MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
TO: Gregory Nardone, Esq., General Counsel & Corporate Secretary, Belmont Ridge Bank National Association; Linda Petrosian, Chief Information Officer / Chief Technology Officer, Belmont Ridge Bank National Association; Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
FROM: Philip Hartmann, Responsible Partner, Calderwood & Harkness LLP; Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
DATE: March 2025
RE: Review and Analysis of Ridgeline Data Systems LLC Proposed Term Sheet — AML Transaction Monitoring & Sanctions Screening Platform
C&H Matter No.: 1045-00002
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP for Belmont Ridge Bank National Association in connection with OCC Consent Order No. OCC-2025-003. This memorandum contains legal analysis and recommendations protected by the attorney-client privilege and the work product doctrine. Do not distribute, copy, or disclose this memorandum or any portion thereof without prior authorization from Calderwood & Harkness LLP and BRB General Counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege.
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP ("C&H") has been engaged by Belmont Ridge Bank National Association ("BRB" or the "Bank") to review and analyze the proposed commercial term sheet (the "Ridgeline Term Sheet" or "Term Sheet") submitted by Ridgeline Data Systems LLC ("Ridgeline") for the provision of a replacement anti-money laundering ("AML") transaction monitoring and sanctions screening platform. The Ridgeline Term Sheet was submitted as an alternative to BRB's incumbent vendor, Veridian Analytics Inc. ("Veridian"), and its proposed upgrade path from Veridian TMS v.8.3 to Veridian TMS v.10.0 with an enhanced OFAC screening module.
Ridgeline is being evaluated as a contingency option as part of the comprehensive BSA/AML and OFAC compliance-program remediation mandated by OCC Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order"). The Consent Order, among other things, requires BRB to deploy an upgraded and independently validated transaction monitoring system and to achieve fully operational OFAC sanctions screening for all Banking-as-a-Service ("BaaS") channels no later than November 1, 2025. The technology remediation workstream is central to BRB's overall remediation efforts, and the selection and implementation of the correct platform is of critical importance to the Bank's regulatory posture.
The key commercial terms proposed by Ridgeline are as follows: an annual contract value ("ACV") of $7,200,000 per year for an initial commitment term of five (5) years, yielding a total nominal contract value ("TCV") of $36,000,000, exclusive of one-time implementation and data migration fees estimated in the range of $3,000,000 to $4,500,000. The Ridgeline Term Sheet was submitted by David Marchetti, Chief Revenue Officer of Ridgeline Data Systems LLC, whose principal offices are located at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661. Ridgeline is organized as a Delaware limited liability company.
C&H Recommendation Summary. Following a thorough review of the proposed commercial terms, applicable regulatory requirements, implementation timelines, cost structures, and risk-allocation provisions, C&H recommends the following:
The Ridgeline Term Sheet presents a credible alternative platform with capabilities that appear, on a preliminary basis, to address the AML transaction monitoring and OFAC sanctions screening requirements set forth in the Consent Order. However, the Term Sheet raises significant concerns across several dimensions that counsel against immediate engagement:
(a) Implementation Timeline Misalignment. Ridgeline's proposed 9-to-12-month implementation timeline is fundamentally incompatible with the Consent Order's technology deadlines, most critically the August 1, 2025 deadline for completion of user acceptance testing ("UAT") on the upgraded transaction monitoring system. Even an aggressively accelerated 6-month implementation initiated in March 2025 would not meet this deadline.
(b) Total Cost of Ownership Premium. Ridgeline's total 5-year cost of ownership (estimated at approximately $39,750,000 to $43,535,000, including implementation fees and annual escalation) represents a 21% to 33% premium over the Veridian TMS v.10.0 upgrade path (estimated at approximately $32,800,000 over the same horizon).
(c) Migration and Operational Risk. A complete platform replacement introduces substantial data migration risk, BaaS channel integration complexity (14 active fintech partners, approximately $74.3 billion in CY 2024 transaction volume), staff retraining requirements, and the potential for alert backlogs and SAR filing delays during the transition period.
(d) Unfavorable Risk-Allocation Provisions. The Term Sheet contains several provisions that are unfavorable to BRB and require significant negotiation, including an inadequate liability cap, insufficient SLA credits, absence of termination-for-convenience rights, uncapped annual fee escalation, vague regulatory compliance representations, and the absence of source code escrow provisions.
C&H therefore recommends that Ridgeline remain positioned as the contingency vendor, with the Veridian TMS v.10.0 upgrade serving as the primary remediation path, unless Veridian upgrade milestones are missed — particularly the August 1, 2025 UAT deadline. The specific contingency trigger points and decision framework are set forth in Section VIII of this memorandum.
Companion Documents. This memorandum should be read in conjunction with the following companion documents prepared by C&H and BRB's advisory team:
• Memorandum on Veridian vs. Ridgeline Vendor Comparison (C&H Matter No. 1045-00002);
• Technology Implementation Timeline & Risk Assessment Memorandum (C&H Matter No. 1045-00002);
• Third-Party Technology Vendor Due Diligence Checklist (C&H Matter No. 1045-00002);
• Veridian Analytics — Amendment to Master Services Agreement (Contract No. VA-BRB-2023-0044) (C&H Matter No. 1045-00002).
II. Background and Context
A. Regulatory Context
On January 15, 2025, the Office of the Comptroller of the Currency ("OCC") issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of a multi-quarter supervisory review process and examination cycle that identified material deficiencies in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") sanctions compliance programs. The Consent Order imposed a civil money penalty ("CMP") of $14,500,000 and mandated a comprehensive remediation program addressing deficiencies in governance, staffing, technology, policies and procedures, independent testing, and regulatory reporting.
Among the core deficiencies cited in the Consent Order, two are directly relevant to the technology vendor evaluation that is the subject of this memorandum:
Technology Deficiency No. 1 — Transaction Monitoring Model Validation and Tuning. The Consent Order found that BRB's AML transaction monitoring model, running on the Veridian TMS v.8.3 platform, had not been independently validated since March 2021 — a gap of more than three years — in contravention of the OCC's supervisory expectations for model risk management as set forth in OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management). Additionally, the model's tuning parameters were last updated in October 2022, leaving the model operating with outdated thresholds and detection scenarios that were not calibrated to BRB's evolving risk profile, particularly the rapid growth of its BaaS business lines.
Technology Deficiency No. 2 — OFAC Sanctions Screening Gap on BaaS Channels. The Consent Order further found that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through certain fintech BaaS channels. Specifically, approximately 12% of NovaPay Technologies Inc. wire and ACH transactions — approximately 3,800,000 of the 31,700,000 total NovaPay transactions processed in calendar year 2023 — went entirely unscreened against OFAC sanctions lists. This screening gap represented a significant failure of the Bank's sanctions compliance program and was treated as a particularly serious finding given the volume and dollar value of the unscreened transactions.
The Consent Order mandates the following technology-related remediation deadlines, which are central to the analysis set forth in this memorandum:
These deadlines are firm requirements of the Consent Order. Failure to meet them would constitute a violation of the Consent Order and could result in additional enforcement action, including assessment of further civil money penalties, imposition of additional remediation requirements, or, in the most severe scenario, restriction or prohibition of BRB's BaaS activities pending compliance.
B. Incumbent Vendor — Veridian Analytics Inc.
BRB's current AML transaction monitoring and sanctions screening technology is provided by Veridian Analytics Inc. ("Veridian"), a Delaware corporation with principal offices at 1900 Embarcadero Road, Suite 400, Palo Alto, California 94303. BRB's primary vendor contact at Veridian is Priya Subramanian, Vice President of Client Solutions.
The existing contractual relationship between BRB and Veridian is governed by the Master Services Agreement and associated statements of work, collectively referred to as Veridian Contract No. VA-BRB-2023-0044. The current ACV under this contract is $4,100,000 per year on a three-year term that expires in December 2026. The system currently in production is Veridian TMS v.8.3, which is the platform specifically identified and flagged in the Consent Order as having been inadequately tuned and insufficiently validated.
Veridian has proposed an upgrade path to Veridian TMS v.10.0, a next-generation platform that includes a substantially enhanced OFAC screening module designed to address the BaaS channel screening gap identified in the Consent Order. The commercial terms of the proposed Veridian upgrade are as follows:
• One-time implementation cost for TMS v.10.0 upgrade and OFAC module deployment: $2,800,000 (fixed);
• Incremental annual licensing for TMS v.10.0 and enhanced OFAC screening module: $1,900,000 per year;
• Post-upgrade ACV: $6,000,000 per year ($4,100,000 existing base ACV + $1,900,000 incremental licensing).
C&H has separately prepared a draft MSA amendment and Statement of Work for the Veridian upgrade, which are cross-referenced to this memorandum and which set forth the specific contractual terms, milestone schedule, SLA structure, and risk-allocation provisions applicable to the Veridian upgrade path.
C. Purpose of Ridgeline Evaluation
Ridgeline Data Systems LLC was identified during the remediation planning process as an alternative AML/sanctions technology vendor with a platform that could potentially serve as a complete replacement for Veridian's transaction monitoring and OFAC screening systems. Ridgeline was identified through a combination of industry referrals, prior familiarity within BRB's technology team, and the independent consultant's (Thornfield Consulting Group LLC) preliminary market survey.
A mutual non-disclosure agreement ("NDA") between BRB and Ridgeline was executed in February 2025 to facilitate the exchange of information necessary for a meaningful evaluation, including BRB's transaction volumes, BaaS partner architecture, current technology stack, and Consent Order remediation requirements. All communications and information exchanges with Ridgeline to date have been conducted under the protection of this NDA.
The purpose of the Ridgeline evaluation is to establish a credible contingency option in the event that the Veridian TMS v.10.0 upgrade proves insufficient to meet the Consent Order's requirements or encounters material implementation delays that jeopardize compliance with the mandated deadlines. This approach — maintaining a primary vendor path with a clearly defined contingency — is consistent with prudent vendor management practices as articulated in the OCC's third-party risk management guidance (OCC Bulletin 2013-29, as updated and supplemented by OCC Bulletin 2023-17 and the Interagency Guidance on Third-Party Relationships: Risk Management issued jointly by the OCC, FDIC, and Federal Reserve Board in June 2023).
III. Summary of Proposed Commercial Terms
The following is a summary and analysis of the material commercial terms set forth in the Ridgeline Term Sheet as received by BRB. All references to specific term sheet provisions are to the Ridgeline Data Systems LLC proposed term sheet dated February 2025 (attached hereto as Attachment 1). C&H's observations and recommendations are included within each subsection.
A. Parties
The proposed transaction would be between:
Vendor: Ridgeline Data Systems LLC, a Delaware limited liability company, with principal offices at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661.
Client: Belmont Ridge Bank National Association, a national banking association organized under the laws of the United States, with its principal office at [BRB's principal office address].
C&H notes that Ridgeline is organized as a limited liability company rather than a corporation. In evaluating the implications of this entity structure, BRB should confirm during the due diligence process that Ridgeline's LLC operating agreement and capitalization provide sufficient financial substance to support the long-term contractual commitments contemplated by the Term Sheet. C&H's Third-Party Technology Vendor Due Diligence Checklist includes specific diligence items relating to vendor financial condition, capitalization, and organizational structure.
B. Term and Renewal
The Ridgeline Term Sheet proposes the following term structure:
Initial Term: Five (5) years from the platform go-live date (i.e., the date on which the Ridgeline platform is deployed into BRB's production environment and accepted by BRB following completion of UAT and any required parallel running period).
Auto-Renewal: The agreement would automatically renew for successive one (1)-year periods following the expiration of the initial five-year term, unless terminated by either party upon not less than one hundred eighty (180) days' prior written notice.
C&H Observation. The proposed five-year initial commitment term is substantially longer than the remaining term on BRB's current Veridian contract, which expires in December 2026 (approximately 22 months from the date of this memorandum). A five-year lock-in with no termination-for-convenience right (discussed further in Section IV.F below) creates significant vendor concentration risk and limits BRB's flexibility to respond to changes in its regulatory environment, technology requirements, or business strategy.
Moreover, because the initial term commences upon the platform go-live date rather than the contract execution date, the total elapsed time of BRB's commitment — from contract execution through the end of the initial term — could extend to six years or longer if the implementation phase takes 9 to 12 months as Ridgeline has proposed. This extended lock-in period should be a significant factor in BRB's evaluation and negotiation strategy.
C&H recommends negotiation of early termination provisions and performance-based exit rights, as discussed in detail in Section IV.F.
C. Annual Contract Value and Total Contract Value
The Ridgeline Term Sheet proposes the following pricing structure:
Annual Contract Value (ACV): $7,200,000 per year.
Total Contract Value (TCV) over the 5-year initial term: $7,200,000 × 5 = $36,000,000 (nominal, before application of any annual escalation).
The ACV is structured as a fixed annual fee and includes the following components:
(a) AML transaction monitoring platform license (core platform functionality, including rule engine, alert generation, case management, and reporting);
(b) Sanctions/OFAC screening module (real-time and batch screening against OFAC Specially Designated Nationals and blocked Persons List ("SDN List"), consolidated sanctions lists, sectoral sanctions lists, and other applicable sanctions lists);
(c) List management services (ongoing maintenance and updating of sanctions lists, politically exposed persons ("PEP") lists, and adverse media data feeds);
(d) Standard support and maintenance (technical support, bug fixes, and system maintenance during standard business hours, with premium after-hours support available at additional cost);
(e) Up to three (3) system updates per year (platform enhancements, rule updates, and technology upgrades released by Ridgeline to its client base generally).
The pricing structure is a fixed annual fee with no per-transaction pricing component. While fixed pricing provides budget predictability, BRB should evaluate whether this structure remains economical as BRB's transaction volumes grow — particularly in the BaaS segment, which has experienced significant year-over-year growth. If BRB's transaction volumes increase materially during the five-year term, a fixed-fee structure may prove advantageous; however, BRB should confirm that the fixed fee does not include volume caps or tier thresholds that could trigger incremental charges at higher volumes.
D. Implementation Fees
In addition to the ACV, Ridgeline proposes a separate one-time implementation and data migration fee. The Term Sheet does not specify a fixed implementation fee amount; rather, it contemplates that the implementation fee will be finalized in a Statement of Work ("SOW") to be negotiated and executed as part of the definitive agreement. However, based on preliminary scoping discussions between BRB's technology team (Linda Petrosian, CIO/CTO) and Ridgeline's technical presales team, the initial estimate range for the implementation fee is $3,000,000 to $4,500,000.
This implementation fee is in addition to the $7,200,000 ACV and encompasses the following scope:
(a) Platform installation and configuration; (b) Data migration from the existing Veridian TMS environment; (c) BaaS channel integration (API development and testing for all 14 active BaaS partner connections); (d) Rule configuration, threshold setting, and initial model tuning; (e) User acceptance testing support; (f) Parallel running support (90-day parallel running period); (g) Production cutover and hypercare support.
C&H Note — Year 1 Cost Comparison. The total Year 1 cost under the Ridgeline path could range from $10,200,000 to $11,700,000, calculated as the $7,200,000 ACV plus $3,000,000 to $4,500,000 in implementation fees. This significantly exceeds the Veridian Year 1 cost of approximately $8,800,000 to $8,900,000, which comprises the $4,100,000 existing base ACV, $1,900,000 in incremental licensing, and the $2,800,000 one-time implementation fee (which is already fixed by the terms of the proposed Veridian MSA amendment). The Year 1 cost differential alone ranges from approximately $1,300,000 to $2,800,000 in Ridgeline's disfavor.
E. Payment Terms
The Ridgeline Term Sheet proposes the following payment structure:
ACV Payments: Quarterly payments in advance, payable at $1,800,000 per quarter ($7,200,000 ÷ 4 = $1,800,000).
Implementation Fee Payments: Payable in three milestone-based installments:
• Thirty percent (30%) upon contract execution;
• Forty percent (40%) upon commencement of user acceptance testing;
• Thirty percent (30%) upon production go-live.
Payment Terms: Net thirty (30) calendar days from invoice date.
C&H notes that the payment structure for implementation fees is heavily front-loaded, with 30% payable at contract execution — before any implementation work has commenced. This structure places a disproportionate share of payment risk on BRB, particularly given the uncertainty in the implementation timeline. If the implementation is delayed or ultimately abandoned, BRB could have paid 30% of the implementation fee (i.e., $900,000 to $1,350,000) with limited recourse.
C&H recommends restructuring the implementation fee payment schedule to tie payments more closely to the achievement of defined milestones and deliverables, with holdback or clawback provisions if milestones are not achieved within specified timeframes. A suggested alternative payment structure would be: 10% at contract execution, 20% at completion of data migration, 30% at commencement of UAT, and 40% at production go-live and acceptance. Additionally, BRB should negotiate the right to withhold the final payment tranche (or a portion thereof) during a post-go-live stabilization period (e.g., 30 to 60 days) to ensure system performance meets acceptance criteria.
F. Annual Escalation
The Ridgeline Term Sheet proposes an annual fee escalation provision as follows:
Beginning in Year 2 of the initial term, the ACV shall be subject to annual escalation equal to the Consumer Price Index ("CPI") plus two percentage points (CPI + 2%), applied to the prior year's ACV.
C&H Observation. This escalation provision is uncapped and, over the five-year term, creates significant cost uncertainty and upside risk for BRB. To illustrate the potential impact of this provision, assuming a CPI rate of 3% (broadly consistent with recent trends), the effective annual escalation would be 5% per year. Under this scenario, the ACV would escalate as follows:
Under this illustrative scenario, the total 5-year licensing cost (excluding implementation fees) would exceed the nominal $36,000,000 TCV by approximately $3,785,000, representing a 10.5% increase over the stated TCV. In a higher-inflation environment (e.g., CPI of 4%), the effective escalation would be 6% per year, and the Year 5 ACV could exceed $9,090,000.
By contrast, the existing Veridian contract contains no annual escalation provision through its expiration in December 2026. While Veridian's renewal terms beyond December 2026 are not yet negotiated and may include an escalation component, BRB will have the opportunity to negotiate that escalation within the context of a competitive renewal process.
Recommendation. C&H recommends that BRB negotiate one of the following alternatives:
(a) A hard cap on annual escalation of no more than 3% per year, regardless of CPI;
(b) Fixed pricing for the full five-year initial term, with escalation applicable only during renewal periods; or
(c) At minimum, a CPI-only escalation (without the 2% adder), with a floor of 0% and a cap of 3%.
G. Service Level Agreements (SLAs)
The Ridgeline Term Sheet proposes the following service level commitments:
Platform Availability: 99.5% uptime, measured on a monthly basis. Uptime is calculated as total available minutes in the measurement period divided by total minutes in the measurement period, excluding scheduled maintenance windows (which Ridgeline proposes to schedule during off-peak hours with at least 48 hours' advance notice to BRB).
Screening Latency: Real-time OFAC sanctions screening completed within 500 milliseconds for at least 95% of transactions submitted for real-time screening during any given measurement period.
Batch Processing: Batch OFAC screening files completed and results delivered within four (4) hours of file submission.
SLA Credits: In the event Ridgeline fails to meet the 99.5% uptime SLA in any given month, BRB shall receive service credits equal to 5% of the monthly fee for each 0.1 percentage point below the 99.5% uptime threshold, subject to a maximum aggregate credit cap of 15% of the monthly fee for that measurement period.
C&H Observation. While the proposed SLA thresholds are within the range of industry norms for cloud-based financial compliance platforms, several aspects of the SLA structure are insufficient given BRB's regulatory posture and the critical nature of the OFAC screening function:
(a) SLA Credit Cap. The proposed cap of 15% of monthly fees is inadequate. At 15% of the monthly ACV ($600,000/month), the maximum monthly credit would be $90,000 — a sum that provides minimal financial incentive for Ridgeline to maintain performance and does not come close to compensating BRB for the regulatory risk associated with system downtime. C&H recommends negotiation of the credit cap to at least 25% of monthly fees.
(b) Absence of Termination Right for Sustained SLA Failure. The Term Sheet does not provide BRB with a termination right in the event of sustained or repeated SLA failures. Given that any material disruption to OFAC screening could result in additional Consent Order violations and regulatory penalties, BRB should have the right to terminate the agreement if Ridgeline fails to meet the 99.0% uptime threshold for three (3) or more consecutive months, or if Ridgeline fails to meet the 99.5% threshold for six (6) or more months within any rolling twelve-month period.
(c) OFAC Screening Completeness. The SLA structure focuses on availability and latency but does not include a specific SLA metric for OFAC screening completeness — i.e., the percentage of transactions that are actually screened against applicable sanctions lists. Given that the screening gap on NovaPay transactions was a primary finding in the Consent Order, C&H recommends the inclusion of a 100% screening completeness SLA for all transaction flows, with any failure to achieve 100% screening treated as a critical SLA breach triggering immediate remediation obligations and, if not cured within 24 hours, a termination right for BRB.
IV. Key Negotiation Points and Risk Allocation Issues
This section identifies and analyzes the principal areas of concern in the Ridgeline Term Sheet from a risk-allocation and contractual perspective. For each issue, C&H sets forth its assessment and recommended negotiation position.
A. Implementation Timeline and Consent Order Deadline Risk
This is the most critical concern identified in C&H's review of the Ridgeline Term Sheet.
Ridgeline has proposed an implementation timeline of nine (9) to twelve (12) months from contract execution to full production deployment. This timeline encompasses all phases of the implementation, including project initiation, system configuration, data migration, BaaS channel integration, rule configuration and tuning, user acceptance testing, parallel running (90 days), and production cutover.
The implications of this timeline in the context of the Consent Order deadlines are as follows:
If BRB were to pivot to Ridgeline immediately — that is, if a definitive agreement were executed in March 2025 — and assuming a 9-month implementation at the optimistic end of Ridgeline's proposed range, full production go-live would not occur until approximately December 2025. Under a 12-month implementation scenario, go-live would not occur until approximately March 2026.
Neither of these outcomes is compatible with the Consent Order's technology deadlines:
Even an aggressively accelerated six (6)-month implementation — which would require significant additional resources and compressed testing cycles, and which Ridgeline has not committed to or confirmed as feasible — would not meet the August 1, 2025 UAT deadline if the implementation commenced after March 2025. A six-month implementation initiated in March 2025 would yield a production go-live date of approximately September 2025, which would miss the August 1 UAT deadline and leave insufficient time for independent model validation by October 1.
C&H Assessment. Based on the foregoing timeline analysis, Ridgeline can serve as a viable replacement platform only under one of the following scenarios:
(a) OCC Extension. The OCC grants an extension to the Consent Order technology deadlines to accommodate a Ridgeline implementation timeline. C&H considers this scenario unlikely and strongly advises against requesting such an extension, as it would signal to the OCC that BRB's remediation program is not on track and could invite additional supervisory scrutiny, additional remediation requirements, or further enforcement action.
(b) Post-Consent Order Compliance Replacement. Ridgeline is contracted as a replacement to be implemented after BRB achieves initial Consent Order compliance via the Veridian TMS v.10.0 upgrade. Under this scenario, BRB would first complete the Veridian upgrade to meet the Consent Order deadlines, and then undertake a subsequent migration to Ridgeline during calendar year 2026 or later. This approach would result in dual implementation costs (as discussed in Section V.B below) but would preserve BRB's Consent Order compliance posture.
(c) Veridian Upgrade Failure. The Veridian TMS v.10.0 upgrade encounters material implementation delays or technical failures that render the Veridian path non-viable. In this scenario, BRB would need to approach the OCC with a revised remediation timeline incorporating Ridgeline as the replacement platform, accompanied by a credible implementation plan and a demonstration that the pivot is being executed with maximum urgency. This is the scenario for which the Ridgeline contingency is being maintained.
Recommendation. Ridgeline should remain positioned as a contingency fallback, not as the primary technology remediation path. If BRB determines that a Ridgeline engagement is necessary, any definitive agreement with Ridgeline should include: (i) contractually committed accelerated implementation milestones, with specific delivery dates for each phase of the implementation; (ii) liquidated damages for timeline overruns, calibrated at a level sufficient to incentivize on-time delivery; and (iii) a termination right for BRB if Ridgeline fails to achieve production go-live within a specified outside date.
B. Data Migration and Parallel Running
The Ridgeline Term Sheet contemplates a "parallel running" period of ninety (90) days during which both the Veridian and Ridgeline systems would operate simultaneously, processing the same transaction flows and generating parallel alert outputs. The purpose of the parallel running period is to validate the Ridgeline platform's detection capabilities, confirm alert quality and completeness, and ensure that the transition does not result in any gap in monitoring or screening coverage.
While parallel running is a prudent implementation practice and consistent with regulatory expectations for technology transitions of this nature, it presents several practical and financial implications:
Cost Implications. During the 90-day parallel running period, BRB would be paying both the Veridian ACV (at the post-upgrade rate of $6,000,000 per year, or approximately $1,500,000 for a 90-day period) and the Ridgeline ACV (at $7,200,000 per year, or approximately $1,800,000 for a 90-day period), for a combined quarterly technology cost of approximately $3,300,000. This overlapping cost represents a material but unavoidable expense in the event of a platform transition.
Operational Complexity. Operating two parallel AML transaction monitoring and OFAC screening platforms simultaneously requires significant operational resources, including dual staffing for alert review, dual investigation workflows, reconciliation of alert outputs between the two systems, and management of potential discrepancies in detection results. BRB's BSA/AML compliance team — currently staffed at 62 FTEs with a planned expansion to 77, supplemented by approximately 30 temporary staff from Pinnacle — would face substantial additional workload during the parallel running period.
Data Migration Scope. The data migration from Veridian to Ridgeline would encompass the following categories of data, all of which are critical to the integrity and continuity of BRB's BSA/AML and OFAC compliance programs:
(i) Historical transaction data (required for model tuning, backtesting, and regulatory examination support); (ii) Alert histories (including alert dispositions, investigation notes, and escalation records); (iii) SAR filing records (including all supporting documentation and narratives); (iv) Customer risk ratings and risk assessment data; (v) Model tuning parameters, detection rule configurations, and threshold settings; (vi) OFAC screening results and disposition records; (vii) Case management records (open and closed investigations).
The scope and complexity of this data migration should not be underestimated. The data would be migrated either from Veridian TMS v.8.3 (the current production system) or from Veridian TMS v.10.0 (if the Veridian upgrade is completed first), and the data structures, field mappings, and formatting conventions may differ significantly between the Veridian and Ridgeline platforms.
C&H Recommendation. In any definitive agreement with Ridgeline:
(a) Require Ridgeline to bear all data migration costs within the stated implementation fee, with no additional charges for data migration services;
(b) Require Ridgeline to provide a dedicated migration team with specified qualifications and experience in financial services AML data migration;
(c) Define clear data completeness and integrity acceptance criteria, including quantitative thresholds for data accuracy, completeness, and reconciliation; and
(d) Specify that BRB retains the right to extend or shorten the parallel running period based on BRB's assessment of system readiness, without additional charges from Ridgeline (except for the standard ACV, which runs concurrently in any event).
C. Regulatory Compliance Representations and Warranties
The Ridgeline Term Sheet includes a general representation that the Ridgeline platform "supports compliance with applicable U.S. anti-money laundering laws and regulations." While this representation is directionally correct, it is materially insufficient in specificity and scope given BRB's current regulatory posture and the detailed compliance requirements set forth in the Consent Order.
C&H Observation. A general representation of this nature provides little contractual protection to BRB in the event that the Ridgeline platform fails to meet specific regulatory requirements. In the context of an active Consent Order with defined technology mandates, BRB requires specific and detailed representations and warranties from Ridgeline addressing the following:
(a) OFAC Sanctions Screening Capability. The platform must be capable of screening against all applicable OFAC lists using the exact terminology recognized by OFAC, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, the Non-SDN Menu-Based Sanctions List, and all other lists maintained and published by OFAC. Ridgeline must warrant that its list management services include timely and complete integration of all OFAC list updates within the timeframes required by applicable regulations and guidance.
(b) BSA/AML Transaction Monitoring Rule Coverage and Configurability. The platform must support a comprehensive library of detection rules and scenarios covering all relevant BSA/AML risk typologies, including but not limited to structuring, rapid movement of funds, funnel accounts, trade-based money laundering, third-party payment processor risks, and BaaS-specific risk patterns. The rules must be configurable and tunable by BRB (or by Ridgeline at BRB's direction) to reflect BRB's specific risk profile, customer base, and transaction patterns.
(c) BaaS Channel Integration — 100% Coverage. The platform must be capable of ingesting and screening 100% of transaction flows from all fourteen (14) of BRB's active BaaS fintech partner channels, including NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., and the remaining eleven partners. Ridgeline must represent that its platform can accommodate the full volume of BRB's BaaS transactions (approximately $74.3 billion in CY 2024, across approximately 31.7 million NovaPay transactions alone and a total BaaS transaction count across all 14 partners that is proportionally larger).
(d) Capacity and Scalability. The platform must be capable of processing BRB's current transaction volumes in real time — CY 2024 statistics include approximately 41,500 transaction monitoring alerts generated, approximately 14,320 OFAC screening hits, and total BaaS transaction volume of approximately $74.3 billion — and must be scalable to accommodate projected growth without degradation of performance or additional licensing fees.
(e) Independent Model Validation Support. Ridgeline must covenant to provide full cooperation and support for independent model validation of the platform's transaction monitoring model, including providing access to model documentation, methodology, source code (under NDA/escrow), validation data, and technical personnel. This is critical because the Consent Order requires independent model validation by October 1, 2025 (or, in a Ridgeline contingency scenario, by the revised deadline negotiated with the OCC).
(f) Regulatory Examination Support. Ridgeline must covenant to cooperate fully with BRB's regulatory examinations, including providing access and information as required by OCC examiners, FinCEN, and any independent consultant appointed by the OCC. Specifically, Ridgeline must agree to cooperate with Thornfield Consulting Group LLC (the OCC-mandated independent consultant, led by Dr. Vivian Castellano, Managing Director) and any successor independent consultant, and must not assert any contractual, proprietary, or other right to limit or restrict such access.
Recommendation. C&H recommends that BRB require enhanced regulatory compliance representations and covenants in any definitive agreement with Ridgeline, including a specific OFAC screening completeness warranty providing that the Ridgeline platform shall screen 100% of all transactions submitted for screening, with no exceptions, gaps, or exclusions. Any failure to achieve 100% screening completeness should be treated as a material breach of the agreement.
D. Indemnification and Limitation of Liability
The Ridgeline Term Sheet proposes the following indemnification and limitation-of-liability framework:
Indemnification. Mutual indemnification for (i) third-party intellectual property infringement claims and (ii) breaches of confidentiality obligations.
Aggregate Liability Cap. Each party's aggregate liability under the agreement shall not exceed an amount equal to twelve (12) months of fees paid by BRB (i.e., $7,200,000).
Consequential Damages Exclusion. Neither party shall be liable to the other for any consequential, incidental, special, punitive, or indirect damages, regardless of the form of action or theory of liability.
C&H Concern. The proposed liability framework is significantly unfavorable to BRB given the Bank's regulatory exposure and the critical nature of the services being procured:
(a) Inadequate Liability Cap. The proposed aggregate liability cap of $7,200,000 (12 months of fees) is insufficient in light of the potential consequences of a Ridgeline system failure. BRB's CMP under the Consent Order was $14,500,000. A system failure that results in an OFAC screening gap, missed SARs, or other compliance deficiencies could expose BRB to additional regulatory penalties, examination findings, enforcement actions, or remediation costs that far exceed $7,200,000. A liability cap at this level effectively transfers the risk of system failure from Ridgeline (the vendor responsible for the system's performance) to BRB (the regulated entity).
(b) Overbroad Consequential Damages Exclusion. The blanket exclusion of consequential, incidental, and special damages, while common in technology licensing agreements, is particularly problematic in this context. Regulatory fines and penalties imposed on BRB as a result of Ridgeline system failures would likely be characterized as consequential or indirect damages under the exclusion, leaving BRB with no contractual remedy against Ridgeline for the most significant category of potential loss.
Recommendation. C&H recommends the following modifications to the indemnification and liability framework:
(a) Increase the aggregate liability cap to at least twenty-four (24) months of fees ($14,400,000), which more closely aligns with BRB's regulatory exposure under the Consent Order;
(b) Negotiate carve-outs from the consequential damages exclusion for: (i) regulatory fines, penalties, and remediation costs directly attributable to Ridgeline system failures or Ridgeline's breach of its regulatory compliance representations and warranties; (ii) losses arising from data breaches or unauthorized disclosure of BRB customer data; and (iii) losses arising from Ridgeline's willful misconduct, gross negligence, or fraud;
(c) Alternatively or additionally, require Ridgeline to maintain errors and omissions ("E&O") professional liability insurance with coverage limits of no less than $20,000,000 per occurrence and in the aggregate, with BRB named as an additional insured, and with a requirement that Ridgeline provide BRB with at least thirty (30) days' prior written notice of any cancellation, non-renewal, or material reduction in coverage.
E. Intellectual Property and Data Ownership
The Ridgeline Term Sheet proposes the following IP and data ownership framework:
Platform IP. Ridgeline retains all intellectual property rights in and to the Ridgeline platform, including all software, algorithms, models, documentation, and related materials. BRB receives a non-exclusive, non-transferable license to use the platform during the term of the agreement for BRB's internal business purposes.
BRB Data. Ridgeline acknowledges that BRB retains ownership of all customer data, transaction data, and derived analytics generated by or through the platform using BRB's data.
C&H Concerns and Recommendations.
(a) Tuning Parameters and Custom Configurations. The Term Sheet does not clearly address the ownership of tuning parameters, model configurations, detection rules, and custom rule logic developed specifically for BRB during and after the implementation process. These items represent significant intellectual capital and operational value. BRB's BSA/AML team will invest substantial time and expertise in configuring, tuning, and optimizing the Ridgeline platform for BRB's specific risk profile and transaction patterns. C&H recommends that the definitive agreement clearly provide that all tuning parameters, model configurations, custom rules, and BRB-specific configurations developed for or by BRB during the engagement are the exclusive property of BRB, and that Ridgeline shall have no right to use, disclose, or license such configurations to any third party.
(b) Data Portability. The Term Sheet does not include provisions for data portability upon termination of the agreement. C&H recommends that the definitive agreement require Ridgeline to: (i) export all BRB data (including all categories identified in Section IV.B above) in standard, industry-recognized formats (e.g., CSV, XML, JSON, or SQL-compatible formats); (ii) provide such data export within a specified timeframe following termination (e.g., 60 days); and (iii) provide reasonable transition assistance services, at BRB's request and at a pre-agreed hourly rate, for a period of up to 12 months following termination to support BRB's migration to a successor platform.
(c) Data Destruction/Return. Following the completion of data export and transition, Ridgeline must be contractually obligated to destroy all copies of BRB data in its possession or control (including data held by any subcontractors) and to certify such destruction in writing to BRB. BRB should also require that Ridgeline's data retention and destruction practices comply with all applicable regulatory requirements, including recordkeeping requirements under the BSA and OFAC regulations.
(d) Source Code Escrow. The Ridgeline Term Sheet does not include any provisions for source code escrow. This is a significant omission. If Ridgeline were to become insolvent, undergo a change of control, materially breach the agreement, or discontinue the platform, BRB could be left without access to the source code necessary to operate, maintain, or migrate from the Ridgeline platform — a potentially catastrophic outcome for a regulated institution operating under a Consent Order. C&H recommends requiring Ridgeline to deposit the platform source code, together with all necessary documentation, build instructions, and third-party software dependencies, with a reputable third-party escrow agent (such as Cobalt Ridge Services Inc., Crowne Albany Advisors, or a comparable provider). Release triggers should include: (i) Ridgeline insolvency, bankruptcy, or assignment for the benefit of creditors; (ii) material breach by Ridgeline that remains uncured following the applicable cure period; (iii) discontinuation of the Ridgeline platform; and (iv) change of control of Ridgeline to an entity that does not assume all obligations under the agreement.
F. Termination Rights
The Ridgeline Term Sheet proposes a limited termination framework:
Termination for Material Breach. Either party may terminate the agreement upon material breach by the other party, subject to a sixty (60)-day cure period following written notice of the breach.
Termination by Mutual Agreement. The agreement may be terminated at any time by mutual written agreement of both parties.
No Termination for Convenience. BRB does not have the right to terminate the agreement for convenience during the initial five-year term.
C&H Concern. The absence of a termination-for-convenience right is highly problematic for BRB in the context of a five-year, $36,000,000+ commitment. There are numerous scenarios in which BRB might need to exit the Ridgeline relationship during the initial term, including:
(a) Changes in BRB's regulatory environment or business strategy that necessitate a different technology approach (e.g., OCC examination findings recommending a different platform, changes in BRB's BaaS strategy that reduce or eliminate the need for the Ridgeline platform's BaaS capabilities);
(b) Emergence of a materially superior technology solution that better meets BRB's evolving needs;
(c) Deterioration in Ridgeline's service quality, financial condition, or competitive positioning that does not rise to the level of a material breach but nonetheless undermines BRB's confidence in the vendor relationship;
(d) A change of control of Ridgeline (e.g., acquisition by a competitor or by an entity with which BRB has a conflict of interest);
(e) BRB's own strategic changes, such as a merger, acquisition, or divestiture, that alter BRB's technology requirements.
Without a termination-for-convenience right, BRB would be contractually obligated to continue paying $7,200,000 per year (plus escalation) for the full five-year term, even if the platform is no longer needed or no longer the optimal solution. The total financial exposure of this lock-in, in a worst-case scenario, could approach the full remaining TCV.
Recommendation. C&H recommends the following modifications:
(a) Termination for Convenience. BRB should have the right to terminate the agreement for convenience upon twelve (12) months' prior written notice, subject to a reasonable early termination fee. C&H suggests a declining early termination fee structure — for example, 50% of the remaining term fees if terminated in Year 1, declining by 10% per year thereafter (40% in Year 2, 30% in Year 3, 20% in Year 4, 10% in Year 5).
(b) Termination for Change of Control. BRB should have the right to terminate the agreement, without penalty, upon a change of control of Ridgeline (defined to include any transaction in which a person or entity acquires 50% or more of the equity interests or substantially all of the assets of Ridgeline).
(c) Termination for Regulatory Compliance Failure. BRB should have the right to terminate if Ridgeline fails to maintain regulatory compliance certifications or if the Ridgeline platform fails to comply with applicable BSA/AML or OFAC requirements as a result of Ridgeline's acts or omissions.
(d) Termination for Sustained SLA Failure. As discussed in Section III.G above, BRB should have the right to terminate if Ridgeline fails to meet specified SLA thresholds for sustained periods.
G. Audit and Examination Rights
The Ridgeline Term Sheet provides BRB with annual audit rights upon thirty (30) days' prior written notice. While this provision is a starting point, it is insufficient to meet BRB's regulatory obligations and the specific requirements of the Consent Order.
C&H Observation. The audit and examination rights in any definitive agreement with Ridgeline must be expanded to encompass the following:
(a) Regulatory Examiner Access. The agreement must expressly provide for access to the Ridgeline platform, systems, data, records, and supporting documentation by OCC examiners and FinCEN, without requiring Ridgeline's prior consent and without limitation as to frequency or scope. This is not merely a contractual preference — it is a regulatory requirement under OCC third-party risk management guidance and the terms of the Consent Order.
(b) Independent Consultant Access. The agreement must provide for access by Thornfield Consulting Group LLC (the OCC-mandated independent consultant, led by Dr. Vivian Castellano, Managing Director, engagement reference TCG-BRB-2025-001) and any successor independent consultant appointed by the OCC. Thornfield's mandate under the Consent Order includes assessment of BRB's transaction monitoring and sanctions screening technology, and the independent consultant must have unfettered access to the platform and all related documentation.
(c) External Auditor and Independent Testing Firm Access. The agreement must provide for access by BRB's external auditor, Caldera & Pope LLP (Franklin Dorsey, Engagement Partner), and any independent BSA/AML testing firm engaged by BRB, to perform audits, assessments, and independent testing of the Ridgeline platform as part of BRB's BSA/AML independent testing program.
(d) Expedited Notice Period. The thirty (30)-day notice requirement should be reduced to ten (10) business days for audits conducted in connection with a regulatory examination, and to immediate access (no notice required) for access by OCC examiners or FinCEN.
(e) No Restriction on Regulatory Access. The agreement should include a specific covenant by Ridgeline that it will cooperate fully with all regulatory examinations and will not assert any contractual, intellectual property, trade secret, or other right to limit, restrict, condition, or delay access by regulatory authorities to the Ridgeline platform, systems, data, or supporting documentation.
Recommendation. C&H recommends the inclusion of a comprehensive regulatory access covenant in any definitive agreement, drafted with specificity to address each of the above requirements.
H. Subcontracting and Personnel
The Ridgeline Term Sheet reserves to Ridgeline the right to use subcontractors for implementation and support services, without specifying any conditions on or limitations to this right.
C&H Recommendation. This provision requires significant tightening in any definitive agreement:
(a) Prior Written Consent. Ridgeline should be required to obtain BRB's prior written consent before engaging any subcontractor to perform services under the agreement. BRB should have the right to withhold consent in its reasonable discretion, and Ridgeline should be required to provide BRB with sufficient information about the proposed subcontractor to enable BRB to conduct appropriate due diligence.
(b) Subcontractor Standards. All subcontractors must be contractually bound by the same confidentiality, data security, regulatory compliance, and audit access obligations that apply to Ridgeline under the agreement. Ridgeline should remain fully responsible for the acts and omissions of its subcontractors.
(c) Named Key Personnel. Ridgeline should be required to identify and commit named key personnel for at least the implementation phase of the engagement, including: (i) a project lead with direct experience in financial services AML platform implementations; (ii) a technical architect responsible for system design and BaaS channel integration; and (iii) a data migration lead. Ridgeline should be required to obtain BRB's prior consent before replacing any named key personnel during the implementation phase, and replacement personnel must have qualifications and experience equivalent to or exceeding those of the original named personnel.
(d) Offshore/Nearshore Restrictions. BRB should consider whether to restrict the use of offshore or nearshore subcontractors for work involving access to BRB customer data, transaction data, or other sensitive information. Any such restrictions should be clearly stated in the definitive agreement.
V. Comparative Cost Analysis: Ridgeline vs. Veridian Upgrade
This section presents a detailed comparison of the total cost of ownership for the two technology paths under consideration, over a five-year horizon beginning in calendar year 2025.
A. Total Cost of Ownership — 5-Year Horizon
Veridian TMS v.10.0 Upgrade Path