ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
SAR BACKLOG TRIAGE PROTOCOL
Suspicious Activity Alert Backlog Dispositioning Framework
Prepared for: Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No.: 1045-00002
February 2025
This memorandum has been prepared by Calderwood & Harkness LLP at the direction of counsel for Belmont Ridge Bank National Association ("BRB") and is protected by the attorney-client privilege and the attorney work product doctrine. This document is intended solely for the use of the individuals identified on the distribution list below and should not be disclosed, distributed, or reproduced without the prior written consent of Calderwood & Harkness LLP. Any unauthorized dissemination may constitute a waiver of applicable privileges.
Authors:
Yuki Nakamura, Lead Associate, Litigation (General) Carlos Espinoza, Working Associate, Litigation (General)
Under the supervision of Philip Hartmann, Responsible Partner, Banking & Finance
Distribution:
Gregory Nardone, General Counsel, Belmont Ridge Bank NA Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA Derek Ballard, Head of Internal Audit, Belmont Ridge Bank NA
Right-click to update Table of Contents
Section 1: Executive Summary
This SAR Backlog Triage Protocol (the "Protocol") establishes a structured, risk-based prioritization framework for the triage and dispositioning of approximately 2,400 unreviewed suspicious activity monitoring alerts that have been identified as constituting a backlog within Belmont Ridge Bank National Association's ("BRB" or the "Bank") BSA/AML transaction monitoring program. The existence and magnitude of this backlog were identified during the Office of the Comptroller of the Currency's ("OCC") targeted BSA/AML examination, which was conducted from March 2024 through September 2024, and the backlog was subsequently cited as a core deficiency in OCC Consent Order No. OCC-2025-003, issued against BRB on January 15, 2025.
The Consent Order identified, among other deficiencies, that BRB's average SAR filing time was approximately 78 days from the date of alert generation, a figure substantially in excess of the regulatory expectation of timely filing — generally understood to require filing within 30 calendar days of the initial detection of facts that may constitute a basis for a suspicious activity report. This delay, combined with the sheer volume of unreviewed alerts, presents significant regulatory, legal, and reputational risk to the Bank. The OCC specifically characterized this deficiency as reflecting an unsafe or unsound banking practice and a violation of 12 C.F.R. Part 21, Subpart B, and the implementing regulations of the Bank Secrecy Act.
The purpose of this Protocol is to provide a comprehensive operational roadmap for the Bank's remediation team, external staffing resources, and legal advisors to systematically prioritize, investigate, and disposition each of the approximately 2,400 backlog alerts in a manner that is both risk-informed and consistent with the Bank's obligations under the Consent Order and applicable law. The Protocol is designed to ensure that the highest-risk alerts — including those with potential nexus to sanctions violations, terrorism financing, or large-dollar suspicious activity — receive immediate attention, while lower-risk alerts are addressed in an orderly and timely fashion.
The full backlog clearance target is June 30, 2025, as specified in the Bank's Comprehensive Remediation Action Plan submitted to the OCC. An interim SAR backlog status report is due to the OCC by March 31, 2025, and this Protocol is structured to ensure that meaningful progress — particularly with respect to the highest-priority alerts — will have been achieved and can be documented by that interim reporting date.
This Protocol integrates staffing from two principal sources. First, Pinnacle Compliance Solutions LLC ("Pinnacle") has been engaged to provide 30 temporary full-time equivalent ("FTE") analysts under a Managed Services Agreement (SOW Ref: PCS-BRB-2025-0012), at a cost of $10,000 per FTE per month, totaling $300,000 per month and $3,600,000 over the 12-month engagement period. Second, BRB's existing BSA/AML department, currently comprising 62 FTEs, will dedicate a subset of permanent analysts to the backlog clearance effort alongside their business-as-usual ("BAU") responsibilities. The Protocol establishes a clear assignment methodology that delineates the respective responsibilities of Pinnacle temporary analysts and BRB permanent staff, with particular attention to ensuring that the highest-risk alert categories are investigated and dispositioned exclusively by experienced BRB permanent personnel.
The total SAR lookback project budget, of which the backlog clearance component is a part, is approximately $5,500,000. This figure encompasses the backlog clearance effort, the broader retrospective review of previously dispositioned alerts and filed SARs, and associated costs for technology, legal counsel, and independent validation.
This Protocol constitutes Workstream 2 of the Bank's Comprehensive Remediation Action Plan (SAR Backlog Clearance & Process Improvement) and is designed to coordinate with the other remediation workstreams, including Workstream 1 (OFAC Sanctions Screening Remediation), Workstream 3 (CDD/EDD Remediation), Workstream 4 (Transaction Monitoring Model Validation), and Workstream 5 (Governance and Training). The Protocol also references the engagement of Thornfield Consulting Group LLC ("Thornfield"), the OCC-mandated independent consultant (engagement reference TCG-BRB-2025-001), which will independently validate backlog clearance quality as part of its comprehensive BSA/AML program assessment. Thornfield's validation will serve as a critical component of the Bank's demonstration of compliance to the OCC and FinCEN.
The stakes of this remediation effort cannot be overstated. FinCEN's Associate Director for the Enforcement Division, Angela Drummond, is monitoring BRB's SAR filing remediation and has expressly reserved enforcement rights pending assessment of the Bank's remediation progress. Failure to achieve the June 30, 2025 backlog clearance milestone, or failure to demonstrate the quality and rigor of the triage and investigation process, could result in further enforcement action, including civil money penalties, additional consent orders, or referral for criminal investigation.
Section 2: Background and Regulatory Context
2.1 OCC Consent Order Findings on SAR Filing Deficiencies
On January 15, 2025, the Office of the Comptroller of the Currency issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of a targeted BSA/AML examination conducted from March 2024 through September 2024, during which the OCC identified pervasive deficiencies in the Bank's Bank Secrecy Act and anti-money laundering compliance program.
Among the most significant findings was the OCC's determination that, as of the examination conclusion date of September 2024, BRB had approximately 2,400 potentially suspicious activity alerts that remained unreviewed in the Bank's transaction monitoring alert queue. These alerts had been generated by the Bank's transaction monitoring system over a period spanning approximately Q1 2024 through September 2024 and had not been subject to initial review, investigation, or disposition. The OCC characterized this backlog as reflecting a fundamental breakdown in the Bank's SAR monitoring and filing processes.
The Consent Order cited not only the volume of the unreviewed alert backlog but also significant concerns regarding the quality and timeliness of SAR filings that the Bank had completed. Specifically, the OCC found that BRB's average SAR filing time was approximately 78 days from the date of alert generation, a figure that far exceeds the regulatory expectation established under 31 C.F.R. § 1020.320(b)(3), which requires that a SAR be filed no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. The 78-day average represents a filing time approximately 2.6 times the regulatory standard and indicates systemic delays in the alert-to-SAR pipeline.
The deficiency is not a new finding for BRB. The OCC had previously issued a Matter Requiring Attention ("MRA") in June 2022 regarding deficiencies in BSA/AML transaction monitoring, including concerns about alert management capacity, staffing levels, and the timeliness of alert disposition. The Bank failed to adequately remediate the issues identified in that MRA, and the current backlog represents a material deterioration of the condition that the prior MRA sought to address. The Consent Order expressly references BRB's failure to remediate the June 2022 MRA as an aggravating factor in the OCC's determination that formal enforcement action was warranted.
Additionally, the Financial Crimes Enforcement Network ("FinCEN") is closely monitoring BRB's SAR filing remediation efforts. Angela Drummond, Associate Director of FinCEN's Enforcement Division, has communicated through the OCC examination team that FinCEN has reserved its independent enforcement rights with respect to the Bank's SAR filing deficiencies. This reservation of rights means that, notwithstanding BRB's compliance with the OCC Consent Order, FinCEN retains the authority to pursue its own enforcement action — including the assessment of civil money penalties under 31 U.S.C. § 5321 — if it determines that the Bank's remediation is insufficient or that the filing delays resulted in material harm to law enforcement or national security interests.
2.2 Current SAR Program Statistics
To contextualize the backlog and the demands of the triage process, the following statistics describe the current state of BRB's SAR program and transaction monitoring operations:
Filing Volume:
• Total Suspicious Activity Reports filed by BRB in calendar year 2024: 3,847
• Total Suspicious Activity Reports filed by BRB in calendar year 2023: 2,914
• Year-over-year increase in SAR filing volume: approximately 32.0% (an increase of 933 filings)
The significant year-over-year increase in SAR filing volume reflects both organic growth in the Bank's transaction base (particularly in BaaS channels) and, in part, belated efforts to address the growing alert backlog during the latter half of 2024.
Alert Generation Volume:
• Total transaction monitoring alerts generated by the Veridian TMS system in calendar year 2024: 41,500
• SAR conversion rate (SARs filed as a percentage of total alerts generated): approximately 9.3% (3,847 SARs ÷ 41,500 alerts)
This conversion rate is within the general range observed across comparably sized banking institutions with significant BaaS operations, though the rate may be artificially depressed if a meaningful number of alerts that should have resulted in SAR filings remain in the unreviewed backlog.
BaaS-Related Filing Activity:
• BaaS-related SARs filed in calendar year 2024: 2,108
• BaaS-related SARs as a percentage of all SARs filed: approximately 54.8% (2,108 ÷ 3,847)
The disproportionate contribution of BaaS channels to SAR filing activity is consistent with the elevated risk profile of the Bank's fintech partnership program and underscores the importance of BaaS-channel alerts within the backlog triage framework.
Currency Transaction Reports:
• CTRs filed in calendar year 2024: 28,612
Transaction Monitoring System:
• Current system: Veridian TMS v.8.3, provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044
• Last independent model validation: March 2021 (approximately four years ago)
• Last tuning parameter update: October 2022 (approximately 28 months ago)
The Veridian TMS system's lack of recent independent validation and tuning is a material contributing factor to both the alert backlog and the alert quality issues identified by the OCC. Outdated tuning parameters may result in both over-generation of low-quality alerts (contributing to the volume of the backlog) and under-detection of genuinely suspicious activity (raising concerns that some suspicious transactions may not have generated alerts at all). The transaction monitoring model validation and system upgrade (to Veridian TMS v.10.0) is addressed under Workstream 4 of the Remediation Action Plan, but the current state of the system directly affects the composition and quality of the alert backlog that is the subject of this Protocol.
2.3 Backlog Composition — Preliminary Analysis
Calderwood & Harkness, in coordination with BRB's BSA/AML department and Pinnacle Compliance Solutions, has conducted a preliminary analysis of the approximately 2,400 unreviewed alerts to inform the design of the triage methodology set forth in this Protocol. The following observations are based on that preliminary analysis, which is subject to refinement as the triage process proceeds.
Temporal Distribution:
The 2,400 unreviewed alerts span the period from approximately Q1 2024 through September 2024, representing approximately six to nine months of alert accumulation. The backlog is not evenly distributed across this period; preliminary data indicates a concentration of unreviewed alerts in the Q2 2024 and Q3 2024 time periods, corresponding with increased transaction volumes in BaaS channels and the departure of several senior BSA/AML analysts during that period.
Business Line Distribution:
The alerts originate from Veridian TMS v.8.3 transaction monitoring scenarios operating across all of BRB's business lines: retail banking, commercial lending, wealth management, and BaaS/fintech partnership channels. However, preliminary data indicates a disproportionate concentration of backlog alerts in BaaS channels, consistent with the overall BaaS-related SAR ratio (54.8% of CY 2024 SARs). Based on initial categorization, approximately 55–60% of the backlog alerts are attributable to BaaS-channel activity, with the remainder distributed across the Bank's traditional business lines.
Alert Type Distribution:
The backlog includes alerts generated by a range of transaction monitoring scenarios, including:
• Structuring — Patterns of transactions structured to avoid Currency Transaction Reporting thresholds or to evade other reporting obligations
• Rapid Movement of Funds — Accounts receiving and dispersing funds within a short timeframe, consistent with pass-through or layering activity
• Unusual Wire/ACH Activity — Wire transfers or Automated Clearing House transactions that are inconsistent with the customer's established profile or that involve high-risk counterparties
• High-Risk Geography Transactions — Transactions involving jurisdictions associated with elevated money laundering, terrorism financing, or sanctions risk, including FATF grey-listed and black-listed countries
• Dormant Account Activity — Reactivation of previously dormant accounts with sudden significant transactional activity
BaaS Partner Concentration:
Among the BaaS-channel alerts, preliminary data indicates that the top three BaaS partners by transaction volume account for the substantial majority of the backlog alert contribution:
• NovaPay Technologies Inc. — 41% of total BaaS transaction volume; $30.5 billion in transaction volume in CY 2024; NovaPay-channel alerts are of heightened concern given the identified OFAC sanctions screening gap affecting approximately 3,800,000 NovaPay transactions (12% of 31.7 million total NovaPay transactions in CY 2023)
• FairLend Digital LLC — 28% of BaaS transaction volume; $1.4 billion in loan originations in FY 2024
• VaultEdge Inc. — 18% of BaaS transaction volume; approximately 870,000 deposit accounts
The remaining 11 BaaS partners collectively account for approximately 13% of BaaS transaction volume. The concentration of alert volume among the top three partners will directly inform the BaaS Partner Association scoring within the triage methodology.
2.4 Key Deadlines
The following table summarizes the critical deadlines governing the backlog clearance effort:
These deadlines are non-negotiable milestones established by the Consent Order and the Bank's Comprehensive Remediation Action Plan. Failure to meet any of these deadlines may result in additional regulatory consequences, including the imposition of civil money penalties by the OCC or FinCEN, the appointment of additional independent monitors, or modification of the Consent Order to impose more restrictive requirements.
Section 3: Scope of Triage Protocol
3.1 Alerts In Scope
The scope of this Triage Protocol encompasses the following categories of alerts:
Primary Scope: All approximately 2,400 unreviewed suspicious activity monitoring alerts residing in BRB's transaction monitoring alert queue as of September 2024, the conclusion date of the OCC's targeted BSA/AML examination. These alerts were generated by the Veridian TMS v.8.3 system during the period from approximately Q1 2024 through September 2024 and were identified by the OCC as constituting the unreviewed backlog. Each of these alerts requires investigation and disposition under this Protocol, regardless of the ultimate determination as to whether a SAR filing is warranted.
Secondary Scope: Any additional alerts that were generated during the same period (Q1 2024 through September 2024) but were improperly closed or inadequately reviewed. During the course of the triage process, the quality review procedures set forth in Section 8 may identify instances in which alerts were ostensibly dispositioned during the relevant period but were, in fact, closed without adequate investigation, without proper documentation of the disposition rationale, or in a manner inconsistent with BRB's SAR policies and procedures. Such alerts will be recaptured into the triage process and assigned a priority category based on the same risk-scoring methodology applied to the primary backlog population.
Business Line Coverage: The Protocol applies to alerts across all of BRB's business lines, including retail banking, commercial lending, wealth management, and all 14 BaaS partner channels through which the Bank provides banking-as-a-service to fintech companies. No business line or partner channel is excluded from the scope of this Protocol.
3.2 Alerts Out of Scope
The following categories of alerts are expressly excluded from the scope of this Triage Protocol:
Post-September 2024 Alerts: Alerts generated after September 30, 2024, are outside the scope of this Protocol. These alerts are to be processed under BRB's current (and, as updated during the remediation, revised) business-as-usual SAR monitoring and filing procedures. The Bank's BAU operations must be maintained concurrently with the backlog clearance effort, and the assignment methodology set forth in Section 6 is designed to ensure that backlog clearance does not compromise the Bank's ability to process new alerts in a timely manner.
Previously Filed SARs Not Subject to Re-Review Under This Protocol: Alerts that were properly dispositioned prior to September 2024 and that resulted in SAR filings are not within the scope of this Triage Protocol. The quality and completeness of previously filed SARs are addressed through the broader SAR lookback project, which constitutes a separate component of Workstream 2 and is governed by its own methodology and scope document. If, during the course of the backlog triage, an analyst identifies a connection between a backlog alert and a previously filed SAR that appears to be deficient, the analyst should follow the escalation procedures set forth in Section 5 to ensure appropriate coordination between the backlog triage and the SAR lookback workstreams.
CTR Filing Issues: Deficiencies in Currency Transaction Report filing are the subject of a separate remediation workstream and are not addressed by this Protocol. However, analysts conducting backlog investigations should note any CTR filing irregularities observed in the course of their work and report them through standard channels.
3.3 Relationship to SAR Lookback Project
It is important to situate this Triage Protocol within the broader context of the SAR lookback project and the Bank's overall remediation program. The SAR lookback project, with a total budget of approximately $5,500,000, encompasses two principal components: (i) the backlog clearance effort governed by this Protocol, which addresses the approximately 2,400 unreviewed alerts; and (ii) a broader retrospective review of previously dispositioned alerts and filed SARs for quality, completeness, and compliance with FinCEN filing requirements.
This Triage Protocol governs only the first component — the prioritization and dispositioning of the unreviewed alert backlog. The broader retrospective review is governed by a separate lookback methodology document and involves a different scope of work, different sampling methodologies, and a different timeline.
However, the two components are interrelated. Findings from the backlog triage may trigger expansion of the lookback scope if systemic issues are identified. For example, if the triage process reveals that a particular transaction monitoring scenario consistently generated alerts that were not reviewed and that involve activity strongly indicative of suspicious conduct, it may be necessary to expand the lookback to examine whether similar alerts generated by the same scenario in prior periods were adequately dispositioned. Similarly, if the triage process identifies patterns suggesting that the Veridian TMS system's tuning parameters were materially miscalibrated during the backlog period, this finding could inform both the lookback scope and the transaction monitoring model validation effort under Workstream 4.
Any determination to expand the lookback scope based on backlog triage findings must be approved by Thomas Ikeda (BSA Officer), Patricia Langston (CCO), and Philip Hartmann (Calderwood & Harkness), and must be communicated to Thornfield Consulting Group for incorporation into its independent assessment.
Section 4: Risk-Ranking Criteria and Triage Categories
4.1 Risk-Ranking Methodology
The central feature of this Protocol is a quantitative, risk-based scoring methodology that assigns each of the approximately 2,400 backlog alerts a composite risk score. This composite score determines the alert's triage category (Priority 1 through Priority 4), which in turn governs the sequence, intensity, and staffing of the investigation and disposition process.
Each alert will be scored across four primary risk dimensions, each of which captures a distinct aspect of the risk presented by the alert:
1. Transaction Amount / Dollar Value — This dimension captures the aggregate dollar value of the transactions underlying the alert. Higher-dollar transactions present greater potential monetary harm and are more likely to warrant regulatory attention.
2. Customer Risk Rating — This dimension captures the customer's existing BSA/AML risk rating within BRB's systems (high, medium, or low), as well as whether the customer is among the approximately 47,000 high-risk accounts that have been identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. Customers with elevated risk ratings or inadequate CDD/EDD documentation present a higher probability that the alerted activity is genuinely suspicious.
3. Alert Type / Scenario — This dimension captures the specific transaction monitoring scenario that generated the alert. Different scenarios are associated with different underlying risk typologies, and some typologies (e.g., structuring, high-risk geography) are inherently higher-risk than others (e.g., peer comparison anomalies).
4. BaaS Partner Association — This dimension captures whether the alert involves a customer or transaction flowing through one of BRB's BaaS fintech partner channels, and if so, which partner. Given the identified compliance gaps in the BaaS program — including the OFAC screening gap affecting NovaPay transactions — BaaS-associated alerts receive elevated risk weighting.
The composite risk score is computed as a weighted aggregate of the four dimension scores, with the following weights:
• Transaction Amount: 25% weight
• Customer Risk Rating: 30% weight
• Alert Type / Scenario: 25% weight
• BaaS Partner Association: 20% weight
The weighting reflects the relative importance of each risk dimension in the context of BRB's specific risk profile and the concerns identified in the Consent Order. Customer Risk Rating receives the highest weighting (30%) because the adequacy of the Bank's knowledge of its customers is foundational to any assessment of whether transactional activity is consistent with expectations, and the identified CDD/EDD deficiencies affecting approximately 47,000 accounts represent a critical gap in the Bank's risk assessment capabilities. Transaction Amount and Alert Type each receive 25% weighting, reflecting their substantial but roughly equivalent contribution to overall alert risk. BaaS Partner Association receives 20% weighting, reflecting the significance of BaaS-channel risks while acknowledging that non-BaaS alerts may also present substantial risk.
4.2 Transaction Amount Scoring
The following scoring table assigns risk points based on the aggregate dollar value of transactions underlying the alert:
For the purpose of this scoring dimension, the "aggregate dollar value" is the total dollar amount of the transactions that triggered the alert, as captured in the Veridian TMS alert detail. Where the alert was generated based on a pattern of transactions over time (e.g., structuring alerts, velocity-based alerts), the aggregate across all related transactions during the alert period is used.
Additional Scoring Rules:
• For structuring alerts specifically, the analyst must aggregate across all related transactions during the alert period, including both the transactions that triggered the alert and any additional transactions during the same period that appear to be part of the same structured pattern. This aggregation may result in a higher dollar-value score than the initial alert detail suggests.
• Wire transfers and ACH transactions receive an additional weighting of +1 risk point if the transaction involves international counterparties (i.e., counterparty banks or beneficiaries located outside the United States). This additional point reflects the elevated risk associated with cross-border funds flows, particularly in the context of potential sanctions evasion or trade-based money laundering.
4.3 Customer Risk Rating Scoring
The following scoring table assigns risk points based on the customer's BSA/AML risk rating as maintained in BRB's customer information systems:
The assignment of 8 risk points to unrated or not-yet-risk-rated customers reflects the inherent uncertainty and potential elevated risk associated with customers for whom the Bank has not completed a risk assessment. An unrated customer is, by definition, a customer about whom the Bank lacks sufficient information to make a risk determination, and the absence of a risk rating may itself be indicative of CDD/EDD deficiencies.
Special Rules:
• Customers onboarded through BaaS partners who are among the approximately 47,000 accounts identified as lacking adequate CDD/EDD documentation receive an automatic high-risk classification for triage purposes, regardless of their system-assigned risk rating. This override is necessary because the system-assigned risk rating may be unreliable for these customers due to the very CDD/EDD deficiencies that are the subject of Workstream 3 remediation.
• Customers who carry a Politically Exposed Person ("PEP") designation, or who are subject to any other heightened-risk designation within BRB's systems (e.g., customers in high-risk industries, customers with prior SAR filings), receive an additional +2 bonus risk points on top of the points assigned based on their base risk rating. This bonus is additive and may result in a dimension score exceeding 10 for individual customers; however, the composite score calculation will cap this dimension's contribution at 10 × 0.30 = 3.0 for purposes of the overall composite.
4.4 Alert Type / Scenario Scoring
The following scoring table assigns risk points based on the transaction monitoring scenario that generated the alert:
The highest score (10) is assigned to High-Risk Geography alerts because of the direct potential nexus to OFAC sanctions compliance and the elevated regulatory scrutiny applied to transactions involving FATF grey-listed or black-listed jurisdictions. Structuring alerts receive the second-highest score (9) because structuring is a federal criminal offense under 31 U.S.C. § 5324 and is a high-priority enforcement concern for both FinCEN and the Department of Justice.
Automatic Escalation Override:
Alerts with a potential nexus to OFAC sanctions concerns are subject to automatic escalation to Priority 1 regardless of the composite score calculated under this scoring methodology. This override is triggered when an alert involves jurisdictions or counterparties that are potentially linked to OFAC-sanctioned parties, including but not limited to alerts arising from transactions that may have been among the approximately 3,800,000 NovaPay transactions (12% of 31.7 million total NovaPay transactions in CY 2023) identified in the OFAC sanctions screening gap analysis. The gravity of potential OFAC violations — which carry strict liability and significant penalties — warrants this categorical escalation regardless of the alert's composite score on other dimensions.
4.5 BaaS Partner Association Scoring
The following scoring table assigns risk points based on the alert's association with BRB's BaaS partner channels:
NovaPay receives the maximum score (10) due to its dominant transaction volume (41% of BaaS volume, representing $30.5 billion in CY 2024) and, critically, the identified OFAC sanctions screening gap that affects a substantial portion of NovaPay's historical transaction base. FairLend Digital (8 points) and VaultEdge (7 points) receive elevated but lower scores reflecting their significant transaction volumes and account bases, respectively, but the absence of the specific OFAC screening deficiency identified for NovaPay. The remaining 11 BaaS partners collectively receive 5 points, reflecting their relatively smaller contribution to transaction volume but recognizing the inherent elevated risk associated with the BaaS model. Non-BaaS alerts receive 2 points, reflecting the baseline risk present in all banking transactions but the relatively lower compliance-gap risk in the Bank's traditional direct-customer business lines.
4.6 Composite Score Calculation and Triage Categories
The composite risk score for each alert is calculated as follows:
Composite Score = (Transaction Amount Score × 0.25) + (Customer Risk Rating Score × 0.30) + (Alert Type Score × 0.25) + (BaaS Partner Score × 0.20)
The maximum possible composite score is:
(10 × 0.25) + (10 × 0.30) + (10 × 0.25) + (10 × 0.20) = 2.5 + 3.0 + 2.5 + 2.0 = 10.0
The minimum possible composite score, for the lowest-risk combination of attributes, would be:
(1 × 0.25) + (2 × 0.30) + (3 × 0.25) + (2 × 0.20) = 0.25 + 0.60 + 0.75 + 0.40 = 2.0
Based on the composite score, each alert is assigned to one of four triage categories:
Estimated Distribution:
Based on the preliminary data analysis described in Section 2.3, the estimated distribution of alerts across triage categories is as follows:
• Priority 1 (Critical): approximately 350–400 alerts
• Priority 2 (High): approximately 600–700 alerts
• Priority 3 (Medium): approximately 700–800 alerts
• Priority 4 (Standard): approximately 400–550 alerts
• Total: approximately 2,400 alerts
These estimates are preliminary and will be refined as the actual scoring process is completed during the first week of triage operations. The distribution may shift if the preliminary data analysis underestimates or overestimates the prevalence of certain risk factors within the backlog population. Any material deviation from the estimated distribution will be reported to Thomas Ikeda and Patricia Langston and factored into resource allocation and timeline planning.
Section 5: Escalation Thresholds and Mandatory Escalation Criteria
5.1 Automatic Escalation to Priority 1
Regardless of the composite risk score calculated under the methodology set forth in Section 4, the following categories of alerts are subject to automatic escalation to Priority 1 and must be investigated and dispositioned within the Priority 1 timeframe (within 30 days of triage initiation, by approximately March 15, 2025):
• OFAC-Sanctioned Jurisdiction Nexus: Any alert with a potential nexus to OFAC-sanctioned jurisdictions, entities, or individuals. This includes alerts involving transactions with counterparties located in comprehensively sanctioned countries (Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine, as well as other jurisdictions subject to targeted sanctions programs) or alerts in which OFAC screening during the investigation identifies potential matches to the Specially Designated Nationals and blocked Persons ("SDN") List or other OFAC sanctions lists.
• Terrorism Financing Indicators: Any alert involving suspected terrorism financing indicators, as defined by FinCEN guidance and BRB's terrorism financing typology matrix. This includes activity patterns associated with known terrorism financing methodologies, involvement of counterparties in jurisdictions with known terrorism financing risk, and any matches or potential matches to the Terrorist Exclusion List or other government-maintained terrorist watchlists.
• Large-Dollar Transactions: Any alert involving aggregate transaction value exceeding $1,000,000, regardless of other risk dimensions. The magnitude of potential monetary harm associated with transactions of this scale warrants Priority 1 treatment.
• Politically Exposed Persons: Any alert involving a customer who is a known PEP, as identified in BRB's customer records or through screening against PEP databases. The heightened corruption and money laundering risks associated with PEPs require immediate attention.
• Law Enforcement Connection: Any alert flagged in connection with a prior law enforcement inquiry, subpoena, grand jury request, or other governmental investigative demand. Alerts with a law enforcement nexus may involve active investigations, and delays in SAR filing could interfere with law enforcement objectives or expose the Bank to liability for obstruction or failure to cooperate.
• NovaPay OFAC Screening Gap: Any NovaPay-channel alert involving transactions that may have been among the approximately 3,800,000 unscreened transactions identified in the OFAC sanctions screening gap analysis. Given that these transactions were not subjected to OFAC screening at the time of processing, any suspicious activity alert generated in connection with such transactions must be treated as potentially involving sanctioned parties or jurisdictions until screening is confirmed and cleared.
5.2 Escalation to BSA Officer (Thomas Ikeda)
Thomas Ikeda, as BSA Officer and AML Program Director, serves as the senior operational escalation point for the backlog clearance effort. The following escalation requirements apply:
• Priority 1 Review and Approval: All Priority 1 alerts must be reviewed and approved by Thomas Ikeda (or his designated deputy, to be formally identified in writing prior to triage commencement) prior to final disposition. No Priority 1 alert may be closed — whether as a SAR filing or as a no-action determination — without Thomas Ikeda's express written approval in the case management system.
• Potential Criminal Activity: Any alert where the investigation reveals indicators of potential criminal activity — including but not limited to fraud, money laundering, structuring, terrorism financing, tax evasion, or corruption — must be escalated to Thomas Ikeda within 24 hours of the identification of such indicators, regardless of the alert's triage category. This escalation requirement is in addition to the analyst's obligation to document the criminal activity indicators in the investigation work papers.
• Insider Involvement: Any alert where the investigation reveals that the SAR filing may involve a BRB insider, director, officer, or employee must be escalated to Thomas Ikeda and Gregory Nardone (General Counsel) immediately upon identification. SAR filings involving insiders are subject to heightened confidentiality requirements under FinCEN regulations and may require accelerated filing (within 30 days of initial detection rather than the standard 30-day period, as applicable). These filings must be handled by a restricted group of authorized personnel to prevent tipping off the subject.
5.3 Escalation to Chief Compliance Officer (Patricia Langston)
Patricia Langston, as Chief Compliance Officer, is responsible for enterprise-level compliance oversight and serves as the escalation point for systemic and program-level findings:
• Systemic Patterns: Any patterns or clusters of related alerts that suggest systemic failures in the transaction monitoring program, customer onboarding processes, or BaaS partner oversight must be escalated to Patricia Langston. Examples include a pattern of similar alerts across multiple customers of the same BaaS partner suggesting a common control failure, or a cluster of alerts arising from a single transaction monitoring scenario that appears to be miscalibrated.
• Deficient Prior Filings: Any findings suggesting that previously filed SARs were materially deficient and require amendment must be escalated to Patricia Langston for assessment of the scope and nature of the deficiency. Such findings may also require coordination with the broader SAR lookback workstream and may need to be reported to the OCC and FinCEN.
5.4 Escalation to Calderwood & Harkness LLP
Certain categories of findings require escalation to Calderwood & Harkness LLP to ensure appropriate legal oversight, privilege protection, and coordination with the broader remediation strategy:
• Novel Legal Questions: Any alert disposition that raises novel legal questions — including questions regarding the application of SAR filing requirements to unusual fact patterns, the scope of the "safe harbor" provision under 31 U.S.C. § 5318(g)(3), or the intersection of SAR filing obligations with other legal requirements — should be escalated to Philip Hartmann or Yuki Nakamura at Calderwood & Harkness for legal analysis and guidance.
• Privilege Considerations: Any situation in which the investigation process may implicate attorney-client privilege or work product protections — for example, where an analyst's investigation touches on communications between BRB and its legal counsel regarding prior compliance decisions — must be escalated to Calderwood & Harkness to ensure that privilege is properly preserved.
• Remediation Strategy Implications: Any finding that may expand the scope of the SAR lookback project, trigger additional reporting obligations to the OCC or FinCEN beyond those currently contemplated, or otherwise affect the trajectory of the Bank's broader remediation program should be reported to Calderwood & Harkness promptly for strategic assessment.
• Potential FinCEN Enforcement Exposure: Given that Angela Drummond's Enforcement Division at FinCEN has reserved enforcement rights, any findings that could constitute independent bases for FinCEN enforcement action — such as patterns of willful SAR filing failures or evidence that the Bank was aware of filing obligations and consciously disregarded them — must be escalated to Calderwood & Harkness immediately for legal analysis and defensive strategy development.
Section 6: Assignment Methodology — Pinnacle Temporary Staff and BRB Permanent Analysts
6.1 Staffing Overview
The backlog clearance effort will be staffed through a combination of BRB's existing permanent BSA/AML personnel and temporary analysts provided by Pinnacle Compliance Solutions LLC under the Managed Services Agreement.
BRB Permanent BSA/AML Staff:
As of January 2025, BRB's BSA/AML department comprises 62 full-time equivalents. This figure includes all levels of personnel — from entry-level analysts to senior investigators, supervisors, and the management team reporting to Thomas Ikeda. A subset of these permanent staff will be dedicated to the backlog clearance effort on a rotating basis, while the remainder will continue to perform BAU transaction monitoring and alert review functions. The specific allocation between backlog and BAU responsibilities is addressed in Section 6.2 below.
Pinnacle Compliance Solutions LLC Temporary Staff:
Pursuant to the Managed Services Agreement between BRB and Pinnacle Compliance Solutions LLC, specifically Statement of Work Reference No. PCS-BRB-2025-0012, Pinnacle will provide 30 full-time equivalent temporary analysts dedicated to the backlog clearance effort. The engagement terms are as follows:
• Rate: $10,000 per FTE per month
• Monthly cost: $300,000 (30 FTEs × $10,000)
• Total engagement cost: $3,600,000 over the 12-month engagement period
• Engagement direction: All Pinnacle analysts operate under the oversight and direction of Andrea Solis, Director of Managed Services at Pinnacle, who in turn reports to Thomas Ikeda on all substantive work product matters
The Pinnacle engagement was structured to provide immediate surge capacity to address the backlog while BRB proceeds with longer-term permanent staffing increases.
Planned Internal Additions:
BRB has authorized the hiring of 15 additional permanent FTEs to augment the BSA/AML department, which will increase the department's permanent headcount from 62 to 77 upon full hiring. However, given the time required for recruitment, background screening, onboarding, and training, these new hires are not expected to be fully onboarded and productive in time to contribute significantly to the initial phases of the backlog clearance effort. As such, this Protocol does not rely on the additional 15 FTEs for resource planning purposes, though they may be incorporated into the later phases of the effort (particularly the Priority 3 and Priority 4 dispositioning tranches) if onboarding proceeds ahead of schedule.
6.2 Role Delineation
Clear delineation of roles and responsibilities between Pinnacle temporary analysts and BRB permanent staff is essential to maintaining the quality and defensibility of the backlog clearance process. The following role assignments govern the backlog triage:
Pinnacle Temporary Analysts (30 FTEs):
• Primary Responsibility: Initial alert review and investigation for Priority 3 and Priority 4 alerts. Pinnacle analysts will serve as the primary investigators for these lower-risk alert categories, performing the investigation steps specified in Section 7.1 for these categories.
• Support Role: Investigation assistance and data gathering for Priority 2 alerts, under the direct supervision of a BRB permanent analyst. In this support capacity, Pinnacle analysts may perform transaction-level data extraction, open-source research, and preliminary analysis, but the investigative conclusions and disposition decisions for Priority 2 alerts rest with the supervising BRB analyst.
• Restriction: Pinnacle analysts may not independently investigate or disposition Priority 1 or Priority 2 alerts. This restriction reflects the heightened risk associated with these alert categories and the need for experienced, permanent BRB personnel to exercise judgment on the most sensitive disposition decisions.
• SAR Narrative Drafting: Pinnacle analysts may draft SAR narratives for Priority 3 and Priority 4 alerts, subject to quality review by BRB permanent staff prior to finalization and filing. No SAR narrative drafted by a Pinnacle analyst may be filed without review and approval by a BRB permanent analyst.
• Quality Control Overlay: All Pinnacle analyst work product is subject to 100% quality review during the first 30 days of the engagement, transitioning to a risk-based sampling rate thereafter, as detailed in Section 8.
BRB Permanent Analysts (Dedicated Backlog Team):
• Dedicated Backlog Team: Approximately 15–20 BRB permanent analysts will be drawn from the 62-person department and assigned to the dedicated backlog clearance team on a rotating basis. The rotation schedule will be managed by Thomas Ikeda to ensure that BAU alert review coverage is maintained at all times and that no single analyst bears a disproportionate share of either backlog or BAU workload.
• Primary Responsibility: All Priority 1 and Priority 2 alert investigations and dispositions. BRB permanent analysts on the dedicated backlog team are responsible for conducting the full investigation specified in Section 7.1 for these high-risk categories and for making disposition recommendations.
• Quality Review Responsibility: BRB permanent analysts are responsible for performing quality review of Pinnacle analyst work product on Priority 3 and Priority 4 alerts, per the sampling rates and criteria set forth in Section 8. This quality review function is critical to ensuring consistency across the backlog clearance effort and identifying any patterns of error or deficiency in Pinnacle analyst performance.
• Final SAR Filing Authority: The authority to approve and file SARs with FinCEN rests exclusively with BRB permanent staff and ultimately with Thomas Ikeda as BSA Officer. Under no circumstances may a Pinnacle analyst independently authorize or submit a SAR filing.
6.3 Assignment Workflow
The following workflow governs the assignment of backlog alerts from intake through final disposition:
Step 1: Intake and Scoring. All approximately 2,400 backlog alerts will be loaded into a centralized triage tracking system, which will be configured within BRB's existing case management platform. For each alert, the system will capture the data fields necessary to calculate the composite risk score under the methodology set forth in Section 4, including: transaction amount, customer risk rating, CDD/EDD status, alert type/scenario, BaaS partner association, OFAC screening status, PEP status, and law enforcement nexus. Where data fields are incomplete or unavailable, the analyst responsible for the initial scoring will use the data sources available in the Veridian TMS and BRB's customer information system to populate the scoring fields, and any data gaps will be documented.
Step 2: Automated Prioritization. The triage tracking system will calculate the composite risk score for each alert and assign the alert to the appropriate triage category (Priority 1 through Priority 4) based on the score ranges defined in Section 4.6. The system will also flag any alerts meeting the automatic escalation criteria defined in Section 5.1, overriding the score-based categorization where applicable.
Step 3: Manual Override Review. BRB senior analysts will manually review the automated category assignments for the top 10% of alerts by composite score to confirm or adjust the categorization. This manual review serves as a quality check on the automated scoring process and provides an opportunity to identify any scoring anomalies or data quality issues that may have affected the automated assignment. Senior analysts may adjust a category assignment upward or downward by one level based on their professional judgment, with documentation of the rationale for any override.
Step 4: Assignment. Following scoring and categorization, alerts are assigned to individual analysts according to the following rules:
• Priority 1 alerts → Assigned to senior BRB permanent analysts with a minimum of five (5) years of AML investigation experience. Batches are limited to no more than 10 alerts per analyst at any given time to ensure thoroughness and attention to detail.
• Priority 2 alerts → Assigned to BRB permanent analysts with Pinnacle analyst support for data gathering and preliminary analysis. Batches are limited to no more than 15 alerts per analyst at any given time.
• Priority 3 alerts → Assigned to Pinnacle analysts operating under BRB analyst supervision. Batches are limited to no more than 20 alerts per analyst at any given time.