CONFIDENTIAL SUPERVISORY INFORMATION PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION ASSERTED THIS DOCUMENT CONSTITUTES CONFIDENTIAL SUPERVISORY INFORMATION WITHIN THE MEANING OF 12 C.F.R. § 4.32 AND MAY NOT BE DISCLOSED WITHOUT THE PRIOR WRITTEN APPROVAL OF THE OFFICE OF THE COMPTROLLER OF THE CURRENCY.
DRAFT — Prepared for Review; To Be Finalized Closer to December 15, 2025 Filing Deadline
SECOND QUARTERLY PROGRESS REPORT TO THE OFFICE OF THE COMPTROLLER OF THE CURRENCY
Pursuant to Consent Order No. OCC-2025-003
Reporting Period: September 16, 2025 – December 15, 2025
Prepared by:
Belmont Ridge Bank National Association OCC Charter No. 48271
Submitted by:
Calderwood & Harkness LLP Outside Regulatory Counsel to Belmont Ridge Bank NA 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No.: 1045-00002
Addressed to:
Jonathan Frey National Bank Examiner / Examiner-in-Charge Office of the Comptroller of the Currency Northeastern District Office 340 Madison Avenue New York, NY 10017
Report Date: December 15, 2025
Consent Order Reference: OCC Consent Order No. OCC-2025-003, effective January 15, 2025
Independent Consultant Engagement Reference: TCG-BRB-2025-001 (Thornfield Consulting Group LLC)
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This Second Quarterly Progress Report (this "Report") is submitted on behalf of Belmont Ridge Bank National Association ("BRB" or the "Bank") to the Office of the Comptroller of the Currency (the "OCC") by Calderwood & Harkness LLP ("C&H"), as the Bank's outside regulatory counsel, pursuant to the reporting requirements set forth in Article XII of Consent Order No. OCC-2025-003 (the "Consent Order" or the "Order"). This Report covers the period from September 16, 2025 through December 15, 2025 (the "Reporting Period") and describes the progress the Bank has made across all five remediation workstreams since the filing of the First Quarterly Progress Report on September 15, 2025 (the "First Report").
As set forth in the First Report and recapitulated here for completeness, the Consent Order was issued by the OCC on January 15, 2025, following a targeted Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") examination conducted from March 2024 through September 2024. The Order identified five core deficiency categories requiring comprehensive remediation:
(i) Office of Foreign Assets Control ("OFAC") sanctions screening deficiencies, including the failure to screen 100% of transactions processed through fintech banking-as-a-service ("BaaS") partner channels;
(ii) Suspicious Activity Report ("SAR") filing deficiencies, including a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the OCC examination date and excessive average filing times;
(iii) Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD") failures affecting approximately 47,000 high-risk customer accounts, predominantly those onboarded through BaaS partner channels;
(iv) Transaction monitoring system ("TMS") model validation deficiencies, including the failure to conduct independent model validation of the Bank's Veridian Analytics TMS for more than three years prior to examination; and
(v) Board-level oversight deficiencies in the Bank's BSA/AML program governance structure.
In accordance with the timeline established by the Consent Order, BRB timely submitted its Comprehensive Remediation Action Plan (the "RAP") to the OCC on May 15, 2025, and filed the First Report on September 15, 2025. This Report constitutes the second of the quarterly progress reports required under Article XII of the Order and describes the significant progress achieved during the Reporting Period.
The Bank is pleased to report that it remains on track for full compliance program implementation and self-certification by the February 15, 2026 deadline established by the Consent Order. The key milestones achieved since the First Report include the following:
• Independent Model Validation of Upgraded TMS. The independent model validation of the upgraded Veridian Analytics TMS v.10.0 was completed on or about October 1, 2025, meeting the deadline established by the Consent Order. The validation was conducted by Thornfield Consulting Group LLC ("Thornfield") and confirmed that the upgraded system is operating effectively and in accordance with applicable regulatory expectations.
• OFAC Screening Fully Operational for All BaaS Channels. Full OFAC screening operationalization across all fourteen (14) active BaaS partner transaction flows was achieved on or about November 1, 2025, meeting the Consent Order milestone. All wire, ACH, card, and BaaS partner transaction streams are now subject to 100% real-time or batch OFAC screening, as applicable.
• CDD/EDD Remediation Progressing Toward Completion. The CDD/EDD remediation project, which involves the review and remediation of approximately 47,000 high-risk customer accounts, is progressing on schedule and on track to achieve the 100% completion target of January 15, 2026. As of the date of this Report, the Bank has completed remediation of approximately 41,300 accounts, or approximately 87.9% of the total population.
• SAR Backlog Fully Cleared. As previously reported in the First Report, the SAR backlog of approximately 2,400 unreviewed alerts was fully cleared by June 30, 2025. During the current Reporting Period, the Bank has continued to maintain SAR filing times well within the 30-day target established by the RAP, with an average filing time of approximately 19 days during the Reporting Period.
Thornfield Consulting Group LLC, the OCC-mandated independent consultant engaged under engagement reference TCG-BRB-2025-001, continues to conduct validation activities under the direction of Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory. Thornfield has completed its independent model validation of the Veridian TMS v.10.0, its validation testing of the remediated OFAC screening program, and is conducting ongoing monitoring of the CDD/EDD remediation effort. Thornfield's final validation report is anticipated to be delivered on or before February 15, 2026, in support of the Bank's compliance self-certification.
The total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty assessed under the Consent Order) remains within approved parameters. As detailed in Section X of this Report, total expenditures to date are approximately $35,400,000 against the $42,500,000 budget, with remaining projected expenditures estimated at approximately $6,200,000 through the February 15, 2026 self-certification date. The civil money penalty of $14,500,000 was timely paid on March 16, 2025, bringing the total remediation outlay including the CMP to $57,000,000.
The Bank and C&H are available to discuss the contents of this Report with Mr. Frey and the OCC examination team at the OCC's convenience.
II. BACKGROUND AND REGULATORY CONTEXT
A. Consent Order Summary
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Order resulted from a targeted BSA/AML examination that was commenced in March 2024 and concluded in September 2024. The examination was conducted by a team of OCC examiners led by National Bank Examiner Jonathan Frey, Examiner-in-Charge, from the OCC's Northeastern District Office.
The Consent Order cited the Bank's failure to maintain an adequate BSA/AML compliance program as required by 12 U.S.C. § 1818(s), the Bank Secrecy Act (31 U.S.C. §§ 5311–5332), and the implementing regulations at 31 C.F.R. Chapter X. In particular, the Order noted the Bank's failure to adequately and timely remediate prior supervisory actions, including:
(a) A Matter Requiring Attention ("MRA") issued in June 2022 relating to deficiencies in the Bank's BSA/AML transaction monitoring system and processes; and
(b) A Matter Requiring Immediate Attention ("MRIA") issued in November 2023 relating to significant gaps in the Bank's OFAC sanctions screening program, particularly with respect to transactions processed through the Bank's BaaS partner channels.
The Consent Order assessed a civil money penalty of $14,500,000 against the Bank, which was timely remitted to the United States Treasury on March 16, 2025. As of the date of this Report, no criminal referral to the United States Department of Justice ("DOJ") has been made in connection with the matters addressed by the Consent Order. The Financial Crimes Enforcement Network ("FinCEN") continues to monitor the Bank's SAR filing remediation efforts through Associate Director Angela Drummond of FinCEN's Enforcement Division, but no separate FinCEN enforcement action has been initiated as of this reporting date.
B. Engagement of Outside Counsel and Independent Consultant
In response to the Consent Order, the Bank engaged the following advisors:
Outside Regulatory Counsel. Calderwood & Harkness LLP was engaged on February 10, 2025, as outside regulatory counsel to the Bank for purposes of advising the Bank on compliance with the Consent Order, coordinating remediation activities, interfacing with the OCC and other regulatory agencies, and preparing all filings required by the Order. The engagement is led by Philip Hartmann, a partner in C&H's Banking & Finance Practice. C&H's engagement was approved by the Bank's Board of Directors and its General Counsel, Gregory Nardone.
Independent Consultant. Thornfield Consulting Group LLC was engaged on February 10, 2025, as the OCC-mandated independent consultant, following the OCC's issuance of non-objection to Thornfield's engagement on February 5, 2025, pursuant to Article VIII of the Consent Order. The engagement is memorialized under engagement reference TCG-BRB-2025-001 and is structured as a fixed-fee arrangement totaling $6,500,000, payable in twelve (12) monthly installments of $541,666.67, plus reimbursable expenses capped at $400,000, for a total engagement value not to exceed $6,900,000.
The Thornfield engagement team is comprised of the following senior professionals:
• Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory — Engagement Lead
• Robert Eastman, Senior Director, AML Transaction Monitoring — Responsible for independent model validation and transaction monitoring assessment
• Jennifer Hwang, Director, Sanctions & OFAC Compliance — Responsible for OFAC screening validation and sanctions compliance assessment
• Nathaniel Burgess, Director, Fintech & Payments Compliance — Responsible for BaaS compliance oversight validation and CDD/EDD remediation monitoring
Thornfield's outside counsel is Hargrove & Stein PC, located at 7 Times Square, 34th Floor, New York, NY 10036.
C. Reporting Timeline
The following table summarizes the key compliance and reporting milestones under the Consent Order, together with their current status:
As reflected above, BRB has met each of the milestones that has come due through the date of this Report. The two remaining substantive milestones — the CDD/EDD 100% completion target on January 15, 2026 and the full compliance self-certification on February 15, 2026 — are on track for timely completion, as described in detail in the sections that follow.
III. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION
A. Objective and Consent Order Requirements
Articles III and IV of the Consent Order required the Bank to remediate deficiencies in its OFAC sanctions screening program. The OCC examination identified that the Bank had failed to screen 100% of transactions processed through its fintech BaaS partner channels against applicable OFAC sanctions lists. Specifically, the OCC determined that approximately 12% of transactions processed through NovaPay Technologies Inc. ("NovaPay") — the Bank's largest BaaS partner by transaction volume — were not screened against OFAC sanctions lists during calendar year 2023. This represented approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed during that period. The unscreened transactions consisted primarily of wire transfers and ACH payments that were routed through a legacy integration pathway that had not been connected to the Bank's Veridian Analytics OFAC screening module.
The Consent Order required the Bank to achieve full OFAC screening operationalization across all BaaS partner channels by November 1, 2025, and to implement comprehensive OFAC compliance policies, procedures, and controls to prevent recurrence of the identified deficiencies.
B. Status of OFAC Screening Remediation
The Bank is pleased to report that the November 1, 2025 deadline for full OFAC screening operationalization across all BaaS partner channels has been met.
Veridian Analytics Inc. ("Veridian"), the Bank's sanctions screening and transaction monitoring vendor, completed the deployment and integration of its enhanced OFAC screening module across all fourteen (14) active BaaS partner transaction flows. The integration effort, which was conducted in three phases beginning in April 2025, involved the establishment of real-time application programming interface ("API") connections between each BaaS partner's transaction processing systems and the Bank's Veridian OFAC screening infrastructure. Both real-time screening (for wire transfers and high-value transactions) and batch screening workflows (for ACH and certain card transactions) have been implemented for all transaction types in accordance with the OFAC Screening Procedures Manual adopted by the Bank as part of the remediated policy suite.
As of November 1, 2025, all transactions processed through the Bank's three largest BaaS partners — NovaPay Technologies, FairLend Digital, and VaultEdge — are subject to 100% real-time OFAC screening. These three partners collectively represent approximately 87% of the Bank's total BaaS transaction volume. The remaining eleven (11) BaaS partners, which collectively represent approximately 13% of BaaS transaction volume, are also fully integrated and subject to 100% OFAC screening.
The integration was completed in the following phases:
• Phase 1 (April – June 2025): Integration of NovaPay Technologies, FairLend Digital, and VaultEdge transaction flows. These partners were prioritized on the basis of transaction volume and risk profile. Phase 1 was completed on June 15, 2025, as previously reported in the First Report.
• Phase 2 (July – September 2025): Integration of the next six (6) BaaS partners by transaction volume. Phase 2 was completed on September 22, 2025, slightly ahead of the internal target date of September 30, 2025.
• Phase 3 (October 2025): Integration of the remaining five (5) BaaS partners. Phase 3 was completed on October 28, 2025, ahead of the November 1, 2025 Consent Order deadline.
C. Validation and Testing Results
During the Reporting Period, Thornfield Consulting conducted independent validation testing of the Bank's remediated OFAC screening program. The validation was led by Jennifer Hwang, Director, Sanctions & OFAC Compliance. Thornfield's validation testing was conducted in accordance with the OFAC Remediation Testing Plan, which specifies the sampling methodology, sample sizes, testing frequency, and acceptance criteria for validation of the remediated screening infrastructure.
Thornfield's testing confirmed 100% screening coverage across all fourteen (14) BaaS partner transaction channels. Specifically, Thornfield selected a statistically representative sample of transactions processed through each BaaS partner during the period from August 1, 2025 through November 15, 2025 and verified that each sampled transaction had been screened against the applicable OFAC sanctions lists prior to processing. The sample included wire transfers, ACH transactions, card transactions, and BaaS partner-specific payment flows. Thornfield identified no instances of unscreened transactions within its sample population.
In addition to coverage testing, Thornfield evaluated the accuracy and effectiveness of the Bank's OFAC screening list management processes. The Bank's screening infrastructure is configured to screen against the following OFAC lists: the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, the Non-SDN Menu-Based Sanctions List, and other relevant OFAC-administered lists. Thornfield confirmed that all applicable lists are being propagated to the screening system within the Bank's established service-level timeframe (not more than twenty-four (24) hours following list updates published by OFAC).
The Bank's updated OFAC screening metrics for the Reporting Period reflect the following performance indicators as compared to the calendar year 2024 baseline:
The increase in total screening hits is attributable to the expanded screening coverage resulting from the integration of all BaaS partner transaction flows. Notably, the false-positive rate has improved from 99.92% to 99.95%, reflecting the enhanced tuning of the OFAC screening module that was implemented as part of the remediation. The average disposition time for screening hits has also decreased from 4.2 hours to 2.8 hours, reflecting the deployment of additional trained screening analysts and the implementation of automated triage workflows for low-risk hits.
D. OFAC Voluntary Self-Disclosure Status
As described in the OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis memorandum prepared by C&H and delivered to the Bank's General Counsel and Compliance Committee, the Bank undertook a careful analysis of whether to submit a voluntary self-disclosure ("VSD") to OFAC in connection with the NovaPay screening gaps identified by the OCC. As previously reported, following consultation with C&H and a thorough evaluation of the potential enforcement exposure, the Bank determined to file a VSD with OFAC, which was submitted on April 30, 2025.
During the current Reporting Period, the Bank received an acknowledgment of receipt from OFAC's Office of Compliance and Enforcement dated October 22, 2025. OFAC has not yet issued a finding or initiated a formal enforcement action in connection with the VSD. C&H continues to monitor the matter and will provide updates to the OCC in future reporting periods. The Bank is prepared to cooperate fully with any OFAC inquiry.
E. Revised OFAC Compliance Policy and Procedures
The Bank's revised enterprise-wide OFAC Compliance Policy was adopted by the Board of Directors on May 12, 2025, and has been in effect since that date. The OFAC Screening Procedures Manual, which provides detailed operational guidance for all sanctions screening activities, was finalized on June 1, 2025 and distributed to all relevant personnel, including BSA/AML compliance staff, transaction processing personnel, BaaS relationship managers, and operations staff.
The revised policies and procedures address, among other things, the following:
(a) Real-time and batch screening requirements for all transaction types, including specific requirements for BaaS partner transaction flows;
(b) Interdiction and blocking procedures, including the process for blocking transactions and accounts involving identified SDNs and other sanctioned parties;
(c) Escalation and reporting protocols, including internal escalation workflows and the preparation and filing of blocking reports with OFAC within the required ten (10) business days;
(d) List management processes, including automated list propagation, manual verification procedures, and quality assurance checks;
(e) Roles and responsibilities of all personnel involved in the sanctions screening process; and
(f) Recordkeeping and documentation requirements consistent with 31 C.F.R. Part 501.
F. Remaining Steps
The Bank considers Workstream 1 to be substantially complete. The OFAC screening remediation has been implemented and independently validated by Thornfield. The remaining activities associated with this workstream are as follows:
(i) Ongoing monitoring and periodic testing of the OFAC screening program in accordance with the Bank's established testing framework, including quarterly sampling of screening coverage and effectiveness;
(ii) Continued monitoring of the OFAC VSD submission and any resulting communications with OFAC; and
(iii) Inclusion of the OFAC screening workstream in Thornfield's final validation report, which is anticipated to be delivered on or before February 15, 2026.
IV. WORKSTREAM 2: SAR BACKLOG CLEARANCE & PROCESS IMPROVEMENT
A. Objective and Consent Order Requirements
Article V of the Consent Order required the Bank to address two related deficiencies in its suspicious activity reporting program: (i) the existence of a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned as of the September 2024 OCC examination date; and (ii) the Bank's excessive average SAR filing time of approximately 78 days from the date of alert generation to the date of SAR filing with FinCEN, which substantially exceeded both regulatory expectations and industry standards.
The Consent Order required the Bank to clear the SAR backlog by June 30, 2025 and to reduce the average SAR filing time to within 30 days of alert generation on a sustained basis.
B. SAR Backlog Clearance — Completion Status
As reported in the First Report, the Bank achieved full clearance of the SAR backlog by June 30, 2025. All 2,400 previously unreviewed alerts were fully dispositioned, with each alert having been either (a) escalated and resulted in the filing of a SAR with FinCEN, (b) closed with documentation of the investigative analysis and rationale for closure, or (c) consolidated with related alerts for joint review and disposition.
During the current Reporting Period, the Bank's SAR lookback project continued to progress toward completion. The lookback project, which was budgeted at $5,500,000, involves a retrospective review of historical transaction activity for the period from January 2022 through September 2024 to identify any potentially suspicious activity that may have been missed due to the transaction monitoring deficiencies identified in the Consent Order. As of the date of this Report, the lookback project has resulted in the identification and filing of 347 additional SARs beyond the Bank's normal-course filings. These lookback SARs relate primarily to transactions processed through the NovaPay and FairLend Digital BaaS channels during periods when transaction monitoring parameters were inadequately calibrated. The lookback project is expected to be substantially complete by January 15, 2026, with final quality assurance review to follow.
With respect to supplemental staffing, the Bank engaged Pinnacle Compliance Solutions LLC ("Pinnacle") under Statement of Work Reference PCS-BRB-2025-0012, with a total contract value of $3,600,000, to provide thirty (30) temporary full-time equivalent ("FTE") compliance analysts to support the SAR backlog clearance and lookback efforts. As the backlog clearance work has been completed and the lookback project nears conclusion, the Bank has commenced a phased ramp-down of Pinnacle temporary staff. As of the date of this Report, eighteen (18) Pinnacle temporary analysts remain deployed, with the ramp-down expected to be substantially complete by January 31, 2026, subject to the pace of the Bank's permanent hiring efforts described in Section VII.C below. The remaining Pinnacle analysts are supporting the CDD/EDD remediation effort on a transitional basis.
C. SAR Filing Timeliness Improvement
The Bank has achieved significant and sustained improvement in SAR filing timeliness during the current Reporting Period. The following table summarizes the Bank's SAR filing time performance:
As reflected above, the Bank's average SAR filing time during the current Reporting Period was approximately 19 days, representing a 76% reduction from the pre-remediation average of 78 days and a further improvement from the 26-day average reported in the First Report. The percentage of SARs filed within the 30-day target has increased from 34% pre-remediation to 94% during the current Reporting Period. The Bank is working to achieve 100% compliance with the 30-day target on a sustained basis; the small percentage of SARs filed beyond 30 days during the Reporting Period involved complex multi-jurisdictional cases requiring extended investigative analysis, all of which were escalated to the BSA Officer and documented in accordance with the Bank's revised SAR Policy & Procedures.
The following table provides comparative SAR and CTR filing volume data:
The year-over-year increase in total SAR filings reflects the combined effect of the enhanced transaction monitoring capabilities of the Veridian TMS v.10.0, the completion of the SAR backlog and lookback projects, and the increased sensitivity of the Bank's monitoring scenarios following the model validation and tuning exercise described in Section VI below. The continued growth in BaaS-related SARs as a proportion of total filings is consistent with the growth trajectory of the Bank's BaaS business and the enhanced monitoring focus on BaaS transaction flows.
D. SAR Quality Assurance Framework
The Bank has implemented a comprehensive SAR Quality Assurance ("QA") framework designed to ensure the accuracy, completeness, and timeliness of all SAR filings on a sustained basis. The QA framework, which was developed in consultation with Thornfield and is described in the Bank's revised SAR Policy & Procedures, includes the following components:
(a) Random Sampling: A random sample of not less than 10% of all SARs filed during each calendar month is selected for independent quality review by the Bank's QA team, which operates independently of the SAR filing function within the BSA/AML department.
(b) Risk-Based Sampling: An additional risk-based sample of SARs is selected for review each month, targeting SARs involving high-risk BaaS partner transactions, high-dollar transactions, and SARs filed in connection with the lookback project.
(c) Error Tracking and Root Cause Analysis: All quality deficiencies identified through QA reviews are logged, categorized, and subjected to root cause analysis. Common error categories include narrative quality deficiencies, incomplete transaction detail, inaccurate subject information, and filing timeliness exceptions.
(d) Corrective Action and Continuous Improvement: Identified deficiencies are escalated to the applicable analyst's supervisor for corrective action, and systemic issues are addressed through targeted training and process improvements.
During the current Reporting Period, the Bank's QA team reviewed a total of 498 SARs (approximately 11.8% of total SARs filed during the period). The QA review identified quality observations in 23 SARs (4.6% of reviewed filings), consisting primarily of narrative enhancements and minor data corrections. No material filing deficiencies were identified, and all identified observations were remediated through the corrective action process. The 4.6% observation rate represents an improvement from the 7.2% rate reported during the First Report period.
E. Revised SAR Policy and Procedures
The Bank's revised SAR Policy & Procedures were adopted by the Board Compliance Committee on May 12, 2025 and have been in effect since that date. The revised policy addresses, among other things: SAR filing standards and regulatory thresholds; alert investigation and disposition procedures; escalation protocols for complex or high-priority cases; quality review requirements, including mandatory supervisory review prior to filing; narrative drafting standards aligned with FinCEN guidance; timeliness benchmarks requiring filing within 30 days of alert generation absent documented supervisory approval for extension; and continuing SAR filing obligations for ongoing suspicious activity.
F. Coordination with FinCEN
FinCEN has continued to monitor the Bank's SAR filing remediation through Associate Director Angela Drummond of FinCEN's Enforcement Division. During the Reporting Period, C&H participated in one informational call with Associate Director Drummond on October 28, 2025, during which C&H provided a status update on the Bank's SAR backlog clearance, lookback project, and filing timeliness improvements. Associate Director Drummond acknowledged the progress reported and did not raise any concerns or adverse findings. As of the date of this Report, no separate FinCEN enforcement action has been initiated against the Bank. C&H will continue to provide updates to FinCEN as requested and will promptly notify the OCC of any material developments in FinCEN's monitoring.
V. WORKSTREAM 3: CDD/EDD REMEDIATION
A. Objective and Consent Order Requirements
Article VI of the Consent Order required the Bank to remediate CDD/EDD documentation for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through the Bank's fintech BaaS partner channels. The OCC examination determined that these accounts had inadequate or missing CDD/EDD documentation, including deficient customer identification records, incomplete beneficial ownership information, inadequate risk assessments, and absent or insufficient EDD documentation for accounts classified as high-risk.
The Consent Order established the following remediation milestones:
• Milestone 1 (July 15, 2025): Completion of CDD/EDD remediation for 50% of the affected population (approximately 23,500 accounts).
• Milestone 2 (January 15, 2026): Completion of CDD/EDD remediation for 100% of the affected population (approximately 47,000 accounts).
The total budget allocated for the CDD/EDD remediation workstream is $4,300,000.
B. Progress Against Milestones
As previously reported in the First Report, the Bank achieved Milestone 1 on July 14, 2025, one day ahead of the July 15, 2025 deadline, with 23,712 accounts remediated (approximately 50.5% of the total population).
During the current Reporting Period, the Bank has continued to make significant progress toward Milestone 2. As of December 15, 2025, the Bank has completed CDD/EDD remediation for approximately 41,300 accounts, representing approximately 87.9% of the total population of 47,000 accounts. This leaves approximately 5,700 accounts remaining to be remediated before the January 15, 2026 deadline.
The following table summarizes the Bank's CDD/EDD remediation progress by BaaS partner:
Based on the current pace of remediation — approximately 2,200 accounts per week — the Bank projects that it will complete remediation of all remaining 5,700 accounts by approximately January 12, 2026, providing a modest buffer ahead of the January 15, 2026 deadline. The Bank has identified the remediation of the remaining 11 smaller BaaS partners as the area requiring the most focused attention, as the completion rate for these partners (74.8%) lags the completion rates for the three largest partners. This reflects the fact that certain of the smaller partners have been less responsive to data requests and have required additional follow-up from the Bank's BaaS relationship management team. The Bank has escalated these matters through the enhanced BaaS compliance oversight framework described in Section VIII below and expects that the remaining accounts will be remediated on schedule.
C. Remediation Methodology
The CDD/EDD remediation is being conducted in accordance with the CDD/EDD Remediation Methodology & Prioritization Memorandum developed by the Bank's compliance team in consultation with Thornfield. The methodology employs a risk-based triage and prioritization approach, under which accounts are categorized and remediated in the following order of priority:
(i) Highest-risk accounts (those with the highest composite risk scores, including accounts with known negative media, PEP indicators, high-risk jurisdictions, or transaction volumes exceeding established thresholds);
(ii) High-volume BaaS partner accounts (accounts onboarded through NovaPay, FairLend Digital, and VaultEdge, which collectively represent 87% of BaaS transaction volume);
(iii) Accounts with the most significant documentation gaps (those missing beneficial ownership information, incomplete customer identification records, or absent EDD documentation); and
(iv) Remaining accounts, prioritized by transaction volume and residual risk.
The remediation process for each account involves a standardized review and, where necessary, the collection of supplemental documentation from the customer and/or the applicable BaaS partner. Remediation activities include verification and updating of customer identification information, collection and verification of beneficial ownership information consistent with 31 C.F.R. § 1010.230, completion of risk assessments using the Bank's updated risk rating methodology, and preparation of EDD documentation for accounts classified as high-risk. Where customer outreach is required, the Bank has implemented a multi-channel approach (email, secure portal, and telephone) to maximize response rates and minimize delays.
Pinnacle temporary analysts continue to support the CDD/EDD remediation effort. As of the date of this Report, twelve (12) of the eighteen (18) remaining Pinnacle analysts are dedicated to CDD/EDD remediation activities, providing surge capacity as the Bank works toward the January 15, 2026 deadline.
D. CDD/EDD Progress Tracking Dashboard
The CDD/EDD Progress Tracking Dashboard, developed in accordance with the specifications established by the Bank's Compliance Committee, is fully operational and provides real-time visibility into remediation progress across all BaaS partners and account categories. The dashboard aggregates data from the Bank's case management system, CDD/EDD documentation repository, and BaaS partner data feeds, and produces standardized reporting on the following key performance indicators:
• Total accounts remediated (count and percentage of 47,000);
• Accounts remediated by BaaS partner;
• Accounts remediated by risk tier;
• Weekly remediation velocity (accounts completed per week);
• Projected completion date based on current trajectory;
• Accounts pending customer outreach or partner data response;
• Accounts with documentation exceptions requiring escalation; and
• Quality assurance review results.
Dashboard reports are prepared weekly by the BSA/AML department and are presented to the Compliance Committee (Chair: James Rutherford) at each monthly meeting. The dashboard data is also shared with Thornfield on a bi-weekly basis to support Thornfield's ongoing validation monitoring of the CDD/EDD workstream.
E. Revised CDD/EDD Policy
The Bank's revised CDD/EDD Policy was adopted by the Board Compliance Committee on May 12, 2025 and has been in effect since that date. The revised policy represents a comprehensive overhaul of the Bank's prior CDD/EDD framework and addresses the following key areas:
(a) Updated customer identification procedures consistent with the Customer Identification Program ("CIP") requirements of 31 C.F.R. § 1020.220;
(b) A revised risk rating methodology incorporating enhanced risk factors for BaaS-onboarded customers, including the risk profile of the BaaS partner, the nature of the products and services offered through the BaaS channel, and the geographic risk associated with the customer population;
(c) Beneficial ownership requirements aligned with the FinCEN CDD Rule (31 C.F.R. § 1010.230), including collection, verification, and ongoing updating requirements;
(d) Ongoing monitoring standards, including the frequency and scope of periodic CDD/EDD reviews, transaction monitoring integration, and event-driven review triggers; and
(e) Periodic review cycles establishing mandatory review intervals of twelve (12) months for high-risk accounts, twenty-four (24) months for medium-risk accounts, and thirty-six (36) months for low-risk accounts.
Specific supplemental requirements for BaaS-onboarded customers have been incorporated into the policy, including enhanced onboarding procedures, mandatory EDD for all BaaS customers meeting defined risk thresholds, and BaaS partner data quality validation requirements.
F. BaaS Partner CDD/EDD Responsibility Matrix
The Bank has implemented a comprehensive RACI (Responsible, Accountable, Consulted, Informed) matrix delineating the respective CDD/EDD obligations of the Bank and its BaaS partners. The RACI matrix is incorporated into the BaaS Partner CDD/EDD Responsibility Matrix, which has been distributed to all fourteen (14) BaaS partners and is incorporated by reference into the compliance addenda to the Bank's BaaS partner agreements (as described in Section VIII.B below).
Under the RACI framework, the Bank retains ultimate accountability for all CDD/EDD obligations as the regulated depository institution, while certain front-line data collection responsibilities may be delegated to BaaS partners subject to the Bank's oversight and validation. The Bank's compliance team conducts quality assurance reviews of all CDD/EDD documentation collected by BaaS partners and retains the right to reject or require supplementation of any documentation that does not meet the Bank's standards.
The Bank has received enhanced cooperation from its three largest BaaS partners in connection with the CDD/EDD remediation effort. Specifically:
• NovaPay Technologies (Ethan Garrison, CEO): Following issuance of the Bank's compliance remediation letter on March 15, 2025, NovaPay has dedicated a team of fifteen (15) compliance support staff to assist with customer outreach and data collection for the remediation project. NovaPay's cooperation has been a significant contributor to the 91.0% completion rate for NovaPay-originated accounts.
• FairLend Digital (Aisha Okonkwo, CEO): FairLend Digital has similarly responded constructively to the Bank's compliance remediation letter and has implemented a secure data portal for the transmission of supplemental CDD/EDD documentation.
• VaultEdge (Marcus Tan, CEO): VaultEdge has cooperated with the Bank's CDD/EDD requests and has provided expedited access to its customer records for accounts requiring remediation.
G. Remaining Steps
The Bank's primary focus for the period between the date of this Report and the January 15, 2026 deadline is the completion of the remaining approximately 5,700 accounts requiring CDD/EDD remediation. The Bank has identified the following actions to ensure timely completion:
(i) Dedicated surge capacity: Twelve (12) Pinnacle temporary analysts will remain deployed on CDD/EDD remediation through January 15, 2026;
(ii) Escalated partner outreach: The Bank's BaaS relationship management team has been directed to conduct daily status calls with the remaining smaller BaaS partners to expedite data responses;
(iii) Supervisory escalation: Any accounts for which customer or partner data has not been received by January 5, 2026 will be escalated to the BSA Officer and CCO for determination of appropriate action, which may include account restriction or closure; and
(iv) Thornfield validation: Thornfield will include validation of the CDD/EDD remediation completeness in its final report due February 15, 2026.
VI. WORKSTREAM 4: TRANSACTION MONITORING MODEL VALIDATION & TUNING
A. Objective and Consent Order Requirements
Article VII of the Consent Order required the Bank to address significant deficiencies in the validation and tuning of its transaction monitoring system. The OCC examination determined that the Bank's Veridian Analytics TMS v.8.3 had not been independently validated since March 2021, a period of more than three years prior to the commencement of the OCC's targeted examination. Additionally, the tuning parameters for the TMS — including scenario thresholds, alert rules, and risk scoring models — had last been updated in October 2022 and had not been recalibrated to reflect changes in the Bank's customer base, product mix, or risk profile, including the significant growth in BaaS transaction volumes.
The Consent Order required the Bank to:
(i) Upgrade the TMS to a current version with enhanced capabilities, with User Acceptance Testing ("UAT") to be completed by August 1, 2025; and
(ii) Complete an independent model validation of the upgraded TMS by October 1, 2025.
B. Veridian TMS v.10.0 Deployment Status
As reported in the First Report, Veridian Analytics Inc., under Contract No. VA-BRB-2023-0044, completed the implementation and deployment of the Veridian TMS v.10.0 upgrade, including the successful completion of User Acceptance Testing, on or about August 1, 2025. The implementation cost was $2,800,000 on a one-time basis, and the Bank entered into an amended licensing agreement reflecting an incremental annual licensing cost of $1,900,000, bringing the total annual contract value ("ACV") for the Veridian platform to $6,000,000 per year, up from the prior ACV of $4,100,000 per year.
The Veridian TMS v.10.0 has been operating in the Bank's production environment since August 2025. The upgrade included a number of significant enhancements relevant to the Consent Order's requirements, including:
(a) Enhanced BaaS transaction monitoring scenarios designed to address the specific risk typologies associated with fintech-originated transactions;
(b) Improved machine learning-assisted alert prioritization to reduce false-positive alert volumes and improve investigator efficiency;
(c) Updated threshold calibration tools enabling more granular and frequent tuning of monitoring parameters;
(d) Enhanced data ingestion capabilities supporting real-time integration with all fourteen (14) BaaS partner transaction feeds; and
(e) Improved reporting and analytics dashboards providing enhanced visibility into monitoring performance metrics.
The technology implementation was overseen by Linda Petrosian, Chief Information Officer / Chief Technology Officer of BRB, with coordination support from Priya Subramanian, VP of Client Solutions at Veridian Analytics Inc.
C. Independent Model Validation — Completion
The Bank is pleased to report that the independent model validation of the Veridian TMS v.10.0 was completed on or about October 1, 2025, meeting the Consent Order deadline. The validation was conducted by Thornfield Consulting, with Robert Eastman, Senior Director, AML Transaction Monitoring, serving as the lead validator.
The scope of Thornfield's independent model validation encompassed the following areas:
(i) Model Design and Conceptual Soundness: Review of the TMS's underlying methodology, including scenario design, rule logic, and risk scoring algorithms, to confirm that the model is conceptually sound and appropriate for the Bank's risk profile, customer base, and product mix.
(ii) Data Integrity: Validation of the completeness, accuracy, and timeliness of data ingested by the TMS from the Bank's core banking system, BaaS partner transaction feeds, and other data sources.
(iii) Scenario and Rule Calibration: Assessment of the calibration of all monitoring scenarios and alert rules, including threshold settings, against the Bank's current risk profile and transaction patterns.
(iv) Threshold Analysis: Above-the-line and below-the-line testing to evaluate whether monitoring thresholds are appropriately set to capture potentially suspicious activity while minimizing false-positive alerts.
(v) Output Validation: Review of a statistically representative sample of TMS outputs (alerts generated and alerts not generated) to confirm that the system is functioning as designed and is effectively identifying potentially suspicious activity.
(vi) Outcomes Analysis: Assessment of the TMS's overall effectiveness by analyzing SAR conversion rates, alert disposition patterns, and correlation between monitoring outputs and known suspicious activity typologies.
Thornfield's validation concluded that the Veridian TMS v.10.0 is operating effectively and in a manner consistent with applicable regulatory expectations and industry standards. Thornfield identified a limited number of observations relating to the tuning of certain BaaS-specific monitoring scenarios, which the Bank addressed during the Reporting Period through the implementation of updated tuning parameters in coordination with Veridian. Specifically, Thornfield recommended adjustments to the threshold settings for two scenarios — one relating to rapid movement of funds through BaaS deposit accounts and another relating to structuring patterns in ACH transactions originated through BaaS channels. Both adjustments were implemented on or about November 10, 2025, and Thornfield confirmed the adequacy of the revised parameters through follow-up testing.
All updated tuning parameters have been documented in the Bank's model documentation repository and have been approved by the Bank's Model Risk Management Committee.
D. Transaction Monitoring Performance Metrics
The following table summarizes the Bank's transaction monitoring performance metrics for the current Reporting Period as compared to the calendar year 2024 baseline:
The annualized alert volume of approximately 38,200 represents a modest reduction from the CY 2024 baseline of 41,500, which is attributable to the enhanced tuning of the Veridian TMS v.10.0 and the implementation of machine learning-assisted alert prioritization. Importantly, despite the reduction in total alert volumes, the SAR conversion rate has increased from 9.3% to 12.1%, indicating that the system is generating higher-quality alerts and that the reduction in alert volume has been achieved by eliminating low-value false-positive alerts rather than reducing the capture of genuinely suspicious activity. The improvement in the average alert-to-disposition time from 14.3 days to 8.6 days reflects both the reduction in alert volumes and the increased analyst capacity resulting from the Bank's hiring and temporary staffing initiatives.
E. Ongoing Validation Schedule
In accordance with the revised BSA/AML program governance framework and OCC supervisory expectations, the Bank has established a periodic independent model validation schedule requiring independent validation of the TMS at least annually. The next scheduled independent model validation is anticipated to occur during the third quarter of 2026 (on or about October 2026). The Bank's Model Risk Management Committee, in coordination with the Compliance Committee, will oversee the scheduling and execution of the annual validation.
With respect to the Ridgeline Data Systems LLC contingency engagement that was referenced in the RAP, the Bank notes that the Veridian TMS v.10.0 upgrade has proven sufficient to meet the Bank's transaction monitoring requirements, and the Bank has determined not to pursue the Ridgeline engagement at this time. The proposed Ridgeline engagement (ACV of $7,200,000 per year, five-year term, total contract value of $36,000,000) was evaluated as a potential replacement for the Veridian platform in the event that the upgrade proved inadequate. In light of the successful implementation and validation of the Veridian TMS v.10.0, the Bank's Technology Steering Committee, with the concurrence of the Compliance Committee, has determined that the Ridgeline evaluation is not warranted at this time and will be revisited in connection with the Bank's next technology strategic planning cycle.
VII. WORKSTREAM 5: BSA/AML PROGRAM GOVERNANCE & TRAINING ENHANCEMENT
A. Objective and Consent Order Requirements
Article IX of the Consent Order required the Bank to address deficiencies in its BSA/AML program governance structure and training program. Specifically, the Order required the Bank to:
(i) Establish a dedicated Compliance Committee of the Board of Directors with specific responsibility for overseeing the Bank's BSA/AML and OFAC compliance program;
(ii) Enhance BSA/AML reporting to the Board to include key metrics related to SAR filing volumes and timeliness, OFAC screening effectiveness, CDD/EDD compliance, and transaction monitoring performance;