ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
DRAFT — PREPARED IN ANTICIPATION OF REGULATORY SUBMISSION
REVISED SUSPICIOUS ACTIVITY REPORT (SAR) POLICY AND PROCEDURES
Belmont Ridge Bank National Association
BSA/AML Compliance Program
Version 1.0 — Draft for Internal Review
Draft Date: April 2025
Prepared By:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
C&H Matter No.: 1045-00002
Prepared For:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022
Attention: Patricia Langston, Chief Compliance Officer Thomas Ikeda, BSA Officer / AML Program Director
This policy supersedes: BRB SAR Policy dated March 2022 (as last amended October 2023).
Consent Order Reference: Prepared in connection with OCC Consent Order No. OCC-2025-003 (effective January 15, 2025).
Principal Drafters: Yuki Nakamura (Lead Associate, Litigation (General)); Carlos Espinoza (Working Associate, Litigation (General)).
Supervising Partner: Philip Hartmann (Responsible Partner, Banking & Finance).
This document contains confidential and privileged materials prepared by legal counsel in anticipation of and in response to regulatory action. Distribution is limited to authorized recipients within Belmont Ridge Bank National Association and its outside advisors. Do not reproduce, forward, or discuss the contents of this document outside of the authorized distribution list without prior consultation with the General Counsel or Calderwood & Harkness LLP.
SECTION 1 — PURPOSE AND SCOPE
1.1 Purpose.  This Revised Suspicious Activity Report (SAR) Policy and Procedures (this "Policy") establishes the comprehensive standards, protocols, roles, responsibilities, and workflows governing the identification, investigation, escalation, documentation, and filing of Suspicious Activity Reports by Belmont Ridge Bank National Association ("BRB" or the "Bank"). This Policy applies enterprise-wide and is intended to ensure that BRB satisfies its obligations under the Bank Secrecy Act ("BSA") and applicable implementing regulations in a manner consistent with regulatory expectations, sound risk-management practices, and the specific remediation commitments made by BRB to its primary federal regulator.
This Policy has been prepared, in part, to address the deficiencies identified in Office of the Comptroller of the Currency ("OCC") Consent Order No. OCC-2025-003, issued and effective as of January 15, 2025 (the "Consent Order"). Two SAR-program findings in particular are addressed by this Policy:
(a) a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of September 2024; and
(b) an average SAR filing turnaround of 78 days from the date of alert generation to the date of filing with the Financial Crimes Enforcement Network ("FinCEN"), materially exceeding the regulatory expectation that SARs be filed on a timely basis (generally understood to require filing within 30 days of the date the institution becomes aware of facts constituting a basis for filing).
Accordingly, this Policy establishes a target filing turnaround of 30 calendar days from alert generation to SAR submission via the FinCEN BSA E-Filing System, together with intermediate milestones and management-level triggers designed to ensure that turnaround is not merely aspirational but is embedded in the day-to-day operation of the SAR program. This Policy supersedes and replaces the practices that produced BRB's prior 78-day average and the alert backlog described above.
This Policy is grounded in, and is intended to be interpreted consistently with, the following primary sources of legal authority:
•  The Bank Secrecy Act, in particular 31 U.S.C. § 5318(g), which imposes the SAR reporting obligation and provides related confidentiality protections and a safe harbor;
•  FinCEN's implementing regulations, in particular 31 C.F.R. § 1020.320, governing SAR filing by banks;
•  The OCC's implementing regulations, in particular 12 C.F.R. Part 21, Subpart B, governing suspicious activity reporting by national banks;
•  Applicable FinCEN administrative rulings, advisories, and interpretive guidance, including guidance addressing continuing-activity SARs, joint SARs, and narrative drafting expectations; and
•  The Consent Order and any subsequent supervisory correspondence or written directives from the OCC or FinCEN concerning BRB's SAR program.
1.2 Scope.  This Policy applies to all business lines and operational functions of Belmont Ridge Bank National Association, including without limitation:
(a) retail banking (deposit accounts, consumer lending, cards, wires, and cash services);
(b) commercial lending (commercial and industrial loans, commercial real estate, and asset-based lending);
(c) wealth management (investment accounts, trust and fiduciary services, and private client services); and
(d) the Bank's Banking-as-a-Service ("BaaS") fintech partnership program.
The Bank currently operates BaaS relationships with fourteen (14) active partner channels, including but not limited to NovaPay Technologies, Inc., FairLend Digital LLC, and VaultEdge, Inc., together with eleven (11) additional partners identified in the BaaS Program Register maintained by the Head of Fintech Partnerships. In calendar year 2024, BaaS-related filings accounted for 2,108 of the 3,847 total SARs filed by the Bank (approximately 54.8%). This concentration underscores the critical importance of full and consistent BaaS-channel coverage under this Policy. The BaaS channels are not treated as ancillary; they are a primary population for SAR investigation and are subject to the same standards, benchmarks, and quality controls as directly booked BRB activity.
This Policy applies to all BRB employees, officers, and directors, and to all temporary personnel, contractors, and agents involved in transaction monitoring, alert review, investigation, or SAR filing, including without limitation managed-services personnel provided by Pinnacle Compliance Solutions LLC ("Pinnacle"). As of the draft date, the applicable population consists of:
•  62 current BSA/AML full-time equivalent employees ("FTEs");
•  15 planned new permanent hires (post-remediation permanent headcount target: 77 FTEs); and
•  30 Pinnacle temporary FTEs deployed under Statement of Work Reference PCS-BRB-2025-0012.
All personnel described above are required to review, understand, and comply with this Policy, and completion of applicable training under Section 12 is a condition of continued assignment to any SAR-related function.
1.3 Regulatory Background and Context
This Policy is issued against, and must be read in the context of, the following regulatory history:
(a) June 2022 — MRA. BRB received a Matter Requiring Attention ("MRA") from the OCC citing deficiencies in BSA/AML transaction monitoring, including model tuning cadence and coverage of BaaS-channel typologies.
(b) November 2023 — MRIA. BRB received a Matter Requiring Immediate Attention ("MRIA") citing gaps in OFAC screening across BaaS channels and inadequate reconciliation between screening outputs and case-management follow-through.
(c) March 2024 – September 2024 — Targeted Examination. The OCC conducted a targeted BSA/AML examination that produced adverse findings across five workstreams, including transaction monitoring, SAR filing, OFAC, governance, and independent testing.
(d) September 2024 — Independent Testing. Caldera & Pope LLP completed the annual independent BSA/AML test (engagement partner: Franklin Dorsey), identifying multiple deficiencies substantially overlapping with the OCC's findings.
(e) January 15, 2025 — Consent Order. OCC Consent Order No. OCC-2025-003 was issued and became effective, citing SAR filing timeliness, alert backlog, model validation lapses, governance shortcomings, and inadequate Board reporting among the core deficiencies. A civil money penalty of $14,500,000 was assessed against the Bank.
(f) Parallel FinCEN Monitoring. FinCEN, through Associate Director Angela Drummond (Enforcement Division), is monitoring BRB's SAR filing remediation and has reserved its independent enforcement rights.
This Policy is a key deliverable under Workstream 2 of the Comprehensive Remediation Action Plan due to the OCC by May 15, 2025. Approval of this Policy and its subsequent implementation are prerequisites to the Bank's ability to demonstrate substantive progress against the SAR-related articles of the Consent Order and to any eventual request for termination of the Consent Order.
1.4 Effective Date
This Policy shall become effective upon the affirmative written approval of each of the following:
•  Thomas Ikeda, BSA Officer / AML Program Director;
•  Patricia Langston, Chief Compliance Officer ("CCO");
•  Gregory Nardone, General Counsel & Corporate Secretary; and
•  The Compliance Committee of the Board of Directors, chaired by James Rutherford.
The Bank targets an effective date coinciding with the OCC's acceptance of the Remediation Action Plan, currently anticipated in May 2025. Until such effective date, this document is a draft and does not modify or supersede the SAR Policy dated March 2022 (as last amended October 2023). Upon effectiveness, the March 2022 Policy shall be retired and archived in accordance with Section 15.4.
SECTION 2 — DEFINITIONS
2.1 Key Terms
For purposes of this Policy, the following terms have the meanings set forth below. Capitalized terms not defined below have the meanings ascribed to them elsewhere in this Policy or in applicable law and regulation.
Alert. An output generated by the Bank's transaction monitoring system (currently Veridian TMS v.8.3, to be upgraded to Veridian TMS v.10.0, with User Acceptance Testing ("UAT") targeted for completion by August 1, 2025) that flags potentially suspicious activity for human review. The term includes alerts generated by automated scenarios, thresholds, behavioral models, and manual referrals routed into the case management system.
Alert Generation Date. The date on which the transaction monitoring system generates an Alert. The Alert Generation Date commences the 30-day filing clock established by Section 5.1 of this Policy.
BaaS Partner. Any fintech company operating financial services offerings through BRB's national banking charter pursuant to a Banking-as-a-Service program agreement. As of the draft date, BRB has fourteen (14) active BaaS Partners.
BSA Officer. Thomas Ikeda, AML Program Director, who has been designated as BRB's BSA Compliance Officer pursuant to 31 C.F.R. § 1020.210.
Case Management System. BRB's system of record for the receipt, triage, investigation, drafting, review, approval, filing, and post-filing tracking of Alerts and SARs, together with all supporting documentation and audit-trail data.
Continuing SAR. A SAR filed to report the continuation of previously reported suspicious activity, filed at least every 90 days from the date of the immediately preceding SAR filing, consistent with FinCEN guidance.
CTR. Currency Transaction Report filed pursuant to 31 C.F.R. § 1010.311.
Enhanced Due Diligence or EDD. The additional customer due diligence measures applied to customers determined to be high risk, whether at onboarding or as a result of ongoing monitoring.
Filing Deadline. Thirty (30) calendar days from the Alert Generation Date for initial SAR filings; provided, however, that where no suspect can be identified as of the 30th day, the Filing Deadline is extended to ninety (90) calendar days from the date of initial detection consistent with 31 C.F.R. § 1020.320(b)(3).
Investigation. The research, analysis, evaluation, and documentation process conducted by BSA/AML personnel to determine whether an Alert warrants a SAR filing.
Lookback. A retrospective review of previously unreviewed or inadequately reviewed Alerts and transactions. The Bank's current SAR Lookback Project has an estimated total budget of $5,500,000 and is described further in Section 11.
Narrative. The free-text portion of FinCEN Form 111 (Part V) describing the suspicious activity that is the subject of the SAR.
QA Review or Quality Assurance Review. The structured post-filing review process conducted pursuant to Section 9 to assess the accuracy, completeness, timeliness, and regulatory compliance of filed SARs.
SAR. Suspicious Activity Report, meaning a report filed with FinCEN via the BSA E-Filing System using FinCEN Form 111.
SAR Conversion Rate. The percentage of transaction monitoring Alerts that result in a SAR filing. The calendar year 2024 SAR Conversion Rate was 9.3% (3,847 SARs from 41,500 Alerts).
Suspicious Activity. Activity that is known, suspected, or has reason to be suspected to (i) involve funds derived from illegal activity; (ii) be designed to evade any requirement of the BSA or its implementing regulations (including through structuring); (iii) have no business or apparent lawful purpose or be unusual for the particular customer, and for which the Bank knows of no reasonable explanation after examination of the available facts; or (iv) involve use of the Bank to facilitate criminal activity. The reporting threshold for known-subject SARs is aggregate activity of $5,000 or more.
Triage. The initial prioritization and assignment process for Alerts based on the risk criteria described in Section 4.2.
SECTION 3 — GOVERNANCE AND ORGANIZATIONAL STRUCTURE
The effectiveness of the SAR program depends on clear allocation of responsibility, functioning escalation channels, and active Board-level oversight. This Section 3 sets forth the governance framework applicable to the SAR program under this Policy.
3.1 BSA Officer Responsibilities
Thomas Ikeda serves as BSA Officer / AML Program Director, having been appointed in March 2023. Mr. Ikeda has overall responsibility for the administration of the SAR program and reports to the CCO, with a dotted-line reporting relationship to the Compliance Committee of the Board of Directors.
The BSA Officer's responsibilities under this Policy include, without limitation:
(a) ensuring that all SAR filing obligations are satisfied on a timely, accurate, and complete basis;
(b) maintaining adequate staffing, tools, and training resources to support the SAR program, and escalating resource gaps to the CCO on a timely basis;
(c) overseeing the quality of SAR investigations, narratives, and filings, including approval authority for high-sensitivity filings under Section 7.2;
(d) certifying, on a monthly basis, the timeliness metrics reported to the Compliance Committee;
(e) escalating matters requiring immediate SAR filing, law enforcement referral, or Board-level attention consistent with Section 8; and
(f) serving as the Bank's principal point of contact with the OCC, FinCEN, and other regulators regarding SAR-related matters, in coordination with the General Counsel.
3.2 Chief Compliance Officer Oversight
Patricia Langston serves as CCO (appointed January 2024) and provides executive oversight of the SAR program as part of the broader BSA/AML compliance program. The CCO reviews monthly SAR program metrics, evaluates trends and root causes, and is responsible for escalating systemic issues to the General Counsel and to the Compliance Committee. The CCO holds ultimate accountability, together with the BSA Officer, for the certification of program adequacy required under the Consent Order.
3.3 Compliance Committee of the Board
Pursuant to the Consent Order, the Board of Directors of the Bank established a dedicated Compliance Committee (the "Compliance Committee"), chaired by James Rutherford, by Board resolution dated February 27, 2025 (satisfying the Consent Order requirement of Board acknowledgment and Committee formation by February 28, 2025).
The Compliance Committee has responsibility for oversight of the BSA/AML compliance program, including the SAR program, and receives monthly reports covering:
•  total SAR volumes and volumes segmented by business line and BaaS Partner;
•  filing timeliness metrics against the 30-day standard;
•  backlog status, including aged Alert counts;
•  SAR Conversion Rate trending;
•  QA results and error categorization;
•  BaaS Partner-specific concerns; and
•  open items and status of remediation commitments under the Consent Order.
The Compliance Committee's charter, minutes, and formal reports are archived by the Corporate Secretary as part of the Bank's Board records.
3.4 Role of General Counsel
Gregory Nardone, General Counsel & Corporate Secretary, provides legal guidance on SAR-related matters, including questions of attorney-client privilege and work-product protection, law enforcement requests, and the availability of the safe-harbor protections under 31 U.S.C. § 5318(g)(3). The General Counsel coordinates with outside counsel, Calderwood & Harkness LLP (Philip Hartmann, Responsible Partner), regarding regulatory engagement on SAR remediation, including preparation of quarterly progress reports to the OCC.
3.5 Internal Audit
Derek Ballard, Head of Internal Audit, is responsible for periodic independent testing of the SAR program's compliance with this Policy, applicable law and regulation, and the Consent Order. Internal Audit's testing findings are reported to the Audit Committee (Chair: Margaret Dao) and, in accordance with the Bank's committee reporting framework, are shared with the Compliance Committee. Internal Audit's independent testing is distinct from, and does not substitute for, the annual independent BSA/AML testing conducted by Caldera & Pope LLP under Section 9.6.
3.6 SAR Program Staffing
The SAR program shall be staffed in accordance with the following framework, which reflects the Bank's remediation-period plan:
(a) Permanent BSA/AML Department (Current): 62 FTEs.
(b) Planned Permanent Additions: 15 new FTEs to be hired during the remediation period, targeting a post-remediation permanent headcount of 77 FTEs. Estimated incremental annual cost: $2,250,000 (based on 15 FTEs at an average fully loaded cost of $150,000 per FTE).
(c) Temporary Managed-Services Staffing: 30 FTE analysts provided by Pinnacle Compliance Solutions LLC (managed by Andrea Solis, Director of Managed Services) under SOW Ref. PCS-BRB-2025-0012, at a rate of $10,000 per FTE per month, for a 12-month contract value of $3,600,000. Pinnacle personnel are deployed for SAR backlog clearance and Lookback support.
All Pinnacle temporary personnel are subject to this Policy, to BRB's supervision protocols under Section 11.3, and to the same training requirements applicable to permanent BSA/AML personnel under Section 12. Notwithstanding the use of managed services, ultimate responsibility for the accuracy, completeness, and timeliness of SAR filings remains with the BSA Officer.
SECTION 4 — ALERT REVIEW AND INVESTIGATION PROCEDURES
4.1 Transaction Monitoring System
The Bank's transaction monitoring system is Veridian TMS, currently operating at version 8.3 (Contract No. VA-BRB-2023-0044). Veridian TMS v.8.3 was last independently validated in March 2021 and last tuned in October 2022; the OCC cited these tuning and validation gaps as a core deficiency in the Consent Order.
An upgrade to Veridian TMS v.10.0 is underway, with:
•  UAT targeted for completion by August 1, 2025;
•  Independent model validation of the upgraded system targeted for completion by October 1, 2025;
•  Implementation cost of approximately $2,800,000 and incremental annual licensing of approximately $1,900,000 (new total ACV: $6,000,000/year); and
•  Ridgeline Data Systems LLC being evaluated as a contingency alternative (proposed ACV of $7,200,000/year over a 5-year term, totaling $36,000,000).
Calendar year 2024 monitoring statistics against which the Bank benchmarks:
•  41,500 Alerts generated;
•  3,847 SARs filed (9.3% SAR Conversion Rate); and
•  ~$74.3 billion in total BaaS transaction volume across the 14 active BaaS Partners.
All transaction channels (retail, commercial, wealth, and all 14 BaaS Partner channels) are within the coverage scope of the transaction monitoring system.
4.2 Alert Triage and Assignment
Every Alert generated by the transaction monitoring system shall be triaged within two (2) business days of the Alert Generation Date. Triage evaluates the following risk criteria in order to determine priority and assignment:
(a) transaction amount (individual and aggregate);
(b) customer risk rating (as maintained in the customer information file);
(c) alert type and underlying scenario;
(d) BaaS Partner association, if any;
(e) geographic risk factors (including originator/beneficiary jurisdictions);
(f) prior SAR history on the subject; and
(g) presence of any adverse media or watchlist match.
High-priority Alerts (as defined in Section 4.2.1) shall be assigned to a senior investigator within one (1) business day of triage. Medium- and low-priority Alerts shall be assigned within three (3) business days of triage. The SAR Backlog Triage Protocol developed in connection with the clearance of the September 2024 backlog (2,400 unreviewed Alerts, target disposition by June 30, 2025) governs the sequencing of Alerts within the backlog population and is incorporated herein by reference.
4.2.1 High-Priority Alert Criteria.  An Alert is a "High-Priority Alert" if it meets any of the following criteria:
(a) individual transaction amount exceeds $100,000;
(b) the Alert involves activity potentially implicating Office of Foreign Assets Control ("OFAC") Specially Designated Nationals ("SDN") list or other sanctions programs;
(c) the Alert is associated with NovaPay Technologies (representing approximately 41% of BaaS volume, or approximately $30.5 billion in CY 2024), FairLend Digital (approximately 28% of BaaS volume), or VaultEdge (approximately 18% of BaaS volume);
(d) the Alert reflects known or suspected terrorist-financing indicators, including transactions with known typologies for terrorist finance;
(e) there are prior unresolved SARs on the same subject; or
(f) the Alert reflects patterns consistent with structuring, layering, rapid movement of funds, funnel-account activity, or similar high-severity typologies.
4.3 Investigation Workflow
Investigations shall proceed through the following five-step workflow, with each step documented in the case management system:
Step 1 — Alert Receipt and Initial Assessment. The assigned investigator reviews the system-generated Alert data, associated transaction details, and initial customer information, and conducts an initial assessment of the risk indicators identified.
Step 2 — Data Gathering. The investigator collects all relevant transactional data, customer information (including customer due diligence ("CDD") and EDD files), account history, third-party database results (e.g., adverse media, watchlists, corporate registry information), and, for BaaS-channel Alerts, data provided by the applicable BaaS Partner in accordance with Section 4.4.
Step 3 — Analysis. The investigator analyzes transaction patterns, identifies red flags, evaluates whether the activity is consistent with the customer's known activity profile and CDD/EDD file, and applies typology knowledge (including but not limited to money-mule, structuring, and account-takeover typologies) to determine whether the activity is suspicious.
Step 4 — Decision and Documentation. The investigator documents findings in the case management system and reaches one of three dispositions: (a) SAR filing recommended; (b) no SAR — activity satisfactorily explained or otherwise not suspicious; or (c) escalation for further review under Section 8.
Step 5 — Supervisory Review. Every disposition must receive supervisory review by a team lead or senior analyst before finalization. The supervisor's review, along with any comments or requested revisions, must be recorded in the case management system.
Investigations shall be substantially complete no later than fifteen (15) calendar days after the Alert Generation Date, allowing adequate time for SAR drafting, quality review, and filing within the 30-day Filing Deadline.
4.4 BaaS Partner Coordination
For Alerts arising from BaaS-channel transaction flows, investigators are authorized (and, where necessary, expected) to request additional information from the applicable BaaS Partner. Under the Revised BaaS Program Agreement compliance addendum, BaaS Partners are contractually obligated to respond to Bank information requests within five (5) business days of receipt.
Any delay or deficiency in BaaS Partner responsiveness shall be documented in the case management system and escalated to Warren Ashby (Head of Fintech Partnerships / BaaS Division) and to the BSA Officer. Repeated delays involving the same BaaS Partner will be factored into the Bank's ongoing BaaS Partner risk assessment and may result in remedial action under the applicable program agreement.
Given that BaaS-related SARs constituted 54.8% of all SARs filed by BRB in CY 2024 (2,108 of 3,847), dedicated BaaS investigative resources shall be maintained within the SAR program, and BaaS-specific typology training shall be provided as described in Section 12.3.
4.5 Investigation Documentation Standards
Every Investigation file shall contain, at minimum:
(a) the underlying Alert details, including scenario, generation date, and system references;
(b) the transaction records reviewed, including source, format, and reconciliation to the underlying systems;
(c) customer information and current risk rating;
(d) all applicable CDD/EDD documentation;
(e) third-party research results (searches, adverse media, corporate registry checks);
(f) the analytical summary and conclusions supporting the disposition;
(g) the disposition recommendation (SAR / no SAR / escalation) with supporting rationale; and
(h) the supervisory review sign-off, dated and attributed to the reviewer.
Investigation files shall be maintained in the case management system with full audit-trail capabilities, and shall be sufficient to support (i) regulatory examination by the OCC and FinCEN, (ii) independent consultant review by Thornfield Consulting Group LLC (engagement reference TCG-BRB-2025-001; Managing Director: Dr. Vivian Castellano), and (iii) annual independent testing under Section 9.6.
SECTION 5 — SAR FILING STANDARDS AND TIMELINESS REQUIREMENTS
5.1 Filing Timeliness Standard
All initial SAR filings shall be submitted to FinCEN via the BSA E-Filing System within thirty (30) calendar days of the Alert Generation Date. This 30-day standard applies uniformly across all business lines — retail, commercial, wealth management, and all BaaS Partner channels — and applies whether the SAR arises from a system-generated Alert, a manual referral, or a Lookback disposition (subject to Section 11.4).
The 30-day standard represents a mandatory and significant improvement from the Bank's prior average of 78 days, which was among the SAR-related deficiencies specifically cited in the Consent Order. The BSA Officer is responsible for ensuring that this standard is embedded in the case management system, that timeliness benchmarks under Section 5.2 are enforced, and that exceptions are tracked and remediated in accordance with Section 9.
Where a Subject cannot be identified as of the 30th day following initial detection, the Filing Deadline is extended to ninety (90) calendar days from the date of initial detection, consistent with 31 C.F.R. § 1020.320(b)(3). Any invocation of the 90-day standard must be affirmatively documented in the case management system with a clear statement of why the Subject could not be identified within 30 days, and must be reviewed by the BSA Officer or designee.
5.2 Timeliness Benchmarks
The Bank shall track SAR turnaround against the following intermediate benchmarks:
Any case that has not achieved Investigation completion by Day 15 must be flagged in the case management system for supervisory attention. Any case that has not entered the review stage by Day 20 shall trigger automated escalation to the applicable team lead and to the BSA Officer's dashboard.
5.3 Continuing Activity SARs
Where suspicious activity continues after an initial SAR filing, the Bank shall file a Continuing SAR every 90 days from the date of the immediately preceding SAR, consistent with FinCEN guidance. The BSA Officer is responsible for maintaining a Continuing SAR calendar, which shall be reviewed weekly, and for ensuring that Continuing SARs are prepared, reviewed, and filed within the same quality standards applicable to initial SARs.
5.4 Joint SARs
Where suspicious activity involves one or more other financial institutions, the Bank may, in coordination with such other institution(s), file a joint SAR. Joint filings shall not, in any circumstance, be used to delay or defer the Bank's independent filing obligation beyond the 30-day standard. If a joint filing cannot practically be completed within 30 days, the Bank shall file its own SAR and, if appropriate, file a subsequent amendment reflecting the joint filing arrangement.
5.5 SAR Filing on Directors, Officers, Employees, and Agents
SARs concerning known or suspected violations by directors, officers, employees, or agents of the Bank shall be filed simultaneously with FinCEN and with the OCC (with a copy to the Board of Directors), consistent with 12 C.F.R. Part 21, Subpart B. Such SARs shall be coordinated in advance with the General Counsel, reviewed by the BSA Officer and the CCO, and, where appropriate, subject to consultation with outside counsel.
5.6 Emergency / Expedited Filing
Where suspicious activity involves (i) an imminent threat to public safety, (ii) potential terrorist financing, or (iii) ongoing criminal conduct where delay would substantially impair law enforcement's ability to respond, the Bank shall file a SAR immediately (within 24 hours where practicable) and shall follow up with a complete SAR filing within the standard timeline as necessary. Law enforcement contact shall be made concurrently in accordance with Section 8.
SECTION 6 — SAR NARRATIVE DRAFTING STANDARDS
6.1 General Narrative Requirements
The SAR Narrative (FinCEN Form 111, Part V) is the single most important qualitative element of a SAR filing, serving as the primary communication of the reporting institution's understanding of the suspicious activity to law enforcement and regulators. Every SAR Narrative filed by the Bank shall provide a clear, concise, complete, and self-contained description of the suspicious activity.
Every Narrative shall answer the "five Ws":
•  Who is conducting the suspicious activity (subject identification);
•  What instruments or mechanisms are being used (accounts, wires, ACH, cash, cards, etc.);
•  When did the activity occur (dates and frequency);
•  Where did the activity occur (locations, jurisdictions, channels); and
•  Why is the activity suspicious (red flags, deviation from expected profile, typology).
Narratives must contain sufficient factual detail to be meaningful and actionable, and shall not consist of boilerplate, generic descriptions, or conclusory statements standing alone.
6.2 Required Narrative Elements
Every Narrative shall include, at minimum:
(a) Subject Identification. Full legal name, all known aliases, date of birth, Social Security Number or Taxpayer Identification Number (where known), address(es), account number(s) held with the Bank, and the subject's relationship to the Bank (direct customer, BaaS-partner end-user, non-customer counterparty, etc.).
(b) Description of Suspicious Activity. Nature of the activity, precise dollar amounts, specific dates, and frequency/pattern of transactions.
(c) Red Flag Indicators. Enumeration of the specific typology red flags identified during Investigation.
(d) Bank Actions Taken. Any account restrictions, enhanced monitoring measures, account closures, or referrals to other functions arising from the Investigation.
(e) Historical Context. Prior SARs filed on the subject; prior Alerts (whether or not they resulted in SARs); relationship duration; and any relevant CDD/EDD context.
(f) BaaS Partner Identification (Where Applicable). For BaaS-channel filings, the Narrative shall identify the BaaS Partner through which the subject was onboarded (e.g., NovaPay Technologies, FairLend Digital, VaultEdge) and shall include the applicable partner-channel transaction details, program identifier, and any partner-provided information relied upon.
All dollar amounts referenced in the Narrative shall be precise and reconciled to underlying transaction records; approximations are not acceptable except where explicitly qualified as such and justified by the underlying records. Narratives shall reference specific account numbers, transaction reference numbers, and dates so that a reader can trace facts back to source records.
6.3 Narrative Quality Standards
Narratives shall:
(a) avoid conclusory language, legal conclusions, and speculation ("the subject is a money launderer" or "this is clearly fraud" — not acceptable);
(b) not contain any information protected by the attorney-client privilege or the work-product doctrine;
(c) use clear, professional English, and avoid internal jargon, undefined abbreviations, or internal codes;
(d) use template preamble language only where fact-specific analysis follows and is properly integrated (template-only Narratives are prohibited); and
(e) generally range from 500 to 1,500 words, depending on complexity, with the understanding that some complex filings will substantially exceed this range and shorter Narratives may be adequate for straightforward matters.
6.4 Narrative Review
Every SAR Narrative shall undergo at least two levels of review prior to filing:
First-Level Review. By a senior investigator or team lead, focused on factual accuracy, completeness of information, and adequacy of red-flag identification.
Second-Level Review. By the BSA Officer (Thomas Ikeda) or a designated QA reviewer, focused on Narrative quality, regulatory-compliance completeness, tone, and consistency with the Bank's filing standards under this Policy.
Each reviewer shall document their review in the case management system, including reviewer name, date/time of review, and any comments, corrections, or approvals. A Narrative may not be submitted for filing until both levels of review are complete and signed off.
SECTION 7 — SAR FILING PROCEDURES
7.1 Filing Method
All SARs shall be filed electronically through the FinCEN BSA E-Filing System (https://bsaefiling.fincen.treas.gov) using FinCEN Form 111. The Bank maintains active BSA E-Filing credentials assigned to the BSA Officer and to designated backup filers within the BSA/AML department. Paper or fax filings are not permitted absent a documented FinCEN system outage and prior written approval by the BSA Officer.
7.2 Filing Approval Authority
Primary filing approval authority rests with the BSA Officer (Thomas Ikeda). In the BSA Officer's absence, the CCO (Patricia Langston) or a designated senior compliance officer identified in writing by the BSA Officer may serve as filing approver.
Notwithstanding the foregoing, the BSA Officer shall personally review and approve any SAR that:
(a) involves aggregate reported activity exceeding $1,000,000;
(b) involves known or suspected insider activity (any director, officer, employee, or agent of the Bank);
(c) has been identified as containing potential law enforcement sensitivity (including any prior law enforcement contact or grand-jury subpoena awareness);
(d) involves systemic issues potentially affecting an entire BaaS Partner channel; or
(e) has been escalated under Section 8.1 to Level 3 or Level 4.
7.3 Filing Confirmation and Recordkeeping
Upon successful filing, the BSA E-Filing System generates a system-assigned acknowledgment number (BSA Identifier) that shall be recorded in the case management system together with the filing date, filer identity, and filing status.
A complete copy of the filed SAR (including the BSA Identifier, filing date, and all supporting documentation) shall be retained for a minimum of five (5) years from the date of filing, as required by 31 C.F.R. § 1020.320(d). All supporting Investigation documentation — including transaction records, customer information, analysis memos, review sign-offs, and QA review records — shall be retained for the same five-year period. Retention shall be in a format that permits retrieval on regulatory or law enforcement request within the timeframes described in Section 15.4.
7.4 Amendments and Corrections
If material errors, omissions, or new information are identified in a filed SAR, an amended or corrected SAR shall be filed as soon as practicable following identification. The amendment record shall be maintained in the case management system, including a clear statement of the correction being made and the basis for the amendment. Amendments arising from QA-identified errors shall be tracked under Section 9.3.
7.5 Confidentiality and Non-Disclosure
Consistent with 31 U.S.C. § 5318(g)(2) and 31 C.F.R. § 1020.320(e), no officer, director, employee, or agent of the Bank may notify any person involved in a transaction that such transaction has been reported through a SAR or that a SAR-related investigation is underway. This prohibition applies with equal force to:
•  the subject of a SAR;
•  customer relationship managers or business-line personnel except on a need-to-know basis for legitimate compliance purposes;
•  BaaS Partners, except to the strictly limited extent necessary to obtain information for completion of the Investigation and filing (and, in such cases, without disclosure that a SAR has been or will be filed); and
•  any third party not authorized under this Policy or applicable law.
Violations of SAR confidentiality may constitute federal crimes under 31 U.S.C. § 5318(g) and are grounds for immediate termination of employment. All third-party requests for SAR-related information (including from law enforcement or regulators) shall be routed to the BSA Officer and the General Counsel, who shall respond in accordance with applicable law and Bank policy.
SECTION 8 — ESCALATION PROTOCOLS
8.1 Internal Escalation
The Bank operates a four-level internal escalation framework for SAR-related matters. Each level of escalation shall be documented in the case management system with time-stamped entries.
Level 1 — Investigator to Team Lead. An Investigator shall escalate to a team lead immediately upon identifying activity that may involve potential terrorist financing, structuring, foreign corruption (including potential FCPA implications), narcotics trafficking, human trafficking, or other high-severity typologies. Team lead acknowledgment shall be logged within the same business day.
Level 2 — Team Lead to BSA Officer. Team leads shall escalate to the BSA Officer cases involving:
(a) aggregate suspicious amounts exceeding $500,000;
(b) activity involving senior Bank employees or directors;
(c) activity involving high-profile customers (as designated in the customer information file);
(d) activity suggesting systemic issues in a BaaS Partner channel; or
(e) potential OFAC implications.
Level 3 — BSA Officer to CCO and General Counsel. The BSA Officer shall escalate to the CCO and the General Counsel matters involving:
(a) potential criminal referrals to law enforcement;
(b) matters requiring Board notification;
(c) patterns suggesting program-level control failures; or
(d) activity that is likely to be of interest to the OCC or FinCEN in their ongoing supervisory activity concerning the Bank.
Level 4 — CCO to Board Compliance Committee. The CCO shall escalate to the Compliance Committee matters requiring Board-level awareness, including systemic compliance failures, significant law enforcement inquiries, and patterns requiring strategic risk decisions (e.g., termination of a BaaS Partner).
8.2 Regulatory Escalation
SARs involving transactions of $5,000 or more that are known or suspected to be related to terrorist activity require special handling. Such SARs shall be prioritized for expedited filing, and the BSA Officer, in coordination with the General Counsel, shall consider whether contemporaneous notification to law enforcement is warranted.
The BSA Officer shall coordinate with the General Counsel on any required or advisable notifications to the OCC examiner-in-charge, Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. Given FinCEN's parallel monitoring of the Bank's SAR filing remediation (through Associate Director Angela Drummond, Enforcement Division), any systemic issues affecting SAR filing volume, timeliness, or quality shall be considered for escalation to FinCEN through appropriate channels, in coordination with the General Counsel.
8.3 Law Enforcement Referrals
Where suspicious activity suggests ongoing criminal conduct, the BSA Officer, in consultation with the General Counsel, may make a voluntary referral to appropriate law enforcement agencies (including but not limited to the FBI, Homeland Security Investigations, IRS Criminal Investigation, or the U.S. Attorney's Office for the applicable district). All law enforcement referrals and contacts shall be documented in the case management system, including the identity of the law enforcement contact, date of contact, and substance of the communication.
Law enforcement referrals do not satisfy or replace the SAR filing obligation. A SAR must still be filed within the 30-day standard notwithstanding any parallel or antecedent law enforcement contact.
SECTION 9 — QUALITY ASSURANCE AND CONTINUOUS MONITORING
9.1 Quality Assurance Program
The Bank shall maintain a post-filing Quality Assurance program to ensure the accuracy, completeness, timeliness, and regulatory compliance of SAR filings. This QA program operates in conjunction with, but is distinct from, first- and second-level Narrative review under Section 6.4. The design, operation, and reporting of the QA program are further described in the SAR Quality Assurance Framework Memorandum, developed as a separate deliverable under the Bank's remediation program.
9.2 QA Sampling Methodology
QA sampling shall combine random and risk-based approaches:
Random Sampling. No fewer than 10% of all filed SARs shall be reviewed each month on a random-sample basis.
Risk-Based Sampling. Targeted, supplemental sampling shall be conducted for:
(a) BaaS-related SARs (given their disproportionate contribution to filing volumes);
(b) SARs filed on or after Day 25 of the 30-day window (near-deadline filings);
(c) SARs involving aggregate amounts exceeding $500,000;
(d) SARs drafted or supported by Pinnacle temporary personnel; and
(e) SARs filed under the Lookback Project.
QA reviewers shall assess: factual accuracy, Narrative quality, completeness of supporting documentation, adherence to the 30-day timeliness standard, proper escalation under Section 8, and correct coding on FinCEN Form 111 (including subject-type designations and activity-category codes).
9.3 Error Tracking and Remediation
QA-identified errors shall be categorized as follows:
(a) Material Errors — errors requiring an amendment filing (e.g., material factual inaccuracies, omission of a known subject or key transaction, or incorrect activity coding).
(b) Significant Errors — errors not requiring an amendment but warranting corrective coaching, additional training, or targeted process changes (e.g., inadequate red-flag articulation, missing historical-context references).
(c) Minor Errors — errors noted for training and trending purposes (e.g., minor grammatical issues, formatting inconsistencies).
A monthly error log shall be maintained by the BSA Officer and reviewed with the CCO. Root cause analysis shall be conducted for any recurring error pattern (defined as three or more instances of the same error type within a rolling 90-day period, or any material error rate exceeding 2% of sampled SARs). Corrective actions — including additional training, process adjustments, technology changes, or staffing changes — shall be documented and tracked to completion.
9.4 Filing Timeliness Monitoring
The BSA Officer shall maintain a real-time dashboard tracking SAR filing timeliness against the 30-day standard. The following key metrics shall be reported monthly to the CCO and quarterly to the Compliance Committee (with monthly reporting to the Compliance Committee during the remediation period):
•  total Alerts generated;
•  total SARs filed;
•  SAR Conversion Rate (CY 2024 baseline: 9.3%);
•  average filing time (current baseline: 78 days; target: ≤30 days);
•  percentage of SARs filed within 30 days;
•  percentage of SARs filed between 31 and 60 days (exception tracking);
•  percentage of SARs filed after 60 days (critical exception — mandatory root cause analysis);
•  backlog status (current and aged Alerts); and
•  BaaS Partner-specific SAR volumes and timeliness.
9.5 SAR Backlog Prevention
To prevent recurrence of the backlog conditions cited in the Consent Order, the following operational controls shall apply at all times:
(a) No Alert may remain unassigned for more than 3 business days following the Alert Generation Date;
(b) No assigned Alert may remain without substantive Investigation activity for more than 15 calendar days;
(c) If the backlog of unreviewed Alerts exceeds 200 at any point in time, the BSA Officer shall immediately escalate to the CCO and initiate contingency staffing measures, including reallocation of Pinnacle personnel and/or invocation of surge staffing under the applicable managed-services SOW; and
(d) Weekly backlog reports shall be generated by the case management system and reviewed by the BSA Officer, with material variances escalated to the CCO.
9.6 Continuous Improvement
Quarterly SAR program reviews shall be conducted jointly by the BSA Officer and the CCO, addressing trending data, error patterns, transaction monitoring system performance, staffing adequacy, and status of Consent Order remediation commitments.
Annual independent testing by Caldera & Pope LLP (Engagement Partner: Franklin Dorsey; BSA/AML testing fee for CY 2024: $1,100,000) shall include SAR program review as a core testing component. Findings from Thornfield Consulting Group's independent assessment and validation engagement (Managing Director: Dr. Vivian Castellano; engagement reference TCG-BRB-2025-001) shall be incorporated into SAR program enhancements as appropriate, and shall be reported to the Compliance Committee.
SECTION 10 — SAR-RELATED REPORTING TO THE BOARD AND REGULATORS
10.1 Internal Reporting to the Board Compliance Committee
Monthly Reports (During Remediation Period). During the remediation period, the BSA Officer shall present to the Compliance Committee monthly SAR program reports covering: SAR volume statistics (total; by business line; by BaaS Partner); filing timeliness metrics; backlog status; QA results; staffing levels; and notable investigative trends and typologies.
Quarterly Reports (Ongoing). On a quarterly basis (both during and after the remediation period), the BSA Officer shall present a comprehensive SAR program performance summary, including trend analysis, benchmarking against peer institutions (where available and appropriate), and status of corrective actions.
Reports shall be presented by the BSA Officer to the Compliance Committee (Chair: James Rutherford), with copies to the Audit Committee (Chair: Margaret Dao) and the Risk Committee (Chair: Arthur Connelly). The Consent Order specifically cited the absence of a dedicated Compliance Committee and the lack of key metrics (including SAR volumes) in Board reporting as deficiencies; this reporting framework is designed to address those findings directly.
10.2 Regulatory Reporting Obligations
The Bank owes the OCC quarterly progress reports under the Consent Order, with the first such report due September 15, 2025, and the second due December 15, 2025. Every progress report shall include SAR-related metrics — backlog status, filing timeliness, volumes, and QA results — with such additional detail as the OCC may request.
In addition:
•  An interim SAR backlog status report is due to the OCC by March 31, 2025.
•  The compliance self-certification due to the OCC by February 15, 2026 shall specifically address SAR program implementation and remediation completion.
10.3 FinCEN Reporting
All SARs shall be filed electronically via the FinCEN BSA E-Filing System, and all Currency Transaction Reports ("CTRs") shall be filed as required by 31 C.F.R. § 1010.311. In CY 2024 the Bank filed 28,612 CTRs. Cross-referencing between the CTR and SAR programs shall be performed for all CTR-triggering customers who are also subjects of SARs, and any inconsistencies (e.g., CTR-triggering activity in a customer profile that failed to generate a corresponding Alert) shall be logged and analyzed for potential monitoring-scenario improvements.
The Bank remains aware that FinCEN, in parallel with the OCC, is monitoring BRB's SAR filing remediation and has reserved its independent enforcement rights. Any material adverse development in SAR filing performance may trigger a separate FinCEN response.
SECTION 11 — SAR LOOKBACK PROJECT PROCEDURES
11.1 Scope and Purpose
In addition to prospective SAR filing under the foregoing sections, the Bank is conducting a comprehensive SAR Lookback Project with an estimated total budget of $5,500,000. The Lookback is designed to (i) fully disposition the 2,400 unreviewed Alerts constituting the September 2024 backlog and (ii) conduct broader historical review to identify potentially unreported suspicious activity within the applicable Lookback period.
11.2 Lookback Period and Population
The Lookback period, the transaction types and customer populations within scope, and the sampling methodology are defined in the separate SAR Lookback Scope & Methodology Memorandum (approved by the BSA Officer and Calderwood & Harkness LLP; issued to the OCC as part of the Remediation Action Plan). Priority within the Lookback shall be given to BaaS-channel transactions given their disproportionate contribution to CY 2024 SAR volumes (54.8% of SARs).
11.3 Backlog Clearance Target
All 2,400 unreviewed Alerts constituting the September 2024 backlog shall be fully dispositioned no later than June 30, 2025. The 30 Pinnacle temporary FTEs (managed by Andrea Solis, Director of Managed Services) are deployed in support of backlog clearance, working under the supervision of designated BRB permanent staff and the ultimate oversight of the BSA Officer.
Alert prioritization within the backlog follows the SAR Backlog Triage Protocol, which applies the same risk-ranking criteria as Section 4.2 (transaction amount, customer risk rating, alert type, BaaS Partner association, and prior SAR history). Weekly progress reports on backlog clearance shall be delivered to the CCO and, monthly, to the Compliance Committee.
11.4 Lookback SAR Filing Standards
SARs identified through the Lookback are subject to the same Narrative, quality, and review standards set forth in Sections 6 and 9 of this Policy. Lookback SARs shall include a notation in the Narrative stating that the filing arises from a retrospective review conducted pursuant to the Consent Order remediation, and shall reference the Lookback Project by internal reference identifier so that regulators and law enforcement can distinguish Lookback filings from routine prospective filings.
SECTION 12 — TRAINING REQUIREMENTS
12.1 Initial Training
All BSA/AML personnel — whether permanent employees or temporary managed-services personnel — shall complete SAR-specific initial training within 30 days of hire, assignment to the SAR program, or role change into a SAR-related function. Initial training shall cover:
(a) applicable legal and regulatory obligations (BSA, 31 C.F.R. § 1020.320, 12 C.F.R. Part 21, Subpart B, and applicable FinCEN guidance);
(b) this Policy and its subordinate procedures;
(c) Alert Investigation methodology and typology knowledge;
(d) Narrative drafting standards under Section 6;
(e) escalation protocols under Section 8;
(f) timeliness requirements under Section 5;
(g) confidentiality obligations under Section 7.5 and Section 14; and
(h) the case management system, including required documentation and audit-trail practices.
12.2 Annual Refresher Training
All SAR program personnel shall complete annual refresher training. Refresher content shall address emerging typologies, regulatory developments (including new or updated FinCEN guidance and advisories), QA findings and error trending, and lessons learned from recent Investigations and filings.
12.3 BaaS-Specific Training
Investigators assigned to BaaS-channel Alerts shall complete specialized training covering:
•  BaaS partner-specific transaction flows and product architectures;
•  Data-sharing protocols under the applicable BaaS program agreements;
•  Unique risk factors of the Bank's three largest BaaS Partners, including:
•  NovaPay Technologies — consumer peer-to-peer payments, approximately 2.1 million end-user accounts;
•  FairLend Digital — online small-business lending, approximately $1.4 billion in FY 2024 originations through BRB; and
•  VaultEdge — digital savings and neobanking, approximately 870,000 deposit accounts.
12.4 Training Records
Completion records for all training (initial, refresher, and BaaS-specific) shall be maintained by the BSA/AML department and made available for regulatory examination and independent consultant review. Training under this Section 12 is part of the enterprise-wide BSA/AML training plan, for which $1,800,000 has been allocated within the remediation budget for training and policy development.
SECTION 13 — TECHNOLOGY AND SYSTEMS
13.1 Transaction Monitoring System
Veridian TMS v.8.3 currently serves as the Bank's transaction monitoring system, generating Alerts across all business lines and BaaS-channel activity. The upgrade to Veridian TMS v.10.0 is underway at a total implementation cost of approximately $2,800,000, with incremental annual licensing of approximately $1,900,000 (bringing the new total ACV to approximately $6,000,000/year). UAT for v.10.0 is targeted for completion by August 1, 2025, and independent model validation of the upgraded system is targeted for completion by October 1, 2025.
Upon deployment, Veridian TMS v.10.0 is expected to (i) improve overall Alert quality (increased precision, reduced noise), (ii) reduce false positives, and (iii) enhance the Bank's ability to monitor BaaS-channel activity through partner-specific scenarios and thresholds. As a contingency, Ridgeline Data Systems LLC has been evaluated (proposed ACV of $7,200,000/year over a 5-year term; $36,000,000 total contract value) and remains available in the event that Veridian TMS v.10.0 fails UAT or validation.
13.2 Case Management System
The Bank's case management system must support the entire SAR workflow end to end: Alert receipt, triage, assignment, Investigation, Narrative drafting, first- and second-level review, BSA Officer approval, e-filing, and post-filing recordkeeping. System requirements include:
(a) complete, tamper-evident audit trails with timestamps for all actions and user attributions;
(b) timeliness tracking against the 30-day standard and the intermediate benchmarks in Section 5.2;
(c) automated escalation notifications when benchmarks are at risk of being missed;
(d) reporting and dashboard capabilities supporting Section 9.4 monitoring; and
(e) integration with the FinCEN BSA E-Filing System and the OFAC screening module described in Section 13.4.
13.3 SAR E-Filing
FinCEN BSA E-Filing System integration shall ensure seamless filing submission and confirmation capture. Filing credentials shall be maintained by the BSA Officer, with backup filing credentials assigned in writing to designated senior compliance staff. Credentialing shall be reviewed at least semi-annually and after any personnel change affecting the assigned filers.
13.4 OFAC Integration
SAR Investigators shall cross-reference OFAC screening results as part of every Investigation. Any OFAC hit identified during a SAR Investigation shall be immediately escalated in accordance with the BRB OFAC Compliance Policy, with parallel notification to the BSA Officer. The Veridian OFAC module enhancement (targeted full operationalization across all BaaS channels by November 1, 2025) is expected to further improve cross-referencing capability.
CY 2024 OFAC statistics: 14,320 screening hits generated, of which 12 were true matches, reflecting a false-positive rate of approximately 99.9%. The high false-positive rate underscores the importance of accurate triage and disposition to avoid Investigator fatigue while ensuring that true matches receive the priority they require.
SECTION 14 — CONFIDENTIALITY, SAFE HARBOR, AND LEGAL PROTECTIONS
14.1 Safe Harbor Protection
Section 5318(g)(3) of Title 31 of the United States Code provides a statutory safe harbor from liability for any financial institution and its officers, employees, and agents that make a SAR filing in good faith. All BRB personnel making good-faith SAR filings and disclosures — whether through formal SARs or through internal reporting within the escalation framework — are protected from civil liability under this provision.
No customer, counterparty, or other person may be informed that a SAR has been filed or that they are the subject of a SAR-related Investigation, and no BRB personnel may confirm or deny the existence of any SAR or SAR-related Investigation except as expressly permitted by applicable law or Bank policy.
14.2 Anti-Retaliation.  No BRB employee shall be discharged, demoted, suspended, threatened, harassed, or otherwise discriminated against for having filed a SAR, having provided information related to a SAR Investigation, or having escalated concerns under the framework set forth in Section 8. These anti-retaliation protections are consistent with 31 U.S.C. § 5328 and applicable OCC regulations.
Reports of retaliation, whether observed or experienced, shall be directed to the CCO (Patricia Langston), the General Counsel (Gregory Nardone), or, anonymously, through BRB's ethics hotline. Retaliation reports will be treated as confidential to the maximum extent consistent with the Bank's ability to investigate and remediate.
14.3 Privilege Considerations
SAR Narratives and filed SARs are regulatory filings and are not privileged. Internal investigation memoranda, legal analyses, and attorney-client communications generated in connection with SAR Investigations (including materials prepared by or at the direction of Calderwood & Harkness LLP under the current remediation engagement) may be privileged and/or protected work product. Such materials shall be:
(a) clearly labeled as privileged and/or work product;
(b) segregated from Investigation files that will be shared with regulators (except as consistent with the Bank's privilege posture); and
(c) handled in accordance with the Privilege Protocol Memorandum established for the remediation engagement.
Questions regarding the privilege status of any specific document, or regarding disclosure of privileged information to regulators or third parties, shall be directed to the General Counsel or to Calderwood & Harkness LLP.
SECTION 15 — POLICY ADMINISTRATION
15.1 Policy Owner
The BSA Officer (Thomas Ikeda) is the designated owner of this Policy. The CCO (Patricia Langston) provides executive oversight of the Policy and is jointly accountable for its effective implementation.
15.2 Review and Revision Cycle
This Policy shall be reviewed and updated at least annually, or more frequently if required by changes in law or regulation, updated regulatory guidance, examination findings, Consent Order developm