1045-00002 · Calderwood & Harkness LLP · documents

revised-ofac-compliance-policy-draft.docx DOCUMENT Antitrust

63 / 84 ← → ✕

Contract analysis Extract to table

REVISED OFAC COMPLIANCE POLICY

Enterprise-Wide Compliance Policy

Belmont Ridge Bank National Association

ATTORNEY-CLIENT PRIVILEGED / WORK PRODUCT — DRAFT FOR INTERNAL REVIEW

Right-click to update Table of Contents

SECTION 1: PURPOSE AND SCOPE

1.1 Purpose

This Revised OFAC Compliance Policy (the "Policy") establishes Belmont Ridge Bank National Association's ("BRB" or the "Bank") enterprise-wide policy governing compliance with all economic sanctions programs administered and enforced by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"). The Policy is designed to ensure that the Bank, across all of its business lines, products, services, and delivery channels, maintains a comprehensive and effective sanctions compliance program commensurate with its risk profile and regulatory obligations.

This Policy has been developed to fulfill the requirements of OCC Consent Order No. OCC-2025-003 (effective January 15, 2025) (the "Consent Order"), which, among other matters, specifically addressed findings of inadequate OFAC sanctions screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows. The Consent Order identified material deficiencies in the Bank's prior sanctions screening infrastructure, including a failure to screen a significant volume of transactions originated by BaaS partner NovaPay Technologies Inc. ("NovaPay") against applicable OFAC sanctions lists. The Bank is committed to the full and timely remediation of all deficiencies identified in the Consent Order and to the establishment of an OFAC compliance program that meets or exceeds regulatory expectations.

This Policy provides the framework for the Bank's sanctions screening, interdiction, blocking, rejecting, and reporting obligations applicable to all business lines, products, services, and delivery channels. It is intended to serve as the foundational policy document within the Bank's Consolidated BSA/AML & Sanctions Policy Suite and to be read in conjunction with the OFAC Screening Procedures Manual, the Comprehensive Remediation Action Plan, and all other related policies and procedures referenced herein.

The development and revision of this Policy reflects the remediation requirements arising from the identification that approximately twelve percent (12%) of NovaPay Technologies Inc. wire and Automated Clearing House ("ACH") transactions—approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023—were not screened against OFAC sanctions lists prior to execution. This screening gap represented a serious compliance failure that exposed the Bank to significant regulatory, financial, and reputational risk. The Bank takes these findings with the utmost seriousness, and this Policy is a central element of the Bank's comprehensive remediation efforts.

1.2 Scope of Applicability

This Policy applies to all officers, employees, contractors, and agents of Belmont Ridge Bank National Association, across all domestic and international operations. Compliance with the requirements of this Policy is mandatory, and all personnel are expected to understand and adhere to the provisions applicable to their respective roles and responsibilities.

The scope of this Policy encompasses the following business lines and operational areas:

• Retail Banking. All consumer deposit products, consumer lending, and retail branch operations.

• Commercial Lending. All commercial and industrial lending, commercial real estate lending, and related treasury management services.

• Wealth Management. All investment advisory, trust, and private banking services.

• Fintech Banking-as-a-Service (BaaS) Partnerships. All fintech sponsor partnerships operating through BRB's national bank charter, including the origination, processing, and settlement of transactions by BaaS partners and their end customers.

This Policy encompasses all fourteen (14) active BaaS fintech sponsor partners operating through BRB's charter, including but not limited to:

(a) NovaPay Technologies Inc.;

(b) FairLend Digital LLC;

(d) All other current and future BaaS partners onboarded under the Bank's BaaS Program Agreement framework.

This Policy applies to all transaction types processed by or through the Bank, including without limitation:

(a) Wire transfers, both domestic and international;

(b) Automated Clearing House (ACH) transactions, including originations and receipts;

(d) Loan originations and disbursements;

(e) Account openings and customer onboarding activities;

(f) Trade finance transactions;

(g) Correspondent banking transactions; and

(h) All payments processed through BaaS partner channels, regardless of transaction type or dollar amount.

The aggregate volume of BaaS transactions underscores the critical importance of comprehensive sanctions screening across all partner channels. In calendar year 2024, total BaaS transaction volume was approximately $74.3 billion across all fourteen (14) partners. NovaPay alone accounted for approximately $30.5 billion in transaction volume, representing approximately forty-one percent (41%) of total BaaS volume. Given the scale and velocity of BaaS transaction flows, the Bank's OFAC compliance program must be calibrated to address the unique risks posed by these channels.

This Policy further applies to all customer onboarding activities, periodic customer reviews, and ongoing monitoring activities, whether conducted directly by the Bank or through BaaS partner platforms under the Bank's oversight.

The scope of this Policy extends to third-party vendor management related to sanctions screening technology. The Bank's current sanctions screening technology vendor is Veridian Analytics Inc. ("Veridian"), and the Bank utilizes the Veridian Transaction Monitoring System ("TMS") v.10.0 and its associated OFAC screening module. All vendor management activities related to the sanctions screening platform are subject to this Policy and the Bank's broader third-party risk management framework.

1.3 Regulatory Framework

The Bank's OFAC compliance obligations arise from a comprehensive body of federal statutes, regulations, executive orders, and regulatory guidance. This Policy is designed to ensure compliance with all applicable legal and regulatory requirements, including but not limited to the following:

OFAC Governing Statutes. The principal statutory authorities under which OFAC administers and enforces economic sanctions programs include:

(a) The International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, which grants the President broad authority to regulate international economic transactions in response to threats to national security, foreign policy, or the economy of the United States;

(b) The Trading with the Enemy Act ("TWEA"), 50 U.S.C. App. §§ 1–44, which provides authority for sanctions programs involving countries with which the United States is at war or has declared a national emergency (currently applicable primarily to the Cuba sanctions program); and

(c) Applicable Executive Orders issued by the President under the foregoing statutory authorities, which establish and modify specific sanctions programs.

OFAC Regulations. OFAC's implementing regulations are codified at 31 C.F.R. Parts 501 through 599. Part 501 sets forth OFAC's general procedural and reporting requirements, including the Economic Sanctions Enforcement Guidelines (Appendix A to Part 501), while Parts 510 through 599 contain the regulations governing individual sanctions programs (e.g., Part 510 — North Korea Sanctions Regulations; Part 560 — Iranian Transactions and Sanctions Regulations; Part 589 — Ukraine-/Russia-Related Sanctions Regulations).

Bank Secrecy Act. The Bank Secrecy Act ("BSA"), 31 U.S.C. § 5311 et seq., and its implementing regulations at 31 C.F.R. Chapter X, impose anti-money laundering and sanctions compliance obligations on financial institutions, including requirements for customer identification programs, suspicious activity reporting, and the maintenance of effective compliance programs.

OCC Guidance and Regulations. The Bank's primary federal regulator is the Office of the Comptroller of the Currency ("OCC"). Applicable OCC regulations and guidance include:

(a) 12 C.F.R. Part 19, which governs civil money penalty proceedings and enforcement actions;

(b) OCC Bulletin 2023-17, which sets forth revised guidance on third-party risk management, including the management of risks associated with fintech partnerships and BaaS arrangements;

(c) The FFIEC BSA/AML Examination Manual, including the chapter on OFAC compliance, which provides detailed guidance on the elements of an effective sanctions compliance program; and

(d) OCC Consent Order No. OCC-2025-003 (effective January 15, 2025), which imposes specific remediation requirements on the Bank related to BSA/AML compliance and OFAC sanctions screening, including requirements directly addressed by this Policy.

Strict Liability Standard. All personnel must understand that OFAC sanctions violations are subject to a strict liability standard. There is no requirement that the Bank or any individual have knowledge of or intent to violate sanctions in order for liability to attach. A violation occurs when a prohibited transaction is processed, regardless of whether the Bank was aware of the sanctioned party's status or the transaction's connection to a sanctioned jurisdiction. This strict liability framework underscores the critical importance of maintaining comprehensive, effective, and continuously operating sanctions screening systems that cover one hundred percent (100%) of the Bank's transactions, without exception.

SECTION 2: GOVERNANCE AND ORGANIZATIONAL STRUCTURE

2.1 Board of Directors Oversight

The Board of Directors of Belmont Ridge Financial Group, Inc. (the "Board") bears ultimate responsibility for ensuring that the Bank maintains an effective OFAC compliance program that is commensurate with the Bank's risk profile, business activities, and regulatory obligations. The Board has delegated day-to-day oversight of the OFAC compliance program to the Compliance Committee and to the Bank's senior management, but the Board retains ultimate accountability for the program's effectiveness and adequacy.

The Compliance Committee of the Board has been newly established in connection with the Consent Order remediation. The Compliance Committee is chaired by James Rutherford and shall receive monthly reporting on OFAC screening metrics. Monthly reports to the Compliance Committee shall include, at a minimum:

(a) Total transaction volumes screened, segmented by business line, transaction type, and BaaS partner;

(b) OFAC screening hit volumes and hit rates;

(d) False-positive rates and trends;

(e) blocking and rejection activity, including the status of all currently blocked property;

(f) OFAC report filing activity, including the timeliness of blocking reports and annual reports;

(g) Voluntary self-disclosure activity, if any;

(h) Remediation progress against the milestones established in the Comprehensive Remediation Action Plan; and

(i) BaaS partner-level performance data, including screening coverage validation results and partner compliance status.

The Board must approve this Policy and any material amendments thereto. The Board shall receive a comprehensive quarterly OFAC program status report, in addition to the monthly reports provided to the Compliance Committee, and shall ensure that the Bank's OFAC compliance program is adequately resourced and that any identified deficiencies are remediated in a timely manner.

OFAC screening performance data presented to the Board and Compliance Committee shall be segmented by business line and by individual BaaS partner to enable effective oversight and identification of partner-specific risks or deficiencies.

2.2 Chief Compliance Officer (CCO)

Patricia Langston, Chief Compliance Officer (appointed January 2024), has overall responsibility for the design, implementation, and maintenance of the Bank's OFAC compliance program. The CCO is the Bank's senior-most compliance officer and serves as the primary point of accountability for ensuring that the Bank's sanctions compliance framework meets all regulatory requirements and industry best practices.

The CCO reports to the General Counsel, Gregory Nardone, and has a direct reporting line to the Compliance Committee of the Board, consistent with the requirements of the Consent Order and sound corporate governance practices. This dual reporting structure is designed to ensure that the CCO has appropriate independence and access to the Board in all matters related to compliance, including OFAC compliance.

The CCO is specifically responsible for:

(a) Ensuring that adequate resources, staffing, and technology are allocated to OFAC compliance, including the timely completion of the Veridian TMS v.10.0 upgrade and the remediation of all screening gaps identified in the Consent Order;

(b) Overseeing the BSA Officer's management of the day-to-day OFAC screening operations;

(c) Approving, in conjunction with the General Counsel and outside counsel, decisions regarding voluntary self-disclosure to OFAC;

(d) Ensuring that OFAC compliance training is delivered to all relevant personnel;

(e) Reviewing and approving material changes to the OFAC compliance program, including changes to screening parameters, technology, and organizational structure; and

(f) Reporting to the Board and Compliance Committee on the status and effectiveness of the OFAC compliance program.

2.3 BSA Officer / AML Program Director

Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), serves as the day-to-day operational owner of the Bank's OFAC sanctions screening program. Mr. Ikeda has been designated as the Bank's primary point of contact for all matters related to OFAC screening operations, interdiction, and reporting.

The BSA Officer's responsibilities with respect to OFAC compliance include, without limitation:

(a) Oversight of all sanctions screening operations, including real-time and batch screening processes;

(b) Management of the sanctions screening team within the BSA/AML Department, including the allocation of analysts to hit review and disposition functions;

(d) Escalation of potential true matches and complex screening hits to the CCO and, where appropriate, to outside counsel;

(e) Timely filing of blocking reports with OFAC's Compliance Division in accordance with the ten (10) business day filing requirement;

(f) Preparation and filing of annual reports of blocked property;

(g) Coordination with law enforcement agencies as necessary in connection with OFAC-related matters;

(h) Monitoring of OFAC list updates and ensuring timely ingestion of list data into the screening system;

(i) Coordination with the CIO/CTO on screening system performance, uptime, and technical issues; and

(j) Preparation of OFAC-related metrics and reports for the CCO, Compliance Committee, and Board.

The BSA Officer reports directly to the CCO and provides regular updates to the Chief Risk Officer, Melissa Chu, on OFAC-related risk matters, including screening system performance, emerging sanctions risks, and remediation progress.

2.4 Head of Fintech Partnerships / BaaS Division

Warren Ashby, Head of Fintech Partnerships / BaaS Division, is responsible for ensuring that all BaaS partner agreements contain adequate OFAC compliance obligations and that all partner transaction flows are fully integrated into BRB's centralized screening infrastructure. Given that BaaS transaction flows represent a significant and growing proportion of the Bank's total transaction volume, Mr. Ashby's role is critical to the effectiveness of the Bank's OFAC compliance program.

Mr. Ashby shall coordinate closely with the BSA Officer (Thomas Ikeda) and the CIO/CTO (Linda Petrosian) to ensure that one hundred percent (100%) of BaaS transactions, across all fourteen (14) active partner channels, are routed through the Bank's sanctions screening system prior to execution. Mr. Ashby is further responsible for:

(a) Negotiating and implementing OFAC-related compliance provisions in all new and amended BaaS partnership agreements;

(b) Conducting ongoing oversight of BaaS partner compliance with OFAC-related contractual obligations;

(c) Coordinating with the BSA Officer on the investigation and disposition of OFAC screening hits related to BaaS partner transactions;

(d) Ensuring that BaaS partners provide complete and accurate transaction data in formats compatible with the Bank's screening system; and

(e) Escalating BaaS partner non-compliance with OFAC-related obligations through the BaaS Compliance Oversight Framework.

2.5 Chief Information Officer / Chief Technology Officer

Linda Petrosian, CIO/CTO, is responsible for maintaining the technical infrastructure supporting the Bank's OFAC screening program. This includes the Veridian Analytics sanctions screening platform, all system integrations connecting BaaS partner transaction feeds to the screening infrastructure, and the data feeds that support sanctions list management and screening operations.

Ms. Petrosian is specifically responsible for:

(a) Ensuring system uptime for the sanctions screening platform at or above the minimum threshold of 99.9% measured monthly;

(b) Ensuring timely ingestion of OFAC list updates into the screening system within twenty-four (24) hours of publication by OFAC;

(c) Managing the technical integration of all transaction channels—including all fourteen (14) BaaS partner channels—into the screening architecture;

(d) Overseeing the upgrade of the Veridian TMS platform from version 8.3 to version 10.0, including the enhanced OFAC module, in accordance with the project timeline established in the Comprehensive Remediation Action Plan;

(e) Maintaining automated verification logs confirming successful list ingestion and system updates; and

(f) Ensuring that business continuity and disaster recovery plans include adequate provisions for sanctions screening during system outages.

2.6 Internal Audit

Derek Ballard, Head of Internal Audit, shall include OFAC compliance within the annual audit plan. The internal audit function provides an independent assessment of the effectiveness of the Bank's OFAC screening controls and the overall adequacy of the sanctions compliance program.

Internal audit shall independently test the effectiveness of OFAC screening controls at least annually, consistent with the Bank's risk-based audit methodology. During the remediation period associated with Consent Order No. OCC-2025-003 (through February 15, 2026), OFAC compliance testing shall be conducted more frequently, as determined by the Head of Internal Audit in consultation with the CCO and the Compliance Committee. Internal audit findings related to OFAC compliance shall be reported to the CCO, the Compliance Committee, and the Board, with management action plans developed for all identified deficiencies.

2.7 Compliance Committee Reporting Requirements

The following reporting cadence and content requirements shall be observed to ensure effective governance oversight of the Bank's OFAC compliance program:

Monthly OFAC Metrics Report to Compliance Committee. The BSA Officer, in coordination with the CCO, shall prepare and deliver a monthly OFAC metrics report to the Compliance Committee (James Rutherford, Chair). This report shall include, at a minimum: total transactions screened (segmented by channel and BaaS partner), hit volumes, true match counts, false-positive rates, blocking and rejection actions taken, voluntary self-disclosure activity, OFAC report filing timeliness, and BaaS partner-level performance data, including the results of screening coverage validation testing.

Quarterly Comprehensive OFAC Program Status Report to the Board. The CCO shall prepare and deliver a quarterly comprehensive OFAC program status report to the full Board of Directors. This report shall provide a holistic assessment of the Bank's OFAC compliance program, including remediation progress, technology upgrade status, staffing and resource adequacy, emerging sanctions risks, regulatory developments, and any material issues or incidents requiring Board attention.

SECTION 3: OFAC SANCTIONS LISTS AND LIST MANAGEMENT

3.1 Sanctions Lists Covered

The Bank's OFAC compliance program shall screen all applicable transactions, customers, and counterparties against the full range of sanctions lists published and maintained by OFAC. The sanctions lists covered by this Policy include, without limitation:

(a) Specially Designated Nationals and blocked Persons List (SDN List). The SDN List identifies individuals and entities whose property and interests in property are blocked pursuant to one or more OFAC sanctions programs. U.S. persons are generally prohibited from engaging in any transactions or dealings with SDNs, and all property and interests in property of SDNs that are within the United States or that come within the possession or control of a U.S. person must be blocked (frozen).

(b) Sectoral Sanctions Identifications List (SSI List). The SSI List identifies persons operating in sectors of the Russian economy designated pursuant to Executive Order 13662. Transactions with persons on the SSI List are subject to specific prohibitions that vary by directive.

(i) Foreign Sanctions Evaders List (FSE List);

(ii) Palestinian Legislative Council List (NS-PLC List);

(iii) Correspondent Account or Payable-Through Account Sanctions List (CAPTA List);

(iv) Non-SDN Menu-Based Sanctions List (NS-MBS List);

(v) Non-SDN Chinese Military-Industrial Complex Companies List (NS-CMIC List); and

(vi) Any other non-SDN lists published by OFAC from time to time.

(d) Country-Based and Program-Specific Sanctions Programs. All country-based and program-specific sanctions programs administered by OFAC, including but not limited to the sanctions programs relating to Cuba, Iran, North Korea, Syria, Russia/Ukraine, Venezuela, and any other jurisdictions or programs designated by OFAC.

(e) Additional Lists. Any additional lists published or updated by OFAC from time to time, including lists that may be established under new or amended executive orders or regulations.

The Bank shall maintain awareness of all active OFAC sanctions programs and shall ensure that its screening system is configured to screen against all applicable lists. A reference table of all active OFAC sanctions programs applicable to the Bank's operations is set forth in Appendix B to this Policy.

3.2 List Update Procedures

Timely and accurate ingestion of OFAC sanctions list updates is essential to the effectiveness of the Bank's screening program. The following procedures shall govern list update management:

OFAC sanctions lists shall be updated in the Veridian Analytics screening system within twenty-four (24) hours of publication by OFAC. This twenty-four-hour standard applies to all list updates, including additions, modifications, and removals of entries on any OFAC list.

The BSA Officer (Thomas Ikeda) or his designee shall monitor OFAC's website (https://www.treasury.gov/ofac), OFAC's email distribution list, and OFAC's RSS feeds on a continuous basis for real-time notification of list updates. The BSA/AML Department shall subscribe to all available OFAC notification services and shall maintain redundant monitoring mechanisms to ensure that no list update is missed.

Emergency list updates—including the designation of new SDNs in connection with imminent threats to national security or foreign policy—shall trigger immediate system propagation. Upon receipt of an emergency list update, the IT team (under Linda Petrosian) shall initiate an immediate update to the screening system, and the BSA Officer shall direct retroactive screening of all pending and in-process transactions to ensure that no transaction involving a newly designated party is processed without screening.

The IT team under Linda Petrosian shall confirm successful list ingestion and system update through automated verification logs. These logs shall document the date and time of list publication by OFAC, the date and time of ingestion into the Veridian platform, the number of records added, modified, or removed, and confirmation of successful propagation to all screening nodes. Any failure in the list update process shall be immediately escalated to the BSA Officer and the CIO/CTO.

All list update records shall be retained for a minimum of five (5) years from the date of the update, in accordance with the recordkeeping requirements of this Policy and applicable regulations.

3.3 Fuzzy Matching and Screening Algorithm Configuration

The Bank's sanctions screening system shall employ robust fuzzy matching logic designed to maximize the identification of potential matches to sanctioned parties while appropriately managing false-positive volumes. The fuzzy matching configuration shall include, at a minimum:

(a) Name-based matching, including variations in spelling, transliteration, phonetic equivalents, name order permutations, and partial name matches;

(b) Alias-based matching, including screening against all known aliases, "also known as" entries, and "formerly known as" entries listed by OFAC;

(c) Address-based matching, including screening of addresses associated with transactions and customer records against sanctioned addresses and geographic identifiers; and

(d) Identifier-based matching, including screening of passport numbers, national identification numbers, tax identification numbers, and other unique identifiers listed on OFAC sanctions entries.

The Bank's calendar year 2024 baseline metrics for OFAC screening are as follows: the screening system generated 14,320 OFAC screening hits across all channels, of which twelve (12) were determined to be true matches requiring blocking or rejection action. The resulting false-positive rate was approximately 99.9% ((14,320 – 12) ÷ 14,320). While a high false-positive rate is inherent in sanctions screening given the breadth of name-based matching required, the Bank is committed to optimizing its screening parameters to reduce false-positive volumes where possible without compromising detection effectiveness.

Matching thresholds and algorithm parameters shall be reviewed and tuned at least semi-annually by the BSA/AML Department in coordination with the CIO/CTO and Veridian Analytics. Each review shall include a documented analysis of the rationale for threshold settings, including the impact of any proposed changes on both detection effectiveness and false-positive volumes. The results of each review, including any parameter changes implemented, shall be documented in the model governance records maintained by the Bank's Model Risk Management function.

Any changes to fuzzy matching parameters require the prior written approval of the BSA Officer (Thomas Ikeda). Significant changes—including any changes that would reduce the sensitivity of the screening algorithm—shall also require the approval of the CCO (Patricia Langston) and shall be communicated to the Compliance Committee.

The goal of the remediation effort, as it relates to screening algorithm configuration, is to optimize the screening system to reduce the false-positive rate where possible—thereby improving the efficiency of hit review and disposition—without compromising the system's ability to detect true matches. Detection effectiveness shall always take priority over false-positive reduction.

SECTION 4: SANCTIONS SCREENING REQUIREMENTS

4.1 Comprehensive Screening Mandate — 100% Transaction Coverage

All transactions processed by or through Belmont Ridge Bank National Association shall be screened against applicable OFAC sanctions lists prior to execution, without exception. This is a non-negotiable requirement. No transaction, regardless of type, amount, channel, or counterparty, shall be exempted from OFAC screening.

This comprehensive screening mandate is a direct response to the screening gap identified by the OCC in connection with Consent Order No. OCC-2025-003. The prior gap, in which approximately twelve percent (12%) of NovaPay Technologies Inc. wire and ACH transactions (approximately 3,800,000 transactions in calendar year 2023) were not screened against OFAC sanctions lists, shall not recur under any circumstances. The Bank has implemented, and continues to implement, the technology, process, and governance controls necessary to ensure that every transaction processed by or through the Bank is screened.

The one hundred percent (100%) coverage requirement applies to all of the following transaction types and channels:

(a) Wire transfers, both domestic and international;

(b) ACH originations and receipts;

(d) Loan disbursements and draws;

(e) Account openings and customer onboarding events;

(f) Deposit transactions;

(g) Trade finance transactions, including letters of credit, documentary collections, and trade-related payments; and

(h) All payment flows originated by, received by, or passing through BaaS partners, regardless of the partner's own screening capabilities or representations.

No transaction type, channel, or partner is exempt from OFAC screening. The Bank, as the chartered national bank and sponsor institution for all BaaS partnerships, bears full and sole responsibility for ensuring that all transactions processed through its charter are screened for compliance with OFAC sanctions programs.

4.2 Real-Time Screening

All wire transfers, both domestic and international, shall be screened in real-time (i.e., prior to execution) against all applicable OFAC sanctions lists. Real-time screening means that the transaction is submitted to the screening system and a screening determination is returned before the transaction is released for settlement or execution. No wire transfer shall be processed until screening has been completed and any resulting hits have been reviewed and dispositioned or placed on hold.

All ACH transactions originated through BaaS partner channels shall be screened in real-time or, where not technically feasible due to the batch processing nature of the ACH network, in near-real-time batch processing. In cases where near-real-time batch processing is employed, holds shall be applied to all flagged items prior to settlement. Specifically, any ACH transaction that generates a screening hit shall be placed on hold and withheld from settlement until the hit has been reviewed and dispositioned in accordance with the procedures set forth in Section 5 of this Policy.

Card authorization screening for high-risk geographies and sanctioned jurisdictions shall occur at the point of authorization. The Bank's card processing systems shall be configured to identify and flag transactions involving sanctioned countries, territories, or geographic regions at the time of authorization, with automated holds or declines applied as appropriate based on the applicable sanctions program.

4.3 Batch Screening

For transaction types not subject to real-time screening, batch screening shall be conducted at a minimum on a daily basis. Batch screening shall be scheduled to ensure that all applicable transactions are screened within the same business day on which they are initiated or received.

Batch screening results shall be reviewed and dispositioned by trained analysts within the BSA/AML Department within the same business day on which the results are generated. Any delays in disposition shall be escalated to the BSA Officer in accordance with the escalation procedures set forth in Section 5.4 of this Policy.

Any matches identified through batch screening shall result in immediate holds on the affected transactions, pending review and disposition. No transaction identified as a potential match in batch screening shall be processed or settled until a disposition determination has been made and documented.

4.4 Customer and Counterparty Screening

All new customers shall be screened against OFAC sanctions lists at the time of account opening or onboarding, regardless of the channel through which onboarding occurs. This requirement applies with equal force to customers onboarded directly by the Bank through its retail, commercial, and wealth management channels and to customers onboarded through BaaS partner platforms, including NovaPay Technologies, FairLend Digital, VaultEdge, and all other BaaS partners. The Bank retains responsibility for ensuring that all customers added to its books and records are screened, irrespective of whether the partner platform conducts its own screening.

The Bank's existing customer base shall be re-screened upon each OFAC list update. When OFAC publishes additions, modifications, or changes to any sanctions list, the Bank's customer database shall be screened against the updated list entries to identify any existing customers who may be matches to newly designated or modified sanctions entries. Any matches identified through re-screening shall be immediately escalated to the BSA Officer for investigation and disposition.

All counterparties, beneficiaries, originators, and intermediaries in payment transactions shall be screened. This includes not only the direct counterparties to the Bank but also all parties identified in payment message fields, including ordering parties, beneficiary parties, intermediary financial institutions, and any other parties whose identities are available in the transaction data.

Customer and counterparty screening shall include, at a minimum, the following data elements: name (full name, aliases, and variations), address, date of birth (where available), national identification numbers (e.g., passport numbers, tax identification numbers), and any other identifiers that may be matched against OFAC sanctions entries.

4.5 BaaS Partner Transaction Screening — Enhanced Requirements

Given the significance of BaaS transaction volumes to the Bank's overall transaction profile and the screening gaps identified in connection with the Consent Order, the Bank shall maintain enhanced OFAC screening requirements for all BaaS partner transaction flows.

All fourteen (14) active BaaS fintech partners' transaction flows shall be routed through BRB's centralized OFAC screening infrastructure, specifically the Veridian Analytics platform. Centralized screening is essential to maintaining the Bank's control over its sanctions compliance obligations and ensuring uniform screening standards across all partner channels.

BaaS partners are expressly prohibited from self-screening in lieu of BRB's centralized screening. While partners may choose to implement their own screening as an additional layer of controls, any partner-level screening does not satisfy the Bank's obligations and shall not be relied upon by the Bank. BRB retains full responsibility as the chartered national bank for ensuring that all transactions processed through its charter are screened in accordance with this Policy and applicable law.

Warren Ashby (Head of Fintech Partnerships) shall ensure that all new and existing BaaS partner integrations include compliant data feeds to the Bank's centralized screening system. Data feeds must provide all required transaction data elements—including originator, beneficiary, and intermediary information—in formats compatible with the Veridian Analytics screening platform.

Each BaaS partner's transaction flow shall be independently validated for one hundred percent (100%) screening coverage at least quarterly. Validation testing shall confirm that every transaction originated, processed, or settled through each partner's channel has been submitted to and screened by the Bank's centralized screening system. The results of validation testing shall be documented and reported to the BSA Officer and the Compliance Committee.

The following top-tier partners, which collectively account for approximately eighty-seven percent (87%) of total BaaS transaction volume, shall be subject to enhanced monitoring and more frequent coverage validation:

These top-tier partners shall be subject to monthly screening coverage validation, in addition to the quarterly validation required for all partners, during the remediation period.

Full OFAC screening operationalization for all BaaS channels is required no later than November 1, 2025, in accordance with the timeline established in the Comprehensive Remediation Action Plan submitted to the OCC. All partner integrations, system upgrades, and testing activities must be completed prior to this date to ensure full compliance.

SECTION 5: INTERDICTION, BLOCKING, AND REJECTION PROCEDURES

5.1 blocking of Transactions Involving SDN Matches

Upon identification of a true match to the SDN List, the relevant transaction shall be immediately blocked (frozen) in accordance with applicable OFAC regulations. Blocking requires that the transaction be halted and that all property or interests in property associated with the SDN be held in a segregated account maintained by the Bank.

Blocked funds shall be placed in a segregated blocked-property account maintained by BRB. The blocked-property account shall be interest-bearing, as required by OFAC regulations, and shall be clearly identified in the Bank's records as containing blocked property subject to OFAC sanctions. The Bank shall maintain accurate and current records of all blocked property, including the identity of the blocked person, the nature and amount of the blocked property, the date of blocking, the applicable sanctions program, and the status of the blocked property (including any applications for specific licenses submitted to OFAC).

The BSA Officer (Thomas Ikeda) shall be notified immediately upon any blocking action. Notification shall include the identity of the blocked person, the nature of the transaction, the amount involved, the applicable sanctions program, and the identity of the BaaS partner or business line involved. The BSA Officer shall confirm the blocking action, ensure the initiation of OFAC reporting procedures, and coordinate with the CCO and General Counsel as necessary.

No blocked transaction may be released without authorization from OFAC in the form of a specific license or upon a documented determination, approved by the BSA Officer, that the match is a false positive following a thorough review. The investigation and review process for potential true matches shall be documented in detail, including all steps taken, information reviewed, and the basis for the final disposition.

5.2 Rejection of Prohibited Transactions

Transactions that are prohibited under a sanctions program but do not involve blocked persons—for example, transactions involving comprehensively sanctioned countries or jurisdictions (such as Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk, and Luhansk regions of Ukraine) or transactions involving prohibited trade activities—shall be rejected. A rejected transaction is one that the Bank declines to process and returns to the originator, as opposed to a blocked transaction, which the Bank holds in a segregated account.

Rejected transactions shall be documented in the Bank's records with the following information, at a minimum: the basis for the rejection, including the specific sanctions program or regulatory provision that prohibits the transaction; the identity of the sanctioned party, jurisdiction, or activity involved; the date and amount of the rejected transaction; and the identity of the originator and intended beneficiary.

The BSA Officer shall ensure that rejected transactions are reported to OFAC in accordance with the reporting requirements set forth in Section 6 of this Policy.

5.3 Holds Pending Review

When a screening hit requires further investigation to determine whether it is a true match or a false positive, the affected transaction shall be placed on hold pending review. No transaction that has generated a screening hit shall be processed or settled until the hit has been reviewed, dispositioned, and documented by a qualified analyst or, in the case of potential true matches, by the BSA Officer.

Holds shall be reviewed and dispositioned within twenty-four (24) hours of the hold being placed. This twenty-four-hour standard applies to all holds, regardless of the transaction type, channel, or dollar amount involved. If the review and disposition of a hold cannot be completed within twenty-four (24) hours—due to the complexity of the match, the need for additional information, or other factors—the hold shall be escalated to the BSA Officer for oversight and tracking.

Hold procedures must not, under any circumstances, result in the unauthorized processing of potentially sanctioned transactions. The Bank's systems and procedures shall be configured to ensure that transactions on hold remain in a held status until an affirmative disposition decision has been made and documented. Automatic release of held transactions without analyst review and disposition is strictly prohibited.

5.4 Escalation Procedures

All potential true matches—defined as screening hits where the initial analyst review cannot conclusively determine that the hit is a false positive—shall be escalated to the BSA Officer (Thomas Ikeda) for review and decision. The BSA Officer shall conduct or oversee an enhanced review of the potential match, including the collection of additional identifying information, consultation with the relevant business line or BaaS partner, and any other investigative steps necessary to reach a disposition.

The BSA Officer shall consult with the CCO (Patricia Langston) and, where warranted by the complexity, ambiguity, or significance of the match, with outside counsel (Calderwood & Harkness LLP; Philip Hartmann, Responsible Partner) prior to final disposition. Consultation with outside counsel is recommended in the following circumstances:

(a) Matches involving high-profile or politically exposed persons;

(b) Matches involving large-dollar transactions or significant blocked property;

(c) Matches where the applicable sanctions program involves nuanced or program-specific prohibitions (e.g., sectoral sanctions, licensing requirements);

REVISED OFAC COMPLIANCE POLICY
Enterprise-Wide Compliance Policy
Belmont Ridge Bank National Association
ATTORNEY-CLIENT PRIVILEGED / WORK PRODUCT — DRAFT FOR INTERNAL REVIEW
Right-click to update Table of Contents
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose
This Revised OFAC Compliance Policy (the "Policy") establishes Belmont Ridge Bank National Association's ("BRB" or the "Bank") enterprise-wide policy governing compliance with all economic sanctions programs administered and enforced by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"). The Policy is designed to ensure that the Bank, across all of its business lines, products, services, and delivery channels, maintains a comprehensive and effective sanctions compliance program commensurate with its risk profile and regulatory obligations.
This Policy has been developed to fulfill the requirements of OCC Consent Order No. OCC-2025-003 (effective January 15, 2025) (the "Consent Order"), which, among other matters, specifically addressed findings of inadequate OFAC sanctions screening protocols for fintech Banking-as-a-Service ("BaaS") transaction flows. The Consent Order identified material deficiencies in the Bank's prior sanctions screening infrastructure, including a failure to screen a significant volume of transactions originated by BaaS partner NovaPay Technologies Inc. ("NovaPay") against applicable OFAC sanctions lists. The Bank is committed to the full and timely remediation of all deficiencies identified in the Consent Order and to the establishment of an OFAC compliance program that meets or exceeds regulatory expectations.
This Policy provides the framework for the Bank's sanctions screening, interdiction, blocking, rejecting, and reporting obligations applicable to all business lines, products, services, and delivery channels. It is intended to serve as the foundational policy document within the Bank's Consolidated BSA/AML & Sanctions Policy Suite and to be read in conjunction with the OFAC Screening Procedures Manual, the Comprehensive Remediation Action Plan, and all other related policies and procedures referenced herein.
The development and revision of this Policy reflects the remediation requirements arising from the identification that approximately twelve percent (12%) of NovaPay Technologies Inc. wire and Automated Clearing House ("ACH") transactions—approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023—were not screened against OFAC sanctions lists prior to execution. This screening gap represented a serious compliance failure that exposed the Bank to significant regulatory, financial, and reputational risk. The Bank takes these findings with the utmost seriousness, and this Policy is a central element of the Bank's comprehensive remediation efforts.
1.2 Scope of Applicability
This Policy applies to all officers, employees, contractors, and agents of Belmont Ridge Bank National Association, across all domestic and international operations. Compliance with the requirements of this Policy is mandatory, and all personnel are expected to understand and adhere to the provisions applicable to their respective roles and responsibilities.
The scope of this Policy encompasses the following business lines and operational areas:
•  Retail Banking. All consumer deposit products, consumer lending, and retail branch operations.
•  Commercial Lending. All commercial and industrial lending, commercial real estate lending, and related treasury management services.
•  Wealth Management. All investment advisory, trust, and private banking services.
•  Fintech Banking-as-a-Service (BaaS) Partnerships. All fintech sponsor partnerships operating through BRB's national bank charter, including the origination, processing, and settlement of transactions by BaaS partners and their end customers.
This Policy encompasses all fourteen (14) active BaaS fintech sponsor partners operating through BRB's charter, including but not limited to:
(a) NovaPay Technologies Inc.;
(b) FairLend Digital LLC;
(c) VaultEdge Inc.; and
(d) All other current and future BaaS partners onboarded under the Bank's BaaS Program Agreement framework.
This Policy applies to all transaction types processed by or through the Bank, including without limitation:
(a) Wire transfers, both domestic and international;
(b) Automated Clearing House (ACH) transactions, including originations and receipts;
(c) Card transactions, including credit card, debit card, and prepaid card transactions;
(d) Loan originations and disbursements;
(e) Account openings and customer onboarding activities;
(f) Trade finance transactions;
(g) Correspondent banking transactions; and
(h) All payments processed through BaaS partner channels, regardless of transaction type or dollar amount.
The aggregate volume of BaaS transactions underscores the critical importance of comprehensive sanctions screening across all partner channels. In calendar year 2024, total BaaS transaction volume was approximately $74.3 billion across all fourteen (14) partners. NovaPay alone accounted for approximately $30.5 billion in transaction volume, representing approximately forty-one percent (41%) of total BaaS volume. Given the scale and velocity of BaaS transaction flows, the Bank's OFAC compliance program must be calibrated to address the unique risks posed by these channels.
This Policy further applies to all customer onboarding activities, periodic customer reviews, and ongoing monitoring activities, whether conducted directly by the Bank or through BaaS partner platforms under the Bank's oversight.
The scope of this Policy extends to third-party vendor management related to sanctions screening technology. The Bank's current sanctions screening technology vendor is Veridian Analytics Inc. ("Veridian"), and the Bank utilizes the Veridian Transaction Monitoring System ("TMS") v.10.0 and its associated OFAC screening module. All vendor management activities related to the sanctions screening platform are subject to this Policy and the Bank's broader third-party risk management framework.
1.3 Regulatory Framework
The Bank's OFAC compliance obligations arise from a comprehensive body of federal statutes, regulations, executive orders, and regulatory guidance. This Policy is designed to ensure compliance with all applicable legal and regulatory requirements, including but not limited to the following:
OFAC Governing Statutes. The principal statutory authorities under which OFAC administers and enforces economic sanctions programs include:
(a) The International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, which grants the President broad authority to regulate international economic transactions in response to threats to national security, foreign policy, or the economy of the United States;
(b) The Trading with the Enemy Act ("TWEA"), 50 U.S.C. App. §§ 1–44, which provides authority for sanctions programs involving countries with which the United States is at war or has declared a national emergency (currently applicable primarily to the Cuba sanctions program); and
(c) Applicable Executive Orders issued by the President under the foregoing statutory authorities, which establish and modify specific sanctions programs.
OFAC Regulations. OFAC's implementing regulations are codified at 31 C.F.R. Parts 501 through 599. Part 501 sets forth OFAC's general procedural and reporting requirements, including the Economic Sanctions Enforcement Guidelines (Appendix A to Part 501), while Parts 510 through 599 contain the regulations governing individual sanctions programs (e.g., Part 510 — North Korea Sanctions Regulations; Part 560 — Iranian Transactions and Sanctions Regulations; Part 589 — Ukraine-/Russia-Related Sanctions Regulations).
Bank Secrecy Act. The Bank Secrecy Act ("BSA"), 31 U.S.C. § 5311 et seq., and its implementing regulations at 31 C.F.R. Chapter X, impose anti-money laundering and sanctions compliance obligations on financial institutions, including requirements for customer identification programs, suspicious activity reporting, and the maintenance of effective compliance programs.
OCC Guidance and Regulations. The Bank's primary federal regulator is the Office of the Comptroller of the Currency ("OCC"). Applicable OCC regulations and guidance include:
(a) 12 C.F.R. Part 19, which governs civil money penalty proceedings and enforcement actions;
(b) OCC Bulletin 2023-17, which sets forth revised guidance on third-party risk management, including the management of risks associated with fintech partnerships and BaaS arrangements;
(c) The FFIEC BSA/AML Examination Manual, including the chapter on OFAC compliance, which provides detailed guidance on the elements of an effective sanctions compliance program; and
(d) OCC Consent Order No. OCC-2025-003 (effective January 15, 2025), which imposes specific remediation requirements on the Bank related to BSA/AML compliance and OFAC sanctions screening, including requirements directly addressed by this Policy.
Strict Liability Standard. All personnel must understand that OFAC sanctions violations are subject to a strict liability standard. There is no requirement that the Bank or any individual have knowledge of or intent to violate sanctions in order for liability to attach. A violation occurs when a prohibited transaction is processed, regardless of whether the Bank was aware of the sanctioned party's status or the transaction's connection to a sanctioned jurisdiction. This strict liability framework underscores the critical importance of maintaining comprehensive, effective, and continuously operating sanctions screening systems that cover one hundred percent (100%) of the Bank's transactions, without exception.
SECTION 2: GOVERNANCE AND ORGANIZATIONAL STRUCTURE
2.1 Board of Directors Oversight
The Board of Directors of Belmont Ridge Financial Group, Inc. (the "Board") bears ultimate responsibility for ensuring that the Bank maintains an effective OFAC compliance program that is commensurate with the Bank's risk profile, business activities, and regulatory obligations. The Board has delegated day-to-day oversight of the OFAC compliance program to the Compliance Committee and to the Bank's senior management, but the Board retains ultimate accountability for the program's effectiveness and adequacy.
The Compliance Committee of the Board has been newly established in connection with the Consent Order remediation. The Compliance Committee is chaired by James Rutherford and shall receive monthly reporting on OFAC screening metrics. Monthly reports to the Compliance Committee shall include, at a minimum:
(a) Total transaction volumes screened, segmented by business line, transaction type, and BaaS partner;
(b) OFAC screening hit volumes and hit rates;
(c) True match counts and details of blocking and rejection actions taken;
(d) False-positive rates and trends;
(e) blocking and rejection activity, including the status of all currently blocked property;
(f) OFAC report filing activity, including the timeliness of blocking reports and annual reports;
(g) Voluntary self-disclosure activity, if any;
(h) Remediation progress against the milestones established in the Comprehensive Remediation Action Plan; and
(i) BaaS partner-level performance data, including screening coverage validation results and partner compliance status.
The Board must approve this Policy and any material amendments thereto. The Board shall receive a comprehensive quarterly OFAC program status report, in addition to the monthly reports provided to the Compliance Committee, and shall ensure that the Bank's OFAC compliance program is adequately resourced and that any identified deficiencies are remediated in a timely manner.
OFAC screening performance data presented to the Board and Compliance Committee shall be segmented by business line and by individual BaaS partner to enable effective oversight and identification of partner-specific risks or deficiencies.
2.2 Chief Compliance Officer (CCO)
Patricia Langston, Chief Compliance Officer (appointed January 2024), has overall responsibility for the design, implementation, and maintenance of the Bank's OFAC compliance program. The CCO is the Bank's senior-most compliance officer and serves as the primary point of accountability for ensuring that the Bank's sanctions compliance framework meets all regulatory requirements and industry best practices.
The CCO reports to the General Counsel, Gregory Nardone, and has a direct reporting line to the Compliance Committee of the Board, consistent with the requirements of the Consent Order and sound corporate governance practices. This dual reporting structure is designed to ensure that the CCO has appropriate independence and access to the Board in all matters related to compliance, including OFAC compliance.
The CCO is specifically responsible for:
(a) Ensuring that adequate resources, staffing, and technology are allocated to OFAC compliance, including the timely completion of the Veridian TMS v.10.0 upgrade and the remediation of all screening gaps identified in the Consent Order;
(b) Overseeing the BSA Officer's management of the day-to-day OFAC screening operations;
(c) Approving, in conjunction with the General Counsel and outside counsel, decisions regarding voluntary self-disclosure to OFAC;
(d) Ensuring that OFAC compliance training is delivered to all relevant personnel;
(e) Reviewing and approving material changes to the OFAC compliance program, including changes to screening parameters, technology, and organizational structure; and
(f) Reporting to the Board and Compliance Committee on the status and effectiveness of the OFAC compliance program.
2.3 BSA Officer / AML Program Director
Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), serves as the day-to-day operational owner of the Bank's OFAC sanctions screening program. Mr. Ikeda has been designated as the Bank's primary point of contact for all matters related to OFAC screening operations, interdiction, and reporting.
The BSA Officer's responsibilities with respect to OFAC compliance include, without limitation:
(a) Oversight of all sanctions screening operations, including real-time and batch screening processes;
(b) Management of the sanctions screening team within the BSA/AML Department, including the allocation of analysts to hit review and disposition functions;
(c) Review and disposition of OFAC screening hits, including the determination of true matches and false positives;
(d) Escalation of potential true matches and complex screening hits to the CCO and, where appropriate, to outside counsel;
(e) Timely filing of blocking reports with OFAC's Compliance Division in accordance with the ten (10) business day filing requirement;
(f) Preparation and filing of annual reports of blocked property;
(g) Coordination with law enforcement agencies as necessary in connection with OFAC-related matters;
(h) Monitoring of OFAC list updates and ensuring timely ingestion of list data into the screening system;
(i) Coordination with the CIO/CTO on screening system performance, uptime, and technical issues; and
(j) Preparation of OFAC-related metrics and reports for the CCO, Compliance Committee, and Board.
The BSA Officer reports directly to the CCO and provides regular updates to the Chief Risk Officer, Melissa Chu, on OFAC-related risk matters, including screening system performance, emerging sanctions risks, and remediation progress.
2.4 Head of Fintech Partnerships / BaaS Division
Warren Ashby, Head of Fintech Partnerships / BaaS Division, is responsible for ensuring that all BaaS partner agreements contain adequate OFAC compliance obligations and that all partner transaction flows are fully integrated into BRB's centralized screening infrastructure. Given that BaaS transaction flows represent a significant and growing proportion of the Bank's total transaction volume, Mr. Ashby's role is critical to the effectiveness of the Bank's OFAC compliance program.
Mr. Ashby shall coordinate closely with the BSA Officer (Thomas Ikeda) and the CIO/CTO (Linda Petrosian) to ensure that one hundred percent (100%) of BaaS transactions, across all fourteen (14) active partner channels, are routed through the Bank's sanctions screening system prior to execution. Mr. Ashby is further responsible for:
(a) Negotiating and implementing OFAC-related compliance provisions in all new and amended BaaS partnership agreements;
(b) Conducting ongoing oversight of BaaS partner compliance with OFAC-related contractual obligations;
(c) Coordinating with the BSA Officer on the investigation and disposition of OFAC screening hits related to BaaS partner transactions;
(d) Ensuring that BaaS partners provide complete and accurate transaction data in formats compatible with the Bank's screening system; and
(e) Escalating BaaS partner non-compliance with OFAC-related obligations through the BaaS Compliance Oversight Framework.
2.5 Chief Information Officer / Chief Technology Officer
Linda Petrosian, CIO/CTO, is responsible for maintaining the technical infrastructure supporting the Bank's OFAC screening program. This includes the Veridian Analytics sanctions screening platform, all system integrations connecting BaaS partner transaction feeds to the screening infrastructure, and the data feeds that support sanctions list management and screening operations.
Ms. Petrosian is specifically responsible for:
(a) Ensuring system uptime for the sanctions screening platform at or above the minimum threshold of 99.9% measured monthly;
(b) Ensuring timely ingestion of OFAC list updates into the screening system within twenty-four (24) hours of publication by OFAC;
(c) Managing the technical integration of all transaction channels—including all fourteen (14) BaaS partner channels—into the screening architecture;
(d) Overseeing the upgrade of the Veridian TMS platform from version 8.3 to version 10.0, including the enhanced OFAC module, in accordance with the project timeline established in the Comprehensive Remediation Action Plan;
(e) Maintaining automated verification logs confirming successful list ingestion and system updates; and
(f) Ensuring that business continuity and disaster recovery plans include adequate provisions for sanctions screening during system outages.
2.6 Internal Audit
Derek Ballard, Head of Internal Audit, shall include OFAC compliance within the annual audit plan. The internal audit function provides an independent assessment of the effectiveness of the Bank's OFAC screening controls and the overall adequacy of the sanctions compliance program.
Internal audit shall independently test the effectiveness of OFAC screening controls at least annually, consistent with the Bank's risk-based audit methodology. During the remediation period associated with Consent Order No. OCC-2025-003 (through February 15, 2026), OFAC compliance testing shall be conducted more frequently, as determined by the Head of Internal Audit in consultation with the CCO and the Compliance Committee. Internal audit findings related to OFAC compliance shall be reported to the CCO, the Compliance Committee, and the Board, with management action plans developed for all identified deficiencies.
2.7 Compliance Committee Reporting Requirements
The following reporting cadence and content requirements shall be observed to ensure effective governance oversight of the Bank's OFAC compliance program:
Monthly OFAC Metrics Report to Compliance Committee. The BSA Officer, in coordination with the CCO, shall prepare and deliver a monthly OFAC metrics report to the Compliance Committee (James Rutherford, Chair). This report shall include, at a minimum: total transactions screened (segmented by channel and BaaS partner), hit volumes, true match counts, false-positive rates, blocking and rejection actions taken, voluntary self-disclosure activity, OFAC report filing timeliness, and BaaS partner-level performance data, including the results of screening coverage validation testing.
Quarterly Comprehensive OFAC Program Status Report to the Board. The CCO shall prepare and deliver a quarterly comprehensive OFAC program status report to the full Board of Directors. This report shall provide a holistic assessment of the Bank's OFAC compliance program, including remediation progress, technology upgrade status, staffing and resource adequacy, emerging sanctions risks, regulatory developments, and any material issues or incidents requiring Board attention.
SECTION 3: OFAC SANCTIONS LISTS AND LIST MANAGEMENT
3.1 Sanctions Lists Covered
The Bank's OFAC compliance program shall screen all applicable transactions, customers, and counterparties against the full range of sanctions lists published and maintained by OFAC. The sanctions lists covered by this Policy include, without limitation:
(a) Specially Designated Nationals and blocked Persons List (SDN List). The SDN List identifies individuals and entities whose property and interests in property are blocked pursuant to one or more OFAC sanctions programs. U.S. persons are generally prohibited from engaging in any transactions or dealings with SDNs, and all property and interests in property of SDNs that are within the United States or that come within the possession or control of a U.S. person must be blocked (frozen).
(b) Sectoral Sanctions Identifications List (SSI List). The SSI List identifies persons operating in sectors of the Russian economy designated pursuant to Executive Order 13662. Transactions with persons on the SSI List are subject to specific prohibitions that vary by directive.
(c) Consolidated Sanctions List (Non-SDN Lists). The Consolidated Sanctions List includes, but is not limited to:
(i) Foreign Sanctions Evaders List (FSE List);
(ii) Palestinian Legislative Council List (NS-PLC List);
(iii) Correspondent Account or Payable-Through Account Sanctions List (CAPTA List);
(iv) Non-SDN Menu-Based Sanctions List (NS-MBS List);
(v) Non-SDN Chinese Military-Industrial Complex Companies List (NS-CMIC List); and
(vi) Any other non-SDN lists published by OFAC from time to time.
(d) Country-Based and Program-Specific Sanctions Programs. All country-based and program-specific sanctions programs administered by OFAC, including but not limited to the sanctions programs relating to Cuba, Iran, North Korea, Syria, Russia/Ukraine, Venezuela, and any other jurisdictions or programs designated by OFAC.
(e) Additional Lists. Any additional lists published or updated by OFAC from time to time, including lists that may be established under new or amended executive orders or regulations.
The Bank shall maintain awareness of all active OFAC sanctions programs and shall ensure that its screening system is configured to screen against all applicable lists. A reference table of all active OFAC sanctions programs applicable to the Bank's operations is set forth in Appendix B to this Policy.
3.2 List Update Procedures
Timely and accurate ingestion of OFAC sanctions list updates is essential to the effectiveness of the Bank's screening program. The following procedures shall govern list update management:
OFAC sanctions lists shall be updated in the Veridian Analytics screening system within twenty-four (24) hours of publication by OFAC. This twenty-four-hour standard applies to all list updates, including additions, modifications, and removals of entries on any OFAC list.
The BSA Officer (Thomas Ikeda) or his designee shall monitor OFAC's website (https://www.treasury.gov/ofac), OFAC's email distribution list, and OFAC's RSS feeds on a continuous basis for real-time notification of list updates. The BSA/AML Department shall subscribe to all available OFAC notification services and shall maintain redundant monitoring mechanisms to ensure that no list update is missed.
Emergency list updates—including the designation of new SDNs in connection with imminent threats to national security or foreign policy—shall trigger immediate system propagation. Upon receipt of an emergency list update, the IT team (under Linda Petrosian) shall initiate an immediate update to the screening system, and the BSA Officer shall direct retroactive screening of all pending and in-process transactions to ensure that no transaction involving a newly designated party is processed without screening.
The IT team under Linda Petrosian shall confirm successful list ingestion and system update through automated verification logs. These logs shall document the date and time of list publication by OFAC, the date and time of ingestion into the Veridian platform, the number of records added, modified, or removed, and confirmation of successful propagation to all screening nodes. Any failure in the list update process shall be immediately escalated to the BSA Officer and the CIO/CTO.
All list update records shall be retained for a minimum of five (5) years from the date of the update, in accordance with the recordkeeping requirements of this Policy and applicable regulations.
3.3 Fuzzy Matching and Screening Algorithm Configuration
The Bank's sanctions screening system shall employ robust fuzzy matching logic designed to maximize the identification of potential matches to sanctioned parties while appropriately managing false-positive volumes. The fuzzy matching configuration shall include, at a minimum:
(a) Name-based matching, including variations in spelling, transliteration, phonetic equivalents, name order permutations, and partial name matches;
(b) Alias-based matching, including screening against all known aliases, "also known as" entries, and "formerly known as" entries listed by OFAC;
(c) Address-based matching, including screening of addresses associated with transactions and customer records against sanctioned addresses and geographic identifiers; and
(d) Identifier-based matching, including screening of passport numbers, national identification numbers, tax identification numbers, and other unique identifiers listed on OFAC sanctions entries.
The Bank's calendar year 2024 baseline metrics for OFAC screening are as follows: the screening system generated 14,320 OFAC screening hits across all channels, of which twelve (12) were determined to be true matches requiring blocking or rejection action. The resulting false-positive rate was approximately 99.9% ((14,320 – 12) ÷ 14,320). While a high false-positive rate is inherent in sanctions screening given the breadth of name-based matching required, the Bank is committed to optimizing its screening parameters to reduce false-positive volumes where possible without compromising detection effectiveness.
Matching thresholds and algorithm parameters shall be reviewed and tuned at least semi-annually by the BSA/AML Department in coordination with the CIO/CTO and Veridian Analytics. Each review shall include a documented analysis of the rationale for threshold settings, including the impact of any proposed changes on both detection effectiveness and false-positive volumes. The results of each review, including any parameter changes implemented, shall be documented in the model governance records maintained by the Bank's Model Risk Management function.
Any changes to fuzzy matching parameters require the prior written approval of the BSA Officer (Thomas Ikeda). Significant changes—including any changes that would reduce the sensitivity of the screening algorithm—shall also require the approval of the CCO (Patricia Langston) and shall be communicated to the Compliance Committee.
The goal of the remediation effort, as it relates to screening algorithm configuration, is to optimize the screening system to reduce the false-positive rate where possible—thereby improving the efficiency of hit review and disposition—without compromising the system's ability to detect true matches. Detection effectiveness shall always take priority over false-positive reduction.
SECTION 4: SANCTIONS SCREENING REQUIREMENTS
4.1 Comprehensive Screening Mandate — 100% Transaction Coverage
All transactions processed by or through Belmont Ridge Bank National Association shall be screened against applicable OFAC sanctions lists prior to execution, without exception. This is a non-negotiable requirement. No transaction, regardless of type, amount, channel, or counterparty, shall be exempted from OFAC screening.
This comprehensive screening mandate is a direct response to the screening gap identified by the OCC in connection with Consent Order No. OCC-2025-003. The prior gap, in which approximately twelve percent (12%) of NovaPay Technologies Inc. wire and ACH transactions (approximately 3,800,000 transactions in calendar year 2023) were not screened against OFAC sanctions lists, shall not recur under any circumstances. The Bank has implemented, and continues to implement, the technology, process, and governance controls necessary to ensure that every transaction processed by or through the Bank is screened.
The one hundred percent (100%) coverage requirement applies to all of the following transaction types and channels:
(a) Wire transfers, both domestic and international;
(b) ACH originations and receipts;
(c) Card authorizations, including credit card, debit card, and prepaid card transactions;
(d) Loan disbursements and draws;
(e) Account openings and customer onboarding events;
(f) Deposit transactions;
(g) Trade finance transactions, including letters of credit, documentary collections, and trade-related payments; and
(h) All payment flows originated by, received by, or passing through BaaS partners, regardless of the partner's own screening capabilities or representations.
No transaction type, channel, or partner is exempt from OFAC screening. The Bank, as the chartered national bank and sponsor institution for all BaaS partnerships, bears full and sole responsibility for ensuring that all transactions processed through its charter are screened for compliance with OFAC sanctions programs.
4.2 Real-Time Screening
All wire transfers, both domestic and international, shall be screened in real-time (i.e., prior to execution) against all applicable OFAC sanctions lists. Real-time screening means that the transaction is submitted to the screening system and a screening determination is returned before the transaction is released for settlement or execution. No wire transfer shall be processed until screening has been completed and any resulting hits have been reviewed and dispositioned or placed on hold.
All ACH transactions originated through BaaS partner channels shall be screened in real-time or, where not technically feasible due to the batch processing nature of the ACH network, in near-real-time batch processing. In cases where near-real-time batch processing is employed, holds shall be applied to all flagged items prior to settlement. Specifically, any ACH transaction that generates a screening hit shall be placed on hold and withheld from settlement until the hit has been reviewed and dispositioned in accordance with the procedures set forth in Section 5 of this Policy.
Card authorization screening for high-risk geographies and sanctioned jurisdictions shall occur at the point of authorization. The Bank's card processing systems shall be configured to identify and flag transactions involving sanctioned countries, territories, or geographic regions at the time of authorization, with automated holds or declines applied as appropriate based on the applicable sanctions program.
4.3 Batch Screening
For transaction types not subject to real-time screening, batch screening shall be conducted at a minimum on a daily basis. Batch screening shall be scheduled to ensure that all applicable transactions are screened within the same business day on which they are initiated or received.
Batch screening results shall be reviewed and dispositioned by trained analysts within the BSA/AML Department within the same business day on which the results are generated. Any delays in disposition shall be escalated to the BSA Officer in accordance with the escalation procedures set forth in Section 5.4 of this Policy.
Any matches identified through batch screening shall result in immediate holds on the affected transactions, pending review and disposition. No transaction identified as a potential match in batch screening shall be processed or settled until a disposition determination has been made and documented.
4.4 Customer and Counterparty Screening
All new customers shall be screened against OFAC sanctions lists at the time of account opening or onboarding, regardless of the channel through which onboarding occurs. This requirement applies with equal force to customers onboarded directly by the Bank through its retail, commercial, and wealth management channels and to customers onboarded through BaaS partner platforms, including NovaPay Technologies, FairLend Digital, VaultEdge, and all other BaaS partners. The Bank retains responsibility for ensuring that all customers added to its books and records are screened, irrespective of whether the partner platform conducts its own screening.
The Bank's existing customer base shall be re-screened upon each OFAC list update. When OFAC publishes additions, modifications, or changes to any sanctions list, the Bank's customer database shall be screened against the updated list entries to identify any existing customers who may be matches to newly designated or modified sanctions entries. Any matches identified through re-screening shall be immediately escalated to the BSA Officer for investigation and disposition.
All counterparties, beneficiaries, originators, and intermediaries in payment transactions shall be screened. This includes not only the direct counterparties to the Bank but also all parties identified in payment message fields, including ordering parties, beneficiary parties, intermediary financial institutions, and any other parties whose identities are available in the transaction data.
Customer and counterparty screening shall include, at a minimum, the following data elements: name (full name, aliases, and variations), address, date of birth (where available), national identification numbers (e.g., passport numbers, tax identification numbers), and any other identifiers that may be matched against OFAC sanctions entries.
4.5 BaaS Partner Transaction Screening — Enhanced Requirements
Given the significance of BaaS transaction volumes to the Bank's overall transaction profile and the screening gaps identified in connection with the Consent Order, the Bank shall maintain enhanced OFAC screening requirements for all BaaS partner transaction flows.
All fourteen (14) active BaaS fintech partners' transaction flows shall be routed through BRB's centralized OFAC screening infrastructure, specifically the Veridian Analytics platform. Centralized screening is essential to maintaining the Bank's control over its sanctions compliance obligations and ensuring uniform screening standards across all partner channels.
BaaS partners are expressly prohibited from self-screening in lieu of BRB's centralized screening. While partners may choose to implement their own screening as an additional layer of controls, any partner-level screening does not satisfy the Bank's obligations and shall not be relied upon by the Bank. BRB retains full responsibility as the chartered national bank for ensuring that all transactions processed through its charter are screened in accordance with this Policy and applicable law.
Warren Ashby (Head of Fintech Partnerships) shall ensure that all new and existing BaaS partner integrations include compliant data feeds to the Bank's centralized screening system. Data feeds must provide all required transaction data elements—including originator, beneficiary, and intermediary information—in formats compatible with the Veridian Analytics screening platform.
Each BaaS partner's transaction flow shall be independently validated for one hundred percent (100%) screening coverage at least quarterly. Validation testing shall confirm that every transaction originated, processed, or settled through each partner's channel has been submitted to and screened by the Bank's centralized screening system. The results of validation testing shall be documented and reported to the BSA Officer and the Compliance Committee.
The following top-tier partners, which collectively account for approximately eighty-seven percent (87%) of total BaaS transaction volume, shall be subject to enhanced monitoring and more frequent coverage validation:
These top-tier partners shall be subject to monthly screening coverage validation, in addition to the quarterly validation required for all partners, during the remediation period.
Full OFAC screening operationalization for all BaaS channels is required no later than November 1, 2025, in accordance with the timeline established in the Comprehensive Remediation Action Plan submitted to the OCC. All partner integrations, system upgrades, and testing activities must be completed prior to this date to ensure full compliance.
SECTION 5: INTERDICTION, BLOCKING, AND REJECTION PROCEDURES
5.1 blocking of Transactions Involving SDN Matches
Upon identification of a true match to the SDN List, the relevant transaction shall be immediately blocked (frozen) in accordance with applicable OFAC regulations. Blocking requires that the transaction be halted and that all property or interests in property associated with the SDN be held in a segregated account maintained by the Bank.
Blocked funds shall be placed in a segregated blocked-property account maintained by BRB. The blocked-property account shall be interest-bearing, as required by OFAC regulations, and shall be clearly identified in the Bank's records as containing blocked property subject to OFAC sanctions. The Bank shall maintain accurate and current records of all blocked property, including the identity of the blocked person, the nature and amount of the blocked property, the date of blocking, the applicable sanctions program, and the status of the blocked property (including any applications for specific licenses submitted to OFAC).
The BSA Officer (Thomas Ikeda) shall be notified immediately upon any blocking action. Notification shall include the identity of the blocked person, the nature of the transaction, the amount involved, the applicable sanctions program, and the identity of the BaaS partner or business line involved. The BSA Officer shall confirm the blocking action, ensure the initiation of OFAC reporting procedures, and coordinate with the CCO and General Counsel as necessary.
No blocked transaction may be released without authorization from OFAC in the form of a specific license or upon a documented determination, approved by the BSA Officer, that the match is a false positive following a thorough review. The investigation and review process for potential true matches shall be documented in detail, including all steps taken, information reviewed, and the basis for the final disposition.
5.2 Rejection of Prohibited Transactions
Transactions that are prohibited under a sanctions program but do not involve blocked persons—for example, transactions involving comprehensively sanctioned countries or jurisdictions (such as Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk, and Luhansk regions of Ukraine) or transactions involving prohibited trade activities—shall be rejected. A rejected transaction is one that the Bank declines to process and returns to the originator, as opposed to a blocked transaction, which the Bank holds in a segregated account.
Rejected transactions shall be documented in the Bank's records with the following information, at a minimum: the basis for the rejection, including the specific sanctions program or regulatory provision that prohibits the transaction; the identity of the sanctioned party, jurisdiction, or activity involved; the date and amount of the rejected transaction; and the identity of the originator and intended beneficiary.
The BSA Officer shall ensure that rejected transactions are reported to OFAC in accordance with the reporting requirements set forth in Section 6 of this Policy.
5.3 Holds Pending Review
When a screening hit requires further investigation to determine whether it is a true match or a false positive, the affected transaction shall be placed on hold pending review. No transaction that has generated a screening hit shall be processed or settled until the hit has been reviewed, dispositioned, and documented by a qualified analyst or, in the case of potential true matches, by the BSA Officer.
Holds shall be reviewed and dispositioned within twenty-four (24) hours of the hold being placed. This twenty-four-hour standard applies to all holds, regardless of the transaction type, channel, or dollar amount involved. If the review and disposition of a hold cannot be completed within twenty-four (24) hours—due to the complexity of the match, the need for additional information, or other factors—the hold shall be escalated to the BSA Officer for oversight and tracking.
Hold procedures must not, under any circumstances, result in the unauthorized processing of potentially sanctioned transactions. The Bank's systems and procedures shall be configured to ensure that transactions on hold remain in a held status until an affirmative disposition decision has been made and documented. Automatic release of held transactions without analyst review and disposition is strictly prohibited.
5.4 Escalation Procedures
All potential true matches—defined as screening hits where the initial analyst review cannot conclusively determine that the hit is a false positive—shall be escalated to the BSA Officer (Thomas Ikeda) for review and decision. The BSA Officer shall conduct or oversee an enhanced review of the potential match, including the collection of additional identifying information, consultation with the relevant business line or BaaS partner, and any other investigative steps necessary to reach a disposition.
The BSA Officer shall consult with the CCO (Patricia Langston) and, where warranted by the complexity, ambiguity, or significance of the match, with outside counsel (Calderwood & Harkness LLP; Philip Hartmann, Responsible Partner) prior to final disposition. Consultation with outside counsel is recommended in the following circumstances:
(a) Matches involving high-profile or politically exposed persons;
(b) Matches involving large-dollar transactions or significant blocked property;
(c) Matches where the applicable sanctions program involves nuanced or program-specific prohibitions (e.g., sectoral sanctions, licensing requirements);
(d) Matches where the disposition may have implications for the Bank's obligations under the Consent Order; and
(e) Any match where the BSA Officer or CCO has questions regarding the applicable legal standard or the Bank's obligations.
Matters involving significant blocking actions, potential violations of OFAC sanctions, or situations that may require voluntary self-disclosure to OFAC shall be further escalated to the General Counsel (Gregory Nardone) and the Compliance Committee of the Board. The escalation contact list is set forth in Appendix C to this Policy.
SECTION 6: OFAC REPORTING REQUIREMENTS
6.1 blocking Reports (10-Day Requirement)
BRB shall file an initial blocking report with OFAC within ten (10) business days of any blocking action involving the property of an SDN or other blocked person. This reporting requirement is mandatory under OFAC regulations and applies to every blocking action taken by the Bank, regardless of the amount involved or the sanctions program under which the blocking occurs.
The blocking report shall be submitted to OFAC's Compliance Division using the prescribed OFAC blocking report form (currently, the "Blocked or Rejected Transactions" form available on OFAC's website). The BSA Officer (Thomas Ikeda) is responsible for ensuring the timely and accurate preparation and filing of all blocking reports.
Each blocking report shall include, at a minimum, the following information:
(a) The blocked person's full name, aliases, and all available identifying information (date of birth, nationality, passport or identification numbers, addresses);
(b) The nature and amount of the blocked property or transaction;
(c) The date on which the property was blocked;
(d) The applicable sanctions program and the specific regulatory citation authorizing the blocking action;
(e) The account number(s) in which the blocked property is held;
(f) The identity of the originator, beneficiary, and any intermediaries involved in the transaction; and
(g) Any other information requested by OFAC or deemed relevant to the blocking action.
Filing timeliness shall be tracked as a key performance indicator and reported to the Compliance Committee on a monthly basis.
6.2 Annual Reports of blocked Property
BRB shall file an annual report with OFAC by September 30 of each year for all property blocked as of June 30 of that year, as required by 31 C.F.R. § 501.603(b)(2). The annual report shall include a current accounting of all blocked property held by the Bank, including the identity of each blocked person, the nature and amount of the blocked property, the applicable sanctions program, and the date of the original blocking action.
The BSA Officer shall maintain a current and accurate inventory of all blocked property at all times. This inventory shall be reconciled at least monthly against the Bank's general ledger and the segregated blocked-property account records to ensure accuracy and completeness. The annual report shall be reviewed by the CCO prior to submission to OFAC.
6.3 Rejected Transaction Reports
Rejected transactions shall be reported to OFAC within ten (10) business days of the rejection using the prescribed reporting mechanism. The Bank shall use the OFAC "Blocked or Rejected Transactions" form (or any successor form) to report rejected transactions to OFAC's Compliance Division.
Documentation of each rejection shall be retained in accordance with the recordkeeping requirements of this Policy, including a description of the rejected transaction, the amount involved, the identity of the parties, the applicable sanctions program, the basis for the rejection, and the date and manner in which the transaction was rejected and the originator was notified.
6.4 Voluntary Self-Disclosure
BRB shall evaluate on a case-by-case basis whether a voluntary self-disclosure ("VSD") to OFAC is appropriate when potential apparent violations of OFAC sanctions are identified. Voluntary self-disclosure is a significant mitigating factor under OFAC's Economic Sanctions Enforcement Guidelines, set forth at Appendix A to 31 C.F.R. Part 501. Where the Bank determines that an apparent violation has occurred—whether through screening system failures, processing errors, or other means—the decision of whether to file a VSD must be made promptly and in good faith.
The decision to file a voluntary self-disclosure shall be made by the CCO (Patricia Langston) and the General Counsel (Gregory Nardone) in consultation with outside counsel (Calderwood & Harkness LLP; Philip Hartmann, Responsible Partner). The decision shall take into account the nature and severity of the potential violation, the amount and number of transactions involved, the root cause of the violation, the adequacy of the Bank's corrective actions, and the guidance provided in OFAC's Enforcement Guidelines regarding mitigating and aggravating factors.
A separate analysis regarding potential voluntary self-disclosure related to the NovaPay screening gaps identified in calendar year 2023 is being conducted under attorney-client privilege by Calderwood & Harkness LLP. The results of that analysis will inform the Bank's decision regarding VSD and will be communicated to the CCO, General Counsel, and the Board through privileged channels.
6.5 SAR Filing Coordination
Where OFAC screening activity identifies suspicious activity beyond the sanctions context—for example, where a screening hit reveals potential money laundering, terrorist financing, or other illicit financial activity—such activity shall be referred to the SAR filing process under the Bank's separate SAR Policy & Procedures. OFAC compliance and broader BSA/AML compliance are complementary functions, and coordination between the sanctions screening team and the suspicious activity monitoring team is essential.
BaaS-related SAR activity in calendar year 2024 totaled 2,108 SARs out of 3,847 total SARs filed by the Bank, representing approximately 54.8% of all SARs. This disproportionate concentration of SAR activity in BaaS channels underscores the importance of close coordination between the Bank's OFAC screening function and its broader transaction monitoring and suspicious activity reporting functions. The BSA Officer shall ensure that information sharing between the OFAC screening team and the SAR team is systematic, timely, and documented.
SECTION 7: BaaS PARTNER OBLIGATIONS AND OVERSIGHT
7.1 Contractual Requirements
All BaaS partner agreements—whether existing or newly executed—shall incorporate the Bank's model compliance addendum, which sets forth detailed requirements for partner support of BRB's OFAC screening program. The model compliance addendum, which is maintained and updated by the BSA/AML Department in coordination with the Legal Department and the BaaS Division, establishes the minimum contractual framework for partner compliance obligations related to sanctions screening.
Key contractual requirements applicable to all BaaS partners include, without limitation:
(a) Data Provision. Partners must provide complete and accurate transaction data—including originator, beneficiary, and intermediary information—to the Bank in formats compatible with the Bank's centralized screening system. Data must be provided in real-time or, where technically necessary, in near-real-time feeds that support timely screening prior to transaction settlement.
(b) Prohibition on External Processing. Partners are contractually prohibited from processing transactions outside of BRB's screening infrastructure. All transactions originated, received, or facilitated by a BaaS partner must flow through the Bank's centralized screening system.
(c) Cooperation in Investigations. Partners must cooperate fully with BRB in the investigation and disposition of OFAC screening hits related to their customers. This includes providing additional customer information, transaction documentation, and other data as reasonably requested by the Bank's BSA/AML Department.
(d) Compliance Representations. Partners must represent and warrant that they will support and comply with all aspects of the Bank's OFAC compliance program and will not take any action that would undermine or circumvent the Bank's screening obligations.
(e) Right to Audit. The Bank reserves the right to audit each BaaS partner's compliance with OFAC-related contractual obligations, including the right to review partner systems, data feeds, and compliance procedures.
7.2 Partner Risk Assessment
Each BaaS partner shall be assessed for OFAC/sanctions risk as part of the Bank's standardized BaaS Partner BSA/AML Risk Assessment process. This risk assessment shall be conducted at the time of initial partner onboarding and updated at least annually thereafter, or more frequently if warranted by changes in the partner's risk profile, transaction patterns, or compliance performance.
Risk factors to be evaluated in the partner risk assessment include, without limitation:
(a) Transaction types offered by the partner (e.g., wire transfers, ACH, card, lending);
(b) Transaction volumes and velocity;
(c) Customer base demographics, including geographic distribution and exposure to high-risk jurisdictions;
(d) Geographic exposure of the partner's operations and customer base to sanctioned countries, territories, or regions;
(e) Historical OFAC screening hit rates and true match rates for the partner's transactions;
(f) Prior compliance issues, regulatory actions, or enforcement actions involving the partner;
(g) The partner's own compliance infrastructure and internal controls, as evaluated through the Bank's due diligence process; and
(h) The partner's responsiveness to Bank requests for information, cooperation in investigations, and compliance with contractual obligations.
Top-tier partners by transaction volume—NovaPay Technologies (41% of BaaS volume), FairLend Digital (28%), and VaultEdge (18%)—shall be subject to enhanced oversight and more frequent compliance testing, reflecting the concentration of risk in these partner channels.
7.3 Partner Data Integrity and Integration
Effective sanctions screening requires complete, accurate, and timely data. The Bank's IT Department (under Linda Petrosian) and the BaaS Division (under Warren Ashby) shall jointly ensure that data feeds from all fourteen (14) BaaS partners are complete, timely, and integrated into the Veridian Analytics screening platform.
Data quality checks shall be performed on a daily basis. These checks shall verify that all expected data feeds have been received, that the data elements required for sanctions screening (including originator name, beneficiary name, intermediary names, addresses, and identifiers) are present and formatted correctly, and that no transactions have been processed outside of the screening system.
Gaps or errors in data feeds shall trigger immediate investigation by the IT Department and the BaaS Division. If a data feed gap or error cannot be resolved promptly—and if there is any risk that transactions may be processed without screening as a result—the BSA Officer shall direct the suspension of transaction processing for the affected partner until the data feed issue is resolved and confirmed by IT. This suspension authority is critical to preventing a recurrence of the screening gaps identified in connection with the Consent Order.
Integration testing for each BaaS partner's data feeds shall be documented and validated at least quarterly. Validation testing shall confirm end-to-end data flow from the partner's platform through the Bank's screening system, including verification that all transaction types originated by the partner are captured and screened.
7.4 Remediation Letters and Enhanced Cooperation
In connection with the Consent Order remediation, BRB has issued compliance remediation letters to key BaaS partners requiring enhanced cooperation, data sharing, and compliance commitments. Remediation letters have been issued to:
(a) NovaPay Technologies Inc., attention: Ethan Garrison, Chief Executive Officer; and
(b) FairLend Digital LLC, attention: Aisha Okonkwo, Chief Executive Officer.
These remediation letters set forth specific requirements for enhanced data provision, cooperation in system integration and testing, and compliance certifications. Additional remediation letters may be issued to other BaaS partners as warranted by the remediation effort.
Failure by a BaaS partner to comply with OFAC-related contractual obligations—including failure to provide complete data feeds, failure to cooperate in the investigation of screening hits, or failure to support the Bank's remediation efforts—may result in escalation through the BaaS Compliance Oversight Framework. Escalation measures may include enhanced monitoring, formal remediation demands, suspension of transaction processing for the non-compliant partner, and, in cases of persistent or material non-compliance, termination of the BaaS partnership agreement.
SECTION 8: TECHNOLOGY AND SYSTEMS
8.1 Sanctions Screening System
BRB's primary sanctions screening system is the Veridian Analytics platform. The Bank is currently upgrading the Veridian platform from Transaction Monitoring System ("TMS") version 8.3 to TMS version 10.0, which includes an enhanced OFAC screening module with improved capabilities for real-time screening, fuzzy matching, list management, and reporting.
Key details regarding the Veridian Analytics engagement are as follows:
The upgraded Veridian TMS v.10.0 system shall support both real-time and batch screening across all transaction types and channels, including all fourteen (14) BaaS partner flows. The upgraded system shall provide enhanced screening capabilities, including improved name-matching algorithms, expanded alias coverage, enhanced geographic screening, and integrated reporting and case management functionality.
The project timeline for the TMS v.10.0 upgrade is as follows:
(a) User acceptance testing ("UAT") for TMS v.10.0 shall be completed no later than August 1, 2025.
(b) Full OFAC screening operationalization for all BaaS channels through the upgraded platform shall be achieved no later than November 1, 2025.
These milestones are aligned with the timelines established in the Comprehensive Remediation Action Plan submitted to the OCC on May 15, 2025.
8.2 System Validation and Tuning
Independent model validation of the sanctions screening system shall be conducted at least annually by a qualified independent party. The next independent validation is scheduled for October 1, 2025, as part of the Consent Order remediation requirements. The independent validation shall assess the screening system's effectiveness, including the adequacy of fuzzy matching algorithms, the accuracy and completeness of list coverage, the timeliness of list updates, and the system's ability to achieve one hundred percent (100%) transaction screening coverage across all channels.
Screening algorithm parameters, fuzzy matching thresholds, and filter settings shall be tuned at least semi-annually, as described in Section 3.3 of this Policy, with formal documentation of all changes, including the rationale for each parameter adjustment and an assessment of the impact on detection effectiveness and false-positive volumes.
The Bank acknowledges the prior deficiency in this area: the last independent validation of the Veridian TMS v.8.3 system was conducted in March 2021, and the last parameter tuning was performed in October 2022. This extended gap between validations and tuning activities contributed to the screening deficiencies identified by the OCC. The Bank shall ensure that this deficiency does not recur by maintaining a formal validation and tuning schedule, tracked and reported to the Compliance Committee, with accountability assigned to the BSA Officer and CIO/CTO.
8.3 System Availability and Contingency
The sanctions screening system shall maintain a minimum uptime of 99.9% measured on a monthly basis. System availability is critical to the Bank's ability to screen one hundred percent (100%) of transactions and to comply with this Policy and applicable regulations. Uptime metrics shall be tracked, documented, and reported to the BSA Officer and CIO/CTO on a daily basis and to the Compliance Committee on a monthly basis.
Business continuity and disaster recovery plans shall include specific provisions for sanctions screening during system outages. These provisions shall address, at a minimum:
(a) Manual screening procedures to be employed during system outages, including procedures for manually screening wire transfers and other high-priority transactions against OFAC sanctions lists;
(b) Transaction holds to be applied to all transactions that cannot be screened during a system outage, pending restoration of screening capability;
(c) Escalation procedures for notifying the BSA Officer, CCO, and CIO/CTO of any system outage affecting screening capability; and
(d) Post-outage retroactive screening of all transactions processed during the outage period to confirm that no sanctioned transactions were processed.
Any system downtime affecting the Bank's sanctions screening capability shall be escalated immediate

REVISED OFAC COMPLIANCE POLICY

SECTION 1: PURPOSE AND SCOPE

SECTION 2: GOVERNANCE AND ORGANIZATIONAL STRUCTURE

SECTION 3: OFAC SANCTIONS LISTS AND LIST MANAGEMENT

SECTION 4: SANCTIONS SCREENING REQUIREMENTS

SECTION 5: INTERDICTION, BLOCKING, AND REJECTION PROCEDURES

Record

Parties

Dates

Amounts