1045-00002 · Calderwood & Harkness LLP · documents

revised-baas-program-agreement-template-amendment.docx DOCUMENT Antitrust

61 / 84 ← → ✕

CONFIDENTIAL — ATTORNEY WORK PRODUCT — PRIVILEGED AND CONFIDENTIAL

COMPLIANCE ADDENDUM TO BANKING-AS-A-SERVICE PROGRAM AGREEMENT

Template for Execution with All BaaS Partners of Belmont Ridge Bank National Association

Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

C&H Matter No.: 1045-00002

Prepared for: Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845

Template — To Be Dated Upon Execution with Each BaaS Partner

DRAFTING NOTE: This Addendum is designed as a model compliance addendum for insertion into each of BRB's fourteen (14) active BaaS partner agreements pursuant to the remediation requirements of OCC Consent Order No. OCC-2025-003 (effective January 15, 2025). Bracketed fields are to be completed for each BaaS Partner upon execution. Exhibits A and B are to be customized for each Partner based on the Partner's specific products, End User base, risk profile, and technical infrastructure.

Right-click to update Table of Contents

PREAMBLE

This Compliance Addendum to Banking-as-a-Service Program Agreement (this "Addendum") is entered into as of the date of execution set forth on the signature page hereof (the "Addendum Effective Date"), by and between:

BELMONT RIDGE BANK NATIONAL ASSOCIATION, a national banking association chartered under 12 U.S.C. § 21 et seq., with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, OCC Charter No. 48271 (the "Bank" or "BRB"),

and

[_______________], a [___] organized under the laws of [___], with its principal office located at [___] (the "BaaS Partner" or "Partner").

The Bank and the Partner are each sometimes referred to herein individually as a "Party" and collectively as the "Parties."

This Addendum supplements and amends that certain Banking-as-a-Service Program Agreement between the Bank and the Partner dated as of [___] (as amended, modified, or supplemented from time to time, the "Program Agreement").

RECITALS

WHEREAS, the Bank operates a Banking-as-a-Service program (the "BaaS Program") through which it sponsors fintech partners to offer financial products and services to end users under the Bank's national bank charter, and the Bank currently maintains fourteen (14) active BaaS partner relationships, including the relationship with the Partner governed by the Program Agreement;

WHEREAS, the Bank and the Partner entered into the Program Agreement, pursuant to which the Partner accesses the Bank's charter and banking infrastructure to offer certain financial products and services to consumers and/or businesses through the Partner's technology platform, subject to the terms, conditions, and regulatory requirements set forth therein;

WHEREAS, the Bank is subject to OCC Consent Order No. OCC-2025-003, effective January 15, 2025 (the "Consent Order"), issued by the Office of the Comptroller of the Currency, which identified significant deficiencies in the Bank's Bank Secrecy Act and Anti-Money Laundering compliance program, including, among other things, inadequate screening of transactions and customers against the sanctions lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), deficient Suspicious Activity Report filing practices, and insufficient Customer Due Diligence and Enhanced Due Diligence for high-risk customers onboarded through fintech partner channels;

WHEREAS, the Bank's BSA/AML compliance program is undergoing a comprehensive remediation pursuant to the Consent Order, which remediation encompasses, among other things, enhanced oversight of all BaaS partner relationships, upgrades to transaction monitoring and OFAC screening infrastructure, remediation of approximately 47,000 high-risk customer accounts that lacked adequate CDD/EDD documentation as of the date of the Consent Order, clearance of a backlog of approximately 2,400 unreviewed suspicious activity alerts, and strengthening of data sharing and information governance between the Bank and its BaaS partners;

WHEREAS, the Bank has engaged Calderwood & Harkness LLP ("C&H") as outside regulatory counsel and Thornfield Consulting Group LLC ("Thornfield") as the OCC-mandated independent consultant to guide, validate, and assess the Bank's remediation efforts;

WHEREAS, BaaS-related Suspicious Activity Reports constituted approximately 54.8% of the Bank's total SARs in calendar year 2024 (2,108 of 3,847 total SARs), and total BaaS transaction volume in calendar year 2024 was approximately $74.3 billion, underscoring the critical importance of robust compliance cooperation between the Bank and each of its BaaS partners;

WHEREAS, this Addendum is being entered into pursuant to the requirements of the Consent Order and the Bank's Comprehensive Remediation Action Plan submitted to the OCC, and is intended to supplement and, where inconsistent, supersede the compliance-related provisions of the Program Agreement to establish enhanced BSA/AML, OFAC, and related compliance obligations for the Partner in connection with the BaaS Program;

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE I — DEFINITIONS

Section 1.1 — Definitions. As used in this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Addendum shall have the meanings ascribed to them in the Program Agreement.

"Addendum Effective Date" means the date of execution of this Addendum by both Parties, as set forth on the signature page hereof.

"Applicable Law" means all federal and state laws, rules, regulations, orders, guidelines, and regulatory guidance applicable to the Bank and/or the Partner's activities under the Program Agreement and this Addendum, including without limitation: (a) the Bank Secrecy Act (31 U.S.C. §§ 5311–5332) and its implementing regulations (31 C.F.R. Chapter X); (b) the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Pub. L. 107-56; (c) OFAC regulations (31 C.F.R. Part 500 et seq.); (d) regulations and guidance issued by the Financial Crimes Enforcement Network ("FinCEN"); (e) the regulations, guidance, bulletins, and supervisory standards of the Office of the Comptroller of the Currency ("OCC"), including OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) and its predecessors and successors; (f) the Federal Deposit Insurance Act and implementing regulations of the Federal Deposit Insurance Corporation; and (g) all applicable state money transmission laws, consumer protection laws, and privacy and data security laws.

"BSA/AML Program" means the Bank's Bank Secrecy Act and Anti-Money Laundering compliance program as required by 12 U.S.C. § 1818(s), 12 C.F.R. Part 21, and FinCEN's implementing regulations, including the Bank's internal policies, procedures, controls, independent testing, training, and designation of a BSA compliance officer.

"BSA Officer" means Thomas Ikeda, BSA Officer and AML Program Director of the Bank, or his duly authorized designee or successor as designated by the Bank from time to time in writing.

"CDD" means Customer Due Diligence as required under 31 C.F.R. § 1020.210, FinCEN's Customer Due Diligence Requirements for Financial Institutions (81 Fed. Reg. 29398 (May 11, 2016)), and the Bank's CDD policies and procedures, as updated from time to time.

"Consent Order" means OCC Consent Order No. OCC-2025-003, effective January 15, 2025, and any amendments, modifications, supplements, or successor orders thereto.

"EDD" means Enhanced Due Diligence for high-risk customers as required under the Bank's risk-based BSA/AML policies and procedures, which may include, without limitation, enhanced identification and verification procedures, source of funds and source of wealth inquiries, enhanced ongoing monitoring, and senior management approval for account opening or continuation.

"End Users" means all customers, whether individuals or entities, of the Partner who access, use, or receive banking products or services through the Partner's platform under the Bank's charter pursuant to the Program Agreement.

"Independent Consultant" means Thornfield Consulting Group LLC (engagement reference TCG-BRB-2025-001), or any successor independent consultant appointed pursuant to the Consent Order and approved by the OCC.

"OFAC" means the U.S. Department of the Treasury's Office of Foreign Assets Control.

"OFAC Sanctions Lists" means the Specially Designated Nationals and blocked Persons List (the "SDN List"), the Sectoral Sanctions Identifications List (the "SSI List"), the Consolidated Sanctions List, the Foreign Sanctions Evaders List (the "FSE List"), the Non-SDN Palestinian Legislative Council List, the Non-SDN Menu-Based Sanctions List, and any other sanctions lists, databases, or compilations of sanctioned or blocked persons or entities administered, maintained, or published by OFAC from time to time.

"OCC" means the Office of the Comptroller of the Currency, an independent bureau within the U.S. Department of the Treasury.

"Partner Channel Transactions" means all transactions, including without limitation wire transfers, ACH credit and debit transactions, card transactions (including debit card, prepaid card, and credit card transactions), peer-to-peer transfers, real-time payment transactions, loan originations and disbursements, deposit transactions, and any other financial transactions, that are initiated, processed, facilitated, or settled through the Partner's platform under the Bank's charter pursuant to the Program Agreement.

"Remediation Action Plan" or "RAP" means the Bank's Comprehensive Remediation Action Plan submitted to the OCC pursuant to Article VII of the Consent Order, as amended, supplemented, or updated from time to time, and any successor or supplemental remediation plans submitted to the OCC in connection with the Consent Order.

"SAR" means a Suspicious Activity Report as required under 31 C.F.R. § 1020.320, including any amendments, corrections, or supplements thereto filed with FinCEN.

"Transaction Monitoring System" or "TMS" means the Bank's automated transaction monitoring platform used to detect potentially suspicious activity in customer accounts and transactions, currently Veridian TMS (being upgraded to version 10.0), and any successor or replacement system deployed by the Bank.

Section 1.2 — Interpretation. In this Addendum, unless the context otherwise requires: (a) the singular includes the plural and vice versa; (b) references to "Articles," "Sections," and "Exhibits" are to Articles, Sections, and Exhibits of this Addendum; (c) the words "include," "includes," and "including" are deemed to be followed by the phrase "without limitation"; (d) the words "herein," "hereof," "hereby," "hereunder," and words of similar import refer to this Addendum as a whole and not to any particular provision; (e) "writing" and "written" include electronic communications; and (f) references to any law, regulation, or order include all amendments, modifications, extensions, replacements, and re-enactments thereof.

ARTICLE II — BSA/AML COMPLIANCE OBLIGATIONS

Section 2.1 — General Compliance Obligation. The Partner acknowledges and agrees that the Bank, as the chartered national banking association, bears ultimate regulatory responsibility for compliance with the Bank Secrecy Act, its implementing regulations, OFAC sanctions requirements, and all other Applicable Law with respect to all End Users and all Partner Channel Transactions. The Partner's activities under the Program Agreement are conducted under the Bank's charter and are, from a regulatory perspective, activities of the Bank for purposes of BSA/AML and OFAC compliance. Accordingly, the Partner shall comply with all Applicable Law applicable to its activities under the Program Agreement and this Addendum, and shall cooperate fully and in good faith with the Bank's BSA/AML Program and all related compliance initiatives. The Partner shall not take any action, or fail to take any action, that would cause or contribute to the Bank being in violation of any of its BSA/AML or OFAC obligations, any provision of the Consent Order, the Remediation Action Plan, or any directive, order, or guidance issued by the OCC, FinCEN, OFAC, or any other applicable regulatory authority.

Section 2.2 — Partner BSA/AML Policies and Procedures.

(a) The Partner shall develop, maintain, implement, and enforce its own written BSA/AML and OFAC compliance policies and procedures that are, in all material respects, no less stringent than the Bank's corresponding policies and procedures as provided to the Partner by the Bank and updated from time to time. The Bank shall make its current BSA/AML and OFAC policies and procedures available to the Partner within a reasonable period following the Addendum Effective Date and shall provide updated versions promptly following any material revision.

(b) The Partner shall submit its BSA/AML and OFAC compliance policies and procedures to the Bank for review and prior written approval before implementation. The Partner shall also submit to the Bank for review and prior written approval any proposed material amendment, supplement, or revision to such policies and procedures. The Bank shall use commercially reasonable efforts to complete its review within thirty (30) calendar days of receipt of the Partner's submission; provided, however, that the Bank's failure to respond within such period shall not be deemed to constitute approval.

(c) The Bank reserves the right, at any time and from time to time, to require modifications, enhancements, or supplements to the Partner's BSA/AML and OFAC policies and procedures as the Bank determines, in its reasonable discretion, to be necessary or appropriate to ensure compliance with Applicable Law, the Consent Order, the Remediation Action Plan, or the Bank's own policies and procedures. The Partner shall implement any such required modifications within the timeframe specified by the Bank, which shall not exceed sixty (60) calendar days unless the Bank agrees in writing to a longer implementation period.

Section 2.3 — Partner Compliance Personnel.

(a) The Partner shall designate a qualified compliance officer who shall be responsible for overseeing the Partner's BSA/AML and OFAC compliance obligations under this Addendum and the Program Agreement (the "Partner Compliance Officer"). The Partner Compliance Officer shall possess education, training, and experience commensurate with the complexity, volume, and risk profile of the Partner's activities under the Program Agreement. The Partner shall notify the Bank in writing of the identity, qualifications, and contact information of the Partner Compliance Officer within thirty (30) calendar days of the Addendum Effective Date.

(b) The Partner Compliance Officer shall serve as the primary point of contact for the Bank's BSA Officer (Thomas Ikeda) and Chief Compliance Officer (Patricia Langston) on all BSA/AML, OFAC, and related compliance matters arising under this Addendum and the Program Agreement. The Partner Compliance Officer shall be available for regular communications, meetings, and consultations with the Bank's compliance personnel at reasonable times and upon reasonable notice.

(c) The Partner shall maintain adequate compliance staffing, including appropriately qualified analysts, investigators, and support personnel, commensurate with the volume and risk profile of Partner Channel Transactions and the number of End Users served through the Partner's platform. The Bank shall have the right to review the adequacy of the Partner's compliance staffing as part of its periodic risk assessments of the Partner under Article XI of this Addendum, and the Partner shall promptly address any staffing deficiencies identified by the Bank.

(d) The Partner shall promptly notify the Bank in writing of any change in the identity or qualifications of the Partner Compliance Officer, or of any material reduction in the Partner's compliance staffing, within five (5) business days of such change or reduction.

Section 2.4 — Partner Training.

(a) The Partner shall ensure that all Partner personnel who are involved in, or who have responsibility for, End User onboarding, transaction processing, customer service, complaint handling, fraud prevention, and compliance functions receive initial and ongoing BSA/AML and OFAC training that is consistent with the Bank's enterprise-wide training standards as communicated to the Partner from time to time. Such training shall cover, at a minimum: (i) the requirements of the Bank Secrecy Act, FinCEN regulations, and OFAC sanctions programs; (ii) the Partner's and Bank's respective BSA/AML and OFAC policies and procedures; (iii) identification and escalation of suspicious activity; (iv) CDD and EDD requirements; (v) OFAC sanctions screening and interdiction procedures; (vi) SAR confidentiality and anti-tipping-off requirements; and (vii) the provisions of this Addendum.

(b) Training shall be provided to all relevant Partner personnel within sixty (60) calendar days of the Addendum Effective Date (for existing personnel) and within thirty (30) calendar days of the commencement of employment or assignment (for new personnel). Refresher training shall be provided at least annually thereafter, and supplemental training shall be provided as necessary in response to changes in Applicable Law, the Bank's policies, or identified compliance deficiencies.

(c) The Partner shall maintain records documenting the completion of all required training, including the names of trained personnel, the dates of training, the topics covered, and the training materials used. The Partner shall provide evidence of training completion to the Bank upon request, and no later than thirty (30) calendar days following the end of each calendar quarter.

ARTICLE III — CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE

Section 3.1 — CDD Obligations.

(a) The Bank retains ultimate responsibility for performing and ensuring the adequacy of Customer Due Diligence on all End Users, including compliance with the Customer Identification Program ("CIP") requirements under 31 C.F.R. § 1020.220 and the beneficial ownership requirements for legal entity customers under 31 C.F.R. § 1010.230 (the "Beneficial Ownership Rule"). Nothing in this Addendum or the Program Agreement shall be construed to relieve the Bank of its regulatory responsibility for CDD, nor shall the delegation of certain CDD collection functions to the Partner limit or reduce the Bank's obligations in any respect.

(b) The Partner is delegated certain CDD collection functions as specifically delineated in the BaaS Partner CDD/EDD Responsibility Matrix attached to this Addendum as Exhibit A and incorporated herein by reference (the "Responsibility Matrix"). All such delegated functions are performed by the Partner as agent of the Bank and are subject at all times to the Bank's oversight, direction, and approval. The Bank reserves the right to modify, expand, restrict, or revoke the scope of delegated CDD functions at any time upon written notice to the Partner.

(c) The Partner shall collect all required CDD information, including all identity verification data, documentary and non-documentary verification evidence, and beneficial ownership information, at the point of End User onboarding and shall transmit such information to the Bank in real-time or within the timeframes specified in the Responsibility Matrix. All CDD data shall be transmitted through the secure data interfaces and in the data formats specified in the technical specifications attached as Exhibit B.

(d) All CDD documentation shall be collected, verified, and maintained in accordance with the Bank's revised CDD/EDD Policy, as updated from time to time and provided to the Partner by the Bank. The Partner shall not onboard any End User, or permit any End User to open an account or conduct a transaction, unless and until the Bank has confirmed that the minimum required CDD information has been received and verified, unless the Bank has provided a prior written exception for specific, defined circumstances.

(e) The Partner shall cooperate with the Bank in performing periodic re-verification of End User identity information and in validating the accuracy and completeness of CDD records, in accordance with the Bank's CDD refresh schedule as communicated to the Partner from time to time.

Section 3.2 — Enhanced Due Diligence for High-Risk End Users.

(a) The Partner shall cooperate fully with the Bank in identifying and flagging End Users who meet the Bank's criteria for Enhanced Due Diligence, as set forth in the Bank's EDD policies and procedures and as communicated to the Partner from time to time. Categories of End Users that may be subject to EDD include, without limitation: (i) politically exposed persons ("PEPs") and their close associates and family members; (ii) End Users domiciled in or conducting significant transactions with persons in countries or regions identified by the Bank, OFAC, FinCEN, or the Financial Action Task Force ("FATF") as high-risk for money laundering or terrorist financing; (iii) End Users exhibiting unusual or unexplained transaction patterns; (iv) high-volume or high-value accounts; (v) End Users operating in industries associated with elevated money laundering or financial crimes risk; and (vi) any other categories designated by the Bank based on its risk assessment.

(b) Upon notification by the Bank that an End User has been designated for EDD, or upon the Partner's own identification of an End User meeting EDD criteria, the Partner shall collect and transmit to the Bank all additional EDD documentation as directed by the Bank within ten (10) business days of the Bank's request. Such EDD documentation may include, without limitation, enhanced identity verification, source of funds documentation, source of wealth documentation, purpose of account information, nature and expected pattern of account activity, references or attestations, and any other information specified by the Bank.

(c) The Partner acknowledges that the Bank identified approximately 47,000 high-risk customer accounts — primarily onboarded through fintech partner channels — that lacked adequate CDD/EDD documentation as of the date of the Consent Order. The Partner shall cooperate fully and on a prioritized basis with the Bank's remediation of any such accounts attributable to the Partner's End Users. Such cooperation shall include the collection, verification, and transmission of CDD/EDD documentation for remediated accounts in accordance with the Bank's phased remediation milestones, specifically: (i) fifty percent (50%) completion of remediation of Partner-attributable accounts by July 15, 2025; and (ii) one hundred percent (100%) completion of remediation of Partner-attributable accounts by January 15, 2026.

(d) If an End User subject to EDD fails to provide the required documentation within the timeframe specified by the Bank, or if the Bank determines that the EDD information obtained is insufficient or unsatisfactory, the Bank shall have the right to restrict, suspend, or close the End User's account and to direct the Partner to take corresponding action on the Partner's platform, including restriction or suspension of access.

Section 3.3 — Ongoing Monitoring of End User Information.

(a) The Partner shall implement and maintain procedures to ensure that End User information is kept current and accurate throughout the life of the End User's account or relationship. Such procedures shall include periodic refresh of CDD and EDD documentation at intervals specified by the Bank, which intervals may vary based on the End User's risk rating.

(b) The Partner shall promptly notify the Bank of any material change in End User information of which the Partner becomes aware, including without limitation any change of name, address, beneficial ownership, organizational structure, nature of business, source of funds, or anticipated transaction activity, within five (5) business days of becoming aware of such change.

(c) The Partner shall implement automated and manual controls to detect changes in End User information and shall provide the Bank with updated information in accordance with the data transmission requirements of Exhibit B.

Section 3.4 — Risk Rating Cooperation.

(a) The Partner shall cooperate with the Bank in assigning and maintaining risk ratings for all End Users, using the Bank's risk rating methodology as provided to the Partner from time to time. The Bank shall retain sole discretion and authority over the assignment and modification of End User risk ratings.

(b) The Partner shall provide to the Bank all data and information reasonably necessary for the Bank to perform initial and ongoing risk assessments of End Users, including End User demographic data, transaction history, geographic information, product usage data, and any other information specified by the Bank.

(c) The Partner shall promptly implement any changes to End User account treatment, monitoring levels, transaction limits, or product restrictions that the Bank directs based on changes in End User risk ratings.

ARTICLE IV — OFAC SANCTIONS SCREENING

Section 4.1 — Bank's OFAC Screening Obligation.

(a) The Bank shall screen one hundred percent (100%) of Partner Channel Transactions and all End Users and their associated parties (including beneficial owners, originators, and beneficiaries) against the OFAC Sanctions Lists. The Bank shall maintain and operate sanctions screening systems and processes reasonably designed to ensure that no Partner Channel Transaction or End User account activity violates any OFAC sanctions program.

(b) Screening shall occur in real-time (i.e., prior to transaction authorization or settlement) for all wire transfers, international ACH transactions, and other high-risk transaction types designated by the Bank. Screening shall occur in batch mode (i.e., within twenty-four (24) hours of transaction initiation) for lower-risk transaction types, in each case in accordance with the Bank's revised OFAC Screening Procedures Manual as updated from time to time. The Bank shall determine, in its sole discretion, which transaction types are subject to real-time versus batch screening, and shall communicate such determinations to the Partner.

(c) The Partner acknowledges that the Consent Order identified a failure by the Bank to screen approximately twelve percent (12%) of transactions in one BaaS partner channel, resulting in approximately 3,800,000 transactions going unscreened in calendar year 2023 out of approximately 31,700,000 total transactions in that channel. This Addendum is designed, in part, to ensure that no such screening gaps recur in any BaaS partner channel, including the Partner's channel. The Partner shall cooperate fully with the Bank in implementing the technical, operational, and procedural measures necessary to achieve and maintain complete OFAC screening coverage.

Section 4.2 — Partner Data Obligations for OFAC Screening.

(a) The Partner shall transmit to the Bank, in the data format and through the technical interfaces specified by the Bank in Exhibit B, all transaction data and End User identifying information necessary for the Bank to perform complete, accurate, and timely OFAC screening of all Partner Channel Transactions and End Users. Such data shall include, at a minimum, all fields required by the Bank's OFAC screening system, including originator name and address, beneficiary name and address, intermediary financial institution information (where applicable), transaction amount, currency, date and time, and any other data fields specified by the Bank.

(b) All transaction data required for OFAC screening shall be transmitted in real-time or in advance of transaction settlement, as specified in the technical specifications attached as Exhibit B. For transactions subject to real-time screening, the Partner shall transmit complete screening data to the Bank prior to the Partner's authorization or processing of the transaction.

(c) The Partner shall not process, authorize, settle, or permit the completion of any Partner Channel Transaction until the Bank has confirmed that OFAC screening has been completed and no blocking or rejection is required, unless the Bank has provided a prior written exception for specified low-risk transaction types that are processed in batch mode. Any such written exception shall specify the transaction types covered, the maximum transaction value thresholds (if applicable), and the batch screening timeline. The Bank may revoke any such exception at any time upon written notice to the Partner.

Section 4.3 — OFAC Hit Disposition and blocking.

(a) If the Bank identifies a potential OFAC match (a "true positive") involving a Partner Channel Transaction or an End User, the Bank shall block, reject, or freeze the relevant transaction or account in accordance with OFAC regulations, including the requirement to file a blocked property report with OFAC within ten (10) business days of blocking.

(b) The Partner shall cooperate immediately and fully with the Bank's interdiction and blocking procedures. Upon notification by the Bank that a transaction or account has been blocked, rejected, or frozen, the Partner shall: (i) suspend access to any affected End User account on the Partner's platform within two (2) hours of notification by the Bank; (ii) prevent the affected End User from initiating any new transactions through the Partner's platform; (iii) preserve all records and communications related to the affected End User and the blocked or rejected transaction; and (iv) provide to the Bank any additional information or documentation related to the affected End User or transaction as the Bank may request.

(c) The Partner shall not release, unfreeze, restore access to, or otherwise permit the completion of any blocked, rejected, or frozen transaction or account without the Bank's prior written authorization. Any such release or restoration shall be made only in accordance with an OFAC-issued specific license or other applicable authorization.

(d) The Partner shall not communicate to any End User or third party the specific reason for any blocking, rejection, or account suspension that is related to OFAC sanctions, except as the Bank may expressly authorize or as required by Applicable Law.

Section 4.4 — OFAC Screening Remediation Cooperation.

(a) The Partner acknowledges the Bank's obligation under the Consent Order and the Remediation Action Plan to achieve full OFAC screening operationalization for all BaaS channels by November 1, 2025.

(b) The Partner shall cooperate fully with the Bank in implementing any system changes, data format modifications, API integrations, process adjustments, or other technical or operational measures necessary to achieve one hundred percent (100%) OFAC screening coverage for all Partner Channel Transactions and End Users. The Partner shall complete any required technical work on the Partner's systems within the timelines specified by the Bank, and shall devote adequate technical and operational resources to ensure timely completion.

(c) The Partner shall participate in testing, user acceptance testing, and validation activities conducted by the Bank in connection with the deployment of new or upgraded OFAC screening systems or processes, as they relate to Partner Channel Transactions, and shall promptly remediate any issues identified during such testing.

ARTICLE V — TRANSACTION MONITORING AND SUSPICIOUS ACTIVITY REPORTING

Section 5.1 — Bank's Transaction Monitoring.

(a) The Bank shall maintain and operate a Transaction Monitoring System to monitor all Partner Channel Transactions for potentially suspicious activity, in accordance with the Bank's BSA/AML Program and Applicable Law. The Bank's TMS is currently being upgraded to Veridian TMS version 10.0, with user acceptance testing completion targeted for August 1, 2025, and full production deployment and independent model validation targeted for October 1, 2025.

(b) The Partner acknowledges that the Bank's Transaction Monitoring System had not been subject to independent model validation since March 2021 and that tuning parameters for the system were last updated in October 2022, both of which deficiencies were identified in the Consent Order. The upgrade to Veridian TMS version 10.0, independent model validation, and comprehensive re-tuning of monitoring scenarios and parameters are remediation priorities under the Remediation Action Plan, and the Partner's cooperation with these efforts is essential.

(c) The Bank shall have sole responsibility and authority for the operation, calibration, tuning, and validation of the Transaction Monitoring System. The Partner shall have no access to, or control over, the Bank's TMS, except as the Bank may expressly provide in writing for purposes of testing or data validation.

Section 5.2 — Partner Data Transmission for Transaction Monitoring.

(a) The Partner shall transmit to the Bank complete, accurate, and timely transaction data for all Partner Channel Transactions in the format and at the frequency specified in Exhibit B. Data transmissions shall be made through the secure interfaces and using the protocols designated by the Bank, and shall include all data fields required by the Bank's Transaction Monitoring System.

(b) Transaction data transmitted by the Partner to the Bank for transaction monitoring purposes shall include, at a minimum, the following fields: (i) originator and/or account holder name and identifying information; (ii) beneficiary name and identifying information (for transfer transactions); (iii) transaction amount and currency; (iv) transaction date and time (including time zone); (v) transaction type (e.g., wire transfer, ACH, card, P2P, deposit, loan disbursement); (vi) geographic identifiers, including originator and beneficiary location, IP address (where available), and device geolocation data (where available); (vii) account number and any associated reference numbers; and (viii) any other data fields reasonably requested by the Bank from time to time.

(c) The Partner shall promptly notify the Bank of any data transmission failures, delays, interruptions, or data quality issues that could affect the completeness, accuracy, or timeliness of data available to the Bank's Transaction Monitoring System. Such notification shall be made to the Bank's BSA Officer and Chief Information Officer (Linda Petrosian) within four (4) hours of the Partner's identification of the issue, and shall include a description of the issue, the estimated volume of affected data, and the Partner's plan for remediation.

Section 5.3 — SAR Cooperation.

(a) The Bank is solely responsible for determining whether to file a Suspicious Activity Report with FinCEN in connection with any End User or Partner Channel Transaction. The decision to file, or to decline to file, a SAR rests exclusively with the Bank and may not be delegated to the Partner or any other third party.

(b) Notwithstanding the Bank's sole responsibility for SAR filing decisions, the Partner shall cooperate fully, promptly, and in good faith with the Bank in connection with all SAR-related investigations, including by providing the following upon the Bank's request:

(i) Complete transaction histories for End Users under investigation, including all Partner Channel Transactions and, to the extent available, any transactions or activity on the Partner's platform that do not constitute Partner Channel Transactions;

(ii) End User communications, including email, in-app messaging, chat logs, and telephone records (to the extent maintained by the Partner);

(iii) Application data, onboarding records, identity verification records, and all CDD/EDD documentation collected by the Partner for the End User;

(iv) Access to Partner personnel who have knowledge of the End User, the transaction under investigation, or the Partner's systems and processes relevant to the investigation, for purposes of interviews, consultations, or written inquiries; and

(v) Any other data, records, or information in the Partner's possession or control that the Bank reasonably determines is necessary for the investigation or for the preparation of a SAR filing.

(c) The Partner shall respond to Bank inquiries related to SAR investigations within five (5) business days of receipt of the Bank's request. For escalated or urgent matters (as designated by the Bank's BSA Officer), the Partner shall respond within two (2) business days.

(d) The Partner shall not disclose to any End User, any third party, or any person not authorized by the Bank or by Applicable Law the existence or contents of any SAR or the existence of any SAR investigation. The Partner acknowledges the safe harbor and anti-tipping-off provisions of 31 U.S.C. § 5318(g)(2) and agrees to comply strictly with such provisions.

(e) The Partner acknowledges that BaaS-related SARs constituted approximately 2,108 of the Bank's 3,847 total SARs filed in calendar year 2024 (approximately 54.8% of total SARs), and that timely and thorough Partner cooperation is essential to the Bank's ability to meet its regulatory obligations for suspicious activity detection, investigation, and reporting.

Section 5.4 — SAR Backlog Remediation Cooperation.

(a) The Partner shall provide prioritized support to the Bank in connection with the Bank's clearance of a backlog of approximately 2,400 unreviewed suspicious activity alerts that were outstanding as of September 2024, as identified in the Consent Order. The Bank's target clearance date for the alert backlog is June 30, 2025.

(b) Such support shall include expedited responses to all data requests, document requests, and information inquiries from the Bank's BSA/AML investigations team and/or the Bank's external BSA/AML testing firm (Caldera & Pope LLP) that relate to alerts in the backlog involving the Partner's End Users or Partner Channel Transactions. The Partner shall use its best efforts to respond to such backlog-related requests within three (3) business days of receipt.

(c) The Partner shall designate a specific point of contact for backlog-related inquiries, who shall be available to the Bank's BSA/AML investigations team during normal business hours (Eastern Time) on all business days.

Section 5.5 — Suspicious Activity Escalation by Partner.

(a) The Partner shall promptly escalate to the Bank's BSA Officer any activity, transaction, pattern, or circumstance that the Partner identifies or suspects may constitute money laundering, terrorist financing, fraud, structuring, sanctions evasion, or other financial crime involving an End User or Partner Channel Transaction.

(b) Such escalation shall occur within twenty-four (24) hours of the Partner's identification or reasonable suspicion of the activity, and shall be made in writing (via email or secure portal, as designated by the Bank) to the Bank's BSA Officer and Chief Compliance Officer, with sufficient detail to enable the Bank to assess the activity, including the End User's identifying information, a description of the suspicious activity or pattern, and any supporting documentation.

(c) The Partner shall not independently file a SAR with FinCEN with respect to any End User or Partner Channel Transaction without the Bank's prior written consent. All SAR filing decisions shall be made by the Bank.

ARTICLE VI — DATA SHARING AND INFORMATION REQUIREMENTS

Section 6.1 — General Data Sharing Obligation.

(a) The Partner shall provide the Bank with access to all data, records, documents, and information in the Partner's possession or control that is reasonably necessary for the Bank to fulfill its obligations under the BSA/AML Program, OFAC sanctions compliance requirements, CDD/EDD policies, SAR filing obligations, Currency Transaction Report ("CTR") filing obligations, and all other regulatory reporting and compliance obligations.

(b) The Partner shall maintain all data in formats compatible with the Bank's systems, as specified in Exhibit B, and shall implement any format changes, data field additions, or system modifications reasonably requested by the Bank in connection with the Bank's compliance obligations or system upgrades. The Partner shall complete any such changes within the timeframes specified by the Bank.

(c) The Partner grants to the Bank a non-exclusive, royalty-free, irrevocable right and license to access, use, copy, retain, and disclose all data provided by the Partner pursuant to this Addendum for purposes of compliance with Applicable Law, the Consent Order, the Remediation Action Plan, and the Bank's BSA/AML Program, including disclosure to the OCC, FinCEN, OFAC, the Independent Consultant, and any other governmental authority as required or permitted by law.

Section 6.2 — Real-Time and Periodic Reporting.

The Partner shall provide the Bank with the following data and reports:

(a) Real-Time Transaction Data Feeds. Real-time data feeds for all Partner Channel Transactions, transmitted through the secure interfaces and in the data formats specified in Exhibit B, sufficient to enable the Bank to perform OFAC screening and transaction monitoring on a real-time or near-real-time basis.

(b) Daily Onboarding and Account Activity Reports. Daily reports, delivered by 8:00 a.m. Eastern Time on the following business day, covering: (i) all new End User accounts opened on the prior business day, including all CDD information collected; (ii) all End User accounts closed, suspended, or restricted on the prior business day; and (iii) summary account activity data for all active End User accounts.

(c) Monthly Aggregate Reports. Monthly reports, delivered within ten (10) business days following the end of each calendar month, covering: (i) aggregate Partner Channel Transaction volumes by transaction type; (ii) total End User counts (new, active, closed, and suspended); (iii) compliance metrics, including CDD/EDD completion rates, data quality metrics, training completion rates, and the number and nature of compliance escalations; and (iv) such other metrics as the Bank may reasonably request.

(d) Ad Hoc Data Extracts. Ad hoc data extracts, reports, and information as reasonably requested by the Bank from time to time, delivered within the timeframes specified by the Bank (which shall not be less than five (5) business days, except in urgent circumstances).

Section 6.3 — Data Quality Standards.

(a) The Partner represents and warrants that all data provided to the Bank pursuant to this Addendum shall be complete, accurate, and timely. "Complete" means that all required data fields are populated with the specified information. "Accurate" means that the data is correct, corresponds to the underlying records, and has been validated through appropriate quality controls. "Timely" means that the data is transmitted within the timeframes specified in this Addendum and Exhibit B.

(b) The Partner shall implement and maintain data quality controls reasonably designed to ensure the completeness, accuracy, and timeliness of all data transmitted to the Bank. Such controls shall include, at a minimum: (i) input validation checks at the point of data capture; (ii) automated error detection and alerting mechanisms; (iii) reconciliation procedures to compare transmitted data against source records; and (iv) periodic data quality assessments.

(c) The Bank shall have the right, exercisable at any time upon reasonable notice, to audit the Partner's data quality controls, procedures, and systems, and to review reports and metrics related to data quality. The Partner shall promptly remediate any data quality deficiencies identified by the Bank and shall provide the Bank with a written remediation plan and timeline for any material deficiencies.

Section 6.4 — Record Retention.

(a) The Partner shall retain all records related to End Users and Partner Channel Transactions, including without limitation onboarding records, CDD/EDD documentation, transaction records, communications, compliance records, and audit logs, for a minimum of five (5) years from the date of the transaction or the date the End User's account is closed, whichever is later, or such longer period as required by Applicable Law.

(b) All records shall be maintained in a format that permits timely retrieval and production to the Bank, the OCC, FinCEN, OFAC, the Independent Consultant, or any other regulatory authority, as required. The Partner shall not destroy, alter, or dispose of any such records without the Bank's prior written consent, unless permitted by the Partner's record retention policy as approved by the Bank.

ARTICLE VII — AUDIT, EXAMINATION, AND INSPECTION RIGHTS

Section 7.1 — Bank Audit Rights.

(a) The Bank and its authorized agents, including Calderwood & Harkness LLP as outside regulatory counsel, Caldera & Pope LLP as external auditor and independent BSA/AML testing firm, the Bank's internal audit department, and any successor or replacement audit, testing, or advisory firms engaged by the Bank, shall have the right to audit, examine, and inspect the Partner's books, records, systems, policies, procedures, controls, and personnel to the extent related to the Program Agreement, this Addendum, and the Partner's compliance with Applicable Law.

(b) Audits may be conducted on-site at the Partner's facilities or remotely through electronic access to the Partner's systems, records, and data, at the Bank's election. The Bank shall provide the Partner with at least ten (10) business days' prior written notice of any scheduled audit; provided, however, that in urgent circumstances involving suspected regulatory violations, potential OFAC sanctions violations, suspected financial crimes, or suspicious activity, the Bank may conduct an audit upon twenty-four (24) hours' notice to the Partner.

(c) The Partner shall make available to the Bank and its authorized agents all books, records, systems, data, and information reasonably requested in connection with an audit, and shall make the Partner's personnel, including management, compliance staff, technology staff, and operations staff, available for interviews, consultations, and inquiries during the audit.

(d) Audits conducted by the Bank or its agents shall be at the Bank's expense, except that the Partner shall bear the cost of providing personnel, facilities, and access in connection with such audits. If an audit identifies material compliance deficiencies or violations attributable to the Partner, the Partner shall bear the cost of remediating such deficiencies or violations.

Section 7.2 — Independent Consultant Access.

(a) The Partner shall provide full cooperation and access to Thornfield Consulting Group LLC, the OCC-mandated independent consultant (engagement reference TCG-BRB-2025-001), as reasonably necessary for Thornfield to fulfill its assessment, validation, and reporting functions under the Consent Order.

(b) Such cooperation and access shall include, without limitation: (i) access to the Partner's systems, records, and data related to the Program Agreement and this Addendum; (ii) access to the Partner's personnel for interviews, inquiries, and consultations; (iii) the production of documents, data, and reports as reasonably requested by Thornfield; and (iv) participation in testing, walkthroughs, and validation exercises conducted by Thornfield.

(c) The Partner's cooperation and access obligations under this Section 7.2 shall continue for the duration of the Thornfield engagement, which is currently expected to extend through February 15, 2026, and any extension thereof as directed by the OCC.

Section 7.3 — Regulatory Examination Access.

(a) The Partner acknowledges and agrees that the OCC, FinCEN, OFAC, the FDIC, and other federal and state regulatory authorities have the right, pursuant to Applicable Law and the Bank's charter, to examine the Partner's books, records, systems, and activities to the extent related to the Program Agreement, this Addendum, and the Bank's compliance obligations. Such examination rights include, without limitation, the authority of the OCC to examine the Bank's service providers, contractors, and agents under 12 U.S.C. § 1867(c) and 12 C.F.R. Part 30 (Appendix D).

(b) The Partner shall cooperate fully and promptly with any examination, investigation, or inquiry conducted by any regulatory authority, including by making Partner personnel available for interviews at the regulator's request, producing documents and data as requested, and providing access to the Partner's systems and facilities.

(c) The Partner shall promptly notify the Bank's BSA Officer and General Counsel of any regulatory examination, inquiry, or request for information directed at the Partner that relates to the Program Agreement, this Addendum, or the Bank's compliance obligations. For reference, the current OCC Examiner-in-Charge for the Bank is Jonathan Frey, and the current FinCEN Associate Director responsible for enforcement matters is Angela Drummond.

Section 7.4 — Internal Audit Cooperation.

The Partner shall cooperate fully with the Bank's Head of Internal Audit, Derek Ballard, and the Bank's internal audit department in connection with any internal audit of the BaaS program, the Bank's BSA/AML compliance functions, or the Partner's compliance with this Addendum. Such cooperation shall include, without limitation, providing access to Partner records, systems, and personnel, responding to audit inquiries, and implementing corrective actions identified in internal audit reports.

ARTICLE VIII — REMEDIATION COOPERATION

Section 8.1 — General Remediation Obligation.

(a) The Partner acknowledges the existence and requirements of the Consent Order and the Bank's Comprehensive Remediation Action Plan, and the Partner understands that the Bank's compliance with the Consent Order is a matter of the highest priority and regulatory urgency.

(b) The Partner shall cooperate fully, promptly, and in good faith with the Bank, Calderwood & Harkness LLP, Thornfield Consulting Group LLC, and any other advisors or consultants engaged by the Bank or appointed by the OCC, in all aspects of the Bank's BSA/AML and OFAC remediation as they relate to the Partner's End Users, Partner Channel Transactions, data, systems, and activities.

(c) The Partner's failure to cooperate with remediation efforts as required by this Article VIII, or the Partner's failure to meet the remediation milestones set forth in Section 8.3 (subject to any extensions agreed in writing by the Bank), shall constitute a material breach of this Addendum and the Program Agreement.

Section 8.2 — Specific Remediation Cooperation Obligations.

The Partner shall undertake the following specific remediation cooperation obligations:

(a) Technical and Operational Changes. The Partner shall implement all technical and operational changes to its systems and processes as directed by the Bank to support the Bank's remediation, including without limitation modifications to data feeds, data formats, API integrations, screening workflows, onboarding processes, End User-facing interfaces, and reporting systems.

(b) CDD/EDD Remediation Support. The Partner shall provide prioritized responses to all data requests, document requests, and information inquiries related to the Bank's CDD/EDD remediation of the approximately 47,000 high-risk accounts identified in the Consent Order. The Partner shall collect, verify, and transmit all required CDD/EDD documentation for Partner-attributable accounts within the timeframes specified by the Bank.

(c) SAR Lookback Support. The Partner shall support the Bank's SAR lookback project by providing historical transaction data, End User records, communications, onboarding documentation, and access to Partner personnel with knowledge of the relevant End Users, transactions, and systems.

(d) TMS and OFAC Screening Testing. The Partner shall participate in testing, user acceptance testing, and validation of the Bank's upgraded Transaction Monitoring System (Veridian TMS version 10.0) and OFAC screening platform as they relate to Partner Channel Transactions. The Partner shall devote adequate technical resources to ensure that Partner data feeds and interfaces are fully compatible with the upgraded systems and that testing is completed within the Bank's specified timelines.

(e) End User Disclosures. The Partner shall implement any changes to End User-facing disclosures, terms of service, privacy notices, or other communications as required by the Bank to ensure compliance with Applicable Law, the Consent Order, or the Bank's policies.

Section 8.3 — Remediation Milestones.

The Partner shall comply with the following remediation deadlines, as they apply to the Partner's End Users and Partner Channel Transactions:

The Bank may modify the foregoing milestones upon written notice to the Partner if such modifications are required by the OCC, the Independent Consultant, or changes in the Remediation Action Plan.

Section 8.4 — Cost Allocation.

(a) Unless otherwise agreed by the Parties in a separate written agreement, the Partner shall bear all costs and expenses associated with any modifications, upgrades, changes, or enhancements to the Partner's own systems, processes, staffing, and operations required to comply with this Addendum, including the remediation cooperation obligations set forth in this Article VIII.

(b) The Bank shall bear all costs and expenses associated with modifications, upgrades, changes, or enhancements to the Bank's own systems, processes, staffing, and operations, including the costs of the Bank's Transaction Monitoring System upgrade, OFAC screening platform enhancements, and the engagement of the Independent Consultant and outside regulatory counsel.

(c) Neither Party shall have any obligation to reimburse the other Party for its internal costs of compliance with this Addendum, except as expressly provided herein or in the Program Agreement.

ARTICLE IX — REPRESENTATIONS AND WARRANTIES

Section 9.1 — Partner Representations and Warranties.

The Partner represents and warrants to the Bank, as of the Addendum Effective Date, as follows:

(a) Organization and Good Standing. The Partner is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization, and has the legal capacity and authority to conduct its business as presently conducted and as contemplated under the Program Agreement and this Addendum.

(b) Authority. The Partner has all necessary corporate, limited liability company, or other organizational authority to enter into and perform its obligations under this Addendum. The execution, delivery, and performance of this Addendum by the Partner have been duly authorized by all necessary corporate or organizational action, and this Addendum constitutes a valid, binding, and enforceable obligation of the Partner in accordance with its terms, subject to applicable bankruptcy, insolvency, and equitable principles.

(c) Sanctions Compliance. Neither the Partner, nor any person who directly or indirectly owns or controls the Partner, nor any director, officer, or senior management employee of the Partner, is a person or entity identified on any OFAC Sanctions List or is otherwise subject to U.S. economic sanctions prohibitions. The Partner is not organized or domiciled in, and does not conduct material business operations in, any country or region that is the subject of comprehensive U.S. economic sanctions (currently Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk People's Republic, and Luhansk People's Republic regions of Ukraine).

(d) Compliance Program. The Partner maintains a compliance program, including policies, procedures, controls, training, and dedicated compliance personnel, that is reasonably designed to comply with all Applicable Law relevant to the Partner's activities under the Program Agreement.

(e) Accuracy of Information. All information previously provided by the Partner to the Bank regarding the Partner's compliance program, business model, End Users, Partner Channel Transactions, technology infrastructure, and organizational structure is true, complete, and accurate in all material respects as of the date such information was provided.

(f) No Adverse Proceedings. The Partner is not aware of any pending or threatened enforcement action, investigation, inquiry, consent order, cease-and-desist order, or similar proceeding by any governmental or regulatory authority related to BSA/AML, OFAC, sanctions, or other financial crimes compliance; provided, however, that if the Partner is aware of any such matter, the Partner shall disclose such matter in writing to the Bank prior to execution of this Addendum, and such disclosure shall be attached hereto as a schedule.

Section 9.2 — Ongoing Representations.

The representations and warranties set forth in Section 9.1 shall be deemed repeated and reaffirmed by the Partner: (a) as of the date of each Partner Channel Transaction; (b) as of each quarterly compliance certification date pursuant to Section 10.2; and (c) as of any other date on which the Bank reasonably requests confirmation of such representations and warranties. If at any time any representation or warranty ceases to be true or accurate in any material respect, the Partner shall promptly notify the Bank in writing and shall provide a detailed explanation of the circumstances.

ARTICLE X — REPORTING AND CERTIFICATION

Section 10.1 — Monthly Compliance Reporting.

On a monthly basis, no later than the fifteenth (15th) calendar day following the end of each calendar month, the Partner shall provide the Bank with a monthly compliance report, in a format prescribed by the Bank, covering the following:

(a) End User onboarding volumes for the reporting month, including new accounts opened, accounts closed, and accounts suspended or restricted, together with CDD/EDD completion status for all new and existing End Users, including the number and percentage of accounts with complete CDD documentation, the number and percentage of accounts with complete EDD documentation (for high-risk End Users), and the number and percentage of accounts with pending or incomplete CDD/EDD documentation;

(b) Data transmission quality metrics for the reporting month, including measures of data completeness (percentage of required fields populated), data accuracy (error rates), and data timeliness (percentage of transmissions completed within specified timeframes), together with a description of any data quality issues identified and corrective actions taken;

(c) Compliance training completion rates for Partner personnel, including the number and percentage of relevant personnel who have completed initial training, annual refresher training, and any supplemental training required during the reporting period;

(d) A description of any identified or suspected compliance issues, data breaches, system failures, or regulatory inquiries that occurred during the reporting month, including the nature of the issue, the date of identification, the current status, and the corrective actions being taken; and

(e) The status of any open remediation action items, including the Partner's progress toward meeting the remediation milestones set forth in Section 8.3 and any other action items assigned by the Bank.

Section 10.2 — Quarterly Compliance Certification.

On a quarterly basis, no

CONFIDENTIAL — ATTORNEY WORK PRODUCT — PRIVILEGED AND CONFIDENTIAL
COMPLIANCE ADDENDUM TO BANKING-AS-A-SERVICE PROGRAM AGREEMENT
Template for Execution with All BaaS Partners of Belmont Ridge Bank National Association
Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No.: 1045-00002
Prepared for: Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845
Template — To Be Dated Upon Execution with Each BaaS Partner
DRAFTING NOTE: This Addendum is designed as a model compliance addendum for insertion into each of BRB's fourteen (14) active BaaS partner agreements pursuant to the remediation requirements of OCC Consent Order No. OCC-2025-003 (effective January 15, 2025). Bracketed fields are to be completed for each BaaS Partner upon execution. Exhibits A and B are to be customized for each Partner based on the Partner's specific products, End User base, risk profile, and technical infrastructure.
Right-click to update Table of Contents
PREAMBLE
This Compliance Addendum to Banking-as-a-Service Program Agreement (this "Addendum") is entered into as of the date of execution set forth on the signature page hereof (the "Addendum Effective Date"), by and between:
BELMONT RIDGE BANK NATIONAL ASSOCIATION, a national banking association chartered under 12 U.S.C. § 21 et seq., with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, OCC Charter No. 48271 (the "Bank" or "BRB"),
and
[_______________], a [___] organized under the laws of [___], with its principal office located at [___] (the "BaaS Partner" or "Partner").
The Bank and the Partner are each sometimes referred to herein individually as a "Party" and collectively as the "Parties."
This Addendum supplements and amends that certain Banking-as-a-Service Program Agreement between the Bank and the Partner dated as of [___] (as amended, modified, or supplemented from time to time, the "Program Agreement").
RECITALS
WHEREAS, the Bank operates a Banking-as-a-Service program (the "BaaS Program") through which it sponsors fintech partners to offer financial products and services to end users under the Bank's national bank charter, and the Bank currently maintains fourteen (14) active BaaS partner relationships, including the relationship with the Partner governed by the Program Agreement;
WHEREAS, the Bank and the Partner entered into the Program Agreement, pursuant to which the Partner accesses the Bank's charter and banking infrastructure to offer certain financial products and services to consumers and/or businesses through the Partner's technology platform, subject to the terms, conditions, and regulatory requirements set forth therein;
WHEREAS, the Bank is subject to OCC Consent Order No. OCC-2025-003, effective January 15, 2025 (the "Consent Order"), issued by the Office of the Comptroller of the Currency, which identified significant deficiencies in the Bank's Bank Secrecy Act and Anti-Money Laundering compliance program, including, among other things, inadequate screening of transactions and customers against the sanctions lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), deficient Suspicious Activity Report filing practices, and insufficient Customer Due Diligence and Enhanced Due Diligence for high-risk customers onboarded through fintech partner channels;
WHEREAS, the Bank's BSA/AML compliance program is undergoing a comprehensive remediation pursuant to the Consent Order, which remediation encompasses, among other things, enhanced oversight of all BaaS partner relationships, upgrades to transaction monitoring and OFAC screening infrastructure, remediation of approximately 47,000 high-risk customer accounts that lacked adequate CDD/EDD documentation as of the date of the Consent Order, clearance of a backlog of approximately 2,400 unreviewed suspicious activity alerts, and strengthening of data sharing and information governance between the Bank and its BaaS partners;
WHEREAS, the Bank has engaged Calderwood & Harkness LLP ("C&H") as outside regulatory counsel and Thornfield Consulting Group LLC ("Thornfield") as the OCC-mandated independent consultant to guide, validate, and assess the Bank's remediation efforts;
WHEREAS, BaaS-related Suspicious Activity Reports constituted approximately 54.8% of the Bank's total SARs in calendar year 2024 (2,108 of 3,847 total SARs), and total BaaS transaction volume in calendar year 2024 was approximately $74.3 billion, underscoring the critical importance of robust compliance cooperation between the Bank and each of its BaaS partners;
WHEREAS, this Addendum is being entered into pursuant to the requirements of the Consent Order and the Bank's Comprehensive Remediation Action Plan submitted to the OCC, and is intended to supplement and, where inconsistent, supersede the compliance-related provisions of the Program Agreement to establish enhanced BSA/AML, OFAC, and related compliance obligations for the Partner in connection with the BaaS Program;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE I — DEFINITIONS
Section 1.1 — Definitions. As used in this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Addendum shall have the meanings ascribed to them in the Program Agreement.
"Addendum Effective Date" means the date of execution of this Addendum by both Parties, as set forth on the signature page hereof.
"Applicable Law" means all federal and state laws, rules, regulations, orders, guidelines, and regulatory guidance applicable to the Bank and/or the Partner's activities under the Program Agreement and this Addendum, including without limitation: (a) the Bank Secrecy Act (31 U.S.C. §§ 5311–5332) and its implementing regulations (31 C.F.R. Chapter X); (b) the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Pub. L. 107-56; (c) OFAC regulations (31 C.F.R. Part 500 et seq.); (d) regulations and guidance issued by the Financial Crimes Enforcement Network ("FinCEN"); (e) the regulations, guidance, bulletins, and supervisory standards of the Office of the Comptroller of the Currency ("OCC"), including OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) and its predecessors and successors; (f) the Federal Deposit Insurance Act and implementing regulations of the Federal Deposit Insurance Corporation; and (g) all applicable state money transmission laws, consumer protection laws, and privacy and data security laws.
"BSA/AML Program" means the Bank's Bank Secrecy Act and Anti-Money Laundering compliance program as required by 12 U.S.C. § 1818(s), 12 C.F.R. Part 21, and FinCEN's implementing regulations, including the Bank's internal policies, procedures, controls, independent testing, training, and designation of a BSA compliance officer.
"BSA Officer" means Thomas Ikeda, BSA Officer and AML Program Director of the Bank, or his duly authorized designee or successor as designated by the Bank from time to time in writing.
"CDD" means Customer Due Diligence as required under 31 C.F.R. § 1020.210, FinCEN's Customer Due Diligence Requirements for Financial Institutions (81 Fed. Reg. 29398 (May 11, 2016)), and the Bank's CDD policies and procedures, as updated from time to time.
"Consent Order" means OCC Consent Order No. OCC-2025-003, effective January 15, 2025, and any amendments, modifications, supplements, or successor orders thereto.
"EDD" means Enhanced Due Diligence for high-risk customers as required under the Bank's risk-based BSA/AML policies and procedures, which may include, without limitation, enhanced identification and verification procedures, source of funds and source of wealth inquiries, enhanced ongoing monitoring, and senior management approval for account opening or continuation.
"End Users" means all customers, whether individuals or entities, of the Partner who access, use, or receive banking products or services through the Partner's platform under the Bank's charter pursuant to the Program Agreement.
"Independent Consultant" means Thornfield Consulting Group LLC (engagement reference TCG-BRB-2025-001), or any successor independent consultant appointed pursuant to the Consent Order and approved by the OCC.
"OFAC" means the U.S. Department of the Treasury's Office of Foreign Assets Control.
"OFAC Sanctions Lists" means the Specially Designated Nationals and blocked Persons List (the "SDN List"), the Sectoral Sanctions Identifications List (the "SSI List"), the Consolidated Sanctions List, the Foreign Sanctions Evaders List (the "FSE List"), the Non-SDN Palestinian Legislative Council List, the Non-SDN Menu-Based Sanctions List, and any other sanctions lists, databases, or compilations of sanctioned or blocked persons or entities administered, maintained, or published by OFAC from time to time.
"OCC" means the Office of the Comptroller of the Currency, an independent bureau within the U.S. Department of the Treasury.
"Partner Channel Transactions" means all transactions, including without limitation wire transfers, ACH credit and debit transactions, card transactions (including debit card, prepaid card, and credit card transactions), peer-to-peer transfers, real-time payment transactions, loan originations and disbursements, deposit transactions, and any other financial transactions, that are initiated, processed, facilitated, or settled through the Partner's platform under the Bank's charter pursuant to the Program Agreement.
"Remediation Action Plan" or "RAP" means the Bank's Comprehensive Remediation Action Plan submitted to the OCC pursuant to Article VII of the Consent Order, as amended, supplemented, or updated from time to time, and any successor or supplemental remediation plans submitted to the OCC in connection with the Consent Order.
"SAR" means a Suspicious Activity Report as required under 31 C.F.R. § 1020.320, including any amendments, corrections, or supplements thereto filed with FinCEN.
"Transaction Monitoring System" or "TMS" means the Bank's automated transaction monitoring platform used to detect potentially suspicious activity in customer accounts and transactions, currently Veridian TMS (being upgraded to version 10.0), and any successor or replacement system deployed by the Bank.
Section 1.2 — Interpretation. In this Addendum, unless the context otherwise requires: (a) the singular includes the plural and vice versa; (b) references to "Articles," "Sections," and "Exhibits" are to Articles, Sections, and Exhibits of this Addendum; (c) the words "include," "includes," and "including" are deemed to be followed by the phrase "without limitation"; (d) the words "herein," "hereof," "hereby," "hereunder," and words of similar import refer to this Addendum as a whole and not to any particular provision; (e) "writing" and "written" include electronic communications; and (f) references to any law, regulation, or order include all amendments, modifications, extensions, replacements, and re-enactments thereof.
ARTICLE II — BSA/AML COMPLIANCE OBLIGATIONS
Section 2.1 — General Compliance Obligation. The Partner acknowledges and agrees that the Bank, as the chartered national banking association, bears ultimate regulatory responsibility for compliance with the Bank Secrecy Act, its implementing regulations, OFAC sanctions requirements, and all other Applicable Law with respect to all End Users and all Partner Channel Transactions. The Partner's activities under the Program Agreement are conducted under the Bank's charter and are, from a regulatory perspective, activities of the Bank for purposes of BSA/AML and OFAC compliance. Accordingly, the Partner shall comply with all Applicable Law applicable to its activities under the Program Agreement and this Addendum, and shall cooperate fully and in good faith with the Bank's BSA/AML Program and all related compliance initiatives. The Partner shall not take any action, or fail to take any action, that would cause or contribute to the Bank being in violation of any of its BSA/AML or OFAC obligations, any provision of the Consent Order, the Remediation Action Plan, or any directive, order, or guidance issued by the OCC, FinCEN, OFAC, or any other applicable regulatory authority.
Section 2.2 — Partner BSA/AML Policies and Procedures.
(a) The Partner shall develop, maintain, implement, and enforce its own written BSA/AML and OFAC compliance policies and procedures that are, in all material respects, no less stringent than the Bank's corresponding policies and procedures as provided to the Partner by the Bank and updated from time to time. The Bank shall make its current BSA/AML and OFAC policies and procedures available to the Partner within a reasonable period following the Addendum Effective Date and shall provide updated versions promptly following any material revision.
(b) The Partner shall submit its BSA/AML and OFAC compliance policies and procedures to the Bank for review and prior written approval before implementation. The Partner shall also submit to the Bank for review and prior written approval any proposed material amendment, supplement, or revision to such policies and procedures. The Bank shall use commercially reasonable efforts to complete its review within thirty (30) calendar days of receipt of the Partner's submission; provided, however, that the Bank's failure to respond within such period shall not be deemed to constitute approval.
(c) The Bank reserves the right, at any time and from time to time, to require modifications, enhancements, or supplements to the Partner's BSA/AML and OFAC policies and procedures as the Bank determines, in its reasonable discretion, to be necessary or appropriate to ensure compliance with Applicable Law, the Consent Order, the Remediation Action Plan, or the Bank's own policies and procedures. The Partner shall implement any such required modifications within the timeframe specified by the Bank, which shall not exceed sixty (60) calendar days unless the Bank agrees in writing to a longer implementation period.
Section 2.3 — Partner Compliance Personnel.
(a) The Partner shall designate a qualified compliance officer who shall be responsible for overseeing the Partner's BSA/AML and OFAC compliance obligations under this Addendum and the Program Agreement (the "Partner Compliance Officer"). The Partner Compliance Officer shall possess education, training, and experience commensurate with the complexity, volume, and risk profile of the Partner's activities under the Program Agreement. The Partner shall notify the Bank in writing of the identity, qualifications, and contact information of the Partner Compliance Officer within thirty (30) calendar days of the Addendum Effective Date.
(b) The Partner Compliance Officer shall serve as the primary point of contact for the Bank's BSA Officer (Thomas Ikeda) and Chief Compliance Officer (Patricia Langston) on all BSA/AML, OFAC, and related compliance matters arising under this Addendum and the Program Agreement. The Partner Compliance Officer shall be available for regular communications, meetings, and consultations with the Bank's compliance personnel at reasonable times and upon reasonable notice.
(c) The Partner shall maintain adequate compliance staffing, including appropriately qualified analysts, investigators, and support personnel, commensurate with the volume and risk profile of Partner Channel Transactions and the number of End Users served through the Partner's platform. The Bank shall have the right to review the adequacy of the Partner's compliance staffing as part of its periodic risk assessments of the Partner under Article XI of this Addendum, and the Partner shall promptly address any staffing deficiencies identified by the Bank.
(d) The Partner shall promptly notify the Bank in writing of any change in the identity or qualifications of the Partner Compliance Officer, or of any material reduction in the Partner's compliance staffing, within five (5) business days of such change or reduction.
Section 2.4 — Partner Training.
(a) The Partner shall ensure that all Partner personnel who are involved in, or who have responsibility for, End User onboarding, transaction processing, customer service, complaint handling, fraud prevention, and compliance functions receive initial and ongoing BSA/AML and OFAC training that is consistent with the Bank's enterprise-wide training standards as communicated to the Partner from time to time. Such training shall cover, at a minimum: (i) the requirements of the Bank Secrecy Act, FinCEN regulations, and OFAC sanctions programs; (ii) the Partner's and Bank's respective BSA/AML and OFAC policies and procedures; (iii) identification and escalation of suspicious activity; (iv) CDD and EDD requirements; (v) OFAC sanctions screening and interdiction procedures; (vi) SAR confidentiality and anti-tipping-off requirements; and (vii) the provisions of this Addendum.
(b) Training shall be provided to all relevant Partner personnel within sixty (60) calendar days of the Addendum Effective Date (for existing personnel) and within thirty (30) calendar days of the commencement of employment or assignment (for new personnel). Refresher training shall be provided at least annually thereafter, and supplemental training shall be provided as necessary in response to changes in Applicable Law, the Bank's policies, or identified compliance deficiencies.
(c) The Partner shall maintain records documenting the completion of all required training, including the names of trained personnel, the dates of training, the topics covered, and the training materials used. The Partner shall provide evidence of training completion to the Bank upon request, and no later than thirty (30) calendar days following the end of each calendar quarter.
ARTICLE III — CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE
Section 3.1 — CDD Obligations.
(a) The Bank retains ultimate responsibility for performing and ensuring the adequacy of Customer Due Diligence on all End Users, including compliance with the Customer Identification Program ("CIP") requirements under 31 C.F.R. § 1020.220 and the beneficial ownership requirements for legal entity customers under 31 C.F.R. § 1010.230 (the "Beneficial Ownership Rule"). Nothing in this Addendum or the Program Agreement shall be construed to relieve the Bank of its regulatory responsibility for CDD, nor shall the delegation of certain CDD collection functions to the Partner limit or reduce the Bank's obligations in any respect.
(b) The Partner is delegated certain CDD collection functions as specifically delineated in the BaaS Partner CDD/EDD Responsibility Matrix attached to this Addendum as Exhibit A and incorporated herein by reference (the "Responsibility Matrix"). All such delegated functions are performed by the Partner as agent of the Bank and are subject at all times to the Bank's oversight, direction, and approval. The Bank reserves the right to modify, expand, restrict, or revoke the scope of delegated CDD functions at any time upon written notice to the Partner.
(c) The Partner shall collect all required CDD information, including all identity verification data, documentary and non-documentary verification evidence, and beneficial ownership information, at the point of End User onboarding and shall transmit such information to the Bank in real-time or within the timeframes specified in the Responsibility Matrix. All CDD data shall be transmitted through the secure data interfaces and in the data formats specified in the technical specifications attached as Exhibit B.
(d) All CDD documentation shall be collected, verified, and maintained in accordance with the Bank's revised CDD/EDD Policy, as updated from time to time and provided to the Partner by the Bank. The Partner shall not onboard any End User, or permit any End User to open an account or conduct a transaction, unless and until the Bank has confirmed that the minimum required CDD information has been received and verified, unless the Bank has provided a prior written exception for specific, defined circumstances.
(e) The Partner shall cooperate with the Bank in performing periodic re-verification of End User identity information and in validating the accuracy and completeness of CDD records, in accordance with the Bank's CDD refresh schedule as communicated to the Partner from time to time.
Section 3.2 — Enhanced Due Diligence for High-Risk End Users.
(a) The Partner shall cooperate fully with the Bank in identifying and flagging End Users who meet the Bank's criteria for Enhanced Due Diligence, as set forth in the Bank's EDD policies and procedures and as communicated to the Partner from time to time. Categories of End Users that may be subject to EDD include, without limitation: (i) politically exposed persons ("PEPs") and their close associates and family members; (ii) End Users domiciled in or conducting significant transactions with persons in countries or regions identified by the Bank, OFAC, FinCEN, or the Financial Action Task Force ("FATF") as high-risk for money laundering or terrorist financing; (iii) End Users exhibiting unusual or unexplained transaction patterns; (iv) high-volume or high-value accounts; (v) End Users operating in industries associated with elevated money laundering or financial crimes risk; and (vi) any other categories designated by the Bank based on its risk assessment.
(b) Upon notification by the Bank that an End User has been designated for EDD, or upon the Partner's own identification of an End User meeting EDD criteria, the Partner shall collect and transmit to the Bank all additional EDD documentation as directed by the Bank within ten (10) business days of the Bank's request. Such EDD documentation may include, without limitation, enhanced identity verification, source of funds documentation, source of wealth documentation, purpose of account information, nature and expected pattern of account activity, references or attestations, and any other information specified by the Bank.
(c) The Partner acknowledges that the Bank identified approximately 47,000 high-risk customer accounts — primarily onboarded through fintech partner channels — that lacked adequate CDD/EDD documentation as of the date of the Consent Order. The Partner shall cooperate fully and on a prioritized basis with the Bank's remediation of any such accounts attributable to the Partner's End Users. Such cooperation shall include the collection, verification, and transmission of CDD/EDD documentation for remediated accounts in accordance with the Bank's phased remediation milestones, specifically: (i) fifty percent (50%) completion of remediation of Partner-attributable accounts by July 15, 2025; and (ii) one hundred percent (100%) completion of remediation of Partner-attributable accounts by January 15, 2026.
(d) If an End User subject to EDD fails to provide the required documentation within the timeframe specified by the Bank, or if the Bank determines that the EDD information obtained is insufficient or unsatisfactory, the Bank shall have the right to restrict, suspend, or close the End User's account and to direct the Partner to take corresponding action on the Partner's platform, including restriction or suspension of access.
Section 3.3 — Ongoing Monitoring of End User Information.
(a) The Partner shall implement and maintain procedures to ensure that End User information is kept current and accurate throughout the life of the End User's account or relationship. Such procedures shall include periodic refresh of CDD and EDD documentation at intervals specified by the Bank, which intervals may vary based on the End User's risk rating.
(b) The Partner shall promptly notify the Bank of any material change in End User information of which the Partner becomes aware, including without limitation any change of name, address, beneficial ownership, organizational structure, nature of business, source of funds, or anticipated transaction activity, within five (5) business days of becoming aware of such change.
(c) The Partner shall implement automated and manual controls to detect changes in End User information and shall provide the Bank with updated information in accordance with the data transmission requirements of Exhibit B.
Section 3.4 — Risk Rating Cooperation.
(a) The Partner shall cooperate with the Bank in assigning and maintaining risk ratings for all End Users, using the Bank's risk rating methodology as provided to the Partner from time to time. The Bank shall retain sole discretion and authority over the assignment and modification of End User risk ratings.
(b) The Partner shall provide to the Bank all data and information reasonably necessary for the Bank to perform initial and ongoing risk assessments of End Users, including End User demographic data, transaction history, geographic information, product usage data, and any other information specified by the Bank.
(c) The Partner shall promptly implement any changes to End User account treatment, monitoring levels, transaction limits, or product restrictions that the Bank directs based on changes in End User risk ratings.
ARTICLE IV — OFAC SANCTIONS SCREENING
Section 4.1 — Bank's OFAC Screening Obligation.
(a) The Bank shall screen one hundred percent (100%) of Partner Channel Transactions and all End Users and their associated parties (including beneficial owners, originators, and beneficiaries) against the OFAC Sanctions Lists. The Bank shall maintain and operate sanctions screening systems and processes reasonably designed to ensure that no Partner Channel Transaction or End User account activity violates any OFAC sanctions program.
(b) Screening shall occur in real-time (i.e., prior to transaction authorization or settlement) for all wire transfers, international ACH transactions, and other high-risk transaction types designated by the Bank. Screening shall occur in batch mode (i.e., within twenty-four (24) hours of transaction initiation) for lower-risk transaction types, in each case in accordance with the Bank's revised OFAC Screening Procedures Manual as updated from time to time. The Bank shall determine, in its sole discretion, which transaction types are subject to real-time versus batch screening, and shall communicate such determinations to the Partner.
(c) The Partner acknowledges that the Consent Order identified a failure by the Bank to screen approximately twelve percent (12%) of transactions in one BaaS partner channel, resulting in approximately 3,800,000 transactions going unscreened in calendar year 2023 out of approximately 31,700,000 total transactions in that channel. This Addendum is designed, in part, to ensure that no such screening gaps recur in any BaaS partner channel, including the Partner's channel. The Partner shall cooperate fully with the Bank in implementing the technical, operational, and procedural measures necessary to achieve and maintain complete OFAC screening coverage.
Section 4.2 — Partner Data Obligations for OFAC Screening.
(a) The Partner shall transmit to the Bank, in the data format and through the technical interfaces specified by the Bank in Exhibit B, all transaction data and End User identifying information necessary for the Bank to perform complete, accurate, and timely OFAC screening of all Partner Channel Transactions and End Users. Such data shall include, at a minimum, all fields required by the Bank's OFAC screening system, including originator name and address, beneficiary name and address, intermediary financial institution information (where applicable), transaction amount, currency, date and time, and any other data fields specified by the Bank.
(b) All transaction data required for OFAC screening shall be transmitted in real-time or in advance of transaction settlement, as specified in the technical specifications attached as Exhibit B. For transactions subject to real-time screening, the Partner shall transmit complete screening data to the Bank prior to the Partner's authorization or processing of the transaction.
(c) The Partner shall not process, authorize, settle, or permit the completion of any Partner Channel Transaction until the Bank has confirmed that OFAC screening has been completed and no blocking or rejection is required, unless the Bank has provided a prior written exception for specified low-risk transaction types that are processed in batch mode. Any such written exception shall specify the transaction types covered, the maximum transaction value thresholds (if applicable), and the batch screening timeline. The Bank may revoke any such exception at any time upon written notice to the Partner.
Section 4.3 — OFAC Hit Disposition and blocking.
(a) If the Bank identifies a potential OFAC match (a "true positive") involving a Partner Channel Transaction or an End User, the Bank shall block, reject, or freeze the relevant transaction or account in accordance with OFAC regulations, including the requirement to file a blocked property report with OFAC within ten (10) business days of blocking.
(b) The Partner shall cooperate immediately and fully with the Bank's interdiction and blocking procedures. Upon notification by the Bank that a transaction or account has been blocked, rejected, or frozen, the Partner shall: (i) suspend access to any affected End User account on the Partner's platform within two (2) hours of notification by the Bank; (ii) prevent the affected End User from initiating any new transactions through the Partner's platform; (iii) preserve all records and communications related to the affected End User and the blocked or rejected transaction; and (iv) provide to the Bank any additional information or documentation related to the affected End User or transaction as the Bank may request.
(c) The Partner shall not release, unfreeze, restore access to, or otherwise permit the completion of any blocked, rejected, or frozen transaction or account without the Bank's prior written authorization. Any such release or restoration shall be made only in accordance with an OFAC-issued specific license or other applicable authorization.
(d) The Partner shall not communicate to any End User or third party the specific reason for any blocking, rejection, or account suspension that is related to OFAC sanctions, except as the Bank may expressly authorize or as required by Applicable Law.
Section 4.4 — OFAC Screening Remediation Cooperation.
(a) The Partner acknowledges the Bank's obligation under the Consent Order and the Remediation Action Plan to achieve full OFAC screening operationalization for all BaaS channels by November 1, 2025.
(b) The Partner shall cooperate fully with the Bank in implementing any system changes, data format modifications, API integrations, process adjustments, or other technical or operational measures necessary to achieve one hundred percent (100%) OFAC screening coverage for all Partner Channel Transactions and End Users. The Partner shall complete any required technical work on the Partner's systems within the timelines specified by the Bank, and shall devote adequate technical and operational resources to ensure timely completion.
(c) The Partner shall participate in testing, user acceptance testing, and validation activities conducted by the Bank in connection with the deployment of new or upgraded OFAC screening systems or processes, as they relate to Partner Channel Transactions, and shall promptly remediate any issues identified during such testing.
ARTICLE V — TRANSACTION MONITORING AND SUSPICIOUS ACTIVITY REPORTING
Section 5.1 — Bank's Transaction Monitoring.
(a) The Bank shall maintain and operate a Transaction Monitoring System to monitor all Partner Channel Transactions for potentially suspicious activity, in accordance with the Bank's BSA/AML Program and Applicable Law. The Bank's TMS is currently being upgraded to Veridian TMS version 10.0, with user acceptance testing completion targeted for August 1, 2025, and full production deployment and independent model validation targeted for October 1, 2025.
(b) The Partner acknowledges that the Bank's Transaction Monitoring System had not been subject to independent model validation since March 2021 and that tuning parameters for the system were last updated in October 2022, both of which deficiencies were identified in the Consent Order. The upgrade to Veridian TMS version 10.0, independent model validation, and comprehensive re-tuning of monitoring scenarios and parameters are remediation priorities under the Remediation Action Plan, and the Partner's cooperation with these efforts is essential.
(c) The Bank shall have sole responsibility and authority for the operation, calibration, tuning, and validation of the Transaction Monitoring System. The Partner shall have no access to, or control over, the Bank's TMS, except as the Bank may expressly provide in writing for purposes of testing or data validation.
Section 5.2 — Partner Data Transmission for Transaction Monitoring.
(a) The Partner shall transmit to the Bank complete, accurate, and timely transaction data for all Partner Channel Transactions in the format and at the frequency specified in Exhibit B. Data transmissions shall be made through the secure interfaces and using the protocols designated by the Bank, and shall include all data fields required by the Bank's Transaction Monitoring System.
(b) Transaction data transmitted by the Partner to the Bank for transaction monitoring purposes shall include, at a minimum, the following fields: (i) originator and/or account holder name and identifying information; (ii) beneficiary name and identifying information (for transfer transactions); (iii) transaction amount and currency; (iv) transaction date and time (including time zone); (v) transaction type (e.g., wire transfer, ACH, card, P2P, deposit, loan disbursement); (vi) geographic identifiers, including originator and beneficiary location, IP address (where available), and device geolocation data (where available); (vii) account number and any associated reference numbers; and (viii) any other data fields reasonably requested by the Bank from time to time.
(c) The Partner shall promptly notify the Bank of any data transmission failures, delays, interruptions, or data quality issues that could affect the completeness, accuracy, or timeliness of data available to the Bank's Transaction Monitoring System. Such notification shall be made to the Bank's BSA Officer and Chief Information Officer (Linda Petrosian) within four (4) hours of the Partner's identification of the issue, and shall include a description of the issue, the estimated volume of affected data, and the Partner's plan for remediation.
Section 5.3 — SAR Cooperation.
(a) The Bank is solely responsible for determining whether to file a Suspicious Activity Report with FinCEN in connection with any End User or Partner Channel Transaction. The decision to file, or to decline to file, a SAR rests exclusively with the Bank and may not be delegated to the Partner or any other third party.
(b) Notwithstanding the Bank's sole responsibility for SAR filing decisions, the Partner shall cooperate fully, promptly, and in good faith with the Bank in connection with all SAR-related investigations, including by providing the following upon the Bank's request:
(i) Complete transaction histories for End Users under investigation, including all Partner Channel Transactions and, to the extent available, any transactions or activity on the Partner's platform that do not constitute Partner Channel Transactions;
(ii) End User communications, including email, in-app messaging, chat logs, and telephone records (to the extent maintained by the Partner);
(iii) Application data, onboarding records, identity verification records, and all CDD/EDD documentation collected by the Partner for the End User;
(iv) Access to Partner personnel who have knowledge of the End User, the transaction under investigation, or the Partner's systems and processes relevant to the investigation, for purposes of interviews, consultations, or written inquiries; and
(v) Any other data, records, or information in the Partner's possession or control that the Bank reasonably determines is necessary for the investigation or for the preparation of a SAR filing.
(c) The Partner shall respond to Bank inquiries related to SAR investigations within five (5) business days of receipt of the Bank's request. For escalated or urgent matters (as designated by the Bank's BSA Officer), the Partner shall respond within two (2) business days.
(d) The Partner shall not disclose to any End User, any third party, or any person not authorized by the Bank or by Applicable Law the existence or contents of any SAR or the existence of any SAR investigation. The Partner acknowledges the safe harbor and anti-tipping-off provisions of 31 U.S.C. § 5318(g)(2) and agrees to comply strictly with such provisions.
(e) The Partner acknowledges that BaaS-related SARs constituted approximately 2,108 of the Bank's 3,847 total SARs filed in calendar year 2024 (approximately 54.8% of total SARs), and that timely and thorough Partner cooperation is essential to the Bank's ability to meet its regulatory obligations for suspicious activity detection, investigation, and reporting.
Section 5.4 — SAR Backlog Remediation Cooperation.
(a) The Partner shall provide prioritized support to the Bank in connection with the Bank's clearance of a backlog of approximately 2,400 unreviewed suspicious activity alerts that were outstanding as of September 2024, as identified in the Consent Order. The Bank's target clearance date for the alert backlog is June 30, 2025.
(b) Such support shall include expedited responses to all data requests, document requests, and information inquiries from the Bank's BSA/AML investigations team and/or the Bank's external BSA/AML testing firm (Caldera & Pope LLP) that relate to alerts in the backlog involving the Partner's End Users or Partner Channel Transactions. The Partner shall use its best efforts to respond to such backlog-related requests within three (3) business days of receipt.
(c) The Partner shall designate a specific point of contact for backlog-related inquiries, who shall be available to the Bank's BSA/AML investigations team during normal business hours (Eastern Time) on all business days.
Section 5.5 — Suspicious Activity Escalation by Partner.
(a) The Partner shall promptly escalate to the Bank's BSA Officer any activity, transaction, pattern, or circumstance that the Partner identifies or suspects may constitute money laundering, terrorist financing, fraud, structuring, sanctions evasion, or other financial crime involving an End User or Partner Channel Transaction.
(b) Such escalation shall occur within twenty-four (24) hours of the Partner's identification or reasonable suspicion of the activity, and shall be made in writing (via email or secure portal, as designated by the Bank) to the Bank's BSA Officer and Chief Compliance Officer, with sufficient detail to enable the Bank to assess the activity, including the End User's identifying information, a description of the suspicious activity or pattern, and any supporting documentation.
(c) The Partner shall not independently file a SAR with FinCEN with respect to any End User or Partner Channel Transaction without the Bank's prior written consent. All SAR filing decisions shall be made by the Bank.
ARTICLE VI — DATA SHARING AND INFORMATION REQUIREMENTS
Section 6.1 — General Data Sharing Obligation.
(a) The Partner shall provide the Bank with access to all data, records, documents, and information in the Partner's possession or control that is reasonably necessary for the Bank to fulfill its obligations under the BSA/AML Program, OFAC sanctions compliance requirements, CDD/EDD policies, SAR filing obligations, Currency Transaction Report ("CTR") filing obligations, and all other regulatory reporting and compliance obligations.
(b) The Partner shall maintain all data in formats compatible with the Bank's systems, as specified in Exhibit B, and shall implement any format changes, data field additions, or system modifications reasonably requested by the Bank in connection with the Bank's compliance obligations or system upgrades. The Partner shall complete any such changes within the timeframes specified by the Bank.
(c) The Partner grants to the Bank a non-exclusive, royalty-free, irrevocable right and license to access, use, copy, retain, and disclose all data provided by the Partner pursuant to this Addendum for purposes of compliance with Applicable Law, the Consent Order, the Remediation Action Plan, and the Bank's BSA/AML Program, including disclosure to the OCC, FinCEN, OFAC, the Independent Consultant, and any other governmental authority as required or permitted by law.
Section 6.2 — Real-Time and Periodic Reporting.
The Partner shall provide the Bank with the following data and reports:
(a) Real-Time Transaction Data Feeds. Real-time data feeds for all Partner Channel Transactions, transmitted through the secure interfaces and in the data formats specified in Exhibit B, sufficient to enable the Bank to perform OFAC screening and transaction monitoring on a real-time or near-real-time basis.
(b) Daily Onboarding and Account Activity Reports. Daily reports, delivered by 8:00 a.m. Eastern Time on the following business day, covering: (i) all new End User accounts opened on the prior business day, including all CDD information collected; (ii) all End User accounts closed, suspended, or restricted on the prior business day; and (iii) summary account activity data for all active End User accounts.
(c) Monthly Aggregate Reports. Monthly reports, delivered within ten (10) business days following the end of each calendar month, covering: (i) aggregate Partner Channel Transaction volumes by transaction type; (ii) total End User counts (new, active, closed, and suspended); (iii) compliance metrics, including CDD/EDD completion rates, data quality metrics, training completion rates, and the number and nature of compliance escalations; and (iv) such other metrics as the Bank may reasonably request.
(d) Ad Hoc Data Extracts. Ad hoc data extracts, reports, and information as reasonably requested by the Bank from time to time, delivered within the timeframes specified by the Bank (which shall not be less than five (5) business days, except in urgent circumstances).
Section 6.3 — Data Quality Standards.
(a) The Partner represents and warrants that all data provided to the Bank pursuant to this Addendum shall be complete, accurate, and timely. "Complete" means that all required data fields are populated with the specified information. "Accurate" means that the data is correct, corresponds to the underlying records, and has been validated through appropriate quality controls. "Timely" means that the data is transmitted within the timeframes specified in this Addendum and Exhibit B.
(b) The Partner shall implement and maintain data quality controls reasonably designed to ensure the completeness, accuracy, and timeliness of all data transmitted to the Bank. Such controls shall include, at a minimum: (i) input validation checks at the point of data capture; (ii) automated error detection and alerting mechanisms; (iii) reconciliation procedures to compare transmitted data against source records; and (iv) periodic data quality assessments.
(c) The Bank shall have the right, exercisable at any time upon reasonable notice, to audit the Partner's data quality controls, procedures, and systems, and to review reports and metrics related to data quality. The Partner shall promptly remediate any data quality deficiencies identified by the Bank and shall provide the Bank with a written remediation plan and timeline for any material deficiencies.
Section 6.4 — Record Retention.
(a) The Partner shall retain all records related to End Users and Partner Channel Transactions, including without limitation onboarding records, CDD/EDD documentation, transaction records, communications, compliance records, and audit logs, for a minimum of five (5) years from the date of the transaction or the date the End User's account is closed, whichever is later, or such longer period as required by Applicable Law.
(b) All records shall be maintained in a format that permits timely retrieval and production to the Bank, the OCC, FinCEN, OFAC, the Independent Consultant, or any other regulatory authority, as required. The Partner shall not destroy, alter, or dispose of any such records without the Bank's prior written consent, unless permitted by the Partner's record retention policy as approved by the Bank.
ARTICLE VII — AUDIT, EXAMINATION, AND INSPECTION RIGHTS
Section 7.1 — Bank Audit Rights.
(a) The Bank and its authorized agents, including Calderwood & Harkness LLP as outside regulatory counsel, Caldera & Pope LLP as external auditor and independent BSA/AML testing firm, the Bank's internal audit department, and any successor or replacement audit, testing, or advisory firms engaged by the Bank, shall have the right to audit, examine, and inspect the Partner's books, records, systems, policies, procedures, controls, and personnel to the extent related to the Program Agreement, this Addendum, and the Partner's compliance with Applicable Law.
(b) Audits may be conducted on-site at the Partner's facilities or remotely through electronic access to the Partner's systems, records, and data, at the Bank's election. The Bank shall provide the Partner with at least ten (10) business days' prior written notice of any scheduled audit; provided, however, that in urgent circumstances involving suspected regulatory violations, potential OFAC sanctions violations, suspected financial crimes, or suspicious activity, the Bank may conduct an audit upon twenty-four (24) hours' notice to the Partner.
(c) The Partner shall make available to the Bank and its authorized agents all books, records, systems, data, and information reasonably requested in connection with an audit, and shall make the Partner's personnel, including management, compliance staff, technology staff, and operations staff, available for interviews, consultations, and inquiries during the audit.
(d) Audits conducted by the Bank or its agents shall be at the Bank's expense, except that the Partner shall bear the cost of providing personnel, facilities, and access in connection with such audits. If an audit identifies material compliance deficiencies or violations attributable to the Partner, the Partner shall bear the cost of remediating such deficiencies or violations.
Section 7.2 — Independent Consultant Access.
(a) The Partner shall provide full cooperation and access to Thornfield Consulting Group LLC, the OCC-mandated independent consultant (engagement reference TCG-BRB-2025-001), as reasonably necessary for Thornfield to fulfill its assessment, validation, and reporting functions under the Consent Order.
(b) Such cooperation and access shall include, without limitation: (i) access to the Partner's systems, records, and data related to the Program Agreement and this Addendum; (ii) access to the Partner's personnel for interviews, inquiries, and consultations; (iii) the production of documents, data, and reports as reasonably requested by Thornfield; and (iv) participation in testing, walkthroughs, and validation exercises conducted by Thornfield.
(c) The Partner's cooperation and access obligations under this Section 7.2 shall continue for the duration of the Thornfield engagement, which is currently expected to extend through February 15, 2026, and any extension thereof as directed by the OCC.
Section 7.3 — Regulatory Examination Access.
(a) The Partner acknowledges and agrees that the OCC, FinCEN, OFAC, the FDIC, and other federal and state regulatory authorities have the right, pursuant to Applicable Law and the Bank's charter, to examine the Partner's books, records, systems, and activities to the extent related to the Program Agreement, this Addendum, and the Bank's compliance obligations. Such examination rights include, without limitation, the authority of the OCC to examine the Bank's service providers, contractors, and agents under 12 U.S.C. § 1867(c) and 12 C.F.R. Part 30 (Appendix D).
(b) The Partner shall cooperate fully and promptly with any examination, investigation, or inquiry conducted by any regulatory authority, including by making Partner personnel available for interviews at the regulator's request, producing documents and data as requested, and providing access to the Partner's systems and facilities.
(c) The Partner shall promptly notify the Bank's BSA Officer and General Counsel of any regulatory examination, inquiry, or request for information directed at the Partner that relates to the Program Agreement, this Addendum, or the Bank's compliance obligations. For reference, the current OCC Examiner-in-Charge for the Bank is Jonathan Frey, and the current FinCEN Associate Director responsible for enforcement matters is Angela Drummond.
Section 7.4 — Internal Audit Cooperation.
The Partner shall cooperate fully with the Bank's Head of Internal Audit, Derek Ballard, and the Bank's internal audit department in connection with any internal audit of the BaaS program, the Bank's BSA/AML compliance functions, or the Partner's compliance with this Addendum. Such cooperation shall include, without limitation, providing access to Partner records, systems, and personnel, responding to audit inquiries, and implementing corrective actions identified in internal audit reports.
ARTICLE VIII — REMEDIATION COOPERATION
Section 8.1 — General Remediation Obligation.
(a) The Partner acknowledges the existence and requirements of the Consent Order and the Bank's Comprehensive Remediation Action Plan, and the Partner understands that the Bank's compliance with the Consent Order is a matter of the highest priority and regulatory urgency.
(b) The Partner shall cooperate fully, promptly, and in good faith with the Bank, Calderwood & Harkness LLP, Thornfield Consulting Group LLC, and any other advisors or consultants engaged by the Bank or appointed by the OCC, in all aspects of the Bank's BSA/AML and OFAC remediation as they relate to the Partner's End Users, Partner Channel Transactions, data, systems, and activities.
(c) The Partner's failure to cooperate with remediation efforts as required by this Article VIII, or the Partner's failure to meet the remediation milestones set forth in Section 8.3 (subject to any extensions agreed in writing by the Bank), shall constitute a material breach of this Addendum and the Program Agreement.
Section 8.2 — Specific Remediation Cooperation Obligations.
The Partner shall undertake the following specific remediation cooperation obligations:
(a) Technical and Operational Changes. The Partner shall implement all technical and operational changes to its systems and processes as directed by the Bank to support the Bank's remediation, including without limitation modifications to data feeds, data formats, API integrations, screening workflows, onboarding processes, End User-facing interfaces, and reporting systems.
(b) CDD/EDD Remediation Support. The Partner shall provide prioritized responses to all data requests, document requests, and information inquiries related to the Bank's CDD/EDD remediation of the approximately 47,000 high-risk accounts identified in the Consent Order. The Partner shall collect, verify, and transmit all required CDD/EDD documentation for Partner-attributable accounts within the timeframes specified by the Bank.
(c) SAR Lookback Support. The Partner shall support the Bank's SAR lookback project by providing historical transaction data, End User records, communications, onboarding documentation, and access to Partner personnel with knowledge of the relevant End Users, transactions, and systems.
(d) TMS and OFAC Screening Testing. The Partner shall participate in testing, user acceptance testing, and validation of the Bank's upgraded Transaction Monitoring System (Veridian TMS version 10.0) and OFAC screening platform as they relate to Partner Channel Transactions. The Partner shall devote adequate technical resources to ensure that Partner data feeds and interfaces are fully compatible with the upgraded systems and that testing is completed within the Bank's specified timelines.
(e) End User Disclosures. The Partner shall implement any changes to End User-facing disclosures, terms of service, privacy notices, or other communications as required by the Bank to ensure compliance with Applicable Law, the Consent Order, or the Bank's policies.
Section 8.3 — Remediation Milestones.
The Partner shall comply with the following remediation deadlines, as they apply to the Partner's End Users and Partner Channel Transactions:
The Bank may modify the foregoing milestones upon written notice to the Partner if such modifications are required by the OCC, the Independent Consultant, or changes in the Remediation Action Plan.
Section 8.4 — Cost Allocation.
(a) Unless otherwise agreed by the Parties in a separate written agreement, the Partner shall bear all costs and expenses associated with any modifications, upgrades, changes, or enhancements to the Partner's own systems, processes, staffing, and operations required to comply with this Addendum, including the remediation cooperation obligations set forth in this Article VIII.
(b) The Bank shall bear all costs and expenses associated with modifications, upgrades, changes, or enhancements to the Bank's own systems, processes, staffing, and operations, including the costs of the Bank's Transaction Monitoring System upgrade, OFAC screening platform enhancements, and the engagement of the Independent Consultant and outside regulatory counsel.
(c) Neither Party shall have any obligation to reimburse the other Party for its internal costs of compliance with this Addendum, except as expressly provided herein or in the Program Agreement.
ARTICLE IX — REPRESENTATIONS AND WARRANTIES
Section 9.1 — Partner Representations and Warranties.
The Partner represents and warrants to the Bank, as of the Addendum Effective Date, as follows:
(a) Organization and Good Standing. The Partner is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization, and has the legal capacity and authority to conduct its business as presently conducted and as contemplated under the Program Agreement and this Addendum.
(b) Authority. The Partner has all necessary corporate, limited liability company, or other organizational authority to enter into and perform its obligations under this Addendum. The execution, delivery, and performance of this Addendum by the Partner have been duly authorized by all necessary corporate or organizational action, and this Addendum constitutes a valid, binding, and enforceable obligation of the Partner in accordance with its terms, subject to applicable bankruptcy, insolvency, and equitable principles.
(c) Sanctions Compliance. Neither the Partner, nor any person who directly or indirectly owns or controls the Partner, nor any director, officer, or senior management employee of the Partner, is a person or entity identified on any OFAC Sanctions List or is otherwise subject to U.S. economic sanctions prohibitions. The Partner is not organized or domiciled in, and does not conduct material business operations in, any country or region that is the subject of comprehensive U.S. economic sanctions (currently Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk People's Republic, and Luhansk People's Republic regions of Ukraine).
(d) Compliance Program. The Partner maintains a compliance program, including policies, procedures, controls, training, and dedicated compliance personnel, that is reasonably designed to comply with all Applicable Law relevant to the Partner's activities under the Program Agreement.
(e) Accuracy of Information. All information previously provided by the Partner to the Bank regarding the Partner's compliance program, business model, End Users, Partner Channel Transactions, technology infrastructure, and organizational structure is true, complete, and accurate in all material respects as of the date such information was provided.
(f) No Adverse Proceedings. The Partner is not aware of any pending or threatened enforcement action, investigation, inquiry, consent order, cease-and-desist order, or similar proceeding by any governmental or regulatory authority related to BSA/AML, OFAC, sanctions, or other financial crimes compliance; provided, however, that if the Partner is aware of any such matter, the Partner shall disclose such matter in writing to the Bank prior to execution of this Addendum, and such disclosure shall be attached hereto as a schedule.
Section 9.2 — Ongoing Representations.
The representations and warranties set forth in Section 9.1 shall be deemed repeated and reaffirmed by the Partner: (a) as of the date of each Partner Channel Transaction; (b) as of each quarterly compliance certification date pursuant to Section 10.2; and (c) as of any other date on which the Bank reasonably requests confirmation of such representations and warranties. If at any time any representation or warranty ceases to be true or accurate in any material respect, the Partner shall promptly notify the Bank in writing and shall provide a detailed explanation of the circumstances.
ARTICLE X — REPORTING AND CERTIFICATION
Section 10.1 — Monthly Compliance Reporting.
On a monthly basis, no later than the fifteenth (15th) calendar day following the end of each calendar month, the Partner shall provide the Bank with a monthly compliance report, in a format prescribed by the Bank, covering the following:
(a) End User onboarding volumes for the reporting month, including new accounts opened, accounts closed, and accounts suspended or restricted, together with CDD/EDD completion status for all new and existing End Users, including the number and percentage of accounts with complete CDD documentation, the number and percentage of accounts with complete EDD documentation (for high-risk End Users), and the number and percentage of accounts with pending or incomplete CDD/EDD documentation;
(b) Data transmission quality metrics for the reporting month, including measures of data completeness (percentage of required fields populated), data accuracy (error rates), and data timeliness (percentage of transmissions completed within specified timeframes), together with a description of any data quality issues identified and corrective actions taken;
(c) Compliance training completion rates for Partner personnel, including the number and percentage of relevant personnel who have completed initial training, annual refresher training, and any supplemental training required during the reporting period;
(d) A description of any identified or suspected compliance issues, data breaches, system failures, or regulatory inquiries that occurred during the reporting month, including the nature of the issue, the date of identification, the current status, and the corrective actions being taken; and
(e) The status of any open remediation action items, including the Partner's progress toward meeting the remediation milestones set forth in Section 8.3 and any other action items assigned by the Bank.
Section 10.2 — Quarterly Compliance Certification.
On a quarterly basis, no

CONFIDENTIAL — ATTORNEY WORK PRODUCT — PRIVILEGED AND CONFIDENTIAL

COMPLIANCE ADDENDUM TO BANKING-AS-A-SERVICE PROGRAM AGREEMENT

PREAMBLE

RECITALS

Record

Parties

Dates

Amounts