ATTORNEY-CLIENT PRIVILEGED & ATTORNEY WORK PRODUCT PREPARED IN CONNECTION WITH OCC CONSENT ORDER NO. OCC-2025-003 THIS DOCUMENT IS PROTECTED FROM DISCLOSURE BY THE ATTORNEY-CLIENT PRIVILEGE, THE WORK PRODUCT DOCTRINE, AND APPLICABLE REGULATORY EXAMINATION PRIVILEGES. DO NOT COPY, DISTRIBUTE, OR DISCLOSE WITHOUT PRIOR AUTHORIZATION OF OUTSIDE COUNSEL.
PRIVILEGED & CONFIDENTIAL MEMORANDUM
Matter No. 1045-00002
May 2, 2025
FROM: Philip Hartmann, Partner Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Telephone: (212) 555-4100
Email: p.hartmann@calderwoodharkness.com
TO: Patricia Langston, Chief Compliance Officer Belmont Ridge Bank National Association
Thomas Ikeda, BSA Officer / AML Program Director Belmont Ridge Bank National Association
CC: Gregory Nardone, General Counsel & Corporate Secretary Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc.
Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP
Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
RE: Post-Remediation Suspicious Activity Report (SAR) Quality Assurance Framework
PRIVILEGE DESIGNATION: Attorney-Client Privileged & Attorney Work Product — Prepared in Connection with OCC Consent Order No. OCC-2025-003
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommended post-remediation quality assurance ("QA") framework for suspicious activity report ("SAR") filing at Belmont Ridge Bank National Association ("BRB" or the "Bank"). The framework is designed to establish a sustainable, ongoing control structure that will demonstrate to the Office of the Comptroller of the Currency ("OCC") that BRB has achieved and can maintain compliance with the SAR filing requirements of the Bank Secrecy Act ("BSA"), its implementing regulations, and the specific directives contained in OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025.
The Consent Order identified a number of serious deficiencies in BRB's BSA/AML compliance program, chief among them the Bank's failure to maintain an adequate SAR filing process. As of the conclusion of the OCC's examination in September 2024, the OCC identified a backlog of approximately 2,400 unreviewed suspicious activity alerts generated by the Bank's transaction monitoring system. Additionally, the OCC determined that the average time from alert generation to SAR filing was approximately 78 days — far exceeding the regulatory expectation that SARs be filed in a timely manner, generally understood to mean within 30 days of the initial detection of facts constituting the basis for the filing.
In response to the Consent Order, BRB is preparing a Comprehensive Remediation Action Plan (the "RAP"), due to the OCC by May 15, 2025. The SAR Backlog Clearance & Process Improvement Plan constitutes Workstream 2 of the RAP and targets full clearance of the alert backlog by June 30, 2025. The QA Framework described herein is designed to operate as the ongoing control structure after backlog clearance has been achieved, ensuring that the deficiencies cited in the Consent Order do not recur. Accordingly, this QA Framework is intended to be submitted to the OCC as a component of the RAP.
The QA Framework addresses both the immediate remediation period and the long-term steady state. During the remediation period, BRB's BSA/AML department is being supplemented by 30 temporary full-time equivalent ("FTE") analysts from Pinnacle Compliance Solutions LLC ("Pinnacle"), engaged under Statement of Work Reference No. PCS-BRB-2025-0012, in addition to the Bank's existing 62 permanent BSA/AML FTEs. The Bank is also in the process of hiring 15 additional permanent FTEs, which will bring the permanent BSA/AML headcount to 77 upon completion. The QA Framework is calibrated to provide appropriate oversight across both the temporary and permanent workforce throughout this transition.
The following data points informed the design of this framework and underscore the scope and complexity of the Bank's SAR filing operations:
•  Total SARs filed, CY 2024: 3,847 (compared to 2,914 in CY 2023, reflecting a year-over-year increase of approximately 32.0%).
•  BaaS-related SARs, CY 2024: 2,108 of the 3,847 total SARs filed (54.8%), reflecting the disproportionately high volume of suspicious activity flowing through the Bank's 14 active fintech Banking-as-a-Service ("BaaS") partner channels.
•  Transaction monitoring alerts, CY 2024: 41,500 total alerts generated, yielding a SAR conversion rate of approximately 9.3% (3,847 SARs ÷ 41,500 alerts).
•  Alert backlog: Approximately 2,400 alerts unreviewed as of September 2024.
•  Average SAR filing time: 78 days from alert generation (vs. 30-day regulatory expectation).
The QA Framework is further designed to satisfy the validation requirements of Thornfield Consulting Group LLC ("Thornfield"), the OCC-mandated independent consultant (engagement reference TCG-BRB-2025-001), and to produce the documentation necessary for BRB's compliance self-certification, which is due to the OCC on or before February 15, 2026. Thornfield's final validation report, also due February 15, 2026, will assess the sustainability of the QA Framework as a key element in its overall evaluation of BRB's remediation efforts.
C&H recommends that the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), acting through the Compliance Committee, formally adopt this framework as part of the RAP and authorize the staffing and technology resources necessary for its implementation. This memorandum provides the detailed design specifications, methodologies, roles and responsibilities, reporting cadences, and implementation milestones required to operationalize the framework.
II. REGULATORY AND SUPERVISORY BACKGROUND
A thorough understanding of the regulatory and supervisory context in which this QA Framework is being developed is essential to appreciating both the urgency of its implementation and the specific design choices embedded within it. This section summarizes the relevant supervisory history, the Consent Order's SAR-related findings, and the roles of the various regulatory and consulting entities whose expectations the framework must satisfy.
A. Consent Order Findings Relevant to SAR QA
OCC Consent Order No. OCC-2025-003 was issued on January 15, 2025, against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of a targeted BSA/AML examination conducted by the OCC's Northeastern District Office, located at 340 Madison Avenue, New York, NY 10017, over the period from March 2024 through September 2024. The examination was led by Examiner-in-Charge Jonathan Frey.
The Consent Order contains several findings directly relevant to the design of this QA Framework. The key SAR-related findings are as follows:
(i) Unreviewed Alert Backlog. As of the conclusion of the examination in September 2024, BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts that had been generated by the Bank's transaction monitoring system (Veridian TMS) but had not been reviewed, investigated, or dispositioned by BSA/AML department personnel. The OCC determined that this backlog represented a material failure to identify and report known or suspected violations of law or suspicious transactions as required by 31 U.S.C. § 5318(g) and 31 CFR § 1020.320.
(ii) SAR Filing Timeliness. The average time from alert generation to SAR filing was determined to be approximately 78 days. This figure significantly exceeds the regulatory expectation — articulated in OCC guidance, FinCEN guidance, and the FFIEC BSA/AML Examination Manual — that SARs be filed within 30 days of the initial detection of facts that may constitute a basis for the filing. In cases where no suspect has been identified, the filing deadline extends to 60 days, but in no case does this extended timeline excuse the 78-day average observed at BRB, as the vast majority of SARs filed by the Bank identified known subjects.
(iii) SAR Filing Quality and Completeness. The Consent Order cited deficient SAR filing quality across both the Bank's traditional retail banking operations and its BaaS channels. Specifically, the OCC identified SARs with incomplete or inadequate narratives that failed to describe the nature and extent of the suspicious activity with sufficient specificity, SARs with inaccurate or missing form fields, and SARs that lacked adequate supporting investigation documentation.
The Consent Order further noted the Bank's prior supervisory history, which the OCC characterized as reflecting a pattern of inadequate remediation of identified deficiencies:
•  June 2022: The OCC issued a Matter Requiring Attention ("MRA") regarding deficiencies in BRB's BSA/AML transaction monitoring program, including concerns about alert tuning, staffing adequacy, and the timeliness of alert disposition.
•  November 2023: The OCC elevated its supervisory posture and issued a Matter Requiring Immediate Attention ("MRIA") regarding gaps in the Bank's OFAC screening program, including failures to appropriately disposition screening hits and a lack of adequate quality controls around the screening process.
The Consent Order specifically cited BRB's failure to adequately remediate these prior supervisory actions under the direction of the Bank's former outside counsel, Drayton Mercer LLP, whose engagement was terminated in January 2025. Calderwood & Harkness was retained as successor counsel effective January 27, 2025.
B. FinCEN Monitoring
The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's SAR filing remediation efforts. As of the date of this memorandum, FinCEN has not filed a separate enforcement action against the Bank; however, FinCEN has expressly reserved its enforcement rights in coordination with the OCC. FinCEN Associate Director Angela Drummond, of the FinCEN Enforcement Division, serves as the agency's designated liaison for the BRB matter.
The existence of FinCEN monitoring — and FinCEN's reserved enforcement posture — significantly heightens the importance of a sustainable QA framework. Should the Bank fail to demonstrate sustained improvement in SAR filing quality and timeliness, there is a meaningful risk that FinCEN could initiate a separate enforcement action, potentially including civil money penalties under 31 U.S.C. § 5321. A robust QA framework that produces objective, data-driven evidence of sustained compliance is therefore critical not only to satisfying the OCC's Consent Order requirements but also to mitigating the risk of a separate FinCEN action.
C. Caldera & Pope BSA/AML Independent Testing
The most recent BSA/AML independent test was completed in September 2024 by Caldera & Pope LLP, a public accounting and advisory firm specializing in financial institution compliance and risk management. The engagement was led by engagement partner Franklin Dorsey, CPA, operating from the firm's Chicago office at 311 South Wacker Drive, Suite 5400, Chicago, IL 60606. The fee for the independent testing engagement was $1,100,000.
The Caldera & Pope independent testing findings echoed and reinforced the OCC's examination findings in virtually every material respect. Specifically, Caldera & Pope identified the same alert backlog, SAR timeliness deficiencies, and SAR quality concerns that formed the basis of the Consent Order. The convergence of these findings from both the regulatory examination and the independent testing engagement underscores the pervasive nature of the deficiencies and reinforces the need for a comprehensive QA framework that addresses the full spectrum of SAR filing quality and timeliness issues.
Caldera & Pope will continue to serve as BRB's independent testing firm during the remediation period and will assess the effectiveness of the QA Framework as part of its ongoing testing activities. The QA Framework has been designed to produce the types of documentation and audit trail that Caldera & Pope will require for its independent testing assessments.
D. Independent Consultant Oversight
Pursuant to the Consent Order, the OCC mandated the engagement of an independent consultant to assess BRB's BSA/AML program and validate the Bank's remediation efforts. BRB engaged Thornfield Consulting Group LLC ("Thornfield") for this purpose under engagement reference TCG-BRB-2025-001. The Thornfield engagement is led by Dr. Vivian Castellano, Managing Director, and Robert Eastman, Senior Director, AML Transaction Monitoring.
Thornfield commenced its on-site assessment at BRB's headquarters on March 1, 2025. The independent consultant's work is organized into two principal deliverables:
1.  Preliminary Gap Assessment — Due April 15, 2025, this deliverable will include Thornfield's initial evaluation of BRB's SAR processes, transaction monitoring program, and related controls. The gap assessment will inform the design refinements to this QA Framework to the extent Thornfield identifies additional areas of concern not already addressed.
2.  Final Validation Report — Due February 15, 2026, this deliverable will assess the sustainability of BRB's remediation efforts, including the QA Framework described in this memorandum. A favorable validation from Thornfield is a prerequisite to BRB's ability to file the compliance self-certification required by the Consent Order and, ultimately, to petition the OCC for termination of the Consent Order.
The QA Framework has been designed with Thornfield's validation requirements in mind. All QA documentation, metrics, and reports will be made available to Thornfield under the Access & Cooperation Protocol established between BRB, C&H, and Thornfield at the outset of the engagement.
III. OBJECTIVES OF THE SAR QA FRAMEWORK
The QA Framework is designed to achieve a primary objective and several supporting secondary objectives. Together, these objectives align the framework with the Bank's regulatory obligations, the specific requirements of the Consent Order, and the broader goal of establishing a culture of sustainable compliance within the BSA/AML department.
Primary Objective
The primary objective of the QA Framework is to ensure that all SARs filed by BRB are timely (filed within 30 days of alert generation), accurate (containing correct information in all form fields), complete (including a thorough narrative description and adequate supporting documentation), and in compliance with FinCEN's SAR filing requirements as set forth in 31 CFR § 1020.320 and related FinCEN guidance. Achievement of this objective on a sustained basis is the fundamental measure of the QA Framework's success.
Secondary Objectives
In addition to the primary objective, the QA Framework is designed to achieve the following secondary objectives:
1. Error Detection and Correction. The framework is designed to detect and correct errors in SAR narrative quality, supporting documentation, and filing decisions before they become systemic. By identifying errors at the earliest possible stage and tracing them to their root causes, the framework enables the Bank to implement corrective actions that prevent recurrence rather than merely addressing individual instances of non-compliance after the fact.
2. Auditable Trail of QA Activities. The framework establishes a comprehensive, auditable trail of QA activities that demonstrates sustained compliance to the OCC, FinCEN, and Thornfield Consulting. This documentation trail is essential to supporting BRB's compliance self-certification, satisfying Thornfield's validation requirements, and providing evidence of good faith compliance efforts should FinCEN elect to exercise its reserved enforcement rights.
3. Data-Driven Continuous Improvement. The framework is designed to produce data-driven insights that enable continuous improvement of the transaction monitoring and investigation process. By tracking error rates, timeliness metrics, and quality scores over time — and by analyzing these data across multiple dimensions (analyst, business line, BaaS partner, alert source, and staffing category) — the framework enables BRB management to identify areas requiring targeted intervention and to measure the effectiveness of those interventions objectively.
4. Support for Committee and Board-Level Reporting. The framework provides the metrics and analysis necessary to support reporting to the Compliance Committee, chaired by James Rutherford, and to the BRFG Board of Directors on SAR quality and timeliness. Effective Board-level oversight of the BSA/AML program is a regulatory expectation, and the QA Framework ensures that the Board receives the information it needs to fulfill its governance responsibilities.
5. Staffing Transition Management. The framework is specifically designed to bridge the transition from remediation-period staffing — comprising 62 permanent FTEs, 30 Pinnacle temporary analysts, and 15 new permanent hires in the onboarding process — to steady-state operations with 77 permanent FTEs. The framework includes differentiated quality controls for temporary staff and adjustable sampling rates that can be calibrated to the risk profile of the workforce at any given point during the transition.
IV. SCOPE
The QA Framework is designed to cover the full spectrum of SAR filing activity at BRB. This section defines the types of SARs subject to QA review, the business lines whose SAR activity is within scope, and the personnel whose work product is subject to the framework's quality controls.
A. SAR Types Covered
The QA Framework applies to all SARs filed by BRB, regardless of the source or trigger for the filing. Specifically, the following categories of SARs are within scope:
•  Transaction Monitoring System Alerts. SARs originating from alerts generated by the Bank's transaction monitoring system, Veridian TMS. The Bank is currently operating Veridian TMS version 8.3 and is in the process of upgrading to version 10.0, with a User Acceptance Testing ("UAT") target date of August 1, 2025. During the transition period, alerts may be generated by either the legacy or upgraded system, and SARs arising from either version are within scope.
•  Manual Referrals from Business Lines. SARs filed as a result of suspicious activity referrals submitted by front-line business personnel, relationship managers, or other Bank employees outside the BSA/AML department through the Bank's internal referral process.
•  Law Enforcement Subpoenas and Requests. SARs filed in response to or in connection with law enforcement subpoenas, grand jury subpoenas, Section 314(a) requests, or other law enforcement inquiries that identify suspicious activity warranting a SAR filing.
•  BaaS Partner Referrals. SARs filed based on suspicious activity referrals received from BRB's BaaS fintech partners. Given the significant volume of BaaS-related SARs (54.8% of total SARs in CY 2024), this category receives heightened attention under the framework.
•  Continuing SARs. SARs filed on a 90-day continuing basis in connection with ongoing suspicious activity, as required by FinCEN guidance. Continuing SARs are subject to QA review for both the timeliness of the 90-day follow-up filing and the adequacy of the updated narrative.
•  Lookback Project SARs. SARs filed in connection with the SAR lookback project (budgeted at $5,500,000), which involves a retrospective review of historical transaction monitoring alerts and activity to identify potential SAR filing failures during prior periods.
B. Business Lines in Scope
All of BRB's business lines are within the scope of the QA Framework. Specifically, the framework covers SAR filings arising from the following business lines and channels:
•  Retail banking (consumer deposit accounts, consumer lending, and related products)
•  Commercial lending (including small business lending and commercial real estate)
•  Wealth management (including fiduciary and investment advisory accounts)
•  All 14 active BaaS fintech partner channels
Given that BaaS-related SARs represented 54.8% of all SARs filed in CY 2024 (2,108 of 3,847), the QA Framework places a heightened focus on SARs originating from BaaS partner channels. Within the BaaS category, specific attention is directed to SARs involving the Bank's top three BaaS partners by transaction volume:
1.  NovaPay Technologies Inc. — NovaPay accounted for approximately 41% of BaaS transaction volume in CY 2024, representing approximately $30.5 billion in total transaction value. NovaPay's prepaid card and digital payments platform generates a significant volume of transaction monitoring alerts, and SARs related to NovaPay activity are a priority for targeted sampling.
2.  FairLend Digital LLC — FairLend accounted for approximately 28% of BaaS transaction volume in CY 2024. FairLend's digital lending platform presents unique suspicious activity typologies, including concerns related to application fraud and synthetic identity fraud.
3.  VaultEdge Inc. — VaultEdge accounted for approximately 18% of BaaS transaction volume in CY 2024. VaultEdge's cryptocurrency-adjacent services present elevated money laundering risk factors that require specialized attention in SAR narratives.
The remaining 11 BaaS partners collectively account for the balance of approximately 13% of BaaS transaction volume and are subject to standard QA review procedures.
C. Personnel in Scope
The QA Framework applies to the work product of all personnel involved in the SAR investigation and filing process. Specifically, the following categories of personnel are within scope:
•  Permanent BSA/AML Department Staff. All BSA/AML department analysts, investigators, and supervisors currently employed by BRB (62 FTEs as of the date of this memorandum) and the 15 additional permanent FTE positions currently in the hiring process.
•  Pinnacle Compliance Solutions LLC Temporary Staff. The 30 temporary FTE analysts provided by Pinnacle under Statement of Work Reference No. PCS-BRB-2025-0012 (key contact: Andrea Solis, Director of Managed Services, Pinnacle Compliance Solutions LLC). The Pinnacle engagement is structured as a 12-month managed services arrangement to supplement BRB's permanent staff during the backlog clearance and remediation period.
•  BSA Officer. Thomas Ikeda, in his capacity as BSA Officer and AML Program Director, bears overall accountability for the quality and timeliness of all SARs filed by the Bank.
•  Chief Compliance Officer. Patricia Langston, in her capacity as CCO, provides executive oversight of the QA Framework and is the escalation point for systemic and critical quality issues.
V. QA SAMPLING METHODOLOGY
The credibility and effectiveness of the QA Framework depend upon a sampling methodology that is both statistically sound and risk-sensitive. This section sets forth the dual-track sampling approach employed by the framework, the specific parameters governing each track, and the adjustments to sampling rates during the remediation period versus steady-state operations.
A. Dual-Track Sampling Approach
The QA Framework employs two concurrent and complementary sampling tracks:
Track 1 — Random Sampling. A systematic random sample of SARs filed during each monthly review period, designed to provide an unbiased assessment of overall SAR quality and timeliness across the full population of filings.
Track 2 — Risk-Based (Targeted) Sampling. A supplemental, targeted sample of SARs that meet specific risk-based trigger criteria, designed to provide focused quality assessment in areas of heightened risk or known vulnerability.
The dual-track approach ensures that the QA Framework provides both breadth of coverage (through random sampling) and depth of coverage in high-risk areas (through targeted sampling). The combined coverage of both tracks is expected to encompass approximately 15% to 25% of all SARs filed monthly, depending on the volume of SARs meeting targeted sampling triggers in any given period.
B. Random Sampling
Population. The population for random sampling consists of all SARs filed by BRB during a given monthly review period. The review cycle is monthly, with each review period corresponding to one calendar month of SAR filing activity.
Sample Size. The minimum random sample size is the greater of (a) 10% of total SARs filed during the review period or (b) 30 SARs. Based on CY 2024 filing volumes of 3,847 SARs annually (approximately 321 SARs per month), a 10% random sample yields approximately 32 SARs per month, which exceeds the 30-SAR floor. In months with lower filing volumes, the 30-SAR minimum ensures an adequate sample size for meaningful quality assessment.
Selection Method. SARs are selected using a systematic random sampling method based on sequential FinCEN BSA Identification Numbers assigned to each filing. The QA Unit calculates the sampling interval (n) by dividing the total number of SARs filed during the review period by the required sample size. A random starting point is selected, and every nth SAR is included in the sample. This approach ensures equal probability of selection across the full population and avoids the potential for selection bias inherent in convenience or judgment-based sampling methods.
Review Criteria. Each SAR in the random sample is subject to a comprehensive review against the following criteria:
•  Completeness of FinCEN SAR form fields — Verification that all required fields in Parts I through V of the FinCEN SAR form have been completed accurately and in their entirety.
•  Narrative quality — Assessment of the SAR narrative for specificity, clarity, and completeness, including identification of subjects, description of the suspicious activity, explanation of why the activity is suspicious, articulation of the nexus to potential underlying criminal violations, and identification of the financial instruments and dollar amounts involved.
•  Timeliness — Measurement of the number of days elapsed from alert generation (or other initial detection of suspicious activity) to SAR filing, benchmarked against the 30-day regulatory expectation.
•  Supporting documentation adequacy — Review of the investigation file for completeness, including transaction records, CDD/EDD records, account statements, correspondence, prior SAR history, and law enforcement referral documentation, as applicable.
•  SAR type categorization — Verification that the SAR has been properly categorized by type of suspicious activity (e.g., structuring, money laundering, fraud, identity theft) and that the characterization is consistent with the facts described in the narrative.
•  Continuing SAR compliance — For continuing SARs, verification that the 90-day filing deadline has been met and that the narrative has been updated to reflect additional investigation findings since the prior filing.
C. Risk-Based (Targeted) Sampling
The risk-based sampling track supplements the random sample by targeting categories of SARs that present elevated quality or compliance risk. The trigger criteria for targeted sampling are as follows:
•  BaaS Partner Channel SARs. SARs arising from any of the 14 active BaaS partner channels are subject to targeted sampling, reflecting the concentration of BaaS-related SARs at 54.8% of total filings and the unique data quality and coordination challenges associated with BaaS-originated suspicious activity.
•  High-Risk Customer Account SARs. SARs involving accounts identified as high-risk under the Bank's CDD/EDD risk rating methodology, including in particular the approximately 47,000 accounts currently subject to CDD/EDD remediation under a separate workstream of the RAP.
•  Pinnacle Temporary Staff SARs. All SARs investigated and/or filed by Pinnacle temporary analysts are subject to targeted sampling as a quality control measure during the staffing transition period. This criterion reflects the inherent risk of quality inconsistency when temporary staff — who may have less institutional knowledge and familiarity with BRB's specific risk profile — are performing SAR functions.
•  Elevated Filing Time SARs. SARs with filing times exceeding 20 days from alert generation are flagged for targeted review. The 20-day threshold serves as an early warning indicator, enabling the QA Unit to identify SARs at risk of exceeding the 30-day benchmark and to investigate the causes of delay.
•  High-Dollar SARs. SARs involving transactions exceeding $500,000 in value are subject to targeted sampling, reflecting the heightened regulatory and reputational risk associated with high-value suspicious activity.
•  OFAC Screening Hit SARs. SARs filed in connection with OFAC screening hits receive targeted review. In CY 2024, BRB's OFAC screening process generated 14,320 hits, of which 12 were determined to be true matches — yielding a false-positive rate of approximately 99.9%. The targeted review of OFAC-related SARs is designed to ensure that the investigation and documentation of true matches is thorough and that the narrative adequately addresses the sanctions-related dimensions of the activity.
•  Lookback Project SARs. SARs filed as a result of the lookback project receive targeted sampling attention (and, as discussed in Section XII below, are subject to 100% review rather than sampling during the lookback period).
•  Prior Elevated Error Rate Categories. Any SAR category, business line, analyst, or alert type identified in prior QA cycles as having an elevated error rate is subject to targeted sampling until the error rate returns to acceptable levels.
Sample Size (Targeted). The targeted sample consists of an additional 5% to 15% of SARs meeting any trigger criterion in a given review period. Where the total population of SARs in a particular trigger category is small (fewer than 20 SARs), all SARs in that category are reviewed rather than sampled.
Combined Coverage. The combined random and targeted sampling tracks are expected to cover approximately 15% to 25% of all SARs filed monthly, depending on the volume of SARs meeting targeted sampling triggers. This level of coverage is consistent with industry best practices for post-enforcement SAR QA programs and is designed to provide a statistically meaningful and risk-appropriate level of assurance.
D. Sampling During Remediation Period vs. Steady State
The sampling methodology is calibrated differently for the remediation period and the post-remediation steady state, reflecting the elevated risk profile during the period of active backlog clearance and staffing transition.
Remediation Period (through February 15, 2026). During the remediation period, the following elevated sampling parameters apply:
•  The random sampling rate is increased from 10% to 15% of total SARs filed per month.
•  Full (100%) review of all SARs investigated and/or filed by Pinnacle temporary analysts, rather than sampling. This reflects the heightened risk of quality inconsistency during the rapid backlog clearance process, which targets the disposition of approximately 2,400 previously unreviewed alerts by June 30, 2025.
•  All other targeted sampling criteria remain in effect at the standard rates described above.
The elevated remediation-period sampling rates are designed to provide BRB, the OCC, and Thornfield Consulting with a higher level of confidence in SAR quality during the most critical phase of the remediation effort.
Steady State (post-February 15, 2026). Upon the filing of the compliance self-certification and the conclusion of Thornfield's validation engagement, the framework transitions to steady-state sampling parameters:
•  Random sampling returns to the standard rate of 10% of total SARs filed per month (or 30 SARs, whichever is greater).
•  Risk-based targeted sampling continues at the rates described above, with Pinnacle-related sampling eliminated as the temporary staffing engagement concludes.
•  Sampling rates are subject to annual reassessment based on error trend data, filing volumes, and regulatory expectations.
VI. QA REVIEW PROCESS AND CRITERIA
This section describes the organizational structure of the QA review function, the standardized review criteria applied to each sampled SAR, and the scoring methodology used to quantify SAR quality.
A. QA Review Team Structure
The QA Framework contemplates the establishment of a dedicated QA Review Unit within the BSA/AML department. The QA Unit will operate under the direct supervision of the BSA Officer, Thomas Ikeda, and will be organizationally distinct from the investigation and filing teams whose work product it reviews. This structural separation is essential to maintaining the independence and credibility of the QA function.
The QA Unit will be staffed as follows:
•  QA Unit Lead (1 FTE). A newly created position to be filled as part of the 15 new permanent FTE additions currently in the hiring process. The QA Unit Lead will have day-to-day responsibility for managing the QA review process, coordinating error tracking and root cause analysis activities, and preparing the monthly QA report. The estimated fully loaded cost of each new FTE is $150,000 per year, bringing the total annual cost of the 15-FTE addition to $2,250,000.
•  Senior QA Reviewers (minimum 3 FTEs). The QA Unit will include a minimum of three senior analysts or investigators serving as QA reviewers. Each QA reviewer must possess at least five years of BSA/AML experience, including demonstrated expertise in SAR investigation and filing. QA reviewers may be drawn from the existing permanent BSA/AML staff or recruited externally as part of the 15-FTE hiring initiative.
Independence Requirement. A fundamental principle of the QA Framework is that QA reviewers must not have been involved in the original investigation or filing of any SAR that they are assigned to review. This independence requirement applies on a per-SAR basis: a reviewer who investigated or filed a particular SAR is disqualified from reviewing that SAR, but is not disqualified from serving as a QA reviewer for other SARs. The QA Unit Lead is responsible for ensuring compliance with this requirement through appropriate assignment protocols.
B. Review Criteria — SAR Quality Scorecard
Each SAR selected for QA review will be evaluated against a standardized SAR Quality Review Scorecard. The scorecard (a template for which is attached as Appendix A) encompasses the following seven review criteria:
1. Timeliness. The number of calendar days elapsed from alert generation (or initial detection of potentially suspicious activity) to SAR filing with FinCEN is measured and compared against the 30-day benchmark. For purposes of this criterion, the following grading thresholds apply:
•  Green: ≤ 25 days from alert generation to filing
•  Yellow: 26–30 days from alert generation to filing
•  Red: > 30 days from alert generation to filing
The timeliness criterion is given substantial weight in the composite quality score, reflecting the OCC's emphasis on filing timeliness as a central deficiency in the Consent Order.
2. Narrative Completeness. The SAR narrative is evaluated for the following elements:
•  Identification of the subject(s) of the suspicious activity, including full legal names, dates of birth, identification numbers, and account numbers
•  Clear and specific description of the suspicious activity, including the nature, timing, and pattern of the transactions or conduct at issue
•  Explanation of why the activity is suspicious, including reference to applicable typologies, red flags, and risk indicators
•  Articulation of the nexus between the observed activity and potential underlying criminal violations (e.g., money laundering, structuring, fraud, terrorist financing)
•  Identification of the financial instruments, accounts, and dollar amounts involved
•  Reference to prior SAR filings on the same subject(s) or related activity, if applicable
3. Form Accuracy. All FinCEN SAR form fields (Parts I through V) are reviewed for accuracy and completeness, including:
•  Correct entity and individual identification information
•  Accurate dollar amounts and date ranges for the reported activity
•  Proper characterization of the type(s) of suspicious activity
•  Correct identification of the filing institution and branch(es) involved
4. Supporting Documentation. The adequacy of the investigation file is assessed, including the presence and quality of:
•  Transaction records (account statements, wire transfer records, ACH records, check images)
•  CDD/EDD records (customer identification documents, beneficial ownership information, risk ratings, enhanced due diligence documentation)
•  Internal correspondence and referral documentation
•  Prior SAR filing history for the subject(s) and related parties
•  Law enforcement referral documentation, subpoenas, or Section 314(a) request documentation, if applicable
5. Decision Quality. The appropriateness of the determination to file (or not file) a SAR is assessed. This criterion evaluates whether the filing decision was consistent with the facts and circumstances of the investigation, BRB's revised SAR Policy & Procedures (currently being drafted as part of the remediation effort), and applicable regulatory guidance. The decision quality assessment also considers whether the investigation was sufficiently thorough to support the filing determination.
6. Continuing SAR Compliance. For continuing SARs, the following elements are evaluated:
•  Timeliness of the 90-day follow-up filing, measured from the date of the prior filing
•  Substantive updates to the narrative reflecting additional investigation findings, new transactions, or changes in the subject's activity since the prior filing
•  Appropriate determination regarding whether to continue, amend, or close the continuing SAR based on the current facts
7. BaaS-Specific Review Elements. For SARs originating from BaaS partner channels, the following additional elements are evaluated:
•  Confirmation that BaaS partner data (including partner-sourced transaction data, customer identification information, and risk assessments) was incorporated into the investigation and SAR narrative
•  Verification that partner notification and coordination occurred in accordance with the BaaS Partner CDD/EDD Responsibility Matrix
•  Assessment of whether fintech-specific risk factors (e.g., rapid account funding, peer-to-peer transfer patterns, cryptocurrency conversion activity) were identified and addressed in the narrative
•  Confirmation that the SAR appropriately identifies the BaaS partner channel through which the suspicious activity was conducted
C. Scoring and Rating
Each of the seven review criteria is scored on a scale of 1 to 5, with the following definitions:
A Composite SAR Quality Score is computed as a weighted average of the seven individual criterion scores. The weighting methodology assigns higher weight to Timeliness, Narrative Completeness, and Decision Quality — the three areas most directly implicated by the Consent Order findings — and lower but still significant weight to the remaining criteria. The specific weightings are set forth in the SAR Quality Review Scorecard template at Appendix A.
SARs are classified based on their Composite SAR Quality Score as follows:
•  Deficient (Composite Score below 3.0): SARs classified as Deficient are subject to mandatory root cause analysis and corrective action. A Deficient rating indicates that the SAR contains material quality issues that must be investigated and remediated.
•  Needs Improvement (Composite Score 3.0 to 3.9): SARs classified as Needs Improvement reflect quality issues that, while not rising to the level of material deficiency, indicate areas where the analyst's work product falls below the Bank's quality expectations. Needs Improvement ratings are tracked for trend analysis and may trigger targeted training or process adjustments.
•  Satisfactory (Composite Score 4.0 and above): SARs classified as Satisfactory meet or exceed the Bank's quality expectations. No corrective action is required, although observations noted during the review may be communicated to the analyst for informational purposes.
VII. ERROR TRACKING AND CLASSIFICATION
Effective quality assurance requires not only the identification of errors but also their systematic tracking, classification, and analysis over time. This section establishes the error taxonomy, tracking methodology, and database infrastructure that underpin the QA Framework's error management capabilities.
A. Error Taxonomy
All errors identified during QA reviews are classified into one of three categories based on severity and potential regulatory impact:
Category 1 — Critical Errors. Category 1 errors represent the most severe quality failures and indicate a fundamental breakdown in the SAR process. Category 1 errors include:
•  Failure to file a required SAR (i.e., a determination not to file a SAR that, upon QA review, is found to have been clearly warranted by the facts and circumstances)
•  Filing a SAR beyond 60 days from alert generation or initial detection of suspicious activity
•  Material omission of subject identification (i.e., failure to identify a known subject in the SAR when the investigation file contains sufficient information for identification)
•  Incorrect blocking or non-blocking determination related to OFAC sanctions (i.e., failure to block when blocking was required, or blocking when it was not warranted)
Category 1 errors carry the most significant regulatory risk, including the potential for adverse supervisory findings, civil money penalties, and, in extreme cases, personal liability for responsible individuals. Every Category 1 error triggers a mandatory individual root cause analysis and corrective action plan.
Category 2 — Significant Errors. Category 2 errors represent material quality deficiencies that, while less severe than Category 1 errors, nonetheless compromise the quality and reliability of the SAR filing. Category 2 errors include:
•  Filing a SAR between 31 and 60 days from alert generation (exceeding the 30-day benchmark but falling short of the 60-day threshold for Category 1 classification)
•  Incomplete SAR narrative lacking key descriptions of suspicious activity, the basis for suspicion, or the nexus to potential criminal violations
•  Incorrect dollar amounts in the SAR filing that materially affect the characterization of the reported activity
•  Failure to file a continuing SAR within the 90-day deadline
Category 3 — Minor Errors. Category 3 errors represent quality issues that do not materially affect the substance or reliability of the SAR filing. Category 3 errors include:
•  Typographical errors in form fields (e.g., misspellings of names, transposed digits in non-material identification numbers)
•  Minor narrative quality deficiencies not affecting the substance of the filing (e.g., grammatical errors, minor stylistic inconsistencies, failure to include non-essential contextual information)
•  Incomplete but non-material supporting documentation (e.g., absence of a duplicative document where the relevant information is available from other sources in the investigation file)
A detailed Error Classification Matrix with specific definitions, examples, and borderline case guidance is attached as Appendix B.
B. Error Rate Tracking
Error rates are calculated on a monthly basis using the following formula:
Monthly Error Rate (Category 1 & 2) = (Number of SARs with at least one Category 1 or Category 2 error) ÷ (Total SARs reviewed in the QA sample during the month) × 100
The target error rate for Category 1 and Category 2 errors combined is less than 5% of reviewed SARs. This target reflects a standard of quality that, if consistently achieved, demonstrates sustainable compliance and should satisfy the expectations of the OCC, FinCEN, and Thornfield Consulting.
Category 3 errors are tracked separately, with a target error rate of less than 10% of reviewed SARs. While Category 3 errors do not individually represent material compliance concerns, a persistently elevated Category 3 error rate may indicate training deficiencies, carelessness, or process issues that, if unaddressed, could lead to more serious errors over time.
Error rates are tracked and reported across the following dimensions to enable targeted analysis and intervention:
(i) By analyst/investigator — enabling identification of individuals who may require additional training or supervision
(ii) By business line — retail banking, commercial lending, wealth management, and BaaS (broken out by individual BaaS partner) — enabling identification of business-line-specific quality issues
(iii) By SAR type — initial SARs versus continuing SARs — enabling assessment of whether the continuing SAR process presents distinct quality challenges
(iv) By alert source — Veridian TMS alerts, manual referrals, law enforcement referrals, and BaaS partner referrals — enabling assessment of whether certain alert sources are associated with higher or lower quality SAR filings
(v) By staffing category — permanent BRB staff versus Pinnacle temporary staff — enabling comparative quality assessment during the staffing transition period
C. Error Database
The QA Unit will maintain a centralized error tracking database in which each identified error is recorded with the following data elements:
•  Unique error identifier
•  SAR reference number (FinCEN BSA ID and internal case number)
•  Date of SAR filing
•  Date of QA review
•  Error category (1, 2, or 3)
•  Detailed error description
•  Analyst/investigator responsible for the SAR
•  Business line and BaaS partner (if applicable)
•  Alert source
•  Staffing category (permanent or temporary)
•  Root cause classification (see Section VIII)
•  Corrective action taken (see Section IX)
•  Corrective action status (open, in progress, validated, closed)
•  Date of corrective action closure
The error database will be maintained in a secure, access-controlled environment. Access to the database will be provided to BSA Officer Thomas Ikeda, CCO Patricia Langston, and Head of Internal Audit Derek Ballard for oversight purposes. Summary data and reports derived from the database will be provided to C&H and Thornfield Consulting in accordance with the applicable information-sharing protocols.
VIII. ROOT CAUSE ANALYSIS
Root cause analysis ("RCA") is a critical component of the QA Framework. Without a systematic effort to understand why errors occur, corrective actions risk addressing symptoms rather than underlying causes, leading to error recurrence and undermining the sustainability of the Bank's compliance improvements. This section establishes the trigger thresholds for RCA, the analytical methodologies to be employed, and the accountability and timeline requirements for RCA completion.
A. RCA Trigger Thresholds
The QA Framework establishes three levels of root cause analysis, each triggered by different conditions:
Individual RCA. An individual root cause analysis is required for every Category 1 (Critical) error identified during a QA review. Individual RCAs focus on the specific facts and circumstances surrounding a single error and are designed to identify the immediate and contributing causes of the failure.
Thematic RCA. A thematic root cause analysis is required when either of the following conditions is met:
•  The Category 2 error rate exceeds 5% in any given monthly review cycle; or
•  A pattern of three or more similar errors is identified across any analytical dimension — i.e., the same type of error is observed across multiple SARs filed by the same analyst, arising from the same business line or BaaS partner, originating from the same alert type, or exhibiting the same quality deficiency.
Thematic RCAs are designed to identify common drivers of recurring errors and to inform systemic corrective actions that address the root cause across the affected population.
Systemic RCA. A systemic root cause analysis is required when either of the following conditions is met:
•  The combined Category 1 and Category 2 error rate exceeds 8% in any single monthly review cycle; or
•  The combined Category 1 and Category 2 error rate trends upward for three consecutive months, regardless of the absolute rate.
Systemic RCAs represent the most comprehensive level of analysis and are designed to identify fundamental process, technology, staffing, or governance failures that are driving broad-based quality degradation.
B. RCA Methodology
The QA Framework employs two complementary analytical methodologies for root cause analysis:
Five Whys Analysis. The Five Whys technique is used for individual RCAs and as a component of thematic analyses. This iterative questioning method begins with the identified error and asks "why" at each successive level until the root cause is identified. The Five Whys approach is particularly effective for tracing errors back through a chain of contributing factors to the fundamental process breakdown or decision failure that initiated the error.
Fishbone (Ishikawa) Diagram Analysis. The Fishbone methodology is used for thematic and systemic RCAs. This approach organizes potential contributing factors into five categories, each of which is examined systematically:
•  People: Training adequacy, staffing levels, experience and expertise, workload and capacity, supervision quality
•  Process: Policy and procedure adequacy, workflow design, escalation protocols, approval and review chains, handoff procedures between investigation stages
•  Technology: Veridian TMS alert quality and tuning, system latency and performance, data integration and completeness, case management system functionality, filing platform reliability
•  Data: CDD/EDD data availability and accuracy, BaaS partner data feed quality and timeliness, transaction data completeness, customer identification data integrity
•  Governance: Supervisory review structure, escalation and accountability mechanisms, performance measurement, management oversight, compliance culture
All RCAs are documented in a standardized format (the RCA Report Template, attached as Appendix C), which includes a structured description of the error(s) under analysis, the analytical methodology employed, the identified root cause(s) and contributing factors, and recommended corrective actions.
C. RCA Accountability
The following timeline and accountability requirements govern the RCA process:
•  Individual RCAs must be completed within 10 business days of error identification.
•  Thematic and systemic RCAs must be completed within 20 business days of the triggering condition being identified.
•  All RCA findings are reviewed and approved by BSA Officer Thomas Ikeda.
•  RCA findings related to Category 1 errors and all systemic RCAs are escalated to CCO Patricia Langston for her review and concurrence.
•  RCA reports are maintained in the centralized error database and are available for review by Internal Audit, C&H, and Thornfield Consulting.
IX. CORRECTIVE ACTION PROCEDURES
The identification of errors and their root causes is meaningful only to the extent that it drives effective corrective action. This section establishes the procedures for developing, implementing, tracking, and validating corrective action plans, as well as the protocols for remedial training and personnel actions when warranted.
A. Corrective Action Plans (CAPs)
Category 1 Error CAPs. For each Category 1 error, a mandatory individual corrective action plan must be developed. The CAP must specify:
•  The specific remedial steps required to address the error (e.g., SAR re-filing, amended SAR filing, retroactive investigation, late filing of a previously unfiled SAR)
•  The person responsible for executing each remedial step
•  The target completion date for each step
•  The validation method by which the QA Unit will confirm that the corrective action has been effectively implemented
Thematic and Systemic CAPs. For quality issues identified through thematic or systemic RCAs, corrective action plans address the root causes identified in the RCA and may include one or more of the following types of interventions:
•  Revisions to SAR policies and procedures
•  Additional or enhanced training for affected analysts, investigators, or supervisors
•  Staffing adjustments (reallocation of workload, addition of supervisory resources, or modification of team structures)
•  Technology enhancements, including Veridian TMS tuning adjustments (the transaction monitoring model was last tuned in October 2022 and is significantly overdue for recalibration), acceleration of the TMS v.10.0 upgrade, or modifications to the case management system
•  Workflow redesign (e.g., addition of quality checkpoints, modification of escalation thresholds, implementation of peer review processes)
B. CAP Tracking and Closure
All corrective action plans are logged in the centralized error database with the following tracking fields: CAP identifier, associated error identifier(s), description of corrective action, responsible person, target completion date, actual completion date, validation method, validation result, and final status (open, in progress, validated, closed).
CAPs are validated for effectiveness by the QA Unit through re-testing. Specifically, the QA Unit will monitor subsequent QA review cycles for recurrence of the specific error type addressed by the CAP. If the error recurs after corrective action implementation, the CAP is reopened and the corrective action is reassessed.
Overdue CAPs are subject to escalation:
•  CAPs not closed by their target completion date are escalated to BSA Officer Thomas Ikeda for review and intervention.
•  CAPs overdue by more than 30 days beyond their target completion date are escalated to CCO Patricia Langston.
C. Remedial Training
Analysts or investigators who exhibit recurring quality issues — defined as two or more Category 1 or Category 2 errors within any 90-day period — are required to complete targeted remedial training. The training is designed to address the specific deficiency patterns identified through the QA review and RCA processes.
Remedial training content is developed in alignment with the Enterprise-Wide BSA/AML Training Plan, for which BRB has budgeted $1,800,000 (covering training development, delivery, and associated policy documentation). Training modules address the full range of SAR-related competencies, including alert investigation methodology, SAR narrative writing, FinCEN form completion, timeliness management, and BaaS-specific investigation techniques.
Pinnacle temporary staff are subject to the same remedial training requirements as permanent BRB employees. Performance issues identified through QA reviews involving Pinnacle analysts are reported to Andrea Solis, Director of Managed Services at Pinnacle Compliance Solutions LLC, in accordance with the reporting and performance management provisions of the Managed Services Agreement.
D. Personnel Actions
The QA Framework establishes clear thresholds at which persistent quality failures are escalated from the compliance domain to the human resources domain for potential personnel action. Specifically:
•  Permanent BRB Staff: An analyst or investigator who accumulates three or more Category 1 errors within any six-month period, or who maintains a consistent Category 2 error rate above 15% for three or more consecutive monthly review cycles, will be referred to Human Resources for potential personnel action. Personnel actions may include reassignment from SAR duties, placement on a performance improvement plan, or termination of employment, as warranted by the facts and circumstances.
•  Pinnacle Temporary Staff: Persistent quality failures by Pinnacle analysts — applying the same thresholds as for permanent staff — trigger a replacement request under the terms of the Pinnacle staffing contract. The replacement request is communicated to Andrea Solis, and Pinnacle is required to provide a qualified replacement within the timeline specified in the Managed Services Agreement.
The personnel action thresholds are designed to be proportionate and fair, providing analysts with multiple opportunities for corrective training before disciplinary consequences are imposed, while also ensuring that the Bank does not tolerate persistent quality failures that jeopardize its compliance posture.
X. REPORTING AND ESCALATION
Effective reporting and escalation mechanisms are essential to ensuring that QA results are communicated to the appropriate stakeholders in a timely manner and that significant quality issues receive the attention of senior management, the Board, and regulators as warranted. This section describes the reporting cadences, content requirements, and escalation protocols that govern the flow of QA information throughout the organization and to external stakeholders.
A. Monthly QA Report
The QA Unit Lead is responsible for preparing a Monthly QA Report for each monthly review cycle. The report is distributed to BSA Officer Thomas Ikeda, CCO Patricia Langston, and Head of Internal Audit Derek Ballard. A template for the Monthly QA Report is attached as Appendix D.
The Monthly QA Report includes the following content:
•  Filing Volume Summary: Total SARs filed during the review period, broken out by SAR type (initial vs. continuing), business line, BaaS partner, and alert source.
•  Sampling Summary: Total SARs sampled during the review period, broken out by random sample and targeted sample, with identification of the specific targeted sampling criteria that applied.
•  Error Rates: Error rates for Category 1, Category 2, and Category 3 errors, separately and in combination. Error rates presented in aggregate and broken out by analyst/investigator, business line, BaaS partner, alert source, SAR type, and staffing category.
•  Timeliness Metrics: Average number of days from alert generation to SAR filing; median days to filing; percentage of SARs filed within 25 days (Green), 26–30 days (Yellow), and beyond 30 days (Red).
•  SAR Quality Score Distribution: Distribution of Composite SAR Quality Scores across the sample, including the number and percentage of SARs classified as Deficient, Needs Improvement, and Satisfactory.
•  Open Corrective Action Plans: Summary of all open CAPs, including target completion dates, status, and any overdue items.
•  CAP Closure Rates: Number of CAPs closed during the review period and cumulative closure rate.
•  Trend Analysis: Month-over-month comparison of key metrics, including error rates, timeliness, and quality scores. Trailing six-month trend charts for each key metric.
•  BaaS Partner-Specific Metrics: Dedicated section reporting on SAR quality and timeliness metrics for each of the 14 active BaaS partners, with particular detail on NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.
•  Observations and Recommendations: QA Unit Lead's narrative commentary on significant findings, emerging trends, and recommended actions.
B. Quarterly QA Summary for Compliance Committee and Board
On a quarterly basis, a QA Summary Report is prepared for submission to the Compliance Committee, chaired by James Rutherford, and distributed to the BRFG Board of Directors. The Board-level distribution includes Diane Whitford (Chair & CEO), Arthur Connelly (Lead Independent Director and Chair of the Risk Committee), and Margaret Dao (Chair of the Audit Committee).
The Quarterly QA Summary is aligned with the Compliance Committee Reporting Framework and includes the following metrics and analysis:
•  Aggregate SAR filing volumes and trends
•  Filing timeliness performance against the 30-day benchmark
•  Composite quality score trends and distribution
•