regulatory-risk-assessment-memorandum.docx

1045-00002 · Calderwood & Harkness LLP · documents

regulatory-risk-assessment-memorandum.docx DOCUMENT Antitrust

58 / 84 ← → ✕

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF CALDERWOOD & HARKNESS LLP

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

February 28, 2025

MEMORANDUM

FROM: Philip Hartmann, Partner, Banking & Finance Practice Group, Calderwood & Harkness LLP Yuki Nakamura, Associate, Litigation (General) Practice Group, Calderwood & Harkness LLP

TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc.

CC: Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association Melissa Chu, Chief Risk Officer, Belmont Ridge Bank National Association

RE: Regulatory Risk Assessment — Exposure to Additional Enforcement Actions Beyond OCC Consent Order No. OCC-2025-003

C&H Matter No.: 1045-00002

Right-click to update Table of Contents

I. Executive Summary

Calderwood & Harkness LLP ("C&H") has been engaged to assess Belmont Ridge Bank National Association's ("BRB" or the "Bank") exposure to additional regulatory and enforcement actions arising from or related to the compliance deficiencies that formed the basis of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025 (the "Consent Order"). This memorandum provides a comprehensive analysis of BRB's secondary enforcement risk across four principal vectors: (1) enforcement by the Financial Crimes Enforcement Network ("FinCEN"); (2) criminal referral to the United States Department of Justice ("DOJ"); (3) enforcement by the Office of Foreign Assets Control ("OFAC"); and (4) state-level regulatory exposure.

Overall Risk Posture. Based on our review of the Consent Order, underlying examination workpapers, BRB's internal compliance documentation, and relevant enforcement precedent, we conclude that BRB faces material secondary enforcement exposure, particularly from OFAC and FinCEN. The OFAC risk is driven principally by the scale of the sanctions screening gap in BRB's NovaPay Technologies Inc. ("NovaPay") Banking-as-a-Service ("BaaS") channel, where approximately 3,800,000 transactions in calendar year 2023 were not screened against applicable sanctions lists. The FinCEN risk is principally attributable to the scope and duration of the Bank's Suspicious Activity Report ("SAR") filing deficiencies, including a backlog of approximately 2,400 unreviewed alerts and an average filing time of 78 days — more than double the regulatory expectation. DOJ criminal referral risk is assessed as lower but non-negligible, with severity that would be extreme if materialized. State-level risks are limited given BRB's national charter but are present for certain BaaS partner activities that may be subject to state money transmitter and lending license requirements.

Key Recommendations. We recommend that BRB pursue proactive mitigation strategies for each risk vector, including: (i) proactive outreach to FinCEN to establish a cooperative dialogue regarding remediation progress; (ii) accelerated completion of the OFAC lookback for unscreened NovaPay transactions, with preparation for a potential voluntary self-disclosure ("VSD") filing if apparent sanctions violations are identified; (iii) rigorous monitoring of the SAR lookback project for indicators that could elevate DOJ criminal referral risk; and (iv) a comprehensive state licensing audit of all 14 active BaaS partners.

Institutional Context. BRB is a $38.7 billion national banking association (OCC Charter No. 48271; FDIC Certificate No. 31845) headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, with approximately 5,800 employees. The Bank is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a publicly traded Delaware corporation listed on the New York Stock Exchange under the ticker symbol "BRFG." BRB's core business lines include retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service partnerships, with 14 active fintech sponsor relationships. The BaaS division generated $127.4 million in revenue in calendar year 2024 on transaction volume of $74.3 billion, making it a strategically significant — and now a regulatory focal point — component of BRB's business.

The balance of this memorandum sets forth the factual background, legal analysis, risk assessment, and recommended mitigation strategies for each enforcement vector in detail.

II. Background and Context

A. Summary of OCC Consent Order No. OCC-2025-003

On January 15, 2025, the OCC Northeastern District Office (340 Madison Avenue, New York, NY 10017) issued Consent Order No. OCC-2025-003 against BRB. The Consent Order was the culmination of a targeted Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") examination conducted from March 2024 through September 2024 under the supervision of Jonathan Frey, National Bank Examiner and Examiner-in-Charge. The Consent Order assessed a civil money penalty ("CMP") of $14,500,000, payable within 60 days of the effective date (i.e., by March 16, 2025).

The Consent Order identifies five core categories of deficiency in BRB's BSA/AML compliance program:

1. OFAC Sanctions Screening Failures. BRB's OFAC screening system failed to screen approximately 12% of wire and Automated Clearing House ("ACH") transactions processed through the NovaPay BaaS channel. This failure resulted in approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023 not being screened against the Specially Designated Nationals and blocked Persons List ("SDN List") or other applicable OFAC sanctions lists. The screening gap was attributed to a systems integration failure between NovaPay's Application Programming Interface ("API") and BRB's Veridian Analytics transaction monitoring system.

2. SAR Filing Deficiencies. BRB maintained a backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024. The Bank's average SAR filing time was 78 days from initial alert detection — significantly exceeding the regulatory expectation that SARs be filed within 30 days of detection, as articulated in FinCEN guidance and OCC examination procedures. The deficiencies reflected both inadequate staffing levels in the Bank's Financial intelligence Unit and deficient case management processes.

3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. Approximately 47,000 high-risk customer accounts, primarily those onboarded through fintech BaaS channels, lacked adequate documentation to satisfy CDD and EDD requirements under 31 C.F.R. § 1020.210 and the OCC's implementing supervisory guidance. These accounts were identified as lacking verified beneficial ownership information, adequate source-of-funds documentation, or risk-appropriate periodic review.

4. Model Validation Deficiencies. BRB's primary transaction monitoring system, Veridian TMS v.8.3 (provided by Veridian Analytics, Inc., under Master Services Agreement Contract No. VA-BRB-2023-0044), was last independently validated in March 2021 — approximately four years prior to the Consent Order. Tuning parameters were last updated in October 2022. The OCC determined that BRB failed to comply with its own model risk management policy, which required annual independent validation, and with the guidance set forth in OCC Bulletin 2011-12, "Supervisory Guidance on Model Risk Management."

5. Board Oversight Deficiencies. BRB's Board of Directors did not maintain a dedicated Compliance Committee, and the quarterly BSA/AML reporting provided to the Board lacked key performance metrics, including SAR filing timelines, alert backlog volumes, OFAC screening coverage rates, and CDD remediation progress. The OCC determined that the Board failed to provide the degree of oversight required by 12 C.F.R. § 21.21 and applicable supervisory guidance.

The Consent Order requires BRB to develop and submit a Comprehensive Remediation Action Plan within 120 days of the effective date (i.e., by May 15, 2025), to engage an OCC-approved independent consultant to conduct a gap assessment and monitor remediation, and to provide quarterly progress reports to the OCC beginning on September 15, 2025.

B. Supervisory Escalation History

The Consent Order did not arise in a supervisory vacuum. The record reflects a progressive escalation of supervisory concerns over a period of more than two years prior to the issuance of the Consent Order:

• June 2022: Matter Requiring Attention ("MRA"). The OCC issued an MRA identifying deficiencies in BRB's BSA/AML transaction monitoring system, including concerns about alert volumes, case management timelines, and the adequacy of model governance. The MRA did not specifically address OFAC screening or BaaS-related risks but noted the need for enhanced monitoring capacity as BaaS operations scaled.

• November 2023: Matter Requiring Immediate Attention ("MRIA"). The OCC escalated its supervisory action to an MRIA — a significantly more serious designation indicating that identified deficiencies posed a threat to the safety and soundness of the institution or constituted potential violations of law. The MRIA specifically identified OFAC screening gaps in BaaS channels and the growing SAR filing backlog as requiring immediate corrective action.

• January 2025: Consent Order. The Consent Order explicitly cites BRB's failure to adequately remediate the deficiencies identified in the prior MRA and MRIA as an aggravating factor supporting the enforcement action and the assessed CMP.

This escalation history is significant for purposes of our secondary enforcement risk assessment because it demonstrates a documented pattern of inadequate remediation following supervisory warnings — a factor that FinCEN, OFAC, and DOJ each consider aggravating in their respective enforcement frameworks.

BRB's prior outside counsel, Drayton Mercer LLP, represented the Bank throughout the examination cycle from 2019 through 2024. Helen Frazier, a partner in Drayton Mercer's financial institutions practice (office at 55 East 52nd Street, Suite 3100, New York, NY 10055), served as lead partner on the engagement. The Drayton Mercer engagement was terminated in January 2025 following issuance of the Consent Order, and Calderwood & Harkness was retained effective February 10, 2025 to provide comprehensive regulatory defense and compliance-program uplift services.

Additionally, BRB's most recent independent BSA/AML program test was conducted by Caldera & Pope LLP (Franklin Dorsey, CPA, engagement partner; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606) and was completed in September 2024. The Caldera & Pope report identified multiple deficiencies that were subsequently echoed in the Consent Order, including the SAR filing backlog, the model validation gap, and CDD documentation deficiencies. The Caldera & Pope report did not specifically identify the scope of the OFAC screening gap in the NovaPay channel, which was identified through the OCC's own targeted transaction testing during the examination.

C. BRB's Current Remediation Posture

Since the issuance of the Consent Order, BRB has undertaken a series of remediation actions intended to demonstrate institutional commitment to compliance-program improvement:

• Engagement of New Outside Counsel. Calderwood & Harkness LLP was engaged effective February 10, 2025 (C&H Matter No. 1045-00002) to serve as BRB's primary outside counsel for regulatory defense, enforcement response, and compliance-program uplift. The engagement encompasses representation before the OCC, FinCEN, OFAC, DOJ, and state regulators as necessary.

• Engagement of Independent Consultant. Thornfield Consulting Group LLC ("Thornfield") has been engaged as the OCC-mandated independent consultant. Dr. Vivian Castellano, Managing Director, serves as the engagement lead. The OCC granted non-objection to the Thornfield engagement on February 5, 2025, and the engagement agreement (Reference No. TCG-BRB-2025-001) was executed on February 10, 2025. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, with a preliminary gap assessment report due to the OCC by April 15, 2025.

• Board Governance Enhancements. A Board Resolution acknowledging the Consent Order and establishing a dedicated Compliance Committee is due for adoption by February 28, 2025. James Rutherford, an independent director with prior experience as General Counsel of a major regional bank holding company, has been designated to serve as Chair of the newly created Compliance Committee.

• Remediation Budget. BRB's Board of Directors has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 CMP assessed in the Consent Order. The combined financial commitment — $57,000,000 — reflects the scope of the remediation undertaking and the Bank's financial capacity to address the identified deficiencies.

• Comprehensive Remediation Action Plan. The Plan is under development by C&H and Thornfield in coordination with BRB's compliance, risk, and technology teams, and is due for submission to the OCC by May 15, 2025.

D. Key Financial Context

An understanding of BRB's financial profile is relevant both to the Bank's capacity to absorb potential additional enforcement costs and to the assessment of shareholder and market risk implications:

• Total assets (as of December 31, 2024): $38.7 billion

• Total deposits (as of December 31, 2024): $29.4 billion

• Net income (fiscal year 2024): $412 million

• Tier 1 capital ratio (as of December 31, 2024): 11.2%

• BRFG shares outstanding: 179,500,000

• BRFG stock price: declined from approximately $47.82 (implied pre-disclosure level) to $41.15 on January 16, 2025, the first trading day following public disclosure of the Consent Order — a decline of approximately 13.9%, representing a loss of approximately $1.2 billion in market capitalization. The stock price partially recovered to $47.82 as of February 7, 2025.

• BRFG market capitalization (as of February 7, 2025): approximately $8.58 billion

• BaaS division revenue (calendar year 2024): $127.4 million

• BaaS division transaction volume (calendar year 2024): $74.3 billion

BRB's Tier 1 capital ratio of 11.2% is above the 8% threshold for "well-capitalized" classification under the OCC's Prompt Corrective Action framework, and the Bank's net income of $412 million provides meaningful capacity to absorb remediation costs and potential additional penalties. However, additional enforcement actions — particularly if they involve penalties in the range of tens of millions of dollars or higher — would place further pressure on earnings, capital ratios, and stock price at a time when the Bank is already absorbing a $57 million remediation and penalty outlay.

III. FinCEN Enforcement Risk Assessment

A. Current FinCEN Posture

As of the date of C&H's engagement (February 10, 2025), FinCEN has not filed a separate enforcement action against BRB. However, our inquiries and review of interagency coordination protocols indicate that FinCEN is actively monitoring BRB's SAR filing remediation efforts pursuant to its coordination with the OCC.

C&H has identified Angela Drummond, Associate Director of FinCEN's Enforcement Division, as the FinCEN liaison responsible for the BRB matter. Ms. Drummond has been involved in interagency coordination discussions with the OCC regarding the scope of BRB's SAR filing deficiencies and the adequacy of BRB's remediation response. While FinCEN has not taken independent enforcement action to date, it has expressly reserved its enforcement rights. The Consent Order itself does not foreclose, limit, or otherwise restrict FinCEN's authority to pursue its own enforcement action based on the same or related conduct. This reservation of rights is standard interagency practice but creates meaningful uncertainty regarding FinCEN's ultimate enforcement posture.

B. Statutory and Regulatory Authority

FinCEN possesses independent authority to bring enforcement actions against financial institutions for violations of the Bank Secrecy Act and its implementing regulations. The principal statutory provisions relevant to BRB's exposure are:

• 31 U.S.C. § 5321 (Civil Money Penalties). FinCEN is authorized to assess civil money penalties for violations of any provision of the BSA or its implementing regulations, including SAR filing requirements and anti-money laundering program requirements. Penalties under Section 5321 can be substantial, with maximum per-violation penalties that vary based on the nature of the violation and the violator.

• 31 U.S.C. § 5322 (Criminal Penalties). FinCEN may refer matters for criminal prosecution under Section 5322, which provides for penalties of up to $250,000 per violation and/or imprisonment of up to five years for willful violations of BSA requirements. Enhanced penalties apply where the violation occurs as part of a pattern of unlawful activity or involves more than $100,000 in a twelve-month period. Criminal prosecution is typically coordinated with the DOJ and is addressed separately in Section IV of this memorandum.

• 31 U.S.C. § 5318(g) (SAR Filing Requirements). This section establishes the requirement for financial institutions to file SARs reporting suspicious transactions to FinCEN. BRB's SAR filing obligations are further specified in 12 C.F.R. Part 21 (for OCC-regulated national banks) and FinCEN's implementing regulations at 31 C.F.R. § 1020.320, which require that SARs be filed within 30 days of the initial detection of facts that may constitute a basis for filing, or within 60 days if no suspect has been identified.

• 31 U.S.C. § 5318(h) (Anti-Money Laundering Program Requirements). Financial institutions are required to maintain an anti-money laundering program that includes, at a minimum, internal policies, procedures, and controls; a designated compliance officer; an ongoing employee training program; and an independent audit function. BRB's program deficiencies, as identified in the Consent Order, implicate this provision.

C. Key Risk Factors — SAR Filing Deficiencies

The SAR filing deficiencies identified in the Consent Order present the core basis for potential FinCEN enforcement. We assess the following factors as material to FinCEN's enforcement calculus:

Alert Backlog. As of September 2024 — the conclusion of the OCC examination period — BRB maintained a backlog of approximately 2,400 unreviewed suspicious activity alerts. Each unreviewed alert represents a potential missed SAR filing, and the volume of the backlog suggests systemic deficiencies in the Bank's case management and investigation processes rather than isolated failures.

Filing Timeliness. BRB's average SAR filing time of 78 days from initial alert detection significantly exceeds the 30-day regulatory expectation for timely filing (or 60 days where no suspect is identified). An average of 78 days indicates that a substantial proportion of filings were made well beyond even the extended 60-day window, and some filings may have been made months after initial detection. FinCEN has consistently emphasized the importance of timely SAR filing as critical to the utility of SARs to law enforcement, and has brought enforcement actions specifically targeting filing delays.

SAR Volume Trends. BRB filed 3,847 SARs in calendar year 2024, compared with 2,914 SARs in calendar year 2023 — a year-over-year increase of 32%. While increased filing could reflect improved detection, the magnitude of the increase may also signal prior under-reporting in calendar year 2023 and earlier periods. FinCEN may view this trend as evidence that the Bank's prior monitoring and filing practices failed to identify and report suspicious activity at an appropriate rate.

BaaS Concentration. Of the 3,847 SARs filed in calendar year 2024, 2,108 (54.8%) were related to BaaS channel activity. This concentration of suspicious activity in fintech channels — which account for a significant but not majority share of the Bank's overall transaction volume — suggests that the BaaS business model generates disproportionate BSA/AML risk. FinCEN has publicly highlighted the BSA/AML risks associated with bank-fintech partnerships, and the concentration of SAR filings in BRB's BaaS channels is likely to heighten FinCEN's interest.

SAR Conversion Rate. BRB's transaction monitoring system generated 41,500 alerts in calendar year 2024, of which 3,847 resulted in SAR filings — a conversion rate of only 9.3%. This low conversion rate could be interpreted in two ways: (i) BRB's monitoring system is over-alerting, generating a high volume of false positives that diverts investigator resources and contributes to the alert backlog; or (ii) BRB's investigative processes are insufficient to adequately review and file on alerts that warrant SAR reporting. Either interpretation presents compliance program deficiencies of concern to FinCEN.

Enforcement Precedent. FinCEN has historically brought separate enforcement actions against financial institutions for SAR filing deficiencies even where the OCC or another primary regulator has already taken enforcement action. Notable precedents include FinCEN's separate CMP assessments against institutions where FinCEN viewed the primary regulator's penalty as insufficient to address the scope of BSA violations, or where FinCEN determined that the systemic nature of SAR filing failures warranted independent enforcement attention. The pattern of deficiencies at BRB — extended duration, high volume, and systemic root causes — is consistent with the types of cases FinCEN has historically pursued as independent actions.

D. Risk of FinCEN Civil Money Penalty

Likelihood Assessment: Moderate (40–55%). We assess the probability of a separate FinCEN civil money penalty action at between 40% and 55%. This assessment reflects the severity and duration of BRB's SAR filing deficiencies, the prior supervisory escalation history (MRA in June 2022, MRIA in November 2023) without adequate remediation, and FinCEN's reservation of enforcement rights. The assessment also accounts for the established practice of FinCEN deferring to the primary regulator where the primary regulator's action adequately addresses the BSA violations — creating meaningful probability that FinCEN may ultimately decline to bring a separate action if BRB's remediation is sufficiently robust and timely.

Severity Assessment. If FinCEN pursues a separate CMP, the penalty amount could range from several million dollars to tens of millions of dollars, depending on FinCEN's evaluation of the duration, scope, and systemic nature of the SAR filing failures. Given that the OCC assessed a CMP of $14.5 million, a FinCEN penalty of comparable or lesser magnitude — likely in the range of $5 million to $20 million — would be consistent with recent enforcement patterns. However, FinCEN's penalty calculation could be higher if FinCEN concludes that the SAR filing deficiencies resulted in the non-reporting of transactions later determined to involve criminal activity, terrorism financing, or sanctions evasion.

Aggravating Factors. Key factors that would weigh toward a more severe FinCEN disposition include:

• The prior MRA (June 2022) and MRIA (November 2023) without adequate remediation — demonstrating that BRB received notice of deficiencies and failed to correct them in a timely manner;

• The high BaaS transaction volume ($74.3 billion in calendar year 2024), which amplifies the transaction-level risk associated with monitoring deficiencies;

• The concentration of SAR filings in BaaS channels (54.8% of total), suggesting structural program weaknesses in the Bank's highest-risk business line; and

• The extended average filing time of 78 days, which significantly diminishes the law enforcement utility of the SARs ultimately filed.

Mitigating Factors. Key factors that would weigh toward a less severe FinCEN disposition or a decision not to bring a separate action include:

• The OCC has already assessed a $14.5 million CMP, and interagency coordination protocols generally favor avoiding duplicative penalties for the same underlying conduct;

• BRB's prompt engagement of an OCC-approved independent consultant (Thornfield) and new outside counsel (Calderwood & Harkness), both within weeks of the Consent Order;

• BRB's proactive and well-funded remediation program ($42.5 million remediation budget), demonstrating institutional commitment to compliance-program improvement;

• BRB's cooperation posture with the OCC and its expressed willingness to cooperate with FinCEN; and

• BRB's engagement of Pinnacle Compliance Solutions LLC to provide 30 temporary FTE analysts for SAR backlog clearance, demonstrating resource commitment to addressing the specific deficiency.

Coordination Dynamic. The coordination between FinCEN and the OCC is a significant variable in assessing FinCEN enforcement risk. FinCEN and the OCC typically coordinate enforcement actions to ensure that the aggregate regulatory response is proportionate and avoids undue duplication. However, the reservation-of-rights language in the Consent Order context creates meaningful uncertainty. FinCEN may ultimately conclude that the $14.5 million OCC CMP, combined with BRB's remediation commitments, constitutes sufficient disposition of the BSA violations. Alternatively, FinCEN may determine that the scale and duration of the SAR filing deficiencies — particularly the 78-day average filing time and the 2,400-alert backlog — warrant an independent enforcement response to reinforce the seriousness of SAR filing obligations.

E. Recommended Mitigation Strategy

We recommend the following mitigation strategy to reduce BRB's FinCEN enforcement exposure:

1. Proactive Outreach. C&H will develop and execute a proactive communication plan with FinCEN Associate Director Angela Drummond, establishing a dialogue regarding BRB's remediation progress and demonstrating the Bank's cooperative posture. The objective of this outreach is to provide FinCEN with comfort that BRB's remediation is proceeding effectively, thereby reducing the perceived need for separate FinCEN enforcement action.

2. Remediation Progress Reporting. C&H will provide FinCEN with copies of key remediation milestones, including SAR backlog clearance status reports, process improvement metrics (including filing time trends), and staffing enhancement documentation. These reports will be coordinated with, and provided in conjunction with, BRB's OCC quarterly reporting (first quarterly report due September 15, 2025).

3. SAR Backlog Clearance. BRB should target clearance of the entire 2,400-alert backlog by June 30, 2025. Achieving this milestone prior to the first OCC quarterly report due date would demonstrate tangible progress. Filing time reduction toward the 30-day benchmark should also be prioritized, with interim targets of 60 days by Q2 2025 and 30 days by Q4 2025.

4. Voluntary Briefing. C&H recommends a voluntary briefing to FinCEN — ideally in conjunction with the first OCC quarterly report submission (September 15, 2025) — presenting BRB's remediation accomplishments, remaining work, and forward-looking compliance program enhancements.

5. Pinnacle Deployment. The deployment of 30 temporary FTE analysts from Pinnacle Compliance Solutions LLC (Andrea Solis, Director of Managed Services; Statement of Work Reference No. PCS-BRB-2025-0012; contract value $3.6 million) should be accelerated to begin no later than March 15, 2025. This deployment will serve both the practical objective of accelerating backlog clearance and the strategic objective of demonstrating resource commitment to regulators.

IV. DOJ Criminal Referral Risk Assessment

A. Current Status

As of February 10, 2025, there is no indication that the OCC or FinCEN has made a criminal referral to the DOJ in connection with BRB's BSA/AML compliance deficiencies. The Consent Order does not reference any criminal referral, though it explicitly does not preclude future referral. C&H has not identified any indication of active grand jury investigation, federal subpoena activity, or other DOJ investigative steps directed at BRB, BRFG, or any BRB personnel.

We note, however, that criminal referrals are typically made confidentially, and the absence of observable DOJ activity does not conclusively establish that no referral has been made or is under consideration. Accordingly, we assess DOJ risk based on the publicly available facts, the regulatory record, and enforcement precedent.

B. Legal Framework

The legal framework for potential DOJ criminal enforcement implicates several federal statutes:

• 31 U.S.C. § 5322 (Criminal Penalties for BSA Violations). Section 5322 provides for criminal penalties of up to $250,000 per violation and/or imprisonment of up to five years for any person who "willfully" violates BSA requirements, including SAR filing requirements, anti-money laundering program requirements, and currency transaction reporting requirements. Where the violation occurs as part of a pattern of unlawful activity involving more than $100,000 in a twelve-month period, the maximum penalties are increased to $500,000 and/or ten years of imprisonment. The willfulness requirement is a critical threshold: DOJ must establish that the defendant knew of and deliberately violated a legal duty, or acted with reckless disregard of a known legal obligation.

• 18 U.S.C. § 1956 (Money Laundering). The federal money laundering statute prohibits conducting or attempting to conduct financial transactions involving the proceeds of specified unlawful activities with the intent to promote the carrying on of the underlying activity, or knowing that the transaction is designed to conceal or disguise the nature, source, location, ownership, or control of proceeds. Application of this statute to BRB would require evidence that Bank personnel knowingly facilitated money laundering through the Bank's compliance program deficiencies.

• 18 U.S.C. § 1957 (Monetary Transactions with Criminally Derived Property). This companion statute prohibits engaging in monetary transactions in excess of $10,000 in criminally derived property. Like Section 1956, application to BRB would require evidence of knowledge that transactions involved criminal proceeds.

• DOJ Corporate Enforcement Policy. DOJ's corporate enforcement policy, as articulated in the Deputy Attorney General's memoranda and the U.S. Attorneys' Manual, provides incentives for corporations to voluntarily self-disclose misconduct, cooperate with investigations, and remediate compliance deficiencies. The policy contemplates that corporations demonstrating these behaviors may be eligible for more favorable resolutions, including declination of prosecution, non-prosecution agreements ("NPAs"), or deferred prosecution agreements ("DPAs") in lieu of indictment.

The DOJ's Money Laundering and Asset Recovery Section ("MLARS") and the United States Attorney's Office for the Southern District of New York ("SDNY") — the district encompassing BRB's headquarters — would have primary jurisdiction over any criminal prosecution arising from BRB's conduct.

C. Key Risk Factors Assessed

We have assessed the following risk factors in evaluating the probability and severity of a DOJ criminal referral:

OFAC Screening Gap. The most significant exposure for potential criminal referral is the OFAC screening gap in the NovaPay channel — approximately 3,800,000 transactions unscreened in calendar year 2023. If the ongoing lookback reveals that any of these unscreened transactions involved parties on the SDN List, blocked entities, or otherwise prohibited transactions under U.S. sanctions programs, the DOJ could view the screening failure as facilitating sanctions violations. However, for criminal liability under 50 U.S.C. § 1705 (the criminal enforcement provision of the International Emergency Economic Powers Act), DOJ would need to establish that BRB personnel acted "willfully" — that is, with knowledge of the sanctions obligations and a deliberate decision to circumvent or disregard them. The available evidence suggests that the screening gap resulted from a systems integration failure between the NovaPay API and the Veridian Analytics platform, rather than a deliberate decision to forgo screening. This technical-failure characterization, if supported by the evidence, would significantly reduce criminal referral risk.

SAR Filing Backlog. The 2,400-alert backlog and the 78-day average filing time reflect significant failures in BRB's SAR filing program. For criminal liability, however, DOJ would need to establish that the filing failures were "willful" — that BRB personnel knowingly chose not to review alerts or file SARs, or deliberately delayed filings to conceal suspicious activity. The more likely characterization is that the backlog resulted from chronic understaffing and inadequate technology, which constitutes negligence and regulatory non-compliance but falls short of the willfulness threshold for criminal prosecution.

No Evidence of Personnel Misconduct. Our review to date has not identified evidence that any BRB employee, officer, or director knowingly assisted in money laundering, sanctions evasion, or other criminal activity. There is no evidence of personal enrichment, corrupt intent, or deliberate concealment of compliance failures from regulators. The absence of such evidence is a significant mitigating factor.

No Identified Actual Criminal Activity. The SAR lookback project and the NovaPay transaction lookback are ongoing, and their results are not yet available. As of the date of this memorandum, there are no identified instances of actual money laundering, terrorist financing, or sanctions violations having been facilitated through the unscreened transactions or the delayed SAR filings. This finding is preliminary, however, and is subject to change as the lookback projects proceed.

Model Validation Gap. The failure to independently validate the Veridian TMS v.8.3 since March 2021, and the failure to update tuning parameters since October 2022, reflects systemic underinvestment in compliance infrastructure. While this underinvestment is serious from a regulatory perspective, it is characteristic of resource allocation failures rather than intentional evasion of regulatory requirements. DOJ has historically not pursued criminal charges for model validation failures standing alone.

D. Likelihood and Severity Assessment

Likelihood Assessment: Low (10–20%). We assess the probability of a DOJ criminal referral at between 10% and 20%. This assessment reflects the absence, based on currently available information, of evidence suggesting willful misconduct, intentional concealment, or deliberate facilitation of criminal activity. The BSA/AML deficiencies, while serious and warranting regulatory enforcement, appear to result from systemic underinvestment, inadequate staffing, and technology failures rather than from willful or corrupt behavior by Bank personnel.

Severity Assessment: Extreme. If a criminal referral were to materialize and result in prosecution, the consequences for BRB and BRFG would be severe in the extreme. Potential outcomes include:

• Criminal penalties under 31 U.S.C. § 5322, potentially reaching hundreds of millions of dollars depending on the number and scope of violations charged;

• A deferred prosecution agreement or non-prosecution agreement, either of which would likely impose an independent corporate compliance monitor, enhanced reporting obligations, and additional monetary penalties;

• Individual criminal liability for officers and employees, potentially including Patricia Langston (CCO), Thomas Ikeda (BSA Officer), and/or prior compliance leadership;

• Reputational devastation that could result in loss of BaaS partner relationships, deposit outflows, and counterparty concerns;

• Significant further decline in BRFG stock price; and

• Potential restrictions on BRB's business activities, including possible limitations on BaaS operations.

Key Trigger to Monitor. The single most important variable for DOJ referral risk is the outcome of the SAR lookback project (budgeted at $5.5 million). If the lookback reveals unreported transactions tied to known criminal actors, designated terrorist organizations, or sanctioned parties, the DOJ referral risk escalates materially. Specifically, if lookback results reveal that BRB's monitoring and filing failures enabled the movement of funds associated with criminal enterprises or terrorism financing — and that BRB received indicators of such activity but failed to investigate or report — DOJ could characterize the Bank's conduct as willful blindness, potentially satisfying the willfulness requirement for criminal prosecution.

E. Mitigating Factors

The following factors weigh against a DOJ criminal referral and support a more favorable enforcement disposition:

• BRB's prompt acceptance of the Consent Order and its retention of new outside counsel and an independent consultant — actions taken within weeks of the enforcement action;

• Neither BRB nor BRFG has any prior criminal history, prior DPA, or prior NPA;

• The appointment of new compliance leadership — Patricia Langston as CCO (January 2024) and Thomas Ikeda as BSA Officer (March 2023) — reflects institutional change that preceded the Consent Order and demonstrates proactive steps following the departure of prior compliance leadership;

• The comprehensive remediation program under way, supported by a Board-approved budget of $42.5 million and direct Board oversight through the newly established Compliance Committee;

• BRB's cooperation with the OCC throughout the examination process and its expressed willingness to cooperate with all regulatory agencies; and

• The technical-failure characterization of the OFAC screening gap, which is more consistent with negligent systems management than with willful disregard of sanctions screening obligations.

F. Recommended Mitigation Strategy

We recommend the following strategy to minimize DOJ criminal referral risk:

1. Documentation of Remediation. BRB should maintain scrupulous documentation of all remediation efforts, compliance program improvements, and cooperation with regulators. This documentation serves the dual purpose of demonstrating good faith to regulators and providing a contemporaneous record that could be critical in any future DOJ inquiry.

2. SAR Lookback Oversight. C&H should closely monitor the SAR lookback project for any transactions or patterns suggesting criminal activity. Thomas Ikeda (BSA Officer) should be instructed to establish an immediate escalation protocol requiring any lookback finding suggesting possible criminal involvement — including transactions involving known criminal actors, terrorist financing, or sanctioned parties — to be escalated to C&H within 24 hours of identification. Any such activity must be immediately referred for SAR filing and subject to C&H legal analysis regarding disclosure and cooperation obligations.

3. DOJ Outreach Timing. We do not recommend proactive outreach to DOJ at this time. In the absence of evidence of criminal activity, premature outreach to DOJ could draw unwanted investigative attention to BRB. We will reassess this recommendation if the lookback reveals specific concerning activity. If the lookback does identify activity warranting DOJ disclosure, C&H will evaluate the appropriateness and timing of a voluntary self-disclosure to DOJ under the Corporate Enforcement Policy, which provides meaningful credit for timely self-disclosure.

4. Document Preservation. BRB should ensure that comprehensive litigation holds are in place across all Bank systems, BaaS partner data repositories, email archives, and third-party vendor systems (including Veridian Analytics) to preserve all potentially relevant documents and communications. The litigation hold should cover the period from January 1, 2021 through the present and should encompass all documents relating to BSA/AML compliance, OFAC screening, SAR filing, transaction monitoring, BaaS partner oversight, and communications with regulators.

5. Enforcement Monitoring. C&H will monitor DOJ enforcement priorities, MLARS public statements, and SDNY press releases for signals regarding BSA enforcement trends and priorities. Any indication that DOJ is prioritizing BSA/AML enforcement against banks with BaaS programs or OFAC screening deficiencies would require reassessment of the risk profile.

V. OFAC Enforcement Risk Assessment

A. Nature of the Exposure

The OFAC screening gap in BRB's NovaPay BaaS channel represents the single most significant secondary enforcement risk identified in this assessment. The core finding in the Consent Order — that BRB's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels — carries potentially severe implications under OFAC's strict-liability enforcement regime.

The screening gap is specifically attributed to BRB's NovaPay Technologies Inc. ("NovaPay") BaaS channel. NovaPay (Ethan Garrison, CEO; 450 Mission Street, Suite 1200, San Francisco, CA 94105) is BRB's largest BaaS partner by transaction volume, representing approximately 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion in calendar year 2024). The NovaPay BaaS program supports approximately 2.1 million end-user accounts and facilitates consumer payments and peer-to-peer ("P2P") transfers — transaction types that are inherently higher risk for sanctions evasion given the speed, volume, and sometimes limited counterparty information associated with P2P payment flows.

In calendar year 2023, BRB processed approximately 31,700,000 transactions through the NovaPay channel. Approximately 12% of these transactions — approximately 3,800,000 — were not screened against applicable OFAC sanctions lists, including the SDN List, the Sectoral Sanctions Identifications ("SSI") List, and other consolidated sanctions lists. The screening failure was attributed to a systems integration deficiency between NovaPay's API and BRB's Veridian Analytics OFAC screening module.

For context, BRB's OFAC screening system generated 14,320 screening hits in calendar year 2024 (for screened transactions), of which 12 were determined to be true matches requiring blocking or rejection. The false-positive rate was approximately 99.9% ((14,320 − 12) ÷ 14,320). While the high false-positive rate is itself a compliance concern requiring calibration, the 12 true matches across screened transactions provide a rough indicator of the potential hit rate. Extrapolating this ratio to the 3,800,000 unscreened transactions suggests that a small number of those transactions may have involved sanctioned parties — though any such extrapolation is highly speculative and should not substitute for a rigorous lookback analysis.

The critical open question for OFAC enforcement risk is whether any of the 3,800,000 unscreened transactions involved transactions with parties on the SDN List, blocked persons, or otherwise prohibited parties under applicable OFAC sanctions programs. This question can only be resolved through a comprehensive lookback analysis, which is currently underway as part of the broader remediation effort.

B. OFAC Regulatory and Enforcement Framework

OFAC's enforcement authority derives principally from the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1701 et seq., and the various Executive Orders issued thereunder that establish sanctions programs targeting specific countries, regimes, and individuals. OFAC implements and enforces U.S. economic sanctions through regulations codified at 31 C.F.R. Chapter V. The enforcement framework relevant to BRB's exposure includes:

Strict Liability Regime. OFAC's enforcement of economic sanctions operates under a strict liability standard. Unlike BSA violations, which require willfulness for criminal prosecution, civil OFAC violations do not require that the violator had knowledge of the prohibited nature of the transaction. A financial institution that processes a transaction involving a blocked person or entity has committed a violation regardless of whether it knew or should have known that the counterparty was sanctioned. This strict liability framework dramatically increases the severity of BRB's OFAC exposure, because the Bank cannot defend against civil enforcement on the ground that the screening gap was inadvertent or the result of a systems failure.

Economic Sanctions Enforcement Guidelines. OFAC's enforcement framework, set forth at 31 C.F.R. Part 501, Appendix A, establishes a graduated penalty structure and identifies factors that OFAC considers in determining whether to impose penalties and in calculating penalty amounts. The guidelines provide for the following range of enforcement responses: (i) no action; (ii) a cautionary letter; (iii) a finding of violation without monetary penalty; (iv) a civil monetary penalty; and (v) referral for criminal prosecution (typically to DOJ). The guidelines identify a series of aggravating and mitigating factors, including the nature of the transaction, the existence of a compliance program, the willfulness of the conduct, whether the institution voluntarily self-disclosed the violation, cooperation with OFAC's investigation, and the institution's sanctions compliance history.

Per-Violation Penalty Exposure. Under IEEPA, as adjusted for inflation, OFAC may impose civil penalties potentially exceeding $300,000 per violation, or an amount equal to twice the value of the underlying transaction, whichever is greater. The theoretical maximum penalty exposure — calculated by multiplying the per-violation maximum by the number of potential violations — is astronomical. If even 1% of the 3,800,000 unscreened transactions (38,000 transactions) involved sanctioned parties, and each transaction constituted a separate violation, the aggregate theoretical penalty exposure would be measured in billions of dollars. We emphasize, however, that OFAC exercises substantial discretion in penalty calculations and typically imposes penalties far below the theoretical maximum, particularly where the institution cooperates and self-discloses.

C. OFAC Voluntary Self-Disclosure Analysis

OFAC's enforcement guidelines provide significant mitigation credit for voluntary self-disclosure of apparent violations. Where an institution identifies and self-discloses apparent violations before OFAC has initiated its own investigation, OFAC's guidelines indicate that the base penalty amount may be reduced by up to 50%, and in many cases, self-disclosed violations are resolved with a finding of violation or cautionary letter rather than a civil monetary penalty.

The VSD analysis for BRB presents a threshold question: BRB does not yet know whether any of the 3,800,000 unscreened transactions constituted actual sanctions violations — that is, transactions involving blocked persons, SDN-listed entities, or other prohibited parties. Without evidence of actual violations, there is no "apparent violation" to self-disclose. Filing a VSD prematurely — before the lookback has identified specific transactions involving sanctioned parties — could be counterproductive, as it would invite OFAC scrutiny without the benefit of complete information and could complicate the Bank's position if the lookback ultimately reveals no actual violations.

C&H is preparing a separate, dedicated memorandum analyzing BRB's OFAC enforcement risk and VSD strategy in detail. That memorandum will address the timing, content, and procedural considerations for a potential VSD filing.

Preliminary Recommendation. We recommend that BRB complete the initial NovaPay transaction lookback before making a VSD determination. The lookback — which will involve screening the 3,800,000 unscreened transactions against current SDN, SSI, and consolidated sanctions lists — should be conducted as part of Thornfield Consulting's on-site assessment and in coordination with the broader SAR lookback project. Thornfield's preliminary gap assessment is due April 15, 2025, and may provide initial data regarding the scope of potential sanctions exposure. The SAR lookback project is expected to produce relevant findings by Q2 2025.

If the lookback reveals any apparent violations — that is, transactions involving sanctioned parties — BRB should file a VSD promptly. The timing is critical: the mitigation credit for voluntary self-disclosure diminishes or disappears if OFAC initiates its own investigation or receives information about the violations from another source (such as the publicly available Consent Order) before the institution self-discloses. Given the public nature of the Consent Order and OFAC's ability to review OCC enforcement actions, the window for BRB to gain maximum VSD credit may be limited.

D. Likelihood and Severity Assessment

Likelihood of OFAC Inquiry or Enforcement: Moderate-to-High (50–65%). We assess the probability that OFAC will open an inquiry or bring an enforcement action at between 50% and 65%. This assessment reflects:

• The scale of the screening gap (3,800,000 unscreened transactions), which is large by any measure and likely to attract OFAC attention;

• The public nature of the Consent Order, which OFAC staff routinely review as part of their monitoring of financial institution compliance;

• The strict liability nature of OFAC enforcement, which removes the willfulness defense available in other enforcement contexts;

• The heightened regulatory focus on sanctions compliance in the current geopolitical environment, including enforcement actions related to Russia/Ukraine sanctions, Iran sanctions, and other active programs; and

• The BaaS context, in which the speed and volume of transactions, combined with the involvement of non-bank fintech intermediaries, create inherent sanctions compliance challenges that OFAC has flagged as a priority concern.

Severity Assessment: Low to Catastrophic (depending on lookback results). The severity of potential OFAC enforcement varies dramatically depending on the outcome of the NovaPay transaction lookback:

• Best Case Scenario. The lookback reveals no transactions with sanctioned parties among the 3,800,000 unscreened transactions. In this scenario, OFAC may take no action at all, or may issue a cautionary letter noting the screening gap and encouraging enhanced compliance measures. The financial impact would be minimal.

• Middle Case Scenario. The lookback reveals a small number of de minimis transactions with sanctioned parties — for example, low-value P2P transfers involving individuals whose names match SDN entries. OFAC issues a finding of violation or imposes a moderate civil monetary penalty, with mitigation credit for VSD (if timely filed), cooperation, and remediation. The financial impact would likely be in the range of $5 million to $25 million.

• Worst Case Scenario. The lookback reveals multiple high-value transactions with SDN-listed entities or specially designated nationals, including transactions involving countries or programs that are current OFAC enforcement priorities (e.g., Russia, Iran, North Korea). OFAC imposes a substantial civil monetary penalty — potentially in the range of $50 million to $100 million or more — and refers the matter to DOJ for potential criminal investigation if evidence suggests that the screening failure was willful or that Bank personnel had knowledge of the sanctioned-party transactions. The reputational, financial, and operational consequences would be severe.

The wide range of potential outcomes underscores the critical importance of the NovaPay transaction lookback. Until that lookback is complete, BRB's OFAC risk cannot be assessed with greater precision.

E. BaaS Partner-Specific OFAC Risk

BRB's OFAC exposure is concentrated in, but not limited to, the NovaPay channel. Each of BRB's major BaaS partners presents a distinct risk profile:

NovaPay Technologies Inc. (Ethan Garrison, CEO). Highest risk. NovaPay supports approximately 2.1 million end-user accounts and facilitates consumer payments and P2P transfers. The 12% screening gap is directly attributed to NovaPay transaction flows. The consumer P2P payment model is inherently higher risk for sanctions evasion because of the volume of small-value transactions, the limited counterparty information sometimes available for P2P transfers, and the speed of transaction processing. NovaPay accounts for 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion).

FairLend Digital LLC (Aisha Okonkwo, CEO). Moderate risk. FairLend operates an online small-business lending platform and accounts for approximately 28% of BaaS transaction volume. FairLend originated $1.4 billion in loans in fiscal year 2024. While the consumer P2P risks applicable to NovaPay are less pronounced for a commercial lending platform, FairLend's commercial counterparty exposure — including small businesses that may serve as fronts for sanctioned parties or their agents — presents a non-trivial OFAC compliance risk. The screening gap identified in the Consent Order is specific to the NovaPay channel, but the adequacy of OFAC screening across all BaaS channels, including FairLend, should be verified.

VaultEdge Inc. (Marcus Tan, CEO). Moderate risk. VaultEdge is a digital savings and neobanking platform with approximately 870,000 deposit accounts, representing approximately 18% of BaaS transaction volume. The deposit-account model presents moderate sanctions risk, particularly if VaultEdge accounts are used for value transfer or if accountholders' identities are not adequately verified against sanctions lists at onboarding and on an ongoing basis.

Remaining 11 BaaS Partners. Collectively accounting for approximately 13% of BaaS transaction volume. Individual risk profiles vary, but aggregate exposure requires assessment. No specific OFAC screening deficiencies have been identified for these partners, though the systemic nature of the screening gap identified in the NovaPay channel raises questions about the adequacy of screening infrastructure across all BaaS channels.

F. Recommended Mitigation Strategy

We recommend the following strategy to address BRB's OFAC enforcement exposure:

1. Veridian OFAC Module Enhancement. BRB should prioritize completion of the Veridian OFAC screening module enhancement under the Statement of Work being developed as an amendment to the Veridian Master Services Agreement (Contract No. VA-BRB-2023-0044). The target completion date is November 1, 2025, at which time BRB should achieve full, validated OFAC screening operationalization across all BaaS channels — including NovaPay, FairLend, VaultEdge, and all other active partners.

2. NovaPay Transaction Lookback. BRB should conduct a targeted lookback of the 3,800,000 unscreened NovaPay transactions from calendar year 2023, screening each transaction against current SDN, SSI, and consolidated sanctions lists. This lookback should be conducted with appropriate methodological rigor to ensure defensibility, with clear documentation of methodology, results, and any apparent violations identified. The lookback should be coordinated with Thornfield's on-site assessment and the broader SAR lookback project.

3. Independent Sanctions Assessment. Jennifer Hwang, Director of Sanctions & OFAC Compliance at Thornfield Consulting Group, should be engaged to provide an independent assessment of BRB's sanctions compliance program, including screening coverage, screening technology, list management, case management for screening hits, and compliance governance. This assessment should cover all BaaS channels, not only NovaPay.

4. VSD Preparation. C&H will begin preparing a draft OFAC voluntary self-disclosure filing framework, including draft narrative, transaction tables, and supporting documentation. This preparation will proceed in parallel with the lookback, with the understanding that the VSD will be finalized and filed only if the lookback reveals apparent violations. The C&H VSD analysis memorandum currently under development will provide detailed guidance on timing and content.

5. NovaPay Compliance Remediation Letter. C&H has drafted a compliance remediation letter to NovaPay requiring enhanced cooperation and data sharing to support the lookback. This letter should be reviewed by BRB management and executed promptly to ensure that BRB has full access to the transaction data, account information, and counterparty details needed for a thorough lookback.

6. Enforcement Monitoring. C&H will monitor OFAC enforcement actions and guidance for analogous fintech/BaaS cases, new FAQ postings, and OFAC Advisory publications that may signal enforcement priorities or provide interpretive guidance relevant to BRB's exposure.

VI. State-Level Regulatory Exposure

A. Preemption Analysis — National Bank Charter

BRB holds a national charter under 12 U.S.C. § 21 et seq., with the OCC serving as its primary federal banking regulator. Under the National Bank Act and the OCC's preemption regulations at 12 C.F.R. Part 7, national banks are generally subject to federal preemption from state laws that "prevent or significantly interfere" with the exercise of national bank powers, as articulated by the Supreme Court in Barnett Bank of Marion County, N.A. v. Nelson, 517 U.S. 25 (1996), and codified in the Dodd-Frank Act's preemption provisions at 12 U.S.C. § 25b.

This preemption framework provides BRB with substantial protection from direct state enforcement of BSA/AML requirements. State bank supervisors do not have primary supervisory authority over national banks, and state BSA/AML requirements that conflict with or duplicate federal requirements are generally preempted. However, preemption is not absolute, and several categories of state-level exposure merit analysis.

B. State Money Transmitter Licensing Risk

BRB's BaaS partners — particularly NovaPay, which facilitates consumer P2P payments — may be subject to state money transmitter licensing requirements in the states where they operate. While BRB itself, as a national bank, is exempt from state money transmitter licensing requirements, its BaaS partners are not necessarily so exempt unless they qualify for a bank-agent exemption under applicable state law. The bank-agent exemption varies significantly from state to state, and its applicability depends on the specific structure of the BaaS arrangement, including whether the fintech partner is acting as an agent of the bank or as an independent money transmitter.

If BRB's BaaS partner activities are characterized by state regulators as unlicensed money transmission, state regulators could bring enforcement actions against the partners themselves. Such actions would not directly target BRB but could have significant reputational and operational consequences for the Bank, including:

• Disruption of BaaS partner operations, potentially requiring cessation of activity in affected states;

• Reputational harm to BRB as the sponsor bank for unlicensed money transmission;

• Regulatory scrutiny of BRB's third-party risk management and BaaS oversight practices by the OCC; and

• Potential for state regulators to assert that BRB aided and abetted unlicensed money transmission by providing the banking infrastructure.

NovaPay Technologies Inc. is a Delaware corporation operating nationally as a consumer payments and P2P transfer platform. NovaPay's licensing status across all 50 states and U.S. territories requires verification. NovaPay's reliance on BRB's national bank charter for the bank-agent exemption from state money transmitter licensing must be evaluated on a state-by-state basis to

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF CALDERWOOD & HARKNESS LLP
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
February 28, 2025
MEMORANDUM
FROM: Philip Hartmann, Partner, Banking & Finance Practice Group, Calderwood & Harkness LLP Yuki Nakamura, Associate, Litigation (General) Practice Group, Calderwood & Harkness LLP
TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc.
CC: Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association Melissa Chu, Chief Risk Officer, Belmont Ridge Bank National Association
RE: Regulatory Risk Assessment — Exposure to Additional Enforcement Actions Beyond OCC Consent Order No. OCC-2025-003
C&H Matter No.: 1045-00002
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP ("C&H") has been engaged to assess Belmont Ridge Bank National Association's ("BRB" or the "Bank") exposure to additional regulatory and enforcement actions arising from or related to the compliance deficiencies that formed the basis of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025 (the "Consent Order"). This memorandum provides a comprehensive analysis of BRB's secondary enforcement risk across four principal vectors: (1) enforcement by the Financial Crimes Enforcement Network ("FinCEN"); (2) criminal referral to the United States Department of Justice ("DOJ"); (3) enforcement by the Office of Foreign Assets Control ("OFAC"); and (4) state-level regulatory exposure.
Overall Risk Posture. Based on our review of the Consent Order, underlying examination workpapers, BRB's internal compliance documentation, and relevant enforcement precedent, we conclude that BRB faces material secondary enforcement exposure, particularly from OFAC and FinCEN. The OFAC risk is driven principally by the scale of the sanctions screening gap in BRB's NovaPay Technologies Inc. ("NovaPay") Banking-as-a-Service ("BaaS") channel, where approximately 3,800,000 transactions in calendar year 2023 were not screened against applicable sanctions lists. The FinCEN risk is principally attributable to the scope and duration of the Bank's Suspicious Activity Report ("SAR") filing deficiencies, including a backlog of approximately 2,400 unreviewed alerts and an average filing time of 78 days — more than double the regulatory expectation. DOJ criminal referral risk is assessed as lower but non-negligible, with severity that would be extreme if materialized. State-level risks are limited given BRB's national charter but are present for certain BaaS partner activities that may be subject to state money transmitter and lending license requirements.
Key Recommendations. We recommend that BRB pursue proactive mitigation strategies for each risk vector, including: (i) proactive outreach to FinCEN to establish a cooperative dialogue regarding remediation progress; (ii) accelerated completion of the OFAC lookback for unscreened NovaPay transactions, with preparation for a potential voluntary self-disclosure ("VSD") filing if apparent sanctions violations are identified; (iii) rigorous monitoring of the SAR lookback project for indicators that could elevate DOJ criminal referral risk; and (iv) a comprehensive state licensing audit of all 14 active BaaS partners.
Institutional Context. BRB is a $38.7 billion national banking association (OCC Charter No. 48271; FDIC Certificate No. 31845) headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, with approximately 5,800 employees. The Bank is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. ("BRFG"), a publicly traded Delaware corporation listed on the New York Stock Exchange under the ticker symbol "BRFG." BRB's core business lines include retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service partnerships, with 14 active fintech sponsor relationships. The BaaS division generated $127.4 million in revenue in calendar year 2024 on transaction volume of $74.3 billion, making it a strategically significant — and now a regulatory focal point — component of BRB's business.
The balance of this memorandum sets forth the factual background, legal analysis, risk assessment, and recommended mitigation strategies for each enforcement vector in detail.
II. Background and Context
A. Summary of OCC Consent Order No. OCC-2025-003
On January 15, 2025, the OCC Northeastern District Office (340 Madison Avenue, New York, NY 10017) issued Consent Order No. OCC-2025-003 against BRB. The Consent Order was the culmination of a targeted Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") examination conducted from March 2024 through September 2024 under the supervision of Jonathan Frey, National Bank Examiner and Examiner-in-Charge. The Consent Order assessed a civil money penalty ("CMP") of $14,500,000, payable within 60 days of the effective date (i.e., by March 16, 2025).
The Consent Order identifies five core categories of deficiency in BRB's BSA/AML compliance program:
1. OFAC Sanctions Screening Failures. BRB's OFAC screening system failed to screen approximately 12% of wire and Automated Clearing House ("ACH") transactions processed through the NovaPay BaaS channel. This failure resulted in approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023 not being screened against the Specially Designated Nationals and blocked Persons List ("SDN List") or other applicable OFAC sanctions lists. The screening gap was attributed to a systems integration failure between NovaPay's Application Programming Interface ("API") and BRB's Veridian Analytics transaction monitoring system.
2. SAR Filing Deficiencies. BRB maintained a backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024. The Bank's average SAR filing time was 78 days from initial alert detection — significantly exceeding the regulatory expectation that SARs be filed within 30 days of detection, as articulated in FinCEN guidance and OCC examination procedures. The deficiencies reflected both inadequate staffing levels in the Bank's Financial intelligence Unit and deficient case management processes.
3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. Approximately 47,000 high-risk customer accounts, primarily those onboarded through fintech BaaS channels, lacked adequate documentation to satisfy CDD and EDD requirements under 31 C.F.R. § 1020.210 and the OCC's implementing supervisory guidance. These accounts were identified as lacking verified beneficial ownership information, adequate source-of-funds documentation, or risk-appropriate periodic review.
4. Model Validation Deficiencies. BRB's primary transaction monitoring system, Veridian TMS v.8.3 (provided by Veridian Analytics, Inc., under Master Services Agreement Contract No. VA-BRB-2023-0044), was last independently validated in March 2021 — approximately four years prior to the Consent Order. Tuning parameters were last updated in October 2022. The OCC determined that BRB failed to comply with its own model risk management policy, which required annual independent validation, and with the guidance set forth in OCC Bulletin 2011-12, "Supervisory Guidance on Model Risk Management."
5. Board Oversight Deficiencies. BRB's Board of Directors did not maintain a dedicated Compliance Committee, and the quarterly BSA/AML reporting provided to the Board lacked key performance metrics, including SAR filing timelines, alert backlog volumes, OFAC screening coverage rates, and CDD remediation progress. The OCC determined that the Board failed to provide the degree of oversight required by 12 C.F.R. § 21.21 and applicable supervisory guidance.
The Consent Order requires BRB to develop and submit a Comprehensive Remediation Action Plan within 120 days of the effective date (i.e., by May 15, 2025), to engage an OCC-approved independent consultant to conduct a gap assessment and monitor remediation, and to provide quarterly progress reports to the OCC beginning on September 15, 2025.
B. Supervisory Escalation History
The Consent Order did not arise in a supervisory vacuum. The record reflects a progressive escalation of supervisory concerns over a period of more than two years prior to the issuance of the Consent Order:
• June 2022: Matter Requiring Attention ("MRA"). The OCC issued an MRA identifying deficiencies in BRB's BSA/AML transaction monitoring system, including concerns about alert volumes, case management timelines, and the adequacy of model governance. The MRA did not specifically address OFAC screening or BaaS-related risks but noted the need for enhanced monitoring capacity as BaaS operations scaled.
• November 2023: Matter Requiring Immediate Attention ("MRIA"). The OCC escalated its supervisory action to an MRIA — a significantly more serious designation indicating that identified deficiencies posed a threat to the safety and soundness of the institution or constituted potential violations of law. The MRIA specifically identified OFAC screening gaps in BaaS channels and the growing SAR filing backlog as requiring immediate corrective action.
• January 2025: Consent Order. The Consent Order explicitly cites BRB's failure to adequately remediate the deficiencies identified in the prior MRA and MRIA as an aggravating factor supporting the enforcement action and the assessed CMP.
This escalation history is significant for purposes of our secondary enforcement risk assessment because it demonstrates a documented pattern of inadequate remediation following supervisory warnings — a factor that FinCEN, OFAC, and DOJ each consider aggravating in their respective enforcement frameworks.
BRB's prior outside counsel, Drayton Mercer LLP, represented the Bank throughout the examination cycle from 2019 through 2024. Helen Frazier, a partner in Drayton Mercer's financial institutions practice (office at 55 East 52nd Street, Suite 3100, New York, NY 10055), served as lead partner on the engagement. The Drayton Mercer engagement was terminated in January 2025 following issuance of the Consent Order, and Calderwood & Harkness was retained effective February 10, 2025 to provide comprehensive regulatory defense and compliance-program uplift services.
Additionally, BRB's most recent independent BSA/AML program test was conducted by Caldera & Pope LLP (Franklin Dorsey, CPA, engagement partner; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606) and was completed in September 2024. The Caldera & Pope report identified multiple deficiencies that were subsequently echoed in the Consent Order, including the SAR filing backlog, the model validation gap, and CDD documentation deficiencies. The Caldera & Pope report did not specifically identify the scope of the OFAC screening gap in the NovaPay channel, which was identified through the OCC's own targeted transaction testing during the examination.
C. BRB's Current Remediation Posture
Since the issuance of the Consent Order, BRB has undertaken a series of remediation actions intended to demonstrate institutional commitment to compliance-program improvement:
• Engagement of New Outside Counsel. Calderwood & Harkness LLP was engaged effective February 10, 2025 (C&H Matter No. 1045-00002) to serve as BRB's primary outside counsel for regulatory defense, enforcement response, and compliance-program uplift. The engagement encompasses representation before the OCC, FinCEN, OFAC, DOJ, and state regulators as necessary.
• Engagement of Independent Consultant. Thornfield Consulting Group LLC ("Thornfield") has been engaged as the OCC-mandated independent consultant. Dr. Vivian Castellano, Managing Director, serves as the engagement lead. The OCC granted non-objection to the Thornfield engagement on February 5, 2025, and the engagement agreement (Reference No. TCG-BRB-2025-001) was executed on February 10, 2025. Thornfield's on-site assessment is scheduled to commence on March 1, 2025, with a preliminary gap assessment report due to the OCC by April 15, 2025.
• Board Governance Enhancements. A Board Resolution acknowledging the Consent Order and establishing a dedicated Compliance Committee is due for adoption by February 28, 2025. James Rutherford, an independent director with prior experience as General Counsel of a major regional bank holding company, has been designated to serve as Chair of the newly created Compliance Committee.
• Remediation Budget. BRB's Board of Directors has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 CMP assessed in the Consent Order. The combined financial commitment — $57,000,000 — reflects the scope of the remediation undertaking and the Bank's financial capacity to address the identified deficiencies.
• Comprehensive Remediation Action Plan. The Plan is under development by C&H and Thornfield in coordination with BRB's compliance, risk, and technology teams, and is due for submission to the OCC by May 15, 2025.
D. Key Financial Context
An understanding of BRB's financial profile is relevant both to the Bank's capacity to absorb potential additional enforcement costs and to the assessment of shareholder and market risk implications:
• Total assets (as of December 31, 2024): $38.7 billion
• Total deposits (as of December 31, 2024): $29.4 billion
• Net income (fiscal year 2024): $412 million
• Tier 1 capital ratio (as of December 31, 2024): 11.2%
• BRFG shares outstanding: 179,500,000
• BRFG stock price: declined from approximately $47.82 (implied pre-disclosure level) to $41.15 on January 16, 2025, the first trading day following public disclosure of the Consent Order — a decline of approximately 13.9%, representing a loss of approximately $1.2 billion in market capitalization. The stock price partially recovered to $47.82 as of February 7, 2025.
• BRFG market capitalization (as of February 7, 2025): approximately $8.58 billion
• BaaS division revenue (calendar year 2024): $127.4 million
• BaaS division transaction volume (calendar year 2024): $74.3 billion
BRB's Tier 1 capital ratio of 11.2% is above the 8% threshold for "well-capitalized" classification under the OCC's Prompt Corrective Action framework, and the Bank's net income of $412 million provides meaningful capacity to absorb remediation costs and potential additional penalties. However, additional enforcement actions — particularly if they involve penalties in the range of tens of millions of dollars or higher — would place further pressure on earnings, capital ratios, and stock price at a time when the Bank is already absorbing a $57 million remediation and penalty outlay.
III. FinCEN Enforcement Risk Assessment
A. Current FinCEN Posture
As of the date of C&H's engagement (February 10, 2025), FinCEN has not filed a separate enforcement action against BRB. However, our inquiries and review of interagency coordination protocols indicate that FinCEN is actively monitoring BRB's SAR filing remediation efforts pursuant to its coordination with the OCC.
C&H has identified Angela Drummond, Associate Director of FinCEN's Enforcement Division, as the FinCEN liaison responsible for the BRB matter. Ms. Drummond has been involved in interagency coordination discussions with the OCC regarding the scope of BRB's SAR filing deficiencies and the adequacy of BRB's remediation response. While FinCEN has not taken independent enforcement action to date, it has expressly reserved its enforcement rights. The Consent Order itself does not foreclose, limit, or otherwise restrict FinCEN's authority to pursue its own enforcement action based on the same or related conduct. This reservation of rights is standard interagency practice but creates meaningful uncertainty regarding FinCEN's ultimate enforcement posture.
B. Statutory and Regulatory Authority
FinCEN possesses independent authority to bring enforcement actions against financial institutions for violations of the Bank Secrecy Act and its implementing regulations. The principal statutory provisions relevant to BRB's exposure are:
• 31 U.S.C. § 5321 (Civil Money Penalties). FinCEN is authorized to assess civil money penalties for violations of any provision of the BSA or its implementing regulations, including SAR filing requirements and anti-money laundering program requirements. Penalties under Section 5321 can be substantial, with maximum per-violation penalties that vary based on the nature of the violation and the violator.
• 31 U.S.C. § 5322 (Criminal Penalties). FinCEN may refer matters for criminal prosecution under Section 5322, which provides for penalties of up to $250,000 per violation and/or imprisonment of up to five years for willful violations of BSA requirements. Enhanced penalties apply where the violation occurs as part of a pattern of unlawful activity or involves more than $100,000 in a twelve-month period. Criminal prosecution is typically coordinated with the DOJ and is addressed separately in Section IV of this memorandum.
• 31 U.S.C. § 5318(g) (SAR Filing Requirements). This section establishes the requirement for financial institutions to file SARs reporting suspicious transactions to FinCEN. BRB's SAR filing obligations are further specified in 12 C.F.R. Part 21 (for OCC-regulated national banks) and FinCEN's implementing regulations at 31 C.F.R. § 1020.320, which require that SARs be filed within 30 days of the initial detection of facts that may constitute a basis for filing, or within 60 days if no suspect has been identified.
• 31 U.S.C. § 5318(h) (Anti-Money Laundering Program Requirements). Financial institutions are required to maintain an anti-money laundering program that includes, at a minimum, internal policies, procedures, and controls; a designated compliance officer; an ongoing employee training program; and an independent audit function. BRB's program deficiencies, as identified in the Consent Order, implicate this provision.
C. Key Risk Factors — SAR Filing Deficiencies
The SAR filing deficiencies identified in the Consent Order present the core basis for potential FinCEN enforcement. We assess the following factors as material to FinCEN's enforcement calculus:
Alert Backlog. As of September 2024 — the conclusion of the OCC examination period — BRB maintained a backlog of approximately 2,400 unreviewed suspicious activity alerts. Each unreviewed alert represents a potential missed SAR filing, and the volume of the backlog suggests systemic deficiencies in the Bank's case management and investigation processes rather than isolated failures.
Filing Timeliness. BRB's average SAR filing time of 78 days from initial alert detection significantly exceeds the 30-day regulatory expectation for timely filing (or 60 days where no suspect is identified). An average of 78 days indicates that a substantial proportion of filings were made well beyond even the extended 60-day window, and some filings may have been made months after initial detection. FinCEN has consistently emphasized the importance of timely SAR filing as critical to the utility of SARs to law enforcement, and has brought enforcement actions specifically targeting filing delays.
SAR Volume Trends. BRB filed 3,847 SARs in calendar year 2024, compared with 2,914 SARs in calendar year 2023 — a year-over-year increase of 32%. While increased filing could reflect improved detection, the magnitude of the increase may also signal prior under-reporting in calendar year 2023 and earlier periods. FinCEN may view this trend as evidence that the Bank's prior monitoring and filing practices failed to identify and report suspicious activity at an appropriate rate.
BaaS Concentration. Of the 3,847 SARs filed in calendar year 2024, 2,108 (54.8%) were related to BaaS channel activity. This concentration of suspicious activity in fintech channels — which account for a significant but not majority share of the Bank's overall transaction volume — suggests that the BaaS business model generates disproportionate BSA/AML risk. FinCEN has publicly highlighted the BSA/AML risks associated with bank-fintech partnerships, and the concentration of SAR filings in BRB's BaaS channels is likely to heighten FinCEN's interest.
SAR Conversion Rate. BRB's transaction monitoring system generated 41,500 alerts in calendar year 2024, of which 3,847 resulted in SAR filings — a conversion rate of only 9.3%. This low conversion rate could be interpreted in two ways: (i) BRB's monitoring system is over-alerting, generating a high volume of false positives that diverts investigator resources and contributes to the alert backlog; or (ii) BRB's investigative processes are insufficient to adequately review and file on alerts that warrant SAR reporting. Either interpretation presents compliance program deficiencies of concern to FinCEN.
Enforcement Precedent. FinCEN has historically brought separate enforcement actions against financial institutions for SAR filing deficiencies even where the OCC or another primary regulator has already taken enforcement action. Notable precedents include FinCEN's separate CMP assessments against institutions where FinCEN viewed the primary regulator's penalty as insufficient to address the scope of BSA violations, or where FinCEN determined that the systemic nature of SAR filing failures warranted independent enforcement attention. The pattern of deficiencies at BRB — extended duration, high volume, and systemic root causes — is consistent with the types of cases FinCEN has historically pursued as independent actions.
D. Risk of FinCEN Civil Money Penalty
Likelihood Assessment: Moderate (40–55%). We assess the probability of a separate FinCEN civil money penalty action at between 40% and 55%. This assessment reflects the severity and duration of BRB's SAR filing deficiencies, the prior supervisory escalation history (MRA in June 2022, MRIA in November 2023) without adequate remediation, and FinCEN's reservation of enforcement rights. The assessment also accounts for the established practice of FinCEN deferring to the primary regulator where the primary regulator's action adequately addresses the BSA violations — creating meaningful probability that FinCEN may ultimately decline to bring a separate action if BRB's remediation is sufficiently robust and timely.
Severity Assessment. If FinCEN pursues a separate CMP, the penalty amount could range from several million dollars to tens of millions of dollars, depending on FinCEN's evaluation of the duration, scope, and systemic nature of the SAR filing failures. Given that the OCC assessed a CMP of $14.5 million, a FinCEN penalty of comparable or lesser magnitude — likely in the range of $5 million to $20 million — would be consistent with recent enforcement patterns. However, FinCEN's penalty calculation could be higher if FinCEN concludes that the SAR filing deficiencies resulted in the non-reporting of transactions later determined to involve criminal activity, terrorism financing, or sanctions evasion.
Aggravating Factors. Key factors that would weigh toward a more severe FinCEN disposition include:
• The prior MRA (June 2022) and MRIA (November 2023) without adequate remediation — demonstrating that BRB received notice of deficiencies and failed to correct them in a timely manner;
• The high BaaS transaction volume ($74.3 billion in calendar year 2024), which amplifies the transaction-level risk associated with monitoring deficiencies;
• The concentration of SAR filings in BaaS channels (54.8% of total), suggesting structural program weaknesses in the Bank's highest-risk business line; and
• The extended average filing time of 78 days, which significantly diminishes the law enforcement utility of the SARs ultimately filed.
Mitigating Factors. Key factors that would weigh toward a less severe FinCEN disposition or a decision not to bring a separate action include:
• The OCC has already assessed a $14.5 million CMP, and interagency coordination protocols generally favor avoiding duplicative penalties for the same underlying conduct;
• BRB's prompt engagement of an OCC-approved independent consultant (Thornfield) and new outside counsel (Calderwood & Harkness), both within weeks of the Consent Order;
• BRB's proactive and well-funded remediation program ($42.5 million remediation budget), demonstrating institutional commitment to compliance-program improvement;
• BRB's cooperation posture with the OCC and its expressed willingness to cooperate with FinCEN; and
• BRB's engagement of Pinnacle Compliance Solutions LLC to provide 30 temporary FTE analysts for SAR backlog clearance, demonstrating resource commitment to addressing the specific deficiency.
Coordination Dynamic. The coordination between FinCEN and the OCC is a significant variable in assessing FinCEN enforcement risk. FinCEN and the OCC typically coordinate enforcement actions to ensure that the aggregate regulatory response is proportionate and avoids undue duplication. However, the reservation-of-rights language in the Consent Order context creates meaningful uncertainty. FinCEN may ultimately conclude that the $14.5 million OCC CMP, combined with BRB's remediation commitments, constitutes sufficient disposition of the BSA violations. Alternatively, FinCEN may determine that the scale and duration of the SAR filing deficiencies — particularly the 78-day average filing time and the 2,400-alert backlog — warrant an independent enforcement response to reinforce the seriousness of SAR filing obligations.
E. Recommended Mitigation Strategy
We recommend the following mitigation strategy to reduce BRB's FinCEN enforcement exposure:
1. Proactive Outreach. C&H will develop and execute a proactive communication plan with FinCEN Associate Director Angela Drummond, establishing a dialogue regarding BRB's remediation progress and demonstrating the Bank's cooperative posture. The objective of this outreach is to provide FinCEN with comfort that BRB's remediation is proceeding effectively, thereby reducing the perceived need for separate FinCEN enforcement action.
2. Remediation Progress Reporting. C&H will provide FinCEN with copies of key remediation milestones, including SAR backlog clearance status reports, process improvement metrics (including filing time trends), and staffing enhancement documentation. These reports will be coordinated with, and provided in conjunction with, BRB's OCC quarterly reporting (first quarterly report due September 15, 2025).
3. SAR Backlog Clearance. BRB should target clearance of the entire 2,400-alert backlog by June 30, 2025. Achieving this milestone prior to the first OCC quarterly report due date would demonstrate tangible progress. Filing time reduction toward the 30-day benchmark should also be prioritized, with interim targets of 60 days by Q2 2025 and 30 days by Q4 2025.
4. Voluntary Briefing. C&H recommends a voluntary briefing to FinCEN — ideally in conjunction with the first OCC quarterly report submission (September 15, 2025) — presenting BRB's remediation accomplishments, remaining work, and forward-looking compliance program enhancements.
5. Pinnacle Deployment. The deployment of 30 temporary FTE analysts from Pinnacle Compliance Solutions LLC (Andrea Solis, Director of Managed Services; Statement of Work Reference No. PCS-BRB-2025-0012; contract value $3.6 million) should be accelerated to begin no later than March 15, 2025. This deployment will serve both the practical objective of accelerating backlog clearance and the strategic objective of demonstrating resource commitment to regulators.
IV. DOJ Criminal Referral Risk Assessment
A. Current Status
As of February 10, 2025, there is no indication that the OCC or FinCEN has made a criminal referral to the DOJ in connection with BRB's BSA/AML compliance deficiencies. The Consent Order does not reference any criminal referral, though it explicitly does not preclude future referral. C&H has not identified any indication of active grand jury investigation, federal subpoena activity, or other DOJ investigative steps directed at BRB, BRFG, or any BRB personnel.
We note, however, that criminal referrals are typically made confidentially, and the absence of observable DOJ activity does not conclusively establish that no referral has been made or is under consideration. Accordingly, we assess DOJ risk based on the publicly available facts, the regulatory record, and enforcement precedent.
B. Legal Framework
The legal framework for potential DOJ criminal enforcement implicates several federal statutes:
• 31 U.S.C. § 5322 (Criminal Penalties for BSA Violations). Section 5322 provides for criminal penalties of up to $250,000 per violation and/or imprisonment of up to five years for any person who "willfully" violates BSA requirements, including SAR filing requirements, anti-money laundering program requirements, and currency transaction reporting requirements. Where the violation occurs as part of a pattern of unlawful activity involving more than $100,000 in a twelve-month period, the maximum penalties are increased to $500,000 and/or ten years of imprisonment. The willfulness requirement is a critical threshold: DOJ must establish that the defendant knew of and deliberately violated a legal duty, or acted with reckless disregard of a known legal obligation.
• 18 U.S.C. § 1956 (Money Laundering). The federal money laundering statute prohibits conducting or attempting to conduct financial transactions involving the proceeds of specified unlawful activities with the intent to promote the carrying on of the underlying activity, or knowing that the transaction is designed to conceal or disguise the nature, source, location, ownership, or control of proceeds. Application of this statute to BRB would require evidence that Bank personnel knowingly facilitated money laundering through the Bank's compliance program deficiencies.
• 18 U.S.C. § 1957 (Monetary Transactions with Criminally Derived Property). This companion statute prohibits engaging in monetary transactions in excess of $10,000 in criminally derived property. Like Section 1956, application to BRB would require evidence of knowledge that transactions involved criminal proceeds.
• DOJ Corporate Enforcement Policy. DOJ's corporate enforcement policy, as articulated in the Deputy Attorney General's memoranda and the U.S. Attorneys' Manual, provides incentives for corporations to voluntarily self-disclose misconduct, cooperate with investigations, and remediate compliance deficiencies. The policy contemplates that corporations demonstrating these behaviors may be eligible for more favorable resolutions, including declination of prosecution, non-prosecution agreements ("NPAs"), or deferred prosecution agreements ("DPAs") in lieu of indictment.
The DOJ's Money Laundering and Asset Recovery Section ("MLARS") and the United States Attorney's Office for the Southern District of New York ("SDNY") — the district encompassing BRB's headquarters — would have primary jurisdiction over any criminal prosecution arising from BRB's conduct.
C. Key Risk Factors Assessed
We have assessed the following risk factors in evaluating the probability and severity of a DOJ criminal referral:
OFAC Screening Gap. The most significant exposure for potential criminal referral is the OFAC screening gap in the NovaPay channel — approximately 3,800,000 transactions unscreened in calendar year 2023. If the ongoing lookback reveals that any of these unscreened transactions involved parties on the SDN List, blocked entities, or otherwise prohibited transactions under U.S. sanctions programs, the DOJ could view the screening failure as facilitating sanctions violations. However, for criminal liability under 50 U.S.C. § 1705 (the criminal enforcement provision of the International Emergency Economic Powers Act), DOJ would need to establish that BRB personnel acted "willfully" — that is, with knowledge of the sanctions obligations and a deliberate decision to circumvent or disregard them. The available evidence suggests that the screening gap resulted from a systems integration failure between the NovaPay API and the Veridian Analytics platform, rather than a deliberate decision to forgo screening. This technical-failure characterization, if supported by the evidence, would significantly reduce criminal referral risk.
SAR Filing Backlog. The 2,400-alert backlog and the 78-day average filing time reflect significant failures in BRB's SAR filing program. For criminal liability, however, DOJ would need to establish that the filing failures were "willful" — that BRB personnel knowingly chose not to review alerts or file SARs, or deliberately delayed filings to conceal suspicious activity. The more likely characterization is that the backlog resulted from chronic understaffing and inadequate technology, which constitutes negligence and regulatory non-compliance but falls short of the willfulness threshold for criminal prosecution.
No Evidence of Personnel Misconduct. Our review to date has not identified evidence that any BRB employee, officer, or director knowingly assisted in money laundering, sanctions evasion, or other criminal activity. There is no evidence of personal enrichment, corrupt intent, or deliberate concealment of compliance failures from regulators. The absence of such evidence is a significant mitigating factor.
No Identified Actual Criminal Activity. The SAR lookback project and the NovaPay transaction lookback are ongoing, and their results are not yet available. As of the date of this memorandum, there are no identified instances of actual money laundering, terrorist financing, or sanctions violations having been facilitated through the unscreened transactions or the delayed SAR filings. This finding is preliminary, however, and is subject to change as the lookback projects proceed.
Model Validation Gap. The failure to independently validate the Veridian TMS v.8.3 since March 2021, and the failure to update tuning parameters since October 2022, reflects systemic underinvestment in compliance infrastructure. While this underinvestment is serious from a regulatory perspective, it is characteristic of resource allocation failures rather than intentional evasion of regulatory requirements. DOJ has historically not pursued criminal charges for model validation failures standing alone.
D. Likelihood and Severity Assessment
Likelihood Assessment: Low (10–20%). We assess the probability of a DOJ criminal referral at between 10% and 20%. This assessment reflects the absence, based on currently available information, of evidence suggesting willful misconduct, intentional concealment, or deliberate facilitation of criminal activity. The BSA/AML deficiencies, while serious and warranting regulatory enforcement, appear to result from systemic underinvestment, inadequate staffing, and technology failures rather than from willful or corrupt behavior by Bank personnel.
Severity Assessment: Extreme. If a criminal referral were to materialize and result in prosecution, the consequences for BRB and BRFG would be severe in the extreme. Potential outcomes include:
• Criminal penalties under 31 U.S.C. § 5322, potentially reaching hundreds of millions of dollars depending on the number and scope of violations charged;
• A deferred prosecution agreement or non-prosecution agreement, either of which would likely impose an independent corporate compliance monitor, enhanced reporting obligations, and additional monetary penalties;
• Individual criminal liability for officers and employees, potentially including Patricia Langston (CCO), Thomas Ikeda (BSA Officer), and/or prior compliance leadership;
• Reputational devastation that could result in loss of BaaS partner relationships, deposit outflows, and counterparty concerns;
• Significant further decline in BRFG stock price; and
• Potential restrictions on BRB's business activities, including possible limitations on BaaS operations.
Key Trigger to Monitor. The single most important variable for DOJ referral risk is the outcome of the SAR lookback project (budgeted at $5.5 million). If the lookback reveals unreported transactions tied to known criminal actors, designated terrorist organizations, or sanctioned parties, the DOJ referral risk escalates materially. Specifically, if lookback results reveal that BRB's monitoring and filing failures enabled the movement of funds associated with criminal enterprises or terrorism financing — and that BRB received indicators of such activity but failed to investigate or report — DOJ could characterize the Bank's conduct as willful blindness, potentially satisfying the willfulness requirement for criminal prosecution.
E. Mitigating Factors
The following factors weigh against a DOJ criminal referral and support a more favorable enforcement disposition:
• BRB's prompt acceptance of the Consent Order and its retention of new outside counsel and an independent consultant — actions taken within weeks of the enforcement action;
• Neither BRB nor BRFG has any prior criminal history, prior DPA, or prior NPA;
• The appointment of new compliance leadership — Patricia Langston as CCO (January 2024) and Thomas Ikeda as BSA Officer (March 2023) — reflects institutional change that preceded the Consent Order and demonstrates proactive steps following the departure of prior compliance leadership;
• The comprehensive remediation program under way, supported by a Board-approved budget of $42.5 million and direct Board oversight through the newly established Compliance Committee;
• BRB's cooperation with the OCC throughout the examination process and its expressed willingness to cooperate with all regulatory agencies; and
• The technical-failure characterization of the OFAC screening gap, which is more consistent with negligent systems management than with willful disregard of sanctions screening obligations.
F. Recommended Mitigation Strategy
We recommend the following strategy to minimize DOJ criminal referral risk:
1. Documentation of Remediation. BRB should maintain scrupulous documentation of all remediation efforts, compliance program improvements, and cooperation with regulators. This documentation serves the dual purpose of demonstrating good faith to regulators and providing a contemporaneous record that could be critical in any future DOJ inquiry.
2. SAR Lookback Oversight. C&H should closely monitor the SAR lookback project for any transactions or patterns suggesting criminal activity. Thomas Ikeda (BSA Officer) should be instructed to establish an immediate escalation protocol requiring any lookback finding suggesting possible criminal involvement — including transactions involving known criminal actors, terrorist financing, or sanctioned parties — to be escalated to C&H within 24 hours of identification. Any such activity must be immediately referred for SAR filing and subject to C&H legal analysis regarding disclosure and cooperation obligations.
3. DOJ Outreach Timing. We do not recommend proactive outreach to DOJ at this time. In the absence of evidence of criminal activity, premature outreach to DOJ could draw unwanted investigative attention to BRB. We will reassess this recommendation if the lookback reveals specific concerning activity. If the lookback does identify activity warranting DOJ disclosure, C&H will evaluate the appropriateness and timing of a voluntary self-disclosure to DOJ under the Corporate Enforcement Policy, which provides meaningful credit for timely self-disclosure.
4. Document Preservation. BRB should ensure that comprehensive litigation holds are in place across all Bank systems, BaaS partner data repositories, email archives, and third-party vendor systems (including Veridian Analytics) to preserve all potentially relevant documents and communications. The litigation hold should cover the period from January 1, 2021 through the present and should encompass all documents relating to BSA/AML compliance, OFAC screening, SAR filing, transaction monitoring, BaaS partner oversight, and communications with regulators.
5. Enforcement Monitoring. C&H will monitor DOJ enforcement priorities, MLARS public statements, and SDNY press releases for signals regarding BSA enforcement trends and priorities. Any indication that DOJ is prioritizing BSA/AML enforcement against banks with BaaS programs or OFAC screening deficiencies would require reassessment of the risk profile.
V. OFAC Enforcement Risk Assessment
A. Nature of the Exposure
The OFAC screening gap in BRB's NovaPay BaaS channel represents the single most significant secondary enforcement risk identified in this assessment. The core finding in the Consent Order — that BRB's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels — carries potentially severe implications under OFAC's strict-liability enforcement regime.
The screening gap is specifically attributed to BRB's NovaPay Technologies Inc. ("NovaPay") BaaS channel. NovaPay (Ethan Garrison, CEO; 450 Mission Street, Suite 1200, San Francisco, CA 94105) is BRB's largest BaaS partner by transaction volume, representing approximately 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion in calendar year 2024). The NovaPay BaaS program supports approximately 2.1 million end-user accounts and facilitates consumer payments and peer-to-peer ("P2P") transfers — transaction types that are inherently higher risk for sanctions evasion given the speed, volume, and sometimes limited counterparty information associated with P2P payment flows.
In calendar year 2023, BRB processed approximately 31,700,000 transactions through the NovaPay channel. Approximately 12% of these transactions — approximately 3,800,000 — were not screened against applicable OFAC sanctions lists, including the SDN List, the Sectoral Sanctions Identifications ("SSI") List, and other consolidated sanctions lists. The screening failure was attributed to a systems integration deficiency between NovaPay's API and BRB's Veridian Analytics OFAC screening module.
For context, BRB's OFAC screening system generated 14,320 screening hits in calendar year 2024 (for screened transactions), of which 12 were determined to be true matches requiring blocking or rejection. The false-positive rate was approximately 99.9% ((14,320 − 12) ÷ 14,320). While the high false-positive rate is itself a compliance concern requiring calibration, the 12 true matches across screened transactions provide a rough indicator of the potential hit rate. Extrapolating this ratio to the 3,800,000 unscreened transactions suggests that a small number of those transactions may have involved sanctioned parties — though any such extrapolation is highly speculative and should not substitute for a rigorous lookback analysis.
The critical open question for OFAC enforcement risk is whether any of the 3,800,000 unscreened transactions involved transactions with parties on the SDN List, blocked persons, or otherwise prohibited parties under applicable OFAC sanctions programs. This question can only be resolved through a comprehensive lookback analysis, which is currently underway as part of the broader remediation effort.
B. OFAC Regulatory and Enforcement Framework
OFAC's enforcement authority derives principally from the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. § 1701 et seq., and the various Executive Orders issued thereunder that establish sanctions programs targeting specific countries, regimes, and individuals. OFAC implements and enforces U.S. economic sanctions through regulations codified at 31 C.F.R. Chapter V. The enforcement framework relevant to BRB's exposure includes:
Strict Liability Regime. OFAC's enforcement of economic sanctions operates under a strict liability standard. Unlike BSA violations, which require willfulness for criminal prosecution, civil OFAC violations do not require that the violator had knowledge of the prohibited nature of the transaction. A financial institution that processes a transaction involving a blocked person or entity has committed a violation regardless of whether it knew or should have known that the counterparty was sanctioned. This strict liability framework dramatically increases the severity of BRB's OFAC exposure, because the Bank cannot defend against civil enforcement on the ground that the screening gap was inadvertent or the result of a systems failure.
Economic Sanctions Enforcement Guidelines. OFAC's enforcement framework, set forth at 31 C.F.R. Part 501, Appendix A, establishes a graduated penalty structure and identifies factors that OFAC considers in determining whether to impose penalties and in calculating penalty amounts. The guidelines provide for the following range of enforcement responses: (i) no action; (ii) a cautionary letter; (iii) a finding of violation without monetary penalty; (iv) a civil monetary penalty; and (v) referral for criminal prosecution (typically to DOJ). The guidelines identify a series of aggravating and mitigating factors, including the nature of the transaction, the existence of a compliance program, the willfulness of the conduct, whether the institution voluntarily self-disclosed the violation, cooperation with OFAC's investigation, and the institution's sanctions compliance history.
Per-Violation Penalty Exposure. Under IEEPA, as adjusted for inflation, OFAC may impose civil penalties potentially exceeding $300,000 per violation, or an amount equal to twice the value of the underlying transaction, whichever is greater. The theoretical maximum penalty exposure — calculated by multiplying the per-violation maximum by the number of potential violations — is astronomical. If even 1% of the 3,800,000 unscreened transactions (38,000 transactions) involved sanctioned parties, and each transaction constituted a separate violation, the aggregate theoretical penalty exposure would be measured in billions of dollars. We emphasize, however, that OFAC exercises substantial discretion in penalty calculations and typically imposes penalties far below the theoretical maximum, particularly where the institution cooperates and self-discloses.
C. OFAC Voluntary Self-Disclosure Analysis
OFAC's enforcement guidelines provide significant mitigation credit for voluntary self-disclosure of apparent violations. Where an institution identifies and self-discloses apparent violations before OFAC has initiated its own investigation, OFAC's guidelines indicate that the base penalty amount may be reduced by up to 50%, and in many cases, self-disclosed violations are resolved with a finding of violation or cautionary letter rather than a civil monetary penalty.
The VSD analysis for BRB presents a threshold question: BRB does not yet know whether any of the 3,800,000 unscreened transactions constituted actual sanctions violations — that is, transactions involving blocked persons, SDN-listed entities, or other prohibited parties. Without evidence of actual violations, there is no "apparent violation" to self-disclose. Filing a VSD prematurely — before the lookback has identified specific transactions involving sanctioned parties — could be counterproductive, as it would invite OFAC scrutiny without the benefit of complete information and could complicate the Bank's position if the lookback ultimately reveals no actual violations.
C&H is preparing a separate, dedicated memorandum analyzing BRB's OFAC enforcement risk and VSD strategy in detail. That memorandum will address the timing, content, and procedural considerations for a potential VSD filing.
Preliminary Recommendation. We recommend that BRB complete the initial NovaPay transaction lookback before making a VSD determination. The lookback — which will involve screening the 3,800,000 unscreened transactions against current SDN, SSI, and consolidated sanctions lists — should be conducted as part of Thornfield Consulting's on-site assessment and in coordination with the broader SAR lookback project. Thornfield's preliminary gap assessment is due April 15, 2025, and may provide initial data regarding the scope of potential sanctions exposure. The SAR lookback project is expected to produce relevant findings by Q2 2025.
If the lookback reveals any apparent violations — that is, transactions involving sanctioned parties — BRB should file a VSD promptly. The timing is critical: the mitigation credit for voluntary self-disclosure diminishes or disappears if OFAC initiates its own investigation or receives information about the violations from another source (such as the publicly available Consent Order) before the institution self-discloses. Given the public nature of the Consent Order and OFAC's ability to review OCC enforcement actions, the window for BRB to gain maximum VSD credit may be limited.
D. Likelihood and Severity Assessment
Likelihood of OFAC Inquiry or Enforcement: Moderate-to-High (50–65%). We assess the probability that OFAC will open an inquiry or bring an enforcement action at between 50% and 65%. This assessment reflects:
• The scale of the screening gap (3,800,000 unscreened transactions), which is large by any measure and likely to attract OFAC attention;
• The public nature of the Consent Order, which OFAC staff routinely review as part of their monitoring of financial institution compliance;
• The strict liability nature of OFAC enforcement, which removes the willfulness defense available in other enforcement contexts;
• The heightened regulatory focus on sanctions compliance in the current geopolitical environment, including enforcement actions related to Russia/Ukraine sanctions, Iran sanctions, and other active programs; and
• The BaaS context, in which the speed and volume of transactions, combined with the involvement of non-bank fintech intermediaries, create inherent sanctions compliance challenges that OFAC has flagged as a priority concern.
Severity Assessment: Low to Catastrophic (depending on lookback results). The severity of potential OFAC enforcement varies dramatically depending on the outcome of the NovaPay transaction lookback:
• Best Case Scenario. The lookback reveals no transactions with sanctioned parties among the 3,800,000 unscreened transactions. In this scenario, OFAC may take no action at all, or may issue a cautionary letter noting the screening gap and encouraging enhanced compliance measures. The financial impact would be minimal.
• Middle Case Scenario. The lookback reveals a small number of de minimis transactions with sanctioned parties — for example, low-value P2P transfers involving individuals whose names match SDN entries. OFAC issues a finding of violation or imposes a moderate civil monetary penalty, with mitigation credit for VSD (if timely filed), cooperation, and remediation. The financial impact would likely be in the range of $5 million to $25 million.
• Worst Case Scenario. The lookback reveals multiple high-value transactions with SDN-listed entities or specially designated nationals, including transactions involving countries or programs that are current OFAC enforcement priorities (e.g., Russia, Iran, North Korea). OFAC imposes a substantial civil monetary penalty — potentially in the range of $50 million to $100 million or more — and refers the matter to DOJ for potential criminal investigation if evidence suggests that the screening failure was willful or that Bank personnel had knowledge of the sanctioned-party transactions. The reputational, financial, and operational consequences would be severe.
The wide range of potential outcomes underscores the critical importance of the NovaPay transaction lookback. Until that lookback is complete, BRB's OFAC risk cannot be assessed with greater precision.
E. BaaS Partner-Specific OFAC Risk
BRB's OFAC exposure is concentrated in, but not limited to, the NovaPay channel. Each of BRB's major BaaS partners presents a distinct risk profile:
NovaPay Technologies Inc. (Ethan Garrison, CEO). Highest risk. NovaPay supports approximately 2.1 million end-user accounts and facilitates consumer payments and P2P transfers. The 12% screening gap is directly attributed to NovaPay transaction flows. The consumer P2P payment model is inherently higher risk for sanctions evasion because of the volume of small-value transactions, the limited counterparty information sometimes available for P2P transfers, and the speed of transaction processing. NovaPay accounts for 41% of total BaaS transaction volume ($30.5 billion of $74.3 billion).
FairLend Digital LLC (Aisha Okonkwo, CEO). Moderate risk. FairLend operates an online small-business lending platform and accounts for approximately 28% of BaaS transaction volume. FairLend originated $1.4 billion in loans in fiscal year 2024. While the consumer P2P risks applicable to NovaPay are less pronounced for a commercial lending platform, FairLend's commercial counterparty exposure — including small businesses that may serve as fronts for sanctioned parties or their agents — presents a non-trivial OFAC compliance risk. The screening gap identified in the Consent Order is specific to the NovaPay channel, but the adequacy of OFAC screening across all BaaS channels, including FairLend, should be verified.
VaultEdge Inc. (Marcus Tan, CEO). Moderate risk. VaultEdge is a digital savings and neobanking platform with approximately 870,000 deposit accounts, representing approximately 18% of BaaS transaction volume. The deposit-account model presents moderate sanctions risk, particularly if VaultEdge accounts are used for value transfer or if accountholders' identities are not adequately verified against sanctions lists at onboarding and on an ongoing basis.
Remaining 11 BaaS Partners. Collectively accounting for approximately 13% of BaaS transaction volume. Individual risk profiles vary, but aggregate exposure requires assessment. No specific OFAC screening deficiencies have been identified for these partners, though the systemic nature of the screening gap identified in the NovaPay channel raises questions about the adequacy of screening infrastructure across all BaaS channels.
F. Recommended Mitigation Strategy
We recommend the following strategy to address BRB's OFAC enforcement exposure:
1. Veridian OFAC Module Enhancement. BRB should prioritize completion of the Veridian OFAC screening module enhancement under the Statement of Work being developed as an amendment to the Veridian Master Services Agreement (Contract No. VA-BRB-2023-0044). The target completion date is November 1, 2025, at which time BRB should achieve full, validated OFAC screening operationalization across all BaaS channels — including NovaPay, FairLend, VaultEdge, and all other active partners.
2. NovaPay Transaction Lookback. BRB should conduct a targeted lookback of the 3,800,000 unscreened NovaPay transactions from calendar year 2023, screening each transaction against current SDN, SSI, and consolidated sanctions lists. This lookback should be conducted with appropriate methodological rigor to ensure defensibility, with clear documentation of methodology, results, and any apparent violations identified. The lookback should be coordinated with Thornfield's on-site assessment and the broader SAR lookback project.
3. Independent Sanctions Assessment. Jennifer Hwang, Director of Sanctions & OFAC Compliance at Thornfield Consulting Group, should be engaged to provide an independent assessment of BRB's sanctions compliance program, including screening coverage, screening technology, list management, case management for screening hits, and compliance governance. This assessment should cover all BaaS channels, not only NovaPay.
4. VSD Preparation. C&H will begin preparing a draft OFAC voluntary self-disclosure filing framework, including draft narrative, transaction tables, and supporting documentation. This preparation will proceed in parallel with the lookback, with the understanding that the VSD will be finalized and filed only if the lookback reveals apparent violations. The C&H VSD analysis memorandum currently under development will provide detailed guidance on timing and content.
5. NovaPay Compliance Remediation Letter. C&H has drafted a compliance remediation letter to NovaPay requiring enhanced cooperation and data sharing to support the lookback. This letter should be reviewed by BRB management and executed promptly to ensure that BRB has full access to the transaction data, account information, and counterparty details needed for a thorough lookback.
6. Enforcement Monitoring. C&H will monitor OFAC enforcement actions and guidance for analogous fintech/BaaS cases, new FAQ postings, and OFAC Advisory publications that may signal enforcement priorities or provide interpretive guidance relevant to BRB's exposure.
VI. State-Level Regulatory Exposure
A. Preemption Analysis — National Bank Charter
BRB holds a national charter under 12 U.S.C. § 21 et seq., with the OCC serving as its primary federal banking regulator. Under the National Bank Act and the OCC's preemption regulations at 12 C.F.R. Part 7, national banks are generally subject to federal preemption from state laws that "prevent or significantly interfere" with the exercise of national bank powers, as articulated by the Supreme Court in Barnett Bank of Marion County, N.A. v. Nelson, 517 U.S. 25 (1996), and codified in the Dodd-Frank Act's preemption provisions at 12 U.S.C. § 25b.
This preemption framework provides BRB with substantial protection from direct state enforcement of BSA/AML requirements. State bank supervisors do not have primary supervisory authority over national banks, and state BSA/AML requirements that conflict with or duplicate federal requirements are generally preempted. However, preemption is not absolute, and several categories of state-level exposure merit analysis.
B. State Money Transmitter Licensing Risk
BRB's BaaS partners — particularly NovaPay, which facilitates consumer P2P payments — may be subject to state money transmitter licensing requirements in the states where they operate. While BRB itself, as a national bank, is exempt from state money transmitter licensing requirements, its BaaS partners are not necessarily so exempt unless they qualify for a bank-agent exemption under applicable state law. The bank-agent exemption varies significantly from state to state, and its applicability depends on the specific structure of the BaaS arrangement, including whether the fintech partner is acting as an agent of the bank or as an independent money transmitter.
If BRB's BaaS partner activities are characterized by state regulators as unlicensed money transmission, state regulators could bring enforcement actions against the partners themselves. Such actions would not directly target BRB but could have significant reputational and operational consequences for the Bank, including:
• Disruption of BaaS partner operations, potentially requiring cessation of activity in affected states;
• Reputational harm to BRB as the sponsor bank for unlicensed money transmission;
• Regulatory scrutiny of BRB's third-party risk management and BaaS oversight practices by the OCC; and
• Potential for state regulators to assert that BRB aided and abetted unlicensed money transmission by providing the banking infrastructure.
NovaPay Technologies Inc. is a Delaware corporation operating nationally as a consumer payments and P2P transfer platform. NovaPay's licensing status across all 50 states and U.S. territories requires verification. NovaPay's reliance on BRB's national bank charter for the bank-agent exemption from state money transmitter licensing must be evaluated on a state-by-state basis to

MEMORANDUM

Record

Parties

Dates

Amounts