ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT DRAFT FOR DISCUSSION PURPOSES ONLY
CONFIDENTIAL TREATMENT REQUESTED — This document has been prepared by Calderwood & Harkness LLP at the direction of Belmont Ridge Bank National Association and its legal counsel in connection with OCC Consent Order No. OCC-2025-003. This document is protected by the attorney-client privilege, the attorney work product doctrine, and applicable bank examination privileges. Distribution is restricted to authorized recipients only.
BELMONT RIDGE BANK NATIONAL ASSOCIATION
Customer Due Diligence and Enhanced Due Diligence Policy
(Revised Draft).
TABLE OF CONTENTS
Right-click to update Table of Contents
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose
This policy establishes Belmont Ridge Bank National Association's ("BRB" or the "Bank") standards, requirements, and operational procedures for Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") in compliance with the Bank Secrecy Act ("BSA"), 31 U.S.C. § 5311 et seq., the USA PATRIOT Act (Title III, Sections 312, 314, and 326), the Financial Crimes Enforcement Network ("FinCEN") Customer Due Diligence Rule codified at 31 C.F.R. § 1010.230, the requirements of the Office of Foreign Assets Control ("OFAC") regarding sanctions screening, and applicable supervisory guidance issued by the Office of the Comptroller of the Currency ("OCC"), the Federal Financial Institutions Examination Council ("FFIEC"), and other federal banking regulators.
This policy has been substantially revised in direct response to OCC Consent Order No. OCC-2025-003, effective January 15, 2025 (the "Consent Order"), which identified significant deficiencies in BRB's CDD/EDD program across multiple dimensions. Among the most critical findings, the OCC determined that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation. The vast majority of these deficient accounts were onboarded through BRB's fintech Banking-as-a-Service ("BaaS") partner channels, reflecting systemic failures in the Bank's oversight of delegated onboarding and due diligence functions performed by third-party fintech partners operating under the BRB charter.
This policy is specifically intended to address Core Deficiency Category (iii) of the Consent Order, which pertains to CDD/EDD program design, implementation, and operational effectiveness. In addition, this policy is designed to remediate the prior supervisory findings that preceded the Consent Order, including the June 2022 Matter Requiring Attention ("MRA") regarding BSA/AML transaction monitoring deficiencies and the November 2023 Matter Requiring Immediate Attention ("MRIA") regarding OFAC screening gaps, to the extent those findings implicate, relate to, or are exacerbated by deficiencies in BRB's customer due diligence processes. The Bank recognizes that effective CDD/EDD is the foundation upon which transaction monitoring, sanctions screening, and suspicious activity detection are built, and that failures in the former necessarily compromise the latter.
This policy reflects BRB's commitment to establishing a CDD/EDD program that satisfies not only the minimum requirements of applicable law and regulation, but also the heightened expectations articulated in the Consent Order and by the OCC examination team. The policy is intended to be a living document, subject to ongoing refinement as the Bank receives the preliminary gap assessment and final validation report from its OCC-mandated independent consultant, Thornfield Consulting Group LLC, and as the Bank progresses through its comprehensive BSA/AML remediation program.
1.2 Scope
This policy applies to all business lines of Belmont Ridge Bank National Association, including without limitation:
(a) Retail Banking, including all consumer deposit accounts, personal lending, and consumer card programs;
(b) Commercial Lending, including all business deposit accounts, commercial real estate loans, asset-based lending, and treasury management services;
(c) Wealth Management, including all investment advisory accounts, trust accounts, and private banking relationships; and
(d) The Fintech BaaS Partnerships Division, encompassing all fourteen (14) active BaaS partners as of the date hereof, through which BRB offers deposit accounts, lending products, card programs, payment services, and other banking products and services to end-user customers.
This policy applies to all customer account types maintained by BRB, whether originated directly or through BaaS partner channels, including deposit accounts (checking, savings, money market, and certificates of deposit), loan accounts (consumer, commercial, and mortgage), wire transfer relationships, Automated Clearing House ("ACH") relationships, debit and prepaid card programs, and any other product or service offered through any channel, including products and services offered through BaaS partner platforms.
This policy applies to all employees of BRB who are involved in any aspect of customer onboarding, account opening, account maintenance, transaction processing, relationship management, compliance, risk management, internal audit, or any other function that touches or supports CDD/EDD processes. This includes, without limitation, front-line banking staff, relationship managers, commercial lending officers, wealth advisors, compliance analysts, BSA/AML investigators, risk management personnel, technology staff supporting CDD/EDD systems, and internal auditors.
This policy further applies to all third-party fintech BaaS partners who perform delegated onboarding or due diligence functions on behalf of BRB under the BRB charter. While BaaS partners are not employees of BRB, they are contractually obligated to comply with the CDD/EDD standards set forth in this policy and in the applicable BaaS partner compliance addenda, and BRB retains ultimate legal and regulatory responsibility for all CDD/EDD obligations regardless of the degree of delegation.
This policy covers the entire customer lifecycle, from pre-onboarding due diligence and account opening, through ongoing monitoring, periodic review, and trigger-event-based review, to account closure and exit. The requirements herein apply at each stage of the customer relationship and are designed to ensure that BRB maintains a current, complete, and accurate understanding of each customer's identity, beneficial ownership structure, risk profile, and expected and actual transaction behavior throughout the duration of the banking relationship.
The geographic scope of this policy encompasses all jurisdictions in which BRB operates, maintains a physical presence, or offers products and services, as well as all jurisdictions in which BRB's BaaS partners originate customers or facilitate transactions on BRB's behalf. Given that certain BaaS partners operate nationwide digital platforms, this effectively encompasses all fifty (50) United States, the District of Columbia, and, to the extent applicable, any international jurisdictions in which BaaS partner end-user customers are domiciled or conduct transaction activity.
1.3 Regulatory Framework
This policy is grounded in and designed to comply with the following statutes, regulations, and regulatory guidance:
(a) Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and its implementing regulations, including the recordkeeping and reporting requirements applicable to national banking associations;
(b) FinCEN Customer Due Diligence Rule (31 C.F.R. § 1010.230), effective May 11, 2018, which establishes minimum standards for customer due diligence by covered financial institutions, including requirements for beneficial ownership identification and verification;
(c) USA PATRIOT Act, Title III (Pub. L. 107-56), including Section 312 (Special Due Diligence for Correspondent Accounts and Private Banking Accounts), Section 314 (Cooperative Efforts to Deter Money Laundering), and Section 326 (Verification of Identification);
(d) OCC BSA/AML Examination Procedures and related interagency guidance, including the OCC's expectations regarding risk-based CDD/EDD programs for national banking associations;
(e) OFAC Requirements (31 C.F.R. Part 501 et seq.) regarding sanctions screening at onboarding and throughout the customer lifecycle, including the requirement to screen against the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List ("SSI List"), and other applicable sanctions lists maintained by OFAC;
(f) OCC Consent Order No. OCC-2025-003, issued January 15, 2025, specifically the articles pertaining to CDD/EDD deficiencies, remediation milestones, independent consultant engagement, and enhanced oversight of BaaS partner channels;
(g) Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual, including sections on Customer Due Diligence, Enhanced Due Diligence, Beneficial Ownership, and Special Measures;
(h) OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance, updated interagency guidance), as applicable to BRB's oversight of CDD/EDD functions delegated to BaaS partners; and
(i) Any subsequent regulatory guidance, interpretive letters, or amendments to the foregoing that are issued during the effective period of this policy.
1.4 Definitions
For the purposes of this policy, the following terms shall have the meanings set forth below. Terms defined in the BSA, FinCEN regulations, OFAC regulations, or the Consent Order that are used but not separately defined herein shall have the meanings ascribed to them in those authorities.
"Adverse Media" means negative news, media reports, or other publicly available information indicating that a customer or beneficial owner may be associated with financial crime, sanctions violations, terrorism, corruption, fraud, or other conduct that is relevant to the Bank's AML/CFT or sanctions compliance obligations.
"BaaS Partner" means a third-party financial technology ("fintech") company that has entered into a Banking-as-a-Service partnership agreement with BRB pursuant to which the BaaS Partner originates customers, offers products and services, or performs other banking functions under the BRB charter.
"Beneficial Owner" means, with respect to a Legal Entity Customer: (i) each individual who, directly or indirectly, owns 25% or more of the equity interests of the Legal Entity Customer (the "Ownership Prong"); and (ii) one individual with significant responsibility to control, manage, or direct the Legal Entity Customer, including an executive officer or senior manager (the "Control Prong"), in each case as defined in 31 C.F.R. § 1010.230.
"Customer" means any natural person or Legal Entity Customer that opens or maintains an account at BRB, or on whose behalf an account is opened or maintained, whether directly or through a BaaS Partner channel.
"Customer Due Diligence (CDD)" means the standard due diligence procedures performed for all customers at onboarding and on an ongoing basis, including customer identification and verification, beneficial ownership identification and verification, customer risk rating, understanding the nature and purpose of the customer relationship, and sanctions and adverse media screening.
"Customer Identification Program (CIP)" means the program established by BRB pursuant to Section 326 of the USA PATRIOT Act and 31 C.F.R. § 1020.220 to verify the identity of each customer at account opening.
"Customer Risk Rating" means the risk classification assigned to each customer (Low, Medium, or High) based on the risk rating methodology set forth in Section 5 of this policy.
"End-User Customer" means a natural person or Legal Entity Customer that opens or maintains an account at BRB through a BaaS Partner platform, as distinguished from the BaaS Partner itself.
"Enhanced Due Diligence (EDD)" means the additional, heightened due diligence procedures required for customers rated High Risk, Politically Exposed Persons, and other specified customer categories, as set forth in Section 7 of this policy.
"High-Risk Customer" means a customer assigned a High customer risk rating under the risk rating methodology in Section 5, or any customer for whom EDD is required under Section 7.
"Legal Entity Customer" means a corporation, limited liability company, partnership, trust (other than statutory trusts and business trusts), or other entity formed under the laws of any domestic or foreign jurisdiction that opens an account at BRB, as defined in 31 C.F.R. § 1010.230(e).
"Lookback" means the retrospective review of historical CDD/EDD files and transaction activity for existing customers, including specifically the remediation of the approximately 47,000 deficient accounts identified in the Consent Order.
"Low-Risk Customer" means a customer assigned a Low customer risk rating under the risk rating methodology in Section 5.
"Medium-Risk Customer" means a customer assigned a Medium customer risk rating under the risk rating methodology in Section 5.
"Money Service Business (MSB)" means any business that qualifies as a money services business under FinCEN regulations (31 C.F.R. § 1010.100(ff)), including money transmitters, check cashers, currency exchangers, and issuers, sellers, or redeemers of prepaid access.
"Natural Person" means a living individual, as distinguished from a legal entity.
"Ongoing Monitoring" means the continuous or periodic review of customer accounts and transaction activity to detect suspicious activity, changes in risk profile, or other circumstances requiring updated CDD/EDD, as described in Section 8.
"Periodic Review" means the scheduled, risk-based review of a customer's CDD/EDD file at the intervals specified in Section 8.1 of this policy.
"Politically Exposed Person (PEP)" means a current or former senior foreign political figure, a current or former senior domestic political figure, or an immediate family member or close associate of such a person, as those terms are used in applicable FinCEN and OCC guidance. For purposes of this policy, BRB applies PEP screening to both foreign and domestic politically exposed persons.
"Sanctions Screening" means the process of screening customer names, beneficial owner names, and transaction data against OFAC sanctions lists and other applicable sanctions lists to identify potential matches.
"Simplified Due Diligence (SDD)" means the reduced due diligence procedures that may be applied to certain low-risk customer categories, subject to the limitations set forth in this policy. During the remediation period, SDD may not be applied to any BaaS-onboarded customer without the prior written approval of the BSA Officer.
"Trigger Event" means any event or circumstance that requires an interim review of a customer's CDD/EDD file outside of the regular periodic review schedule, as specified in Section 8.2 of this policy.
SECTION 2: GOVERNANCE AND OVERSIGHT
2.1 Board and Compliance Committee Oversight
The Board of Directors of Belmont Ridge Financial Group ("BRFG"), the parent holding company of BRB, has established a Compliance Committee as a standing committee of the Board, chaired by James Rutherford, pursuant to Board Resolution dated February 28, 2025. The establishment of this committee was undertaken in direct response to the governance enhancement requirements of the Consent Order and reflects the Board's recognition that CDD/EDD program oversight requires dedicated, senior-level attention.
The Compliance Committee shall receive monthly reporting on the status of BRB's CDD/EDD program, including detailed reporting on remediation progress against the 47,000-account remediation target established under the Consent Order. Monthly reports to the Compliance Committee shall include, at a minimum, the following information:
(a) The total number of accounts pending CDD/EDD remediation, broken down by remediation tier (Tier 1, Tier 2, and Tier 3), by BaaS partner, and by business line;
(b) Completion rates for the remediation project, expressed both in absolute numbers and as a percentage of the total remediation population, with comparison to the milestone schedule;
(c) The current risk rating distribution across BRB's customer base, including trends and shifts in the proportion of customers rated High, Medium, and Low;
(d) Exception tracking, including the number, nature, and duration of active exceptions to CDD/EDD policy requirements;
(e) Escalation of systemic issues, including any patterns of non-compliance by BaaS partners, technology system failures affecting CDD/EDD processes, or other circumstances that may materially impact the Bank's ability to meet its CDD/EDD obligations;
(f) Quality assurance results and deficiency trends; and
(g) Any communications from or interactions with the OCC, FinCEN, Thornfield Consulting Group, or Caldera & Pope LLP relating to CDD/EDD program adequacy.
The Audit Committee of the BRFG Board of Directors, chaired by Margaret Dao, and the Risk Committee, chaired by Arthur Connelly, shall each receive quarterly reporting on CDD/EDD program metrics as part of the consolidated BSA/AML compliance dashboard. Quarterly reporting to these committees shall provide a broader strategic overview, including analysis of trends, risk concentrations, and the effectiveness of controls, in addition to the detailed operational metrics provided to the Compliance Committee on a monthly basis.
The Compliance Committee shall have the authority and responsibility to review and approve this policy, and any material amendments hereto, prior to implementation. The Committee shall also have the authority to direct the CCO and BSA Officer to take specific remedial actions where CDD/EDD program deficiencies are identified or where remediation progress falls behind the established milestones.
2.2 Roles and Responsibilities
Effective implementation of this policy requires clearly defined roles and responsibilities across BRB's organizational structure. The following individuals and functions bear specific accountability for the CDD/EDD program:
Chief Compliance Officer — Patricia Langston. Ms. Langston serves as the overall policy owner for this CDD/EDD Policy and the broader BSA/AML and Sanctions Policy Suite. She is responsible for ensuring the adequacy, currency, and effectiveness of this policy and for overseeing BRB's compliance with the CDD/EDD-related requirements of the Consent Order. Ms. Langston reports directly to the Compliance Committee on all matters relating to the CDD/EDD program and provides regular updates to the BRFG Board of Directors. In her capacity as CCO, Ms. Langston has authority to approve exceptions to this policy, to direct enhanced oversight of specific BaaS partners or business lines, and to escalate matters to the Board or to regulatory authorities as warranted.
BSA Officer / AML Program Director — Thomas Ikeda. Mr. Ikeda bears day-to-day operational oversight responsibility for the CDD/EDD program. He is responsible for the implementation of this policy across all business lines and BaaS channels, the supervision of CDD/EDD staff, the design and delivery of training programs, and the operation of the quality assurance function. Mr. Ikeda manages BRB's BSA/AML department, which currently comprises sixty-two (62) full-time equivalent employees ("FTEs"). The department is in the process of expanding to seventy-seven (77) FTEs through the addition of fifteen (15) new permanent hires, a recruitment effort expected to be substantially completed by June 30, 2025. In addition, to support the remediation effort, BRB has engaged Pinnacle Compliance Solutions LLC to provide thirty (30) temporary compliance analysts under Statement of Work Reference PCS-BRB-2025-0012. These temporary analysts are dedicated to SAR backlog clearance and CDD/EDD remediation tasks and report to Mr. Ikeda through their designated team leads.
Chief Risk Officer — Melissa Chu. Ms. Chu is responsible for the integration of CDD/EDD risk assessments into BRB's enterprise risk management framework. She ensures that customer risk ratings assigned under this policy are consistent with and aligned to BRB's overall risk appetite, as articulated in the Board-approved Risk Appetite Statement. Ms. Chu provides independent risk management challenge to the BSA/AML department's risk rating methodology and escalates enterprise-level risk concerns to the Risk Committee.
Head of Fintech Partnerships / BaaS Division — Warren Ashby. Mr. Ashby is responsible for ensuring that all fourteen (14) active BaaS partners comply with their delegated CDD/EDD obligations as specified in this policy and in the applicable BaaS partner compliance addenda. He serves as the primary liaison between BaaS partners and the BSA/AML department, facilitating communication, issue resolution, and escalation of BaaS partner compliance deficiencies. Mr. Ashby is also responsible for the execution of BaaS partner risk tiering assessments and for recommending enhanced oversight, onboarding suspension, or termination actions where warranted.
Head of Internal Audit — Derek Ballard. Mr. Ballard is responsible for the independent testing and audit of CDD/EDD processes, including the sampling and review of BaaS partner onboarding files, periodic review files, and remediation files. Internal Audit provides the third line of defense and reports its findings directly to the Audit Committee. Mr. Ballard's team coordinates with the independent testing firm, Caldera & Pope LLP, to ensure comprehensive audit coverage without duplication.
CIO / CTO — Linda Petrosian. Ms. Petrosian is responsible for the technology infrastructure supporting CDD/EDD processes, including the customer information system (system of record), data integration with the Veridian Transaction Monitoring System ("TMS") and the OFAC sanctions screening platform, data migration and integrity, system access controls, and the technology components of the Veridian TMS v.10.0 upgrade. Ms. Petrosian's team also supports the development and deployment of the CDD/EDD Progress Tracking Dashboard.
Line-of-Business Managers. The heads of each business line — Retail Banking, Commercial Lending, and Wealth Management — are individually accountable for CDD/EDD compliance within their respective lines of business. This accountability includes ensuring that front-line staff are trained, that CDD/EDD procedures are followed at account opening and throughout the customer lifecycle, and that escalations are handled promptly.
Pinnacle Compliance Solutions LLC Temporary Staff. The thirty (30) temporary FTEs provided by Pinnacle Compliance Solutions LLC (per SOW Ref PCS-BRB-2025-0012) are deployed to support SAR backlog clearance and CDD/EDD remediation activities. These temporary analysts operate under the direct supervision of the BSA Officer and designated BSA/AML supervisors within BRB, must complete all required training before commencing work, and are subject to the same quality assurance standards as BRB permanent staff.
2.3 Independent Consultant Oversight
Pursuant to the requirements of the Consent Order, BRB has engaged Thornfield Consulting Group LLC ("Thornfield") as the OCC-mandated independent consultant to assess and validate BRB's BSA/AML program, including specifically the CDD/EDD program that is the subject of this policy. The engagement is referenced as TCG-BRB-2025-001 and is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory Practice.
Thornfield's engagement scope includes a comprehensive assessment of the design and operational effectiveness of BRB's CDD/EDD program, an evaluation of the remediation methodology and its implementation, a review of sample remediated customer files, and an assessment of BRB's oversight of BaaS partner CDD/EDD functions. Thornfield team member Nathaniel Burgess, Director, Fintech & Payments Compliance, will focus specifically on CDD/EDD compliance within BaaS channels, given that the BaaS-onboarded customer population represents the largest concentration of CDD/EDD deficiencies identified in the Consent Order.
The following key milestones govern Thornfield's engagement as it relates to the CDD/EDD program:
(a) Preliminary Gap Assessment (due April 15, 2025): Thornfield's initial assessment of BRB's CDD/EDD program, identifying gaps, weaknesses, and areas requiring further policy refinement or operational improvement. The findings of this assessment will directly inform further revisions to this policy and to the Bank's remediation approach.
(b) Final Validation Report (due February 15, 2026): Thornfield's comprehensive validation of BRB's CDD/EDD program design, implementation, remediation completion, and sustainability. This report will be submitted to the OCC and will constitute a critical element of BRB's demonstration of compliance with the Consent Order requirements.
BRB's BSA Officer and CCO shall cooperate fully with Thornfield, provide timely access to all requested documents, data, systems, and personnel, and promptly address any interim findings or recommendations issued by Thornfield during the engagement period.
2.4 Policy Review and Approval Cycle
This policy shall be reviewed at least annually, or more frequently upon the occurrence of any of the following:
(a) A material change in applicable regulatory requirements, including new statutes, regulations, or regulatory guidance affecting CDD/EDD obligations;
(b) A material change in BRB's business model, risk profile, product offerings, or geographic footprint;
(c) The addition or termination of a BaaS partner, or a material change in the nature, volume, or risk characteristics of an existing BaaS partner's activities;
(d) Findings from Thornfield Consulting, Caldera & Pope, Internal Audit, or the OCC that warrant policy revision;
(e) The occurrence of a significant control failure, regulatory action, or enforcement event relating to CDD/EDD; or
(f) Such other circumstances as the CCO or BSA Officer determines necessitate a policy review.
Interim amendments to this policy that are non-material in nature may be approved by the CCO, with prompt notification to the Compliance Committee. Material amendments — including any changes to risk rating methodology, EDD trigger criteria, BaaS partner oversight standards, or remediation milestones — require the prior approval of the Compliance Committee before implementation. All amendments shall be documented with a version history, and the amended policy shall be promptly distributed to all affected personnel and BaaS partners.
SECTION 3: CUSTOMER IDENTIFICATION PROGRAM (CIP)
3.1 CIP Requirements for Natural Persons
BRB's Customer Identification Program for natural persons requires the collection and verification of the following minimum identification information at or before account opening:
(a) Full legal name of the individual, as it appears on the individual's government-issued identification;
(b) Date of birth;
(c) Residential address (a post office box is not acceptable as the sole address; where a customer does not have a fixed residential address, an alternative address may be accepted with documented justification and BSA/AML supervisor approval);
(d) Government-issued identification number: For U.S. persons, a Social Security Number ("SSN") is required. For non-U.S. persons who do not possess an SSN, a taxpayer identification number ("TIN"), passport number and country of issuance, alien identification card number, or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard is required.
Documentary Verification. BRB requires documentary verification of identity through the presentation of an unexpired government-issued photo identification document. Acceptable documents include a valid state-issued driver's license, a valid U.S. or foreign passport, a state-issued identification card, a U.S. military identification card, or, for non-U.S. persons, a valid foreign government-issued identification document bearing a photograph. Copies of identification documents must be retained in BRB's system of record.
Non-Documentary Verification. In addition to documentary verification, or in cases where documentary verification cannot be completed at the time of account opening, BRB employs non-documentary verification methods, including cross-referencing customer-provided information against independent data sources such as consumer credit bureau records, public records databases, commercial identity verification services, and other reliable third-party sources. Non-documentary verification may supplement but generally should not replace documentary verification absent documented justification and escalation in accordance with Section 3.4.
Timing of Verification. Verification of customer identity must be completed at or before account opening. In limited circumstances where the nature of the account relationship requires that the account be opened before verification is fully completed (for example, where the customer is not physically present and documentation must be received by mail or electronic submission), the Bank must implement procedures to limit account activity pending completion of verification. Specifically, no outgoing wire transfers, ACH originations exceeding $500 in aggregate, or cash withdrawals may be processed until CIP verification is complete. Verification must be completed within thirty (30) calendar days of account opening; accounts failing to achieve completed verification within this timeframe are subject to the escalation and restriction procedures set forth in Section 3.4.
3.2 CIP Requirements for Legal Entity Customers
BRB's Customer Identification Program for Legal Entity Customers requires the collection and verification of the following minimum identification information:
(a) Full legal name of the entity, as registered with the applicable governmental authority;
(b) Principal place of business address (registered agent address alone is not sufficient; the physical business address must be obtained);
(c) Employer Identification Number (EIN) or equivalent tax identification number. For foreign entities that do not possess an EIN, an equivalent foreign tax identification number or registration number must be obtained;
(d) State or country of formation and date of formation;
(e) Organizational documents, including articles of incorporation, certificate of formation, partnership agreement, trust instrument, or equivalent formation documents as applicable to the entity type.
Documentary Verification. Identity of Legal Entity Customers must be verified through review of organizational documents and cross-referencing against state Secretary of State filings, corporate registry databases, or equivalent government registries. Third-party commercial data provider verification may be used to supplement documentary verification.
Complex Entity Structures. For customers with complex organizational structures — including multi-layered holding structures, entities with foreign parent companies, and entities involving trusts, nominees, or bearer shares — BRB requires documentation of the full ownership chain sufficient to identify all beneficial owners meeting the applicable thresholds (see Section 4). Where the ownership structure is so opaque that beneficial ownership cannot be determined, the matter must be escalated to the BSA/AML department for risk assessment and a determination of whether the relationship can be established or maintained consistent with BRB's risk appetite.
3.3 CIP for Customers Onboarded Through BaaS Partner Channels
BRB, as the chartered national banking association (OCC Charter No. 48271), retains ultimate legal and regulatory responsibility for CIP compliance for all customers whose accounts are opened under the BRB charter, regardless of whether the onboarding process is performed in whole or in part by a BaaS partner. This principle is foundational and non-negotiable. The delegation of CIP collection and verification tasks to a BaaS partner does not transfer or diminish BRB's own CIP obligations.
BaaS partners may collect CIP information and perform initial identity verification on BRB's behalf only pursuant to a written agreement that (i) specifies the partner's CIP obligations in detail, (ii) requires compliance with this policy and BRB-approved onboarding workflows, (iii) reserves BRB's rights to audit, test, and review the partner's CIP practices at any time, and (iv) provides for remediation and escalation in the event of CIP deficiencies. The template for such agreements is set forth in the Revised BaaS Program Agreement — Template Compliance Addendum (see Section 10).
All CIP data collected by BaaS partners must be transmitted to and stored in BRB's centralized customer information system (system of record) within twenty-four (24) hours of account opening. This requirement is essential to ensuring that BRB maintains a complete and current record of all customer identifications and is able to retrieve CIP information for examination, audit, or law enforcement purposes without dependency on BaaS partner systems.
BRB's BSA/AML department must perform quality assurance sampling on no less than ten percent (10%) of BaaS-onboarded accounts on a monthly basis to verify CIP completeness and accuracy. The 10% minimum sample rate applies to each BaaS partner individually, not in the aggregate, ensuring that sampling is representative across all partner channels.
The following specific requirements and risk considerations apply to the top three BaaS partners by transaction volume:
(i) NovaPay Technologies Inc. NovaPay (CEO: Ethan Garrison) represents BRB's single largest BaaS partner by volume, with approximately 2.1 million end-user accounts and approximately 41% of total BaaS transaction volume, representing approximately $30.5 billion in transaction value in calendar year 2024. Given the scale of NovaPay's operations and the specific OFAC screening gap findings in the Consent Order relating to NovaPay transactions, CIP quality assurance for NovaPay-onboarded accounts is assigned the highest priority. The BSA/AML department shall maintain a dedicated NovaPay oversight team responsible for CIP, CDD, and EDD quality assurance for NovaPay-originated accounts.
(ii) FairLend Digital LLC. FairLend Digital (CEO: Aisha Okonkwo) is BRB's second-largest BaaS partner, with approximately $1.4 billion in loan originations through BRB in fiscal year 2024 and approximately 28% of BaaS transaction volume. FairLend Digital's lending-focused model presents distinct CIP challenges, including the need for robust income and identity verification in connection with credit underwriting, and the intersection of CIP with fair lending and consumer compliance obligations. CIP quality assurance for FairLend Digital must address both BSA/AML and consumer compliance dimensions.
(iii) VaultEdge Inc. VaultEdge (CEO: Marcus Tan) maintains approximately 870,000 deposit accounts through BRB, representing approximately 18% of BaaS transaction volume. VaultEdge's digital-first savings and deposit platform presents CIP challenges associated with remote onboarding, including reliance on non-documentary verification methods. CIP quality assurance for VaultEdge must include testing of the effectiveness of non-documentary verification procedures.
3.4 Identity Verification Exceptions and Escalation
Accounts that cannot be verified through standard CIP procedures — whether due to discrepancies in customer-provided information, failure of non-documentary verification, inability to obtain acceptable documentary identification, or any other reason — must be escalated to the BSA/AML department within forty-eight (48) hours of the identification of the verification issue. The BSA/AML department shall assess the nature of the verification failure, determine whether alternative verification methods are available and appropriate, and document the assessment and any compensating measures applied.
No account may remain open beyond thirty (30) calendar days without completed CIP verification. Accounts that fail to achieve completed verification within this timeframe must be restricted (activity limitations including blocking of all outgoing transactions) and referred to the BSA/AML investigations unit for SAR consideration. The BSA/AML department shall determine whether the account should be closed and whether a SAR filing is warranted based on the circumstances surrounding the verification failure.
All CIP exceptions — meaning any account for which standard CIP procedures were not completed within the required timeframe or for which alternative procedures were employed — must be logged in the centralized CIP exception register. The BSA Officer shall review the CIP exception register and report CIP exception trends and patterns to the CCO on a monthly basis. Persistent or systemic CIP exceptions associated with a particular BaaS partner shall trigger enhanced oversight and potential escalation under the BaaS Compliance Oversight Framework.
SECTION 4: BENEFICIAL OWNERSHIP IDENTIFICATION AND VERIFICATION
4.1 Beneficial Ownership Requirements
In accordance with the FinCEN Customer Due Diligence Rule (31 C.F.R. § 1010.230), BRB must identify and verify the identity of the beneficial owners of all Legal Entity Customers at the time of account opening.
For purposes of the Ownership Prong, BRB must identify each individual who, directly or indirectly, owns 25% or more of the equity interests of the Legal Entity Customer. Indirect ownership must be traced through intermediary entities, trusts, or other structures to the ultimate natural person owners. Where the ownership structure involves multiple layers of entities, BRB must obtain sufficient documentation to identify all individuals meeting the 25% ownership threshold at each level of the structure.
For purposes of the Control Prong, BRB must identify one individual who has significant responsibility to control, manage, or direct the Legal Entity Customer. This individual is typically a chief executive officer, chief financial officer, chief operating officer, managing member, general partner, president, vice president, or treasurer, or any other individual who regularly performs similar functions.
Beneficial ownership certification must be obtained at account opening using BRB's standardized Beneficial Ownership Certification Form, which is designed to comply with FinCEN's requirements and incorporates the certifications specified in 31 C.F.R. § 1010.230(b). The individual opening the account on behalf of the Legal Entity Customer must certify, to the best of that individual's knowledge, the identity of each beneficial owner meeting the Ownership Prong and the Control Prong.
4.2 Verification of Beneficial Owners
The identity of each beneficial owner identified under the Ownership Prong or Control Prong must be verified using the same CIP procedures applicable to natural persons as set forth in Section 3.1 of this policy. This includes, at a minimum, the collection of the beneficial owner's full legal name, date of birth, residential address, and government-issued identification number, and verification through documentary and/or non-documentary means.
For beneficial owners located outside the United States, additional verification measures are required, including verification through a valid passport, consular documentation, or an equivalent government-issued identification document issued by the beneficial owner's country of citizenship or residence. Where the beneficial owner resides in a FATF-identified high-risk jurisdiction or an OFAC-sanctioned country or region, the EDD procedures set forth in Section 7 shall apply.
4.3 Exemptions
Exemptions from beneficial ownership requirements apply only to entity types specifically enumerated in 31 C.F.R. § 1010.230(e). Exempt entity types include, but are not limited to:
(a) Financial institutions regulated by a federal functional regulator or a state bank regulator;
(b) Departments or agencies of the United States, of any state, or of any political subdivision of any state;
(c) Any entity established under the laws of the United States, of any state, or of any political subdivision of any state, or under an interstate compact between two or more states, that exercises governmental authority on behalf of the United States or any such state or political subdivision;
(d) Publicly traded companies listed on a securities exchange registered with the U.S. Securities and Exchange Commission under Section 6 of the Securities Exchange Act of 1934, or any subsidiary of such a company;
(e) Registered investment companies, as defined in Section 3 of the Investment Company Act of 1940;
(f) Investment advisers, as defined in Section 202(a)(11) of the Investment Advisers Act of 1940;
(g) Pooled investment vehicles;
(h) Insurance companies, as defined in Section 2 of the Investment Company Act of 1940;
(i) Entities that are operated or controlled by a financial institution;
(j) Non-profit organizations as described in Section 501(c) of the Internal Revenue Code, to the extent they qualify for exemption; and
(k) Such other entity types as may be specified in applicable FinCEN regulations.
The determination that an entity qualifies for a beneficial ownership exemption must be documented with supporting evidence (e.g., evidence of public listing, regulatory registration, or tax-exempt status) and reviewed at each periodic review cycle to confirm continued applicability of the exemption. Exempt status is not permanent and may be lost if the entity's circumstances change.
4.4 Ongoing Beneficial Ownership Updates
BRB recognizes that beneficial ownership of Legal Entity Customers may change over time, and that maintaining current beneficial ownership information is essential to effective CDD/EDD. Accordingly, BRB must update beneficial ownership information upon the occurrence of any Trigger Event (as defined in Section 8.2) that indicates or suggests a change in the entity's ownership or control structure, or at the next scheduled periodic review (as set forth in Section 8.1), whichever is earlier.
Customer-facing staff, including relationship managers, commercial lending officers, and wealth advisors, must inquire about changes in beneficial ownership at each significant interaction with a Legal Entity Customer, including but not limited to: new product openings, loan renewals or modifications, material changes in account activity or expected transaction patterns, changes to authorized signers, and any other substantive engagement that provides an opportunity to update the customer's information.
Where a customer reports or BRB otherwise identifies a change in beneficial ownership, the updated Beneficial Ownership Certification Form must be obtained within thirty (30) calendar days, and the identity of any new beneficial owner must be verified in accordance with Section 4.2. The customer's risk rating must be reassessed following any change in beneficial ownership.
4.5 Beneficial Ownership for BaaS Partner Customers
BaaS partners are required to collect beneficial ownership certifications for all applicable Legal Entity Customers at onboarding, using BRB-approved certification forms. The BaaS partner must transmit the completed certification form and all supporting documentation to BRB's system of record within twenty-four (24) hours of account opening, consistent with the data transmission requirements of Section 3.3.
BRB's BSA/AML department must independently verify a sample of beneficial ownership certifications collected by BaaS partners, with a minimum sampling rate of ten percent (10%) of certifications per BaaS partner per month. Independent verification includes confirmation that the certification form is complete, that the identified beneficial owners meet the applicable thresholds, and that identity verification of each beneficial owner has been performed in accordance with Section 4.2.
Of particular urgency, for the approximately 47,000 high-risk accounts identified in the Consent Order as lacking adequate CDD or EDD documentation — the majority of which were onboarded through BaaS partner channels — the remediation project must verify and cure all beneficial ownership deficiencies as part of the comprehensive remediation effort. The beneficial ownership remediation is governed by the following milestone schedule:
(a) July 15, 2025: Fifty percent (50%) of the remediation population — 23,500 accounts — shall have fully verified and documented beneficial ownership certifications and supporting verification records.
(b) January 15, 2026: One hundred percent (100%) of the remediation population — all 47,000 accounts — shall have fully verified and documented beneficial ownership certifications and supporting verification records.
Where a BaaS partner customer fails to provide or update beneficial ownership information within the timeframes specified in the remediation procedures, the account must be escalated for potential restriction or closure in accordance with Section 15.2.
SECTION 5: CUSTOMER RISK RATING METHODOLOGY
5.1 Risk Rating Framework
Every customer of BRB must be assigned a customer risk rating at the time of onboarding. The risk rating framework utilizes a three-tier classification: Low Risk, Medium Risk, and High Risk. The assigned risk rating determines the level of due diligence required for the customer, as follows:
(a) Low Risk: Standard CDD procedures apply (Section 6).
(b) Medium Risk: Standard CDD procedures apply (Section 6). In certain circumstances, additional due diligence measures may be warranted based on specific risk factors, as determined by the BSA/AML department.
(c) High Risk: Enhanced Due Diligence procedures are required (Section 7), in addition to standard CDD procedures.
Customer risk ratings must be documented in BRB's centralized customer information system and must be electronically linked to the transaction monitoring system. BRB currently utilizes the Veridian Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"), which is in the process of being upgraded to Veridian TMS v.10.0. User acceptance testing ("UAT") for the v.10.0 upgrade is targeted for completion by August 1, 2025. The integration of risk rating data with the TMS is essential to ensuring that transaction monitoring rules and alert thresholds are appropriately calibrated to the risk profile of each customer.
5.2 Risk Rating Factors
The following categories of risk factors are considered in assigning a customer risk rating. The relative weighting of each factor is set forth in the Customer Risk Rating Scorecard (Appendix B).
Customer Type. The nature and legal structure of the customer is a significant risk factor. Customer types include, without limitation: individual natural persons, sole proprietorships, domestic corporations and limited liability companies, foreign corporations and entities, trusts (including revocable and irrevocable trusts, statutory trusts, and business trusts), non-profit organizations, money service businesses ("MSBs"), professional services firms (including law firms, accounting firms, and real estate professionals), fintech companies, virtual currency businesses, and government entities. Certain customer types — including MSBs, virtual currency businesses, and non-bank financial institutions — are associated with inherently higher BSA/AML risk and receive correspondingly higher risk scores.
Geographic Risk. Geographic risk encompasses the customer's domicile address, country of citizenship or formation, countries in which the customer conducts business, and the geographic profile of the customer's expected and actual transaction activity. BRB maintains an internal high-risk country list, which is updated at least quarterly and incorporates countries and jurisdictions identified by the Financial Action Task Force ("FATF") as high-risk or under increased monitoring, countries and regions subject to OFAC sanctions (including comprehensive sanctions, sectoral sanctions, and secondary sanctions), countries identified by Transparency International or comparable sources as having elevated corruption risk, and countries designated as non-cooperative jurisdictions by international standard-setting bodies. Customers domiciled in, formed in, or conducting significant transactions with any high-risk jurisdiction receive elevated geographic risk scores.
Product/Service Risk. Certain products and services offered by BRB carry inherently higher money laundering or terrorist financing risk. These include, without limitation: wire transfer services (both domestic and international), international ACH transactions, correspondent banking relationships, private banking and wealth management services, trade finance and letters of credit, prepaid card programs, peer-to-peer ("P2P") payment services, and digital savings products offered through BaaS partner platforms. The product risk factor reflects both the inherent risk of the product itself and the manner in which the product is accessed by the customer (e.g., in-branch versus online versus BaaS partner platform).
Transaction Behavior Risk. Expected and actual transaction behavior is a significant risk factor. Customers with expected high transaction volumes, cash-intensive activity, rapid movement of funds between accounts or to third parties, frequent international transfers, or patterns inconsistent with their stated business purpose or occupation receive elevated transaction behavior risk scores. For new customers, the expected activity profile (documented at onboarding) serves as the basis for the initial transaction behavior risk assessment; for existing customers, actual transaction history is compared against the expected profile at each periodic review.
Channel Risk. The channel through which a customer is onboarded and serviced is a distinct risk factor. Customers onboarded through in-branch, face-to-face interactions present lower channel risk than customers onboarded through online or digital channels, and customers onboarded through BaaS partner channels present the highest channel risk due to the indirect nature of the onboarding process and the inherent limitations on BRB's ability to directly observe and interact with the customer during the onboarding process.
To directly address the Consent Order's findings regarding insufficient due diligence for BaaS-onboarded customers, all customers onboarded through BaaS partner channels receive an automatic uplift of one risk level in the risk rating calculation. Specifically:
• A BaaS-onboarded customer who would otherwise score as Low Risk based on the aggregate of other risk factors is assigned a Medium Risk rating;
• A BaaS-onboarded customer who would otherwise score as Medium Risk is assigned a High Risk rating; and
• A BaaS-onboarded customer who would otherwise score as High Risk remains rated High Risk (the uplift does not create a risk tier above High).
This channel risk uplift applies to all fourteen (14) active BaaS partners without exception and reflects the heightened inherent risk of indirect onboarding channels. The appropriateness of this uplift shall be reassessed periodically as BRB's BaaS partner oversight capabilities mature and as remediation progresses, but any reduction or elimination of the uplift requires Compliance Committee approval and prior consultation with the OCC.
Industry/Occupation Risk. The customer's industry, profession, or occupation is a risk factor. Industries and occupations associated with higher BSA/AML risk include, without limitation: casinos and gaming establishments, precious metals and stones dealers, marijuana-related businesses (in states where permitted under state law), import/export businesses, arms and defense contractors, real estate (particularly luxury real estate), art and antiques dealers, and any industry identified by FinCEN or law enforcement as presenting elevated financial crime risk.
PEP Status. Politically Exposed Persons — whether foreign or domestic — are automatically rated High Risk under this policy. PEP screening is performed at onboarding and refreshed at each periodic review and upon any trigger event. PEP status extends to the PEP's immediate family members and known close associates when they are identified through the screening process.
Adverse Media/Negative News. The presence of adverse media or negative news relating to a customer or beneficial owner is a risk factor that may result in an elevated risk rating. Adverse media screening is performed at onboarding and refreshed at each periodic review and upon any trigger event. The identification of material adverse media automatically triggers a review by the BSA/AML department and potential upgrade of the customer's risk rating to High.
Sanctions Screening Results. Any prior OFAC or sanctions screening hit — including hits that were ultimately resolved as false positives — is a risk factor and must be considered in the risk rating assessment. A customer with a history of repeated screening hits (even if all resolved as false positives) may present elevated risk warranting a higher risk rating and closer monitoring.
5.3 Risk Rating Assignment Process
Initial Assignment. The initial customer risk rating is assigned at the time of onboarding based on the information collected during CIP/CDD and the application of the risk factors and scoring methodology described in Sections 5.2 and Appendix B. For customers onboarded directly by BRB (retail, commercial, and wealth management channels), the risk rating is assigned by the onboarding officer or relationship manager and validated by a BSA/AML analyst.
BaaS Channel Validation. For customers onboarded through BaaS partner channels, the BaaS partner may perform an initial risk scoring using BRB-approved risk rating models. However, BRB's BSA/AML department must perform an independent risk rating validation within fifteen (15) business days of account opening. Until the independent validation is completed, the BaaS partner's initial risk scoring is treated as preliminary, and any High Risk customer identified by the BaaS partner's initial scoring must be subject to EDD procedures immediately without awaiting BRB's validation.
Periodic Recalculation. Customer risk ratings are recalculated at each periodic review (Section 8.1) and upon the occurrence of any trigger event (Section 8.2). Recalculation considers all available information, including updated CIP/CDD data, beneficial ownership changes, transaction history, sanctions screening results, and any adverse media or other relevant developments.
Overrides. Any override of a system-generated risk rating — whether to upgrade (increase) or downgrade (decrease) the rating — must be documented with a written rationale that is approved by a BSA/AML supervisor at the Senior Investigator level or above. Downgrades of risk ratings from High to Medium or from Medium to Low are subject to particular scrutiny and must be supported by compelling evidence that the risk factors justifying the higher rating no longer apply. All overrides are subject to quality assurance review and must be included in periodic reporting to the BSA Officer and CCO.
5.4 Risk Rating Distribution Monitoring
The BSA Officer shall monitor the distribution of customer risk ratings across BRB's entire customer base, including analysis by business line and by BaaS partner, to identify anomalies, trends, and concentrations that may indicate weaknesses in the risk rating methodology or in the onboarding and review processes.
The following metrics must be reported monthly to the Compliance Committee:
(a) Total number and percentage of customers rated High, Medium, and Low;
(b) Breakdown of risk rating distribution by business line (Retail Banking, Commercial Lending, Wealth Management, and each BaaS partner);
(c) Trends in risk rating distribution over time, including changes in the proportion of High-Risk customers;
(d) Number and nature of risk rating overrides during the reporting period;
(e) Risk rating distribution for newly onboarded customers during the reporting period, compared to the existing customer base; and