PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / WORK PRODUCT DOCTRINE
MEMORANDUM
TO:
Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
FROM:
Philip Hartmann, Responsible Partner, Calderwood & Harkness LLP
Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP
Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
DATE: March 10, 2025
RE: SAR Lookback Project — Scope, Methodology, and Documentation Requirements (C&H Matter No. 1045-00002)
CC:
Melissa Chu, Chief Risk Officer, Belmont Ridge Bank National Association
Derek Ballard, Head of Internal Audit, Belmont Ridge Bank National Association
Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank National Association
I. EXECUTIVE SUMMARY
This memorandum defines the scope, methodology, timeline, and documentation standards for a comprehensive Suspicious Activity Report ("SAR") lookback project (the "Lookback" or "Lookback Project") to be conducted by and on behalf of Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The Lookback Project is mandated in connection with Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025, against the Bank (the "Consent Order"). The SAR Lookback constitutes a critical workstream within BRB's broader Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance-program remediation effort, and has been allocated a dedicated budget of $5,500,000.
The Lookback Project is designed to address two core deficiencies identified by the OCC during its targeted BSA/AML examination, which was conducted from March 2024 through September 2024. First, the OCC identified a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the September 2024 examination date. Second, the OCC identified systemic SAR filing quality and timeliness deficiencies, with the average filing time measured at 78 days from alert generation — far exceeding the regulatory expectation that SARs be filed in a timely manner, typically within 30 days of detection.
The scope of the Lookback Project encompasses both BRB's traditional retail banking channels and all 14 of BRB's active Banking-as-a-Service ("BaaS") fintech partner channels. Particular focus will be directed to BaaS-related activity, which accounted for 2,108 of 3,847 total SARs filed in calendar year 2024 (approximately 54.8% of all SARs). Given the significant volume and complexity of BaaS-originated transactions and the specific compliance deficiencies identified in certain BaaS partner channels, BaaS activity represents the most concentrated area of risk within the Lookback population.
The Lookback will be supported operationally by Pinnacle Compliance Solutions LLC ("Pinnacle"), which will provide 30 temporary full-time-equivalent ("FTE") BSA/AML analysts under a managed services engagement. The project will be overseen internally by Thomas Ikeda, BRB's BSA Officer and AML Program Director, with legal direction and oversight from Calderwood & Harkness LLP ("C&H"). Independent assessment and validation of the Lookback methodology and outcomes will be performed by Thornfield Consulting Group LLC ("Thornfield") (Dr. Vivian Castellano, engagement lead; engagement reference TCG-BRB-2025-001).
The following key deadlines govern the Lookback Project's execution:
• March 31, 2025: Interim SAR Backlog Status Report to the OCC, reporting progress on the disposition of the 2,400-alert backlog.
• June 30, 2025: SAR backlog clearance target — 100% of the 2,400 unreviewed alerts fully dispositioned with SAR filings or documented closures.
• May 15, 2025: Comprehensive Remediation Action Plan due to the OCC, incorporating the Lookback methodology and preliminary results.
• February 15, 2026: Overall compliance implementation deadline; Thornfield final validation report; compliance self-certification to the OCC.
This memorandum is prepared by Calderwood & Harkness LLP at the direction of BRB's General Counsel and is protected by the attorney-client privilege and the work-product doctrine. It is prepared in anticipation of continued regulatory proceedings and potential enforcement actions, and should be treated accordingly.
II. BACKGROUND AND REGULATORY CONTEXT
A. Consent Order Findings Related to SAR Filing
OCC Consent Order No. OCC-2025-003, effective January 15, 2025, identified significant deficiencies in BRB's suspicious activity monitoring and reporting program. The Consent Order was issued following the OCC's targeted BSA/AML examination of BRB, which commenced in March 2024 and concluded in September 2024. The examination focused on BRB's overall BSA/AML compliance infrastructure, with particular emphasis on the Bank's transaction monitoring program, SAR filing practices, OFAC sanctions screening controls, and customer due diligence and enhanced due diligence ("CDD/EDD") procedures — particularly as they relate to BRB's rapidly growing BaaS business line.
The Consent Order's key findings relating to SAR filing include the following:
First, the OCC identified a backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024. These alerts had been generated by BRB's transaction monitoring system but had not been subjected to investigation or dispositioning. The existence of this backlog indicates that potentially suspicious transactions were not being reviewed or reported within any reasonable timeframe, exposing the Bank to the risk that reportable activity was neither detected nor disclosed to the Financial Crimes Enforcement Network ("FinCEN") as required by the Bank Secrecy Act and its implementing regulations.
Second, the OCC found that BRB's average SAR filing time was approximately 78 days from the date of alert generation — substantially exceeding the regulatory expectation that SARs be filed within 30 days of the initial detection of facts that may constitute a basis for filing, as contemplated by 31 C.F.R. § 1020.320(b)(3). This pervasive delay in filing indicates systemic resource constraints, workflow inefficiencies, and inadequate supervisory oversight within BRB's BSA/AML department during the examination period.
Third, the OCC identified quality deficiencies in SAR narratives and supporting documentation. Examiners noted that numerous SAR filings lacked sufficient detail regarding the nature of the suspicious activity, failed to adequately describe the transactional patterns at issue, and in certain cases contained inaccurate or incomplete subject information. These quality deficiencies undermine the utility of SAR filings to law enforcement and FinCEN and reflect a broader failure in BRB's SAR preparation and quality-review processes.
For contextual perspective, BRB filed a total of 3,847 SARs in calendar year 2024, an increase from 2,914 SARs in calendar year 2023. The Bank also filed 28,612 Currency Transaction Reports ("CTRs") in calendar year 2024. During the same period, BRB's transaction monitoring system — the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 (the "Veridian TMS v.8.3"), under Contract No. VA-BRB-2023-0044 — generated approximately 41,500 alerts. This yields a SAR conversion rate of approximately 9.3% (3,847 SARs ÷ 41,500 alerts), a metric that will be subject to further analysis during the Lookback to assess whether the conversion rate reflects appropriate alert disposition practices or, conversely, whether alerts were being systematically closed without adequate investigation.
B. Escalation of Prior Supervisory Findings
The Consent Order did not arise in a supervisory vacuum. BRB has been the subject of escalating supervisory attention regarding its BSA/AML program for approximately three years:
In June 2022, the OCC issued a Matter Requiring Attention ("MRA") regarding deficiencies in BRB's BSA/AML transaction monitoring program. The MRA identified concerns with the calibration of monitoring rules, the timeliness of alert investigation, and the adequacy of staffing levels within the BSA/AML department. BRB acknowledged the MRA and represented to the OCC that corrective measures would be implemented.
In November 2023, the OCC escalated its supervisory concerns by issuing a Matter Requiring Immediate Attention ("MRIA") regarding gaps in BRB's OFAC sanctions screening processes. The MRIA was prompted by the OCC's finding that certain transaction flows associated with BaaS partner channels — most notably NovaPay Technologies Inc. — were not being subjected to OFAC screening. This represented a significant compliance failure with direct implications for sanctions enforcement and national security.
The Consent Order expressly cites BRB's failure to adequately remediate these prior supervisory actions as a basis for the escalation from informal supervisory measures (MRA and MRIA) to formal enforcement action. The OCC specifically noted that the BSA/AML deficiencies identified in the June 2022 MRA had not been fully corrected and that the OFAC screening gaps identified in the November 2023 MRIA persisted during the March–September 2024 examination. This pattern of inadequate remediation was a significant aggravating factor in the OCC's decision to pursue a formal Consent Order and civil money penalty.
BRB's prior outside counsel, Drayton Mercer LLP (Helen Frazier, lead partner), represented the Bank during the 2023–2024 OCC examination cycle. That engagement was terminated in January 2025 following issuance of the Consent Order, and Calderwood & Harkness LLP was retained as replacement regulatory counsel on February 10, 2025.
C. Independent Testing Findings
Caldera & Pope LLP ("Caldera & Pope"), BRB's external auditor and contracted independent BSA/AML testing firm, serves as the Bank's independent testing provider under the regulatory framework set forth in the Federal Financial Institutions Examination Council's ("FFIEC") BSA/AML Examination Manual. The most recent independent BSA/AML test was completed by Caldera & Pope (Franklin Dorsey, Engagement Partner) in September 2024.
The Caldera & Pope testing engagement identified multiple SAR-related deficiencies that were subsequently echoed — and amplified — in the OCC Consent Order. Specifically, Caldera & Pope's findings included: the existence of the alert backlog, untimely SAR filing patterns, narrative quality concerns, and inadequate quality-control mechanisms within the SAR filing workflow. The alignment between Caldera & Pope's independent testing findings and the OCC's examination conclusions underscores the pervasive and well-documented nature of the deficiencies at issue. BRB's BSA/AML independent testing fee for 2024 was $1,100,000.
D. FinCEN Parallel Monitoring
The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. Angela Drummond, Associate Director of FinCEN's Enforcement Division, has been in communication with the OCC regarding BRB's compliance deficiencies. As of the date of this memorandum, no separate FinCEN enforcement action has been filed against BRB. However, FinCEN has explicitly reserved its enforcement rights in coordination with the OCC, and the quality and completeness of the SAR Lookback Project will be a critical factor in mitigating the risk of a separate FinCEN enforcement action, which could include additional civil money penalties.
FinCEN's parallel interest in this matter elevates the importance of the Lookback Project beyond the immediate requirements of the Consent Order. The Lookback must be conducted with sufficient rigor, documentation, and transparency to demonstrate to both the OCC and FinCEN that BRB has undertaken a thorough, comprehensive, and good-faith effort to identify and report all previously unreported suspicious activity and to remediate all material deficiencies in previously filed SARs.
E. Civil Money Penalty
The OCC assessed a civil money penalty of $14,500,000 against BRB under the Consent Order, payable within 60 days of the effective date (i.e., due by March 16, 2025). SAR filing deficiencies were among the contributing factors specifically cited in the OCC's penalty assessment, alongside the OFAC screening gaps and CDD/EDD deficiencies. The magnitude of the penalty reflects the severity and duration of the compliance deficiencies, the prior supervisory history, and BRB's failure to remediate previously identified issues in a timely manner.
The penalty, combined with the remediation costs and ongoing regulatory oversight requirements, underscores the substantial financial and reputational consequences of the compliance failures that the Lookback Project is designed to address.
III. LOOKBACK OBJECTIVES
The SAR Lookback Project is organized around five core objectives, each of which is essential to satisfying the requirements of the Consent Order and mitigating the risk of further enforcement actions by the OCC and FinCEN:
Objective 1: Disposition of Unreviewed Alert Backlog. The first and most time-critical objective is to disposition the 2,400 unreviewed suspicious activity alerts identified as of September 2024. Each alert in the backlog must be subjected to a complete review and investigation, with a resulting determination of whether a SAR filing is warranted or whether closure with a fully documented rationale is appropriate. This objective must be completed by June 30, 2025, with an interim milestone of 75% completion (approximately 1,800 alerts) by April 30, 2025.
Objective 2: Retrospective Review of Historical Alert Dispositions and SAR Filings. The second objective is to conduct a retrospective review of previously filed SARs and previously closed (unfiled) alerts during the Lookback period. This review is designed to identify three categories of deficiency: (a) suspicious activity that should have resulted in a SAR filing but did not, representing "false negatives" in the alert disposition process; (b) previously filed SARs with materially deficient narratives or supporting documentation that require amendment or correction; and (c) patterns of suspicious activity that were not captured by the existing transaction monitoring model, representing gaps in detection capability.
Objective 3: Identification of Systemic Transaction Monitoring Gaps. The third objective is to identify systemic gaps in BRB's transaction monitoring rules, thresholds, and alert disposition processes that contributed to the backlog and filing deficiencies documented in the Consent Order. Findings from the Lookback will directly inform the tuning and upgrade of the Veridian TMS to version 10.0, which constitutes Workstream 4 of the broader remediation program. This objective ensures that the Lookback serves not only a backward-looking remedial function but also a forward-looking preventive function.
Objective 4: Regulatory Demonstration of Thoroughness. The fourth objective is to produce sufficient documentation and work product to satisfy the OCC and FinCEN that BRB has conducted a thorough and good-faith lookback. The Lookback documentation will support the Comprehensive Remediation Action Plan (due to the OCC by May 15, 2025) and the compliance self-certification that BRB must submit to the OCC by February 15, 2026. Meeting this objective requires meticulous recordkeeping, defensible sampling methodologies, and transparent reporting of findings — including adverse findings.
Objective 5: Prospective SAR Filing Compliance. The fifth objective is to ensure that all SAR filings resulting from the Lookback comply with FinCEN's SAR filing requirements under 31 C.F.R. § 1020.320, including the 30-day timeliness standard. This objective applies both to new SARs identified through the Lookback and to amended or corrected filings for previously filed SARs. Going forward, the processes and standards established during the Lookback will serve as a foundation for BRB's steady-state SAR filing operations.
IV. LOOKBACK PERIOD
A. Primary Lookback Period
The primary lookback period is January 1, 2022 through December 31, 2024 — a span of 36 months encompassing three full calendar years.
The selection of January 1, 2022 as the starting date for the primary lookback period is grounded in several considerations. The June 2022 MRA represents the earliest formal supervisory finding identifying deficiencies in BRB's transaction monitoring program. By commencing the lookback from the beginning of the calendar year in which systemic deficiencies were first formally noted, the project captures the full temporal scope of potentially compromised monitoring and reporting activity. Beginning on January 1 of a calendar year, rather than on the date of the MRA itself, provides a clean and defensible boundary that encompasses any activity occurring during the period immediately preceding the supervisory finding.
The primary lookback period also encompasses several critical operational milestones and conditions that bear directly on the integrity of BRB's BSA/AML program during the period under review:
(a) The full period during which the Veridian TMS v.8.3 was in use without independent model validation. The most recent independent model validation of the Veridian TMS was completed in March 2021, meaning the system has operated for nearly four years without a validated assessment of its detection effectiveness. This extended period without validation raises significant questions about the system's ability to detect suspicious activity during the lookback period.
(b) The full period since the last tuning of TMS monitoring parameters, which was completed in October 2022. The absence of parameter tuning for over two years means that the monitoring rules in effect during the lookback period may not have been calibrated to reflect changes in BRB's customer base, transaction patterns, product offerings, or risk environment — particularly the rapid expansion of the BaaS business line.
(c) The full period of BaaS partner onboarding for BRB's three largest fintech partners by transaction volume: NovaPay Technologies Inc. (onboarded 2021), FairLend Digital LLC (onboarded 2022), and VaultEdge Inc. (onboarded 2023). The introduction of each new BaaS partner significantly altered BRB's transaction profile and risk exposure, and the lookback period captures all activity associated with these partner relationships during the relevant timeframe.
B. Extended Lookback Scope
For customer populations identified as presenting heightened risk, the lookback period may be extended back to January 1, 2021 at the discretion of the BSA Officer (Thomas Ikeda) in consultation with Calderwood & Harkness. Populations that may warrant extended lookback treatment include, but are not limited to:
(a) Customers associated with the OFAC screening gap at NovaPay Technologies Inc. NovaPay was onboarded as a BaaS partner in 2021 and represented the most significant source of the OFAC screening gap identified in the November 2023 MRIA. Approximately 3,800,000 NovaPay transactions in calendar year 2023 were not subjected to OFAC sanctions screening, out of approximately 31,700,000 total NovaPay transactions in that year — representing an unscreened rate of approximately 12.0%. Extending the lookback to January 1, 2021 would capture the full NovaPay relationship from inception, permitting a comprehensive assessment of any suspicious or sanctions-related activity that may have occurred during the period before screening controls were in place.
(b) High-risk BaaS-onboarded accounts among the approximately 47,000 accounts identified as lacking adequate CDD/EDD documentation. Because these accounts were onboarded without sufficient due diligence, the risk profile of these customers is uncertain, and a longer lookback period may be necessary to identify patterns of suspicious activity that would have been detectable had proper due diligence been conducted.
The decision to extend the lookback for any particular population will be documented in a supplemental memorandum setting forth the specific rationale, the affected customer population, and the additional data extraction requirements. Any such extension will be communicated to Thornfield Consulting for incorporation into its validation framework.
C. Lookback Period Data Volume Estimates
The following estimates are provided to contextualize the scale of the Lookback Project and to support resource planning and sampling design:
Total transaction monitoring alerts generated during the primary lookback period (CY 2022–CY 2024): Approximately 110,000 to 120,000 alerts. This estimate is based on the known CY 2024 alert volume of 41,500 and estimated lower volumes in prior years, reflecting the progressive growth in BRB's transaction volumes and monitoring system alert generation rates over the three-year period.
Total SARs filed during the lookback period: Approximately 9,500 to 10,000 SARs. This estimate comprises 3,847 SARs filed in CY 2024, 2,914 SARs filed in CY 2023, and an estimated 2,700 to 3,200 SARs filed in CY 2022 (based on available internal data and filing trends).
BaaS share of SAR filings: BaaS-related SARs represent a growing share of total filings, consistent with the growth of BRB's BaaS business line. In CY 2024, 2,108 of 3,847 SARs (54.8%) were associated with BaaS partner channels. The BaaS share in CY 2022 and CY 2023 is estimated to have been lower but still substantial, and precise figures will be confirmed during the data extraction phase.
These volume estimates are preliminary and subject to refinement as data extraction proceeds. Final population counts will be documented in the Population Definition Workpapers and shared with Thornfield Consulting for validation of sampling parameters.
V. SCOPE OF REVIEW
The Lookback Project encompasses four distinct review populations, each with its own review methodology, completion criteria, and documentation requirements. In addition, the Lookback applies across all BRB business lines and channels. The scope of each population and the applicable channel coverage are detailed below.
A. Population 1: Unreviewed Alert Backlog (2,400 Alerts)
Population 1 consists of the approximately 2,400 suspicious activity alerts that were generated by the Veridian TMS v.8.3 but remained unreviewed and undispositioned as of the September 2024 OCC examination date. This population represents the most acute and time-sensitive component of the Lookback Project.
The Lookback will conduct a 100% review of all 2,400 unreviewed alerts. No sampling is applicable to this population; every alert must be fully investigated and dispositioned. For each alert, the assigned analyst will conduct a comprehensive investigation, including review of the underlying transactions, the customer's account history and risk profile, applicable BaaS partner data (where relevant), open-source research, and any other available information bearing on the alert.
Upon completion of the investigation, the analyst will make an initial determination of whether a SAR filing is warranted or whether closure of the alert without filing is appropriate. For alerts resulting in SAR filings, the SAR must be prepared and filed within 30 days of the Lookback investigation team's determination that a filing is warranted. For alerts resulting in closure, a closure memorandum documenting the investigative analysis and the specific rationale for the decision not to file must be prepared and retained in the alert investigation file. All dispositions are subject to the two-level review process described in Section VII.C below.
The target completion dates for Population 1 are 75% disposition (approximately 1,800 alerts) by April 30, 2025, and 100% disposition by June 30, 2025.
B. Population 2: Previously Closed Alerts — Re-Review Sample
Population 2 consists of a statistically significant sample of alerts that were reviewed and closed without a SAR filing during the primary lookback period (CY 2022–2024). The total estimated population of closed alerts during this period is approximately 95,000 to 105,000, derived from the total alert volume (approximately 110,000–120,000) minus the number of SARs filed (approximately 9,500–10,000) and minus the 2,400 alerts in the unreviewed backlog.
The purpose of the Population 2 re-review is to identify cases in which alerts were improperly closed and a SAR filing should have been made — that is, to detect and quantify the "false negative" rate in BRB's alert disposition process during the lookback period. The detailed sampling methodology for Population 2 is set forth in Section VI.A below.
The Population 2 re-review will apply particular focus to the following categories of closed alerts, which are assessed to present elevated risk of improper closure:
(i) Alerts associated with BaaS partner transaction flows across all 14 active partners, with priority assigned to NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. based on their disproportionate share of transaction volume and SAR activity;
(ii) Alerts associated with high-risk customer segments, including politically exposed persons ("PEPs"), money services businesses ("MSBs"), cash-intensive businesses, and foreign correspondent accounts;
(iii) Alerts generated by transaction monitoring scenarios that were specifically the subject of the June 2022 MRA, as these scenarios were identified as inadequately calibrated or staffed; and
(iv) Alerts associated with the 47,000 high-risk customer accounts identified as lacking adequate CDD/EDD documentation.
C. Population 3: Previously Filed SARs — Quality Review Sample
Population 3 consists of a statistically significant sample of SARs filed during the lookback period (CY 2022–2024), drawn from the total estimated population of approximately 9,500 to 10,000 SAR filings. The purpose of this review is to assess the quality, accuracy, and completeness of previously filed SARs and to identify filings with materially deficient narratives, incomplete supporting documentation, or inaccurate reporting that may require the submission of amended or corrected filings.
The detailed sampling methodology for Population 3 is set forth in Section VI.B below. Priority review will be directed to:
(i) SARs filed more than 60 days after alert generation, given the OCC's finding that the average filing time was 78 days. These late-filed SARs are assessed to present a higher risk of quality deficiencies, as the extended elapsed time between alert generation and filing may have resulted in loss of investigative context, staleness of information, or compressed preparation timelines;
(ii) SARs associated with BaaS partner activity, which accounted for 54.8% of all SARs filed in CY 2024 and which present unique complexity due to the involvement of third-party fintech platforms, indirect customer relationships, and multi-party transaction flows.
For SARs identified as requiring amendment or correction, the amended filings will be prepared and submitted in accordance with the standards set forth in Section VIII below.
D. Population 4: Transaction Activity Not Subject to Alert Generation
Population 4 consists of a targeted review of transaction activity during the lookback period that may not have generated alerts due to known gaps in the Veridian TMS v.8.3 model. Unlike Populations 1 through 3, which are derived from the TMS alert population, Population 4 addresses the risk that suspicious activity occurred outside the detection perimeter of the existing monitoring system.
The specific categories of transaction activity within Population 4 include:
(i) Unscreened NovaPay transactions. Approximately 3,800,000 transactions processed through the NovaPay BaaS channel in CY 2023 were not subjected to OFAC sanctions screening. These transactions will be subjected to retrospective sanctions screening against current and historically applicable sanctions lists. A stratified random sample (approximately 5%–10%) of these unscreened transactions will also be analyzed for indicators of suspicious activity warranting SAR filing.
(ii) Transaction types or scenarios not covered by existing monitoring rules. During the OCC examination, examiners identified certain transaction types and behavioral patterns that were not addressed by the Veridian TMS v.8.3 monitoring rules. The Lookback will identify and analyze a targeted set of transactions falling within these uncovered categories, using supplemental data extraction and rules-based testing.
(iii) Activity associated with high-risk accounts lacking CDD/EDD. Approximately 47,000 customer accounts were identified as lacking adequate CDD/EDD documentation. A risk-prioritized sample of these accounts will have their full transaction history during the lookback period analyzed for suspicious activity patterns that may not have been flagged by the TMS due to incomplete customer risk profiles.
This population will be analyzed using supplemental data extraction and rules-based testing conducted outside of the existing TMS. The data extraction and analytical framework will be developed in coordination with Veridian Analytics (Priya Subramanian, VP of Client Solutions) and BRB's Chief Information Officer / Chief Technology Officer (Linda Petrosian).
E. Channel Coverage
The Lookback covers all BRB business lines and channels without exception. The Bank's operations and the corresponding channel-level scope are as follows:
Retail Banking. The Lookback encompasses all branch-originated and online banking transactions, including consumer deposit accounts, personal lending products, and digital banking channels. Retail banking represents BRB's legacy business and the largest share of its traditional customer base.
Commercial Lending. Commercial loan origination and servicing activity is within scope, including commercial real estate loans, lines of credit, Small Business Administration ("SBA") lending, and equipment financing. Transaction activity associated with commercial lending customers — including deposit account activity — will be subject to review within the applicable Lookback populations.
Wealth Management. Client transactions and account activity within BRB's wealth management division are within scope, including investment account transactions, trust and fiduciary activity, and high-net-worth customer accounts.
BaaS / Fintech Partnerships. All 14 active fintech partners are within scope, with priority assigned to the top three partners by transaction volume:
• NovaPay Technologies Inc. — 41% of BaaS transaction volume; approximately $30.5 billion in transaction volume in CY 2024; CEO: Ethan Garrison; principal office: 450 Mission Street, Suite 1200, San Francisco, CA 94105. NovaPay is the single largest contributor to BRB's BaaS transaction volume and the primary source of the OFAC screening gap identified in the November 2023 MRIA.
• FairLend Digital LLC — 28% of BaaS transaction volume; approximately $1.4 billion in loan originations through BRB in FY 2024; CEO: Aisha Okonkwo; principal office: 100 Summer Street, Suite 800, Boston, MA 02110. FairLend operates as a digital lending platform utilizing BRB's charter for consumer and small business lending.
• VaultEdge Inc. — 18% of BaaS transaction volume; approximately 870,000 deposit accounts maintained through BRB; CEO: Marcus Tan; principal office: 2200 Ross Avenue, Suite 3600, Dallas, TX 75201. VaultEdge operates primarily as a neobank platform offering FDIC-insured deposit accounts through BRB.
• Remaining 11 BaaS Partners — Collectively represent 13% of BaaS transaction volume. These partners span a range of fintech verticals, including payments, payroll services, and specialty lending.
Total BaaS transaction volume in CY 2024 was approximately $74.3 billion, generating BaaS-related revenue to BRB of approximately $127.4 million. The rapid growth and scale of the BaaS business line, combined with the compliance deficiencies identified in this channel, necessitate the heightened focus assigned to BaaS-related activity throughout the Lookback.
VI. SAMPLING METHODOLOGY
A. Sampling Framework for Population 2 (Closed Alerts Re-Review)
Statistical Basis. The sampling framework for the Population 2 re-review of previously closed alerts employs stratified random sampling designed to achieve a confidence level of 95% with a margin of error of ±3%. These parameters are selected to provide a high degree of statistical rigor and defensibility, consistent with regulatory expectations for lookback exercises of this nature and scope.
Stratification Variables. The sample will be stratified along the following dimensions to ensure representative coverage and to facilitate identification of deficiency patterns across different segments of the closed alert population:
(i) Channel: Retail banking versus BaaS, with BaaS further broken down by partner for the top three partners (NovaPay, FairLend Digital, and VaultEdge) and aggregated for the remaining 11 partners;
(ii) Alert type / monitoring scenario: Alerts will be grouped by the TMS rule or scenario that generated the alert (e.g., structuring, rapid movement of funds, high-risk geography, unusual transaction patterns, peer-group outlier), enabling analysis of whether certain monitoring scenarios exhibited higher rates of improper closure;
(iii) Calendar year: Separate strata for CY 2022, CY 2023, and CY 2024, to identify temporal trends in disposition quality;
(iv) Customer risk rating: Stratified by the customer's risk rating at the time of alert generation (e.g., low, moderate, high, or not rated), with particular attention to customers rated high-risk or for whom risk ratings were absent;
(v) Transaction dollar amount tier: Alerts stratified by the aggregate dollar value of the transactions underlying the alert, using tiers to be defined during the data extraction phase but expected to include tiers such as $5,000–$25,000, $25,001–$100,000, $100,001–$500,000, and above $500,000.
Estimated Total Population. The total population of closed alerts during the primary lookback period (CY 2022–2024) is estimated at approximately 95,000 to 105,000. This estimate is derived by subtracting the estimated number of SAR filings (approximately 9,500–10,000) and the 2,400 unreviewed backlog alerts from the estimated total alert volume (approximately 110,000–120,000). Final population counts will be confirmed during the data extraction phase and documented in the Population Definition Workpapers.
Estimated Sample Size. Based on the applicable confidence level, margin of error, and anticipated stratification distribution, the estimated sample size for Population 2 is approximately 3,500 to 4,500 closed alerts. The final sample size will be determined upon completion of the data extraction and population validation process.
Oversampling. BaaS-related closed alerts will be oversampled at a rate of 1.5× to 2.0× the proportional representation rate. This oversampling is warranted by the disproportionate share of SAR activity originating from BaaS channels, the specific compliance gaps identified in BaaS partner operations, and the heightened regulatory focus on BaaS-related risk. The oversampling rate will be finalized in consultation with Thornfield Consulting based on the actual distribution of BaaS-related alerts within the total population.
B. Sampling Framework for Population 3 (Filed SAR Quality Review)
Statistical Basis. The sampling framework for the Population 3 quality review of previously filed SARs employs stratified random sampling designed to achieve a confidence level of 95% with a margin of error of ±5%. The slightly wider margin of error relative to Population 2 reflects the different nature of the review (quality assessment of completed filings, as opposed to de novo disposition review) and the generally lower expected deficiency rate.
Stratification Variables. The Population 3 sample will be stratified along the following dimensions:
(i) Filing timeliness: SARs grouped by the elapsed time between alert generation and SAR filing — specifically, ≤30 days, 31–60 days, 61–90 days, and >90 days. This stratification variable is directly responsive to the OCC's finding regarding the 78-day average filing time and will enable assessment of whether filing delays are correlated with narrative quality deficiencies;
(ii) Channel: Retail banking versus BaaS, with the same sub-stratification by BaaS partner as described for Population 2;
(iii) SAR type / activity category: SARs grouped by the type of suspicious activity reported (e.g., structuring, money laundering, terrorist financing, fraud, identity theft, other), to enable analysis of quality trends by activity type;
(iv) Calendar year: Separate strata for CY 2022, CY 2023, and CY 2024.
Estimated Total Population. The total population of SARs filed during the primary lookback period is estimated at approximately 9,500 to 10,000, as detailed in Section IV.C above.
Estimated Sample Size. The estimated sample size for Population 3 is approximately 1,200 to 1,500 SARs. As with Population 2, the final sample size will be confirmed upon completion of data extraction and population validation.
Oversampling. Two oversampling adjustments will be applied to the Population 3 sample. First, SARs filed more than 60 days after alert generation will be oversampled at 2.0× the proportional rate, reflecting the heightened risk of quality deficiencies in late-filed reports. Second, BaaS-related SARs will be oversampled at 1.5× the proportional rate, consistent with the rationale described for Population 2.
C. Sampling Framework for Population 4 (Unmonitored Transaction Activity)
Approach. Given the nature of Population 4 — which consists of transaction activity that did not generate TMS alerts and therefore exists outside the alert-based population framework — a targeted, risk-based selection approach will be employed rather than pure random sampling.
Targeted Populations. The Population 4 review will address the following categories:
(i) NovaPay unscreened transactions: 100% of the approximately 3,800,000 NovaPay transactions identified as unscreened for OFAC sanctions purposes in CY 2023 will be subjected to retrospective sanctions screening against the Specially Designated Nationals and blocked Persons List ("SDN List"), the Sectoral Sanctions Identifications List ("SSI List"), and other applicable sanctions lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control. In addition, a stratified random sample of approximately 5%–10% of these unscreened transactions (i.e., approximately 190,000–380,000 transactions) will be subjected to supplemental suspicious activity analysis to determine whether the underlying activity warrants SAR filing.
(ii) High-risk accounts lacking CDD/EDD: For the approximately 47,000 high-risk customer accounts identified as lacking adequate CDD/EDD documentation, a risk-prioritized sample of approximately 10%–15% of these accounts (i.e., approximately 4,700–7,050 accounts) will have their full transaction history during the lookback period analyzed for suspicious activity patterns. Account selection will be prioritized based on available risk indicators, including transaction volume, geographic risk factors, account opening channel, and product type.
Data Extraction Specifications. Detailed data extraction specifications for Population 4 will be developed in coordination with Linda Petrosian (BRB CIO/CTO) and Veridian Analytics (Priya Subramanian). The extraction specifications will be documented and subject to review by Thornfield Consulting to ensure completeness and accuracy. Population 4 data extraction is expected to be more complex and time-intensive than data extraction for Populations 1–3, given the need to identify and retrieve transaction-level data from systems outside the TMS alert framework.
D. Adjustments and Expansion
To ensure the Lookback achieves its remedial objectives, a dynamic sample-expansion mechanism will be in effect throughout the review process. Specifically:
If initial sampling results for any stratum within Population 2 or Population 3 indicate an error rate exceeding 10% — defined as more than 10% of sampled items within that stratum requiring either a new SAR filing (for Population 2) or a material amendment or correction (for Population 3) — the sample for that stratum will be expanded to cover 100% of the population in that stratum. This full-population review will be completed within the applicable Lookback timeline.
The 10% error rate threshold represents a conservative trigger designed to identify strata in which dispositioning deficiencies are sufficiently prevalent to warrant complete review. The threshold was selected in consultation with Thornfield Consulting based on regulatory precedent in comparable lookback engagements and the OCC's expectations for thoroughness.
All sample-size determinations, stratification decisions, oversampling rates, and expansion triggers are subject to review and concurrence by Thornfield Consulting Group (Dr. Vivian Castellano). Any changes to the sampling methodology after the commencement of the Lookback must be documented and approved in writing by the BSA Officer (Thomas Ikeda), Calderwood & Harkness (Philip Hartmann or Yuki Nakamura), and Thornfield Consulting.
VII. ALERT RE-REVIEW CRITERIA AND DECISION FRAMEWORK
A. Standards for Alert Disposition
Each alert subject to review during the Lookback — whether drawn from the Population 1 unreviewed backlog or from the Population 2 re-review sample — will be evaluated against two core standards:
SAR Filing Standard. The fundamental question for each alert is whether the underlying activity, viewed in its totality and in the context of the customer's profile and all known information, meets the regulatory standard for SAR filing. Under 31 C.F.R. § 1020.320, a national bank is required to file a SAR when the bank knows, suspects, or has reason to suspect that a transaction conducted or attempted by, at, or through the bank involves or aggregates funds or other assets of at least $5,000 and:
(a) The transaction involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation;
(b) The transaction is designed, whether through structuring or other means, to evade any requirements of the Bank Secrecy Act or its implementing regulations;
(c) The transaction has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction; or
(d) The transaction involves the use of the bank to facilitate criminal activity.
The re-review will assess whether, based on the information available at the time of the original alert, as well as any additional information obtained during the re-review process, the activity met any of these criteria. Where the original disposition was a closure without filing, the re-reviewer will determine whether a reasonable, appropriately trained BSA/AML investigator, applying the regulatory standard, would have concluded that a SAR filing was warranted.
Documentation Standard. In addition to assessing the substantive correctness of the original disposition, the re-review will evaluate whether the original alert disposition is supported by adequate investigative documentation. This includes an assessment of whether the investigation file contains: a meaningful transaction analysis, a review of the customer's profile and account history, documentation of any open-source research conducted, and a clear and articulate rationale for the disposition decision. Dispositions that lack adequate documentation are problematic even if the substantive conclusion may have been correct, because the absence of documentation prevents the Bank (and its regulators) from verifying the basis for the decision.
B. Categories of Re-Review Outcomes
Each alert or SAR re-reviewed during the Lookback will be classified into one of five outcome categories:
Category A — Confirmed Proper Closure. The original closure decision is supported by the facts developed during the original investigation and during the re-review, and the investigation file contains adequate documentation to support the disposition. No further action is required. The re-review conclusion and supporting analysis will be documented in a Re-Review Disposition Memorandum and added to the alert investigation file.
Category B — Documentation Deficiency Only. The original closure decision appears substantively correct — that is, the underlying activity does not appear to meet the SAR filing standard based on the information available — but the supporting documentation in the investigation file is insufficient to adequately demonstrate the basis for the closure decision. In these cases, supplemental documentation must be prepared to cure the deficiency. The supplemental documentation will include a narrative description of the investigative analysis and the rationale for the closure, reconstructed from available records, and will be added to the alert investigation file.
Category C — Filing Required. The re-review reveals activity that meets the SAR filing standard as defined in Section VII.A above but was not previously reported to FinCEN via SAR filing. A new SAR must be prepared and filed in accordance with the standards set forth in Section VIII below. The investigation file must be supplemented with the re-review analysis supporting the filing determination.
Category D — Amendment Required. For previously filed SARs in Population 3, the re-review reveals material deficiencies in the SAR narrative, inaccurate information in the filing, or missing elements that substantially affect the completeness or accuracy of the report. An amended or corrected SAR must be filed. Category D applies only to Population 3 items and is not applicable to Population 2 (which involves closed alerts, not filed SARs). The nature and extent of the required amendments will be documented, and the amended filing will cross-reference the original SAR filing.
Category E — Escalation Required. The re-review reveals facts that, in addition to any applicable SAR filing requirement, warrant immediate escalation beyond the normal Lookback workflow. This category includes, but is not limited to: potential terrorist financing indicators, potential proliferation financing activity, significant OFAC nexus (i.e., potential involvement of sanctioned persons, entities, or countries), evidence of fraud, embezzlement, or insider abuse involving BRB employees or officers, and any activity involving BRB senior management or Board members. Category E items are subject to the escalation protocols set forth in Section XIV below, and the applicable SAR filing or amendment requirements of Categories C or D apply concurrently.
C. Quality Review and Supervisory Approval
All alert dispositions during the Lookback — including dispositions of Population 1 backlog alerts and re-review dispositions of Population 2 and Population 3 items — are subject to a mandatory two-level review process:
Level 1: Analyst Investigation and Initial Disposition Recommendation. The assigned analyst (whether a Pinnacle temporary analyst or a BRB permanent staff member) conducts the investigation, prepares the investigation file, and makes an initial disposition recommendation, including a proposed outcome category (A through E). The Level 1 analyst documents the investigation and recommendation in the applicable investigation form and signs and dates the recommendation.
Level 2: Supervisory Review and Approval. A BRB senior investigator or BSA/AML team lead, designated by and reporting to Thomas Ikeda, reviews the Level 1 analyst's investigation file and disposition recommendation. The Level 2 reviewer independently assesses whether the investigation is complete, the analysis is sound, and the recommended disposition is appropriate. The Level 2 reviewer either approves the recommendation, returns the file for additional investigation, or overrides the recommendation with a different disposition (with documented rationale). The Level 2 reviewer signs and dates the approval.
In addition to the two-level review process, all SAR filings resulting from the Lookback (Categories C and D) are subject to an additional quality review by a designated SAR Quality Reviewer before the filing is submitted to FinCEN through the BSA E-Filing System. The SAR Quality Reviewer will verify the completeness and accuracy of the SAR form and narrative, confirm that all required fields are completed, and ensure that the narrative meets the standards set forth in Section VIII.B below. The SAR Quality Reviewer will complete a quality-review checklist and sign off on the filing.
VIII. SAR FILING STANDARDS FOR LOOKBACK-IDENTIFIED ACTIVITY
A. Filing Timeliness
For activity identified through the Lookback as warranting a SAR filing (Category C outcomes from Populations 1, 2, and 4) or as requiring an amended filing (Category D outcomes from Population 3), the filing or amendment must be completed within 30 days of the Lookback team's determination that a filing is warranted. This 30-day standard is measured from the date on which the re-review analyst's Category C or Category D recommendation is approved at the Level 2 supervisory review stage.
Adherence to this 30-day standard is critical for several reasons. First, it demonstrates to the OCC and FinCEN that BRB has internalized the timeliness expectations applicable to SAR filing. Second, it ensures that newly identified suspicious activity is reported promptly, maximizing the utility of the information to law enforcement and FinCEN's analytical programs. Third, it establishes a performance baseline that should carry forward into BRB's steady-state SAR filing operations after the Lookback is completed.
The BSA Officer (Thomas Ikeda) will track SAR filing timelines on a weekly basis and report any filings that are approaching or have exceeded the 30-day standard. Any filings that cannot be completed within 30 days due to extraordinary circumstances (e.g., complex multi-subject investigations requiring additional subpoena responses or third-party information) must be documented with a written justification and approved by Calderwood & Harkness.
B. Narrative Requirements
SAR narratives for Lookback-identified filings must meet heightened documentation standards that reflect both FinCEN's general narrative expectations and the specific circumstances of the Lookback Project. Each SAR narrative must include the following elements:
(i) Lookback identification. The narrative must identify the filing as a result of a comprehensive lookback project conducted pursuant to OCC Consent Order No. OCC-2025-003. This identification should appear prominently in the opening paragraph of the narrative and should provide sufficient context for the reader to understand the circumstances under which the activity was identified and reported.
(ii) Complete activity description. The narrative must contain a complete description of the suspicious activity, addressing the "who, what, when, where, why, and how" of the activity. This includes a clear articulation of the nature of the suspicious conduct, the basis for the Bank's suspicion, and the relationship of the activity to the applicable SAR filing criteria.
(iii) Transaction details. All relevant transaction details must be included, encompassing transaction types, amounts, dates, counterparties, account numbers, and routing information. Where the suspicious activity involves a pattern of transactions, the narrative must describe the pattern and identify the individual transactions constituting the pattern.
(iv) Customer identification and risk profile. The narrative must include complete subject identification information (name, date of birth, Social Security number or Tax Identification Number, address, and any other available identifying information) and a description of the customer's risk profile, including risk rating, occupation, source of funds (if known), and account opening date.
(v) BaaS partner identification. Where the suspicious activity involves a customer onboarded through a BaaS partner channel or transactions processed through a BaaS partner platform, the narrative must identify the specific fintech partner and describe the nature of the BaaS relationship.
(vi) Related filings. The narrative must cross-reference any related CTR filings, prior SAR filings for the same customer, or continuing activity SAR filings.
(vii) Explanation of delayed reporting. The narrative must include an explanation of why the activity was not previously reported. Depending on the circumstances, this explanation may include one or more of the following: the alert was in the unreviewed backlog and had not been investigated; the alert was previously investigated and improperly closed without a SAR filing; the activity was not captured by the Bank's transaction monitoring rules; or the original SAR filing contained material deficiencies requiring amendment.
C. Continuing Activity SARs
Where the Lookback identifies suspicious activity that is ongoing at the time of the re-review, a SAR must be filed promptly and the subject customer's account(s) must be placed under enhanced monitoring. Continuing activity SARs must reference all prior filings for the same subject and provide an updated summary of the suspicious activity observed since the last filing (or, where no prior filing exists, since the inception of the identified suspicious pattern).
The determination of whether activity is "ongoing" will be made by the Level 2 supervisor in consultation with the BSA Officer. Accounts associated with continuing suspicious activity will be flagged for priority review and may be subject to account restriction or closure decisions in accordance with BRB's policies and applicable law.
D. Retroactive OFAC Analysis
For transactions identified through the Lookback that were not previously subjected to OFAC sanctions screening — particularly the approximately 3,800,000 unscreened NovaPay transactions in CY 2023 — any potential matches against current or historically applicable sanctions lists must be immediately escalated. This includes matches against the SDN List, the SSI List, the Non-SDN Menu-Based Sanctions List, the Foreign Sanctions Evaders List, and any other applicable OFAC lists in effect at the time of the transaction or currently.
Upon identification of a potential sanctions match, the matter must be immediately escalated to the BSA Officer (Thomas Ikeda), the Chief Compliance Officer (Patricia Langston), and Calderwood & Harkness (Philip Hartmann) for assessment. The assessment will include a determination of whether the match constitutes an apparent violation of OFAC regulations and, if so, whether a voluntary self-disclosure to OFAC is warranted.
This analysis is closely coordinated with the separate OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis being conducted by Calderwood & Harkness as part of Workstream 1 of the broader remediation program. Any sanctions-related findings from the Lookback will be incorporated into the OFAC analysis and reported to the OFAC remediation team on an immediate basis.
IX. STAFFING AND RESOURCE ALLOCATION
A. Pinnacle Compliance Solutions Deployment
Pinnacle Compliance Solutions LLC ("Pinnacle") (Andrea Solis, Director of Managed Services) has been engaged to provide 30 full-time-equivalent temporary BSA/AML analysts under a managed services engagement (Statement of Work Reference: PCS-BRB-2025-0012). The total contract value for the Pinnacle engagement is $3,600,000, calculated at 30 FTEs × $10,000 per month per FTE × 12 months, yielding a monthly run rate of approximately $300,000.
Of the 30 Pinnacle FTEs, approximately 18 to 20 will be primarily assigned to the SAR Lookback Project during the initial phase (March through June 2025), which is focused on the Population 1 backlog clearance. The remaining 10 to 12 Pinnacle FTEs will support ongoing SAR filing operations and other remediation workstreams during this period. As the Population 1 backlog is cleared and the Lookback transitions to Population 2, Population 3, and Population 4 reviews, the allocation of Pinnacle resources between the Lookback and ongoing operations will be adjusted by the BSA Officer in consultation with Calderwood & Harkness.
All Pinnacle analysts deployed to the Lookback Project are subject to the supervision and quality-control protocols set forth in the separate Memorandum on Temporary Staff Supervision & Quality Control Protocols, which establishes standards for analyst onboarding, training, performance monitoring, and work-product review. Pinnacle analysts perform Level 1 investigation and disposition functions only; all Level 2 supervisory approvals must be performed by BRB permanent staff.
B. BRB Internal Staff
BRB's existing BSA/AML department, which consisted of 62 FTEs as of January 2025, will assign a dedicated Lookback team of approximately 8 to 10 senior investigators and team leads. These staff members will be responsible for providing Level 2 supervisory review of Lookback dispositions, performing SAR Quality Review functions, and serving as subject-matter resources for Pinnacle analysts on complex investigations.
Thomas Ikeda, BSA Officer and AML Program Director, will serve as the overall Lookback project manager, with direct reporting on Lookback progress to Patricia Langston (CCO). Mr. Ikeda will be responsible for day-to-day oversight of the Lookback, including resource allocation decisions, escalation management, and coordination with Pinnacle, Thornfield Consulting, and Calderwood & Harkness.
Additional internal support will be provided by BRB's internal audit team, led by Derek Ballard (Head of Internal Audit), which will conduct independent quality sampling of Lookback dispositions on a monthly basis as described in Section XIII.A below.