved BaaS transaction integration, expanded detection scenario libraries, enhanced case management functionality, and the upgraded OFAC screening module discussed in Workstream 1. The commercial terms of the upgrade are as follows:
• One-time implementation fee: $2,800,000
• Incremental annual licensing cost: $1,900,000 per year
• New total annual contract value (post-upgrade): $6,000,000 per year
• Key Veridian contact: Priya Subramanian, Vice President, Client Solutions
2. User Acceptance Testing. UAT for the Veridian TMS v.10.0 is targeted for completion by August 1, 2025. The UAT will encompass functional testing, integration testing across all BaaS partner transaction flows, performance testing under production-scale transaction volumes, and validation of detection scenario logic and alert generation.
3. Independent Model Validation. Upon successful deployment of Veridian TMS v.10.0, an independent model validation will be conducted and completed by October 1, 2025. The model validation will be performed by Thornfield under the direction of Robert Eastman and will assess the adequacy of the model's design, the appropriateness of tuning parameters and thresholds, the completeness of transaction coverage, the effectiveness of detection scenarios, and the model's overall fitness for BRB's current risk profile and transaction environment.
4. Tuning Parameter Recalibration. Following the model validation, BRB will recalibrate all tuning parameters, including above-the-line and below-the-line thresholds, based on the model validation findings and BRB's updated risk profile. The recalibration will specifically address the growth in BaaS transaction volume and the associated changes in transaction typologies and risk patterns.
5. Ongoing Periodic Validation Schedule. BRB will establish an ongoing periodic validation schedule requiring independent model validation of the transaction monitoring system at least annually, with additional validations required upon any material change to the model, its inputs, or the operating environment.
6. Contingency Vendor Evaluation. BRB has evaluated Ridgeline Data Systems LLC as a contingency alternative to the Veridian TMS v.10.0 upgrade. The Ridgeline platform would involve the following commercial terms:
• Annual contract value: $7,200,000 per year
• Contract term: 5 years
• Total contract value: $36,000,000
• Key Ridgeline contact: David Marchetti, Chief Revenue Officer
C&H's recommendation is to proceed with the Veridian TMS v.10.0 upgrade as the primary solution, with Ridgeline maintained as a fallback option in the event that the Veridian implementation proves insufficient or falls materially behind schedule. The Veridian vs. Ridgeline Vendor Comparison Memorandum, prepared by C&H and BRB's technology team, details the relative merits of each platform and provides the basis for this recommendation. BRB has executed a non-disclosure agreement with Ridgeline and has reviewed a preliminary term sheet to ensure that the contingency option can be activated expeditiously if needed.
Milestone Deadlines.
• August 1, 2025: Veridian TMS v.10.0 UAT complete and system deployed to production.
• October 1, 2025: Independent model validation of the upgraded Veridian TMS v.10.0 completed by Thornfield.
Accountability.
• Linda Petrosian — CIO/CTO: Responsible for Veridian TMS v.10.0 technology implementation, system integration, UAT, and production deployment.
• Thomas Ikeda — BSA Officer: Responsible for tuning parameter recalibration, detection scenario review, and coordination with Thornfield on model validation.
• Robert Eastman (Thornfield): Independent oversight and conduct of model validation.
Related Documents.
• Workstream 4 TM Model Validation & Tuning Plan
• Veridian MSA Amendment
• Technology Implementation Timeline & Risk Assessment Memorandum
• Veridian vs. Ridgeline Vendor Comparison Memorandum
• Ridgeline NDA and Term Sheet Review
Workstream 5: BSA/AML Program Governance & Training Enhancement
Objective. The objective of Workstream 5 is to remediate the board-level and organizational governance deficiencies identified in the Consent Order and to establish an enterprise-wide BSA/AML and sanctions training program that ensures all relevant personnel — from front-line staff to the Board of Directors — possess the knowledge, skills, and awareness necessary to discharge their respective compliance responsibilities.
Key Activities. Workstream 5 encompasses the following principal activities:
1. Compliance Committee Establishment and Governance. As noted in Section II.E above, the BRFG Board adopted a Board Resolution dated February 28, 2025 establishing the Compliance Committee as a standing committee of the Board, with James Rutherford appointed as Chair. The Compliance Committee Charter — adopted concurrently — defines the Committee's composition, authority, duties, and meeting frequency. During the remediation period, the Compliance Committee will meet at least monthly. Additionally, BRFG's corporate bylaws have been amended to incorporate the Compliance Committee as a permanent standing committee, ensuring that the governance enhancement is structurally embedded and not dependent on ad hoc Board action.
2. Enhanced BSA/AML Reporting to the Board. BRB is implementing a significantly enhanced BSA/AML reporting framework that includes:
• Monthly reports to the Compliance Committee covering: SAR filing volumes and filing timeliness metrics; OFAC screening hit rates and disposition outcomes; CDD/EDD remediation progress against milestones; transaction monitoring alert volumes, SAR conversion rates, and alert aging; BaaS partner risk ratings and compliance assessment results; and remediation workstream status updates.
• Quarterly reports to the full Board of Directors incorporating all of the above metrics, along with strategic-level analysis, risk assessments, and recommendations.
The reporting framework has been documented in a Compliance Committee Reporting Framework that specifies the content, format, data sources, and delivery schedule for each report.
3. BSA/AML Department Organizational Restructuring. BRB is increasing its permanent BSA/AML department headcount from 62 FTEs to 77 FTEs, a net increase of 15 new permanent hires. The new positions span multiple functions within the BSA/AML department, including alert review and investigation, SAR preparation and filing, OFAC screening operations, CDD/EDD operations, transaction monitoring analytics, and compliance program management. The estimated cost of the 15 new permanent FTEs is approximately $2,250,000 per year (15 FTE × $150,000 average fully loaded cost, inclusive of salary, benefits, and overhead).
4. Enterprise-Wide BSA/AML Training Program. BRB is developing and deploying a comprehensive, audience-segmented BSA/AML and sanctions training program covering all relevant personnel throughout the organization. The training program includes the following components:
• Front-Line Staff Training: Fundamental BSA/AML awareness, red flags for suspicious activity, customer identification requirements, and SAR referral procedures.
• BaaS Relationship Managers Training: Specialized training addressing the unique compliance risks associated with BaaS partnerships, BaaS partner oversight responsibilities, CDD/EDD delegation and monitoring, and escalation procedures.
• Compliance Staff Training: Advanced training covering transaction monitoring operations, alert review and investigation, SAR preparation and narrative writing, OFAC screening operations and disposition, CDD/EDD documentation standards, and regulatory examination preparation.
• Senior Management Training: Training covering BSA/AML regulatory framework, OFAC obligations, enterprise risk management integration, resource allocation, and management accountability.
• Board and Senior Management Tailored Training: Specialized training for the Board of Directors and senior management covering the BSA/AML regulatory framework, OFAC obligations, personal liability under 31 U.S.C. § 5322 and related statutes, Consent Order requirements and obligations, governance oversight responsibilities, and emerging BSA/AML risk trends in the fintech and BaaS sectors.
• OFAC-Specific Module: Dedicated training for sanctions screening personnel covering OFAC list management, screening system operations, true match versus false positive disposition, interdiction and blocking procedures, and OFAC reporting requirements.
The training program will be delivered through a combination of in-person instructor-led sessions and e-learning modules, with annual recertification required for all personnel. Training completion and recertification will be tracked through BRB's learning management system and reported to the Compliance Committee.
Budget.
• Training and Policy Development: $1,800,000
• Board and Governance Restructuring: $500,000
• Internal Headcount Additions (15 FTE): $2,250,000 (annualized)
Accountability.
• Patricia Langston — CCO: Overall workstream leadership; BSA/AML policy suite ownership; training program development.
• Gregory Nardone — General Counsel: Legal oversight of governance restructuring; bylaws amendments; privilege and confidentiality protocols.
• James Rutherford — Compliance Committee Chair: Board-level oversight; Compliance Committee governance.
• Derek Ballard — Head of Internal Audit: Independent testing of governance effectiveness; remediation progress verification.
Related Documents.
• Workstream 5 BSA/AML Governance & Training Enhancement Plan
• Compliance Committee Charter
• Amended Bylaws
• Compliance Committee Reporting Framework
• Enterprise-Wide BSA/AML Training Plan
• Board & Senior Management Training Outline
• Consolidated BSA/AML & Sanctions Policy Suite Index
IV. BaaS / FINTECH PARTNERSHIP OVERSIGHT — CROSS-CUTTING THEME
While each of the five remediation workstreams addresses a specific deficiency category identified in the Consent Order, a cross-cutting theme that pervades the entire remediation program is the need for fundamental restructuring of BRB's oversight of its Banking-as-a-Service and fintech partnership business. The Consent Order's findings are not incidental to BRB's BaaS operations — they are, in large part, caused by deficiencies in the design, implementation, and monitoring of BRB's BaaS compliance framework.
BaaS Business Profile
BRB operates fourteen (14) active BaaS partnerships through its OCC charter. These partnerships generate significant transaction volume and revenue for BRB:
• Total BaaS transaction volume (CY 2024): Approximately $74.3 billion
• Total BaaS revenue (CY 2024): $127.4 million
The BaaS transaction volume is concentrated among BRB's three largest partners:
Concentration of Deficiencies in BaaS Channels
BaaS-related suspicious activity reports accounted for 2,108 of the 3,847 total SARs filed by BRB in CY 2024, or approximately 54.8% of all SARs. This disproportionate concentration is symptomatic of the elevated compliance risk inherent in BaaS relationships, where the customer-facing functions — onboarding, transaction initiation, customer communication — are performed by the fintech partner rather than by BRB directly, creating operational separation between the bank and the compliance-relevant activities.
Multiple Consent Order deficiency categories are concentrated in BaaS channels, including:
• OFAC screening gaps (Deficiency 1), which were caused by the incomplete integration of BaaS transaction flows into the screening platform;
• CDD/EDD failures (Deficiency 3), which were concentrated in accounts onboarded through BaaS partners where CDD/EDD responsibilities were inadequately defined and supervised; and
• SAR backlog (Deficiency 2), which was significantly driven by the volume and complexity of BaaS-originated alerts.
Restructured BaaS Compliance Oversight Framework
In response to the Consent Order findings and Thornfield's preliminary gap assessment, BRB is implementing a restructured BaaS Compliance Oversight Framework that includes the following components:
• Risk-Based Partner Tiering: All fourteen BaaS partners will be classified into risk tiers based on transaction volume, product type, customer population characteristics, geographic exposure, historical compliance performance, and regulatory risk profile. Tier assignments will drive the frequency and intensity of ongoing monitoring, compliance testing, and management review.
• Ongoing Monitoring Program: BRB will conduct continuous and periodic monitoring of BaaS partner compliance performance, including transaction monitoring alert rates, SAR referral rates, CDD/EDD documentation quality, OFAC screening hit rates, and partner responsiveness to BRB compliance inquiries and requests.
• Compliance Testing: BRB's Internal Audit function and, where appropriate, Thornfield will conduct periodic compliance testing of BaaS partner operations, including testing of customer onboarding processes, transaction screening, suspicious activity identification and referral, and data sharing and reporting.
• Escalation and Termination Triggers: The framework defines specific escalation and termination triggers, including quantitative and qualitative thresholds that, if breached, require escalation to the CCO, the Compliance Committee, and potentially to the OCC. In extreme cases, BRB retains the right to terminate a BaaS partnership for material compliance failures.
Revised BaaS Program Agreement Template
BRB is implementing a revised BaaS Program Agreement template that includes a comprehensive compliance addendum requiring enhanced BSA/AML and OFAC obligations from all fourteen fintech partners. The compliance addendum addresses:
• Partner BSA/AML and OFAC compliance obligations
• Data sharing requirements, including real-time and batch data feeds
• BRB audit rights, including on-site inspection rights
• SAR cooperation obligations, including timely response to BRB information requests
• CDD/EDD responsibilities, including clearly defined delegation and retention of duties
• Remediation cooperation requirements
• Representations and warranties regarding the partner's own compliance program
• Termination rights for material compliance breaches
BaaS Partner BSA/AML Risk Assessment Template
BRB has developed a standardized BaaS Partner BSA/AML Risk Assessment Template for use in conducting quarterly risk evaluations of all fourteen BaaS partners. The template provides a consistent framework for assessing each partner's compliance risk profile and tracking changes over time.
Key Partner Contacts
• NovaPay Technologies Inc.: Ethan Garrison, Chief Executive Officer
• FairLend Digital LLC: Aisha Okonkwo, Chief Executive Officer
• VaultEdge Inc.: Marcus Tan, Chief Executive Officer
Internal Accountability
Warren Ashby, Head of Fintech Partnerships / BaaS Division, has primary operational accountability for BaaS partner oversight restructuring and for ensuring that all fourteen fintech partners cooperate with BRB's remediation efforts. Mr. Ashby reports to Raymond Okoye, President and COO, and has a dual reporting line to Patricia Langston, CCO, on all compliance matters. Thornfield's Nathaniel Burgess provides independent assessment of BRB's BaaS oversight framework and fintech-related remediation activities.
V. MASTER TIMELINE AND KEY MILESTONES
The following table sets forth the master timeline and key milestones for the remediation program, from the effective date of the Consent Order through the compliance self-certification date. The status of each milestone as of the RAP filing date (May 15, 2025) is indicated.
The master milestone tracker, which provides additional granularity including sub-milestones, dependencies, and critical-path analysis, is included as Appendix C.
VI. BUDGET SUMMARY
A. Remediation Budget (Board-Approved, Exclusive of CMP)
The following table summarizes the remediation budget approved by the Board of Directors in the February 28, 2025 Board Resolution. This budget is exclusive of the $14,500,000 civil money penalty, which is addressed separately in Section VI.B below.
A contingency allowance of approximately 10% has been embedded within the line item estimates above to account for unanticipated cost increases, scope adjustments, and execution risks. This contingency does not represent a separate budget line but rather reflects a buffer within each workstream's estimated cost. Detailed budget allocations by workstream and vendor are provided in Appendix D.
B. Civil Money Penalty
The CMP was paid by BRB on March 14, 2025, two days prior to the due date, via wire transfer to the OCC. The CMP is non-deductible for federal income tax purposes under Section 162(f) of the Internal Revenue Code, which disallows deductions for amounts paid or incurred to, or at the direction of, a government or governmental entity in relation to the violation of any law or the investigation or inquiry into the potential violation of any law. The after-tax cost of the CMP is therefore equal to the full $14,500,000 payment amount.
C. Total Estimated Outlay
The total estimated financial outlay associated with the Consent Order and the remediation program is as follows:
• Total remediation budget (exclusive of CMP): $42,500,000
• Civil money penalty: $14,500,000
• Total estimated outlay: $57,000,000
D. C&H Fee Collar and Budget Controls
The financial terms of C&H's engagement have been structured to provide cost predictability and appropriate budget controls, as follows:
• Estimated Total C&H Fees: $8,000,000, allocated as follows:
• Phase 1 (engagement through RAP filing — February 10, 2025 to May 15, 2025): $4,800,000
• Phase 2 (implementation and monitoring — May 16, 2025 to February 15, 2026): $3,200,000
• Fee Collar: A variance of ±15% from the $8,000,000 estimated total is permitted without re-approval. Fee overruns exceeding $9,200,000 (calculated as $8,000,000 × 1.15) require written approval from BRB's General Counsel, Gregory Nardone, prior to continued work at rates exceeding the collar.
• Expense Cap: C&H's reimbursable expenses are capped at $250,000 for the duration of the engagement. This cap is exclusive of costs for experts and consultants (including Thornfield) that are billed directly to BRB rather than through C&H.
• Evergreen Retainer: BRB deposited an evergreen retainer of $500,000 with C&H on February 12, 2025. The retainer is applied against monthly invoices and replenished to the $500,000 level as needed.
• Billing Cycle: C&H bills monthly, with payment due net 30 days from invoice date.
• Budget Reconciliation: Quarterly budget reconciliation meetings will be held between C&H (Philip Hartmann), BRB's General Counsel (Gregory Nardone), and BRB's CFO (Samantha Reeves) to review actual expenditures against budget, identify any variances, and discuss prospective cost adjustments.
E. Context Relative to BRB Financials
To provide the Board with appropriate context for evaluating the materiality of the remediation program's financial impact, the following key financial metrics for BRB and BRFG are presented:
The total remediation outlay of $57.0 million (inclusive of the CMP) represents approximately 13.8% of BRFG's FY 2024 net income of $412 million. While material, this outlay is within BRB's financial capacity and does not raise capital adequacy concerns given BRB's Tier 1 capital ratio of 11.2%, which is well above the regulatory minimum and the "well capitalized" threshold. BRB's pre-remediation BSA/AML budget of $18.2 million per year will be significantly increased on a going-forward basis to reflect the enhanced permanent staffing (15 new FTEs at $2.25 million), elevated technology costs (Veridian TMS v.10.0 at $6.0 million per year), and ongoing compliance program enhanc

REMEDIATION ACTION PLAN

EXECUTIVE SUMMARY

ATTENTION:

TABLE OF CONTENTS

I. PURPOSE AND BACKGROUND

II. SUMMARY OF CONSENT ORDER DEFICIENCY CATEGORIES

Record

Parties

Dates

Amounts