1045-00002 · Calderwood & Harkness LLP · documents

securities-disclosure-obligations-memo.docx DOCUMENT Antitrust

71 / 84 ← → ✕

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4000 Facsimile: (212) 558-3588

February 14, 2025

MEMORANDUM

TO:

Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc. 680 Lexington Avenue, 22nd Floor New York, New York 10022

CC:

Samantha Reeves, Chief Financial Officer, BRB/BRFG Patricia Langston, Chief Compliance Officer, BRB Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP Carlos Espinoza, Working Associate, Calderwood & Harkness LLP

FROM:

Philip Hartmann, Partner, Calderwood & Harkness LLP

RE:

Securities Disclosure Obligations of Belmont Ridge Financial Group, Inc. (NYSE: BRFG) in Connection with OCC Consent Order No. OCC-2025-003

Matter No.: 1045-00002

THIS MEMORANDUM IS PROTECTED BY THE ATTORNEY-CLIENT PRIVILEGE AND CONSTITUTES ATTORNEY WORK PRODUCT. IT IS INTENDED SOLELY FOR THE USE OF THE ADDRESSEE AND THOSE PERSONS COPIED HEREIN. THIS MEMORANDUM SHOULD NOT BE DISCLOSED TO ANY THIRD PARTY WITHOUT THE PRIOR WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP. DISCLOSURE TO ANY THIRD PARTY MAY RESULT IN WAIVER OF THE ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the securities disclosure obligations of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") (NYSE: BRFG) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), and the rules and regulations promulgated thereunder by the U.S. Securities and Exchange Commission (the "SEC"), in connection with the consent order issued by the Office of the Comptroller of the Currency (the "OCC") against Belmont Ridge Bank National Association ("BRB" or the "Bank") on January 15, 2025, designated as OCC Consent Order No. OCC-2025-003 (the "Consent Order"). BRB operates under OCC Charter No. 48271 and holds FDIC Certificate No. 31845.

BRFG is a publicly traded bank holding company incorporated in the State of Delaware (EIN 83-2947561) whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG." BRFG is the sole parent company and controlling shareholder of BRB (EIN 13-6148320). As a publicly traded reporting company, BRFG is subject to the full panoply of SEC disclosure requirements, including but not limited to current reports on Form 8-K, annual reports on Form 10-K, quarterly reports on Form 10-Q, and proxy statements filed pursuant to Section 14(a) of the Exchange Act.

The Consent Order imposes significant obligations on BRB arising from deficiencies in its Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program and related regulatory frameworks, including failures in Office of Foreign Assets Control ("OFAC") sanctions screening, suspicious activity reporting, customer due diligence and enhanced due diligence, transaction monitoring system model validation, and Board-level compliance oversight. The Consent Order further imposes a civil money penalty ("CMP") of $14,500,000 payable by March 16, 2025. The Board of Directors of BRFG has approved a comprehensive remediation budget of $42,500,000 (exclusive of the CMP), bringing the total estimated financial exposure in connection with the Consent Order to $57,000,000.

The Company disclosed the Consent Order publicly via a Form 8-K filed on January 16, 2025, one business day after the Consent Order's effective date. On the date of disclosure, BRFG's common stock declined from approximately $47.82 per share to approximately $41.15 per share — a decline of approximately $6.67 per share, or 13.9% — confirming the market's assessment of the Consent Order's materiality. As of February 7, 2025, the stock price had partially recovered to $47.82 per share.

The principal disclosure vehicles requiring attention are: (i) the initial Form 8-K filing (already made on January 16, 2025, and subject to review for completeness), (ii) subsequent Form 8-K filings as material developments occur, (iii) the annual report on Form 10-K for fiscal year ended December 31, 2024 ("FY 2024 10-K"), which will be the first annual report filed after the Consent Order's effective date, and (iv) the proxy statement for the Company's upcoming annual meeting of shareholders.

Based on our analysis, we conclude that the Consent Order, CMP, and remediation program are material to BRFG under both quantitative and qualitative standards and require robust, continuing disclosure across all SEC reporting vehicles. The initial Form 8-K disclosure has been filed; however, additional and ongoing disclosure obligations arise in connection with the FY 2024 10-K, quarterly Form 10-Q filings, the proxy statement, and potential future Form 8-K filings as material developments occur throughout the remediation period and beyond. This memorandum sets forth our detailed analysis and recommendations for each of these disclosure obligations.

II. Background

A. The Consent Order

On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB. The Consent Order is the culmination of a targeted BSA/AML examination that the OCC conducted from March 2024 through September 2024, during which OCC examiners identified pervasive deficiencies in BRB's BSA/AML compliance infrastructure. The Consent Order identifies five core categories of deficiency, each of which is described below.

First, OFAC Sanctions Screening Failures. The OCC found that approximately 12% of wire transfer and Automated Clearing House ("ACH") transactions processed through BRB's banking-as-a-service ("BaaS") partnership with NovaPay Technologies Inc. ("NovaPay") were not subjected to OFAC sanctions screening. The unscreened transaction volume was approximately 3,800,000 transactions out of a total of approximately 31,700,000 NovaPay transactions processed through BRB in calendar year 2023. The failure to screen these transactions against OFAC's Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC-administered sanctions lists constitutes a serious potential violation of the International Emergency Economic Powers Act ("IEEPA") and OFAC's implementing regulations at 31 C.F.R. Part 500 et seq.

Second, SAR Filing Deficiencies. The OCC identified a significant backlog of unreviewed suspicious activity alerts within BRB's transaction monitoring system. As of September 2024, approximately 2,400 suspicious activity alerts remained unreviewed, and the Bank's average time to file Suspicious Activity Reports ("SARs") with the Financial Crimes Enforcement Network ("FinCEN") was 78 days — substantially exceeding the 30-day regulatory expectation established under FinCEN's SAR filing requirements at 31 C.F.R. § 1020.320.

Third, Customer Due Diligence/Enhanced Due Diligence Failures. The OCC found that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BRB's fintech BaaS partnerships — lacked adequate customer due diligence ("CDD") and enhanced due diligence ("EDD") documentation. These deficiencies implicate the Customer Due Diligence Rule promulgated by FinCEN at 31 C.F.R. § 1010.230, as well as the OCC's Comptroller's Handbook guidance on BSA/AML compliance.

Fourth, Transaction Monitoring Model Validation Deficiencies. The OCC found that BRB's primary transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 and was last tuned in October 2022. Sound risk management practices, as well as interagency guidance on model risk management (OCC Bulletin 2011-12 / Federal Reserve SR 11-7), require periodic independent validation and ongoing tuning of transaction monitoring models. The absence of validation for nearly four years represents a significant control failure.

Fifth, Board Oversight Deficiencies. The OCC found that BRB's Board of Directors had not established a dedicated Compliance Committee and that BSA/AML reporting metrics provided to the Board were inadequate to enable effective oversight. The lack of dedicated Board-level compliance governance is inconsistent with the OCC's heightened supervisory expectations for institutions with significant BSA/AML risk profiles, particularly those engaged in BaaS activities.

The Consent Order also references BRB's prior supervisory history, which amplifies the severity of the current findings. The OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding transaction monitoring deficiencies and a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps. The Consent Order expressly cites BRB's failure to remediate these prior supervisory findings as an aggravating factor.

The Consent Order imposes a civil money penalty of $14,500,000, payable within 60 days of the Consent Order's effective date (i.e., by March 16, 2025). As of the date of this memorandum (February 14, 2025), no criminal referral to the U.S. Department of Justice ("DOJ") has been made in connection with the matters underlying the Consent Order; however, the Consent Order does not preclude such a referral in the future, and the prospect of a DOJ referral remains a material risk factor.

Additionally, FinCEN is separately monitoring BRB's SAR filing remediation efforts. Angela Drummond, Associate Director of FinCEN's Enforcement Division, has been designated as the FinCEN liaison for BRB's remediation. FinCEN has expressly reserved its enforcement rights, meaning that a separate FinCEN enforcement action — potentially including additional civil money penalties — remains possible.

B. Remediation Program

In response to the Consent Order, BRFG and BRB have initiated a comprehensive remediation program. Calderwood & Harkness LLP was formally engaged on February 10, 2025 as outside regulatory counsel to advise the Company and the Bank on all matters related to the Consent Order and remediation.

The OCC has mandated the engagement of an independent consultant to assess BRB's BSA/AML compliance program and oversee certain aspects of the remediation. Thornfield Consulting Group LLC ("Thornfield") has been engaged pursuant to the Consent Order's independent consultant requirement (engagement reference TCG-BRB-2025-001). The OCC issued its formal non-objection to the Thornfield engagement on February 5, 2025. Thornfield's engagement is structured as a fixed-fee arrangement of $6,500,000 plus $400,000 in expenses, for a total of $6,900,000.

The Board of Directors of BRFG approved a comprehensive remediation budget of $42,500,000, exclusive of the $14,500,000 CMP. The approved remediation budget is allocated as follows:

The Consent Order establishes two critical deadlines for the remediation program. First, BRB is required to submit a Comprehensive Remediation Action Plan (the "Action Plan") to the OCC by May 15, 2025. The Action Plan must set forth detailed milestones, responsible personnel, resource allocations, and timelines for each remediation workstream. Second, the Consent Order requires full compliance implementation — meaning completion of all remediation activities and demonstration of sustained compliance — by February 15, 2026, twelve months from the approximate date of remediation commencement.

C. BRFG Financial Profile (as of December 31, 2024)

To contextualize the financial impact of the Consent Order and remediation program, it is helpful to summarize BRFG's key financial metrics as of December 31, 2024:

BRFG's core business lines consist of retail banking, commercial lending, wealth management, and fintech BaaS partnerships. The BaaS business line, while representing a modest percentage of total assets, generates $127,400,000 in annual revenue and processes approximately $74,300,000,000 in annual transaction volume across 14 active fintech partners. This business line is directly implicated by the Consent Order's findings regarding OFAC screening failures, CDD/EDD deficiencies, and transaction monitoring inadequacies, all of which disproportionately affected BaaS-onboarded accounts and transactions.

III. Form 8-K Disclosure Analysis

A. Initial 8-K Filing — January 16, 2025 Disclosure

BRFG publicly disclosed the Consent Order via a Current Report on Form 8-K filed with the SEC on January 16, 2025, one business day after the Consent Order's January 15, 2025 effective date. This section analyzes the applicable Form 8-K triggering items and the timeliness and appropriateness of the filing.

Item 1.01 — Entry into a Material Definitive Agreement. Item 1.01 of Form 8-K requires disclosure when a registrant enters into a "material definitive agreement not made in the ordinary course of business." The threshold question is whether an OCC consent order constitutes a "material definitive agreement" within the meaning of this item. Consent orders are not traditional commercial agreements; they are regulatory orders that impose legally binding obligations on the subject institution, typically arising from the exercise of the OCC's enforcement authority under 12 U.S.C. § 1818. However, courts and SEC staff have recognized that the substance, rather than the form, of an arrangement determines whether it falls within the scope of Item 1.01. A consent order that imposes material financial obligations (here, a $14,500,000 CMP) and significant operational requirements (here, a $42,500,000 remediation program) can, in certain circumstances, be characterized as a "material definitive agreement" for disclosure purposes. Nevertheless, the more customary and appropriate approach for disclosing regulatory enforcement actions is under Item 8.01, as discussed below.

Item 2.06 — Material Impairments. Item 2.06 requires disclosure when the registrant's board of directors, a committee thereof, or authorized officers conclude that a material charge for impairment to one or more of the registrant's assets is required under GAAP. While the $14,500,000 CMP and $42,500,000 remediation budget represent material charges, Item 2.06 is most commonly applied to impairment of goodwill, long-lived assets, or investments, rather than regulatory penalties and remediation costs. Accordingly, Item 2.06 is not the primary disclosure vehicle, although the Company should evaluate whether any assets (such as capitalized software costs related to the Veridian TMS v.8.3 system being replaced) require impairment analysis in connection with the remediation.

Item 7.01 (Regulation FD Disclosure) / Item 8.01 (Other Events). Item 8.01 permits (and, for material events, practically requires) disclosure of events that the registrant "deems of importance to security holders." This is the most appropriate and commonly used item for disclosure of a regulatory consent order by a publicly traded banking institution. Item 8.01 serves as the catch-all provision for material regulatory actions that do not fit neatly within the enumerated 8-K triggering items. Item 7.01, which addresses disclosures made pursuant to Regulation FD (17 C.F.R. §§ 243.100-243.103), would also be applicable if the Company were simultaneously furnishing the information to comply with Regulation FD obligations. We understand that the January 16, 2025 8-K was filed under Item 8.01, which we consider appropriate.

Stock Price Impact and Market Materiality. The market's reaction to the January 16, 2025 disclosure provides compelling evidence of the Consent Order's materiality. BRFG's stock price declined from approximately $47.82 per share to approximately $41.15 per share on the disclosure date, representing a decline of approximately $6.67 per share, or 13.9%. This decline represents an erosion of approximately $1,197,000,000 in aggregate market capitalization in a single trading session. While stock price movements are not the sole determinant of materiality, the magnitude and immediacy of the decline — 13.9% in one day on news of the Consent Order — powerfully corroborates the conclusion that the Consent Order is material to BRFG's investors.

Timeliness of Disclosure. The Company's one-day turnaround from the Consent Order's effective date to the 8-K filing is consistent with best practices for publicly traded banking institutions facing significant regulatory actions. While Item 8.01 technically permits disclosure within four business days, the SEC and market participants expect more prompt disclosure of material regulatory enforcement actions, and one-day disclosure aligns with the Company's obligation to avoid selective disclosure and to maintain fair and transparent public markets. We view the timeliness of the initial filing as appropriate.

B. Content of Initial 8-K — Adequacy Review

While the timeliness of the January 16, 2025 8-K filing was appropriate, we strongly recommend a thorough review of the filed 8-K for completeness, accuracy, and consistency with forward-looking disclosure obligations. The content of the initial 8-K establishes the baseline for all subsequent disclosures; any gaps or inaccuracies in the initial filing can create liability exposure and complicate subsequent reporting.

In our judgment, the following key elements should have been included in the initial 8-K (and, if any were omitted, should be addressed in an amended or supplemental filing or, at a minimum, in the forthcoming 10-K):

1. Description of the Consent Order's Core Findings. The 8-K should describe the five core deficiency categories identified by the OCC: OFAC sanctions screening failures, SAR filing deficiencies, CDD/EDD failures, transaction monitoring model validation deficiencies, and Board oversight deficiencies. While the level of detail may be more condensed in an 8-K than in an annual report, investors should be informed of the nature and scope of the regulatory findings.

2. Civil Money Penalty Amount and Payment Deadline. The 8-K should clearly state the $14,500,000 CMP amount and the March 16, 2025 payment deadline. This is a definite, quantifiable financial obligation that investors need to evaluate.

3. Statement Regarding BRB's Intent to Comply. The 8-K should include a statement that BRB has consented to the order and intends to comply fully with all of its terms. This is standard practice in disclosure of consent orders and signals to investors that the Company is not contesting the findings.

4. Engagement of Independent Consultant. The 8-K should disclose that the Consent Order mandates the engagement of an independent consultant, identify Thornfield as the selected consultant (if the OCC's non-objection had been received prior to filing, which in this case it had not, as the non-objection was received February 5, 2025), and describe the consultant's role. If Thornfield was not yet identified at the time of the initial filing, the disclosure should have noted the requirement and stated that the selection process was underway.

5. Estimated Financial Impact. The 8-K should provide the Board-approved remediation budget of $42,500,000 and the total estimated financial outlay of $57,000,000 (inclusive of the CMP). To the extent that the Board had not yet approved the full remediation budget on January 16, 2025, the 8-K should have noted that the Company expected to incur significant remediation costs and would provide estimates as they became available.

6. Risk Factors Regarding Potential Additional Regulatory Actions. The 8-K should include cautionary language noting the possibility of additional enforcement actions by FinCEN, DOJ, or OFAC, and that the Consent Order does not preclude such actions.

7. Cautionary Language Regarding Forward-Looking Statements. The 8-K should include safe harbor language under the Private Securities Litigation Reform Act of 1995 ("PSLRA"), 15 U.S.C. § 78u-5, identifying forward-looking statements regarding remediation costs, timelines, and outcomes, and cautioning investors that actual results may differ materially from those projected.

We will coordinate with Mr. Nardone's office to review the filed 8-K against these elements and determine whether any amendments or supplemental disclosures are advisable.

C. Subsequent 8-K Filing Obligations

The initial 8-K filing was a critical first step, but BRFG's 8-K obligations do not end with the initial disclosure. As the remediation progresses and the regulatory landscape evolves, a number of potential developments could trigger the need for additional 8-K filings. We set forth below the key triggering events that should be monitored on an ongoing basis.

Payment of the $14,500,000 CMP (March 16, 2025 Deadline). The actual payment of the CMP represents a material cash outflow and the satisfaction of a specific obligation under the Consent Order. While the payment itself is already expected and disclosed, the act of payment may warrant an 8-K update, particularly if the payment is accompanied by any modifications to the Consent Order's terms, or if any issues arise regarding the timing or manner of payment.

Filing of the Comprehensive Remediation Action Plan (May 15, 2025 Deadline). The submission of the Action Plan to the OCC is a significant milestone. If the Action Plan contains material new information — such as significant revisions to the remediation cost estimate, the identification of previously unknown deficiencies, or changes to the remediation timeline — a supplemental 8-K disclosure may be required. Even if the Action Plan does not contain materially new information, the Company should consider a brief 8-K update confirming the timely submission of the Action Plan, as this demonstrates compliance with the Consent Order's terms and provides investors with a positive status update.

Any Separate FinCEN Enforcement Action or DOJ Criminal Referral. A separate enforcement action by FinCEN or a criminal referral by the DOJ would constitute an independently material event requiring immediate 8-K disclosure. Given that FinCEN has reserved its enforcement rights and that no DOJ criminal referral has been precluded, the Company must maintain heightened vigilance for any indications that such actions are forthcoming.

OFAC Enforcement Action or Voluntary Self-Disclosure Outcome. The OFAC sanctions screening failures identified in the Consent Order create a distinct risk of OFAC enforcement. If the Company files a voluntary self-disclosure ("VSD") with OFAC, or if OFAC initiates an enforcement action, either event would be material and would require 8-K disclosure. We note that the analysis of whether to file a VSD with OFAC is being addressed in a separate memorandum (the "OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis"), and the decision to file a VSD could itself be a disclosable event.

Material Changes to the Remediation Budget. The Board-approved remediation budget of $42,500,000 is an estimate, and actual costs may deviate. Under the Calderwood & Harkness engagement letter, cost overruns exceeding 15% of the engagement budget (i.e., overruns exceeding approximately $1,200,000 on the $8,000,000 legal fee estimate, or approximately $9,200,000 in absolute terms across the engagement) require General Counsel approval. More broadly, if aggregate remediation costs materially exceed the $57,000,000 total estimate — for example, due to unexpected scope expansion identified by Thornfield, technology implementation delays, or the discovery of additional compliance deficiencies — an 8-K disclosure of the revised cost estimate may be warranted.

Termination or Material Modification of BaaS Partner Relationships. The remediation program may impose enhanced compliance requirements on BRB's fintech BaaS partners that could lead to partner attrition or renegotiation of existing agreements. Two partnerships warrant particular monitoring. First, the NovaPay Technologies relationship, which processed approximately $30,500,000,000 in transaction volume in CY 2024 (representing approximately 41% of total BaaS volume) and which was specifically identified in the Consent Order as the source of the OFAC screening gap. A termination or material modification of the NovaPay relationship could significantly impact BaaS revenue and transaction volume. Second, the FairLend Digital relationship, through which BRB originated approximately $1,400,000,000 in consumer loans in FY 2024. The loss or restructuring of either partnership would likely require 8-K disclosure.

Material Findings by Thornfield Consulting. During the course of its independent assessment, Thornfield may identify findings that materially alter the scope, cost, or timeline of the remediation program. For example, if Thornfield identifies additional compliance deficiencies not previously disclosed, or if Thornfield concludes that the remediation timeline is insufficient, such findings could constitute material new information requiring 8-K disclosure.

Material Personnel Changes. The departure of key personnel during the critical remediation period could be material, particularly if it disrupts the continuity of remediation efforts or signals deeper institutional dysfunction. Specifically, the departure of CEO Diane Whitford, CCO Patricia Langston, BSA Officer Thomas Ikeda, or other senior officers closely involved in the remediation should be evaluated for 8-K disclosure under Item 5.02 (Departure of Directors or Certain Officers; Election of Directors; Appointment of Certain Officers; Compensatory Arrangements of Certain Officers).

We recommend that the Disclosure Committee establish a standing protocol for monitoring each of the foregoing triggering events and promptly assessing materiality in consultation with outside counsel.

IV. Form 10-K Disclosure Analysis

A. Timing

BRFG's annual report on Form 10-K for the fiscal year ended December 31, 2024 (the "FY 2024 10-K") will be the first annual report filed after the January 15, 2025 effective date of the Consent Order. As such, the FY 2024 10-K must reflect the Consent Order as a subsequent event and must integrate disclosure of the Consent Order and its implications throughout the relevant sections of the filing. The FY 2024 10-K is expected to be filed on or before the applicable SEC deadline, which for large accelerated filers is 60 days after fiscal year end (i.e., March 1, 2025, or the next business day thereafter). Given the significance of the Consent Order and the complexity of the disclosures involved, we strongly recommend that the drafting process for the 10-K be accelerated and that Calderwood & Harkness be given the opportunity to review and comment on all Consent Order-related sections prior to filing.

B. Item 1 — Business Description

Item 1 of the FY 2024 10-K should be updated to provide a clear and comprehensive description of BRB's BSA/AML compliance program and its critical role in supporting the Bank's business lines, with particular emphasis on the fintech BaaS partnerships. The business description should include the following elements:

• A description of BRB's BaaS business model, including the number of active fintech partners (14), the aggregate CY 2024 transaction volume processed through BaaS partnerships (approximately $74,300,000,000), and the aggregate CY 2024 BaaS revenue ($127,400,000).

• A discussion of the regulatory supervision framework applicable to BRB's operations, including the OCC's role as BRB's primary federal banking regulator, FinCEN's oversight of BSA compliance, and OFAC's jurisdiction over sanctions compliance.

• A disclosure of the Consent Order and its impact on BRB's operations and the BaaS business model. This discussion should describe the core findings of the Consent Order, the CMP, the remediation program, and the expected timeline for compliance. The discussion should be written in a manner that provides investors with a clear understanding of how the Consent Order affects BRB's ability to conduct its BaaS business during the remediation period and the potential longer-term implications for the BaaS business line.

• A description of the enhanced compliance infrastructure being built in response to the Consent Order, including the Veridian TMS v.10.0 upgrade, the expansion of BSA/AML staffing, and the establishment of a dedicated Board-level Compliance Committee.

C. Item 1A — Risk Factors

Item 1A of the FY 2024 10-K must be updated to include or expand risk factors addressing the Consent Order and its multifaceted implications. We recommend the following risk factors be included, in addition to any existing risk factor language that may require updating:

1. Regulatory Compliance Risk. The 10-K should include a prominent risk factor disclosing the Consent Order and the required remediation program, and clearly stating the risk that additional enforcement actions may be taken by the OCC (including the potential for more severe sanctions if the Company fails to satisfy the Consent Order's requirements), FinCEN (which has reserved its enforcement rights), the DOJ (which has not been precluded from receiving a criminal referral), or OFAC (in connection with the unscreened NovaPay transactions). This risk factor should disclose the prior supervisory history, including the June 2022 MRA and November 2023 MRIA, and the Company's failure to remediate those findings, which was cited as an aggravating factor in the Consent Order.

2. Financial Risk. A risk factor should address the $57,000,000 total estimated outlay, the potential for cost overruns beyond the Board-approved budget, the non-deductibility of the $14,500,000 CMP under 26 U.S.C. § 162(f) (which increases the effective after-tax cost of the CMP), and the potential for additional financial penalties if FinCEN, OFAC, or other agencies take separate enforcement action. The risk factor should also note that the remediation cost estimates are preliminary and subject to revision as the remediation progresses and as Thornfield completes its independent assessment.

3. Operational Risk. The 10-K should include a risk factor addressing the operational disruption that the remediation program will impose on BRB's day-to-day operations. This includes the risk associated with the technology upgrade from Veridian TMS v.8.3 to v.10.0, which involves a complex system implementation with inherent risk of delays, cost overruns, and integration challenges. It also includes the staffing challenges associated with recruiting and onboarding 15 permanent FTE and 30 temporary FTE from Pinnacle Compliance Solutions during a period of heightened demand for BSA/AML compliance professionals across the banking industry.

4. BaaS / Fintech Partnership Risk. Given the centrality of the BaaS business line to the Consent Order's findings, a dedicated risk factor should address the risk that enhanced compliance requirements may lead to the termination, non-renewal, or renegotiation of fintech partner agreements. This risk factor should specifically address the NovaPay Technologies relationship (given its identification in the Consent Order in connection with the OFAC screening gap and its significance as a revenue driver representing 41% of BaaS transaction volume), as well as the broader risk that the regulatory action may impair BRB's competitive position in the BaaS market.

5. Reputational Risk. A risk factor should address the reputational harm arising from the Consent Order, including negative media coverage, potential loss of investor confidence (as evidenced by the 13.9% stock decline), and the risk of customer attrition in BRB's retail banking, commercial lending, and wealth management businesses.

6. Risk of Additional Regulatory Actions. While partially addressed in the regulatory compliance risk factor, a separate or supplemental risk factor should clearly state that FinCEN has reserved its enforcement rights, that no DOJ criminal referral has been made as of the date of the filing but that a referral is not precluded, and that the OFAC sanctions screening failures may give rise to independent OFAC enforcement. The Company should disclose that the outcome and timing of any such additional actions is uncertain and could result in additional financial penalties, operational restrictions, or reputational harm.

7. Key Personnel Risk. A risk factor should address the Company's reliance on key compliance personnel during the remediation period. CCO Patricia Langston was appointed in January 2024 and BSA Officer Thomas Ikeda was appointed in March 2023 — both are relatively recent appointees to their respective roles, and their continued service during the critical 12-month remediation period is essential to the success of the remediation program. The loss of either individual, or of CEO Diane Whitford, during the remediation period could adversely affect the Company's ability to satisfy the Consent Order's requirements on the mandated timeline.

D. Item 7 — Management's Discussion and Analysis (MD&A)

The MD&A section of the FY 2024 10-K must provide a thorough discussion of the Consent Order's financial impact and the known trends and uncertainties associated with the remediation program. The following topics should be addressed in detail.

Financial Impact. Management should discuss the $14,500,000 CMP, including whether it has been accrued as a liability in the Q4 2024 financial statements or will be recognized as an expense in Q1 2025. To the extent the Company determined, based on the progression of the OCC examination and the likelihood of the Consent Order's issuance, that the CMP was probable and estimable as of December 31, 2024, the CMP should have been accrued in the FY 2024 financial statements as a loss contingency under ASC 450. The MD&A should also discuss the $42,500,000 remediation budget and the expected timing of expenditures, which are anticipated to be incurred over the approximately 12-month period from February 2025 through February 2026. The discussion should differentiate between capital expenditures (such as the Veridian TMS v.10.0 system implementation) and operating expenses (such as temporary staffing, consulting fees, and training costs).

Materiality Analysis. The MD&A should present a transparent assessment of the materiality of the Consent Order-related costs to the Company's financial position and results of operations. We note the following key data points:

The $57,000,000 total outlay represents approximately 13.8% of FY 2024 net income, which exceeds the commonly applied 5% quantitative materiality threshold and clearly satisfies quantitative materiality standards. The CMP alone at 3.5% of net income approaches the quantitative threshold and carries significant qualitative weight as a regulatory penalty. While the total outlay is modest relative to total assets ($38,700,000,000; 0.15%) and market capitalization (approximately $8,580,000,000; 0.66%), the 13.9% stock price decline on the disclosure date unambiguously demonstrates market materiality. The MD&A should address these quantitative metrics transparently and explain the Company's assessment of the overall materiality of the Consent Order-related costs.

Liquidity and Capital Impact. The $57,000,000 total outlay, while significant relative to net income, is manageable in the context of BRFG's overall financial position. The Company maintains $29,400,000,000 in total deposits and an 11.2% Tier 1 capital ratio, both of which provide ample capacity to absorb the remediation costs without jeopardizing the Bank's safety and soundness. However, the MD&A should disclose any impact of the Consent Order-related costs on the Company's capital planning, dividend capacity, or share repurchase programs. If the Board has determined that no modification to the Company's capital return program is necessary, this should be stated affirmatively to reassure investors. Conversely, if the Board has determined to suspend or reduce share repurchases or dividends to conserve capital during the remediation period, this should be disclosed promptly.

Ongoing BSA/AML Program Costs. The MD&A should also address the expected increase in BRB's ongoing (post-remediation) BSA/AML compliance costs. BRB's FY 2024 BSA/AML budget was $18,200,000. Following the remediation, ongoing costs will be substantially higher due to the increased annual contract value for the Veridian TMS system ($6,000,000 per year under v.10.0 versus $4,100,000 per year under v.8.3, representing an increase of $1,900,000 per year) and the permanent expansion of BSA/AML staffing from 62 FTE to 77 FTE. The MD&A should disclose the expected post-remediation run-rate for BSA/AML compliance costs and the impact on the Company's operating expense structure.

Known Trends and Uncertainties. The MD&A must address the known trends and uncertainties associated with the Consent Order and remediation program, consistent with SEC Regulation S-K Item 303(b). Key uncertainties include: (i) the remediation cost estimates are preliminary and subject to change as the Action Plan is developed and as Thornfield's independent assessment progresses; (ii) FinCEN and OFAC may pursue separate enforcement actions, the financial and operational impact of which cannot be predicted; (iii) DOJ criminal referral, while not made as of the date of the filing, has not been precluded; and (iv) the enhanced compliance requirements may impact the Company's BaaS business, including potential partner attrition or renegotiation, the revenue impact of which cannot be estimated with certainty.

E. Item 8 — Financial Statements and Supplementary Data

The FY 2024 financial statements included in the 10-K must reflect the Consent Order and its financial implications in accordance with applicable accounting standards. We address the key accounting and disclosure considerations below.

Accounting Treatment of the CMP. The $14,500,000 CMP should be recognized as a loss contingency under ASC 450-20 (Loss Contingencies). The Consent Order was issued on January 15, 2025, which is after the December 31, 2024 balance sheet date. However, the underlying OCC examination commenced in March 2024, and the Company was on notice of potential enforcement action throughout the second half of 2024. If, as of December 31, 2024, management concluded that the issuance of the Consent Order and the imposition of a CMP were probable and that the amount of the CMP was reasonably estimable, the CMP should have been accrued as a liability in the Q4 2024 financial statements. If the CMP was not accrued as of December 31, 2024, it should be recognized as an expense in Q1 2025.

Remediation Costs. The $42,500,000 remediation budget represents costs that will be incurred over the remediation period (approximately February 2025 through February 2026). These costs should be expensed as incurred, consistent with ASC 450 and general expense recognition principles. Certain technology costs associated with the Veridian TMS v.10.0 implementation may qualify for capitalization under ASC 350-40 (Internal-Use Software) if they meet the applicable capitalization criteria, but the majority of remediation costs (consulting fees, temporary staffing, training, and lookback project costs) will be expensed as incurred.

Note Disclosures — Legal Proceedings. The notes to the financial statements should include a comprehensive legal proceedings disclosure describing the Consent Order, the CMP, the remediation program, and the potential for additional regulatory actions. This note should be drafted with sufficient specificity to enable investors to understand the nature of the regulatory action, the financial obligations it imposes, and the range of potential outcomes. The note should also disclose the engagement of Thornfield as the OCC-mandated independent consultant and the key deadlines under the Consent Order (Action Plan due May 15, 2025; full compliance by February 15, 2026).

Subsequent Events Disclosure (ASC 855). The Consent Order was issued on January 15, 2025, which is after the December 31, 2024 balance sheet date but before the expected date of the financial statements' issuance. Under ASC 855-10 (Subsequent Events), management must evaluate whether the Consent Order represents a recognized subsequent event (Type I) — i.e., an event that provides additional evidence with respect to conditions that existed at the balance sheet date — or a non-recognized subsequent event (Type II) — i.e., an event that provides evidence with respect to conditions that did not exist at the balance sheet date. Given that the OCC examination commenced in March 2024 and the underlying BSA/AML deficiencies existed throughout FY 2024 and prior periods, there is a strong argument that the Consent Order is a Type I event that requires recognition in the December 31, 2024 financial statements (at least to the extent of the CMP). Alternatively, if the Company determines that the conditions giving rise to the specific terms of the Consent Order (i.e., the CMP amount and the specific remediation requirements) did not crystalize until after December 31, 2024, the Consent Order may be treated as a Type II non-recognized subsequent event requiring disclosure but not recognition. This determination should be made in consultation with the Company's external auditor, Caldera & Pope LLP (engagement partner Franklin Dorsey), and should be clearly documented in the Company's accounting records.

Coordination with External Auditor. It is essential that the Company's external auditor, Caldera & Pope LLP, be fully informed of all aspects of the Consent Order, the remediation program, and the associated cost estimates. The auditor will need to evaluate the completeness and accuracy of the Company's legal contingency disclosures, the appropriateness of any loss accrual under ASC 450, and the adequacy of the subsequent events disclosure. The auditor may require management representation letters addressing the completeness of disclosures related to the Consent Order and the Company's assessment of the range of reasonably possible losses from additional regulatory actions. We recommend that a meeting be scheduled with engagement partner Franklin Dorsey at the earliest opportunity to discuss these matters.

F. Item 9A — Controls and Procedures

Item 9A of the FY 2024 10-K requires management's assessment of the effectiveness of the Company's disclosure controls and procedures and internal control over financial reporting ("ICFRR"). The Consent Order raises important questions regarding the adequacy of both sets of controls.

Disclosure Controls and Procedures. The Company must evaluate whether its disclosure controls and procedures were effective as of December 31, 2024. The BSA/AML deficiencies identified in the Consent Order — including the Board oversight deficiency, the failure to remediate prior MRA and MRIA findings, and the inadequacy of compliance reporting metrics — raise questions about whether the Company's internal information-gathering and reporting processes were sufficient to ensure that material BSA/AML compliance information was timely communicated to the officers responsible for SEC disclosures. If the Company concludes that these deficiencies impaired the effectiveness of its disclosure controls and procedures, such conclusion must be disclosed in Item 9A.

Management's Assessment of Internal Controls (ICFRR). The more complex question is whether the BSA/AML deficiencies identified in the Consent Order constitute a material weakness in ICFRR. It is important to note that BSA/AML compliance deficiencies do not automatically constitute ICFRR material weaknesses; ICFRR is principally concerned with the reliability of financial reporting, and BSA/AML compliance is an operational/regulatory function that does not directly affect the accuracy of financial statement line items in most circumstances. However, the scope and severity of the control failures identified in the Consent Order — particularly the Board oversight deficiency, the failure to validate the transaction monitoring model for nearly four years, and the systemic breakdown in OFAC screening processes — may indicate pervasive weaknesses in the Company's overall control environment that could be deemed to rise to the level of an ICFRR material weakness.

We recommend that the Company, in consultation with Head of Internal Audit Derek Ballard and external auditor Caldera & Pope, conduct a thorough assessment of whether the Consent Order findings indicate a material weakness in ICFRR. If a material weakness is identified, the Company must disclose it in the 10-K and describe the remediation plan for addressing the material weakness. The existence of a material weakness would also prevent the Company from concluding that its ICFRR was effective as of December 31, 2024, and the external auditor's report on ICFRR (required for large accelerated filers under Section 404(b) of the Sarbanes-Oxley Act) would include an adverse opinion on ICFRR.

V. Proxy Statement Disclosure Analysis

A. Upcoming Annual Meeting

BRFG's next annual meeting of shareholders is expected to be held in the spring of 2025, and the proxy statement filed in connection with that meeting will be the first proxy filed after the Consent Order's issuance. The proxy statement must address the Consent Order and its implications in multiple contexts, including Board governance and oversight, executive compensation, related party transactions, and shareholder engagement.

B. Board Governance and Oversight

The proxy statement should prominently disclose the establishment of the new dedicated Compliance Committee of the Board of Directors, which the Consent Order requires as a remedial measure for the Board oversight deficiency. The Compliance Committee is expected to be chaired by James Rutherford and is to be established pursuant to a Board Resolution that is due to be adopted by February 28, 2025. The proxy statement should describe the Compliance Committee's charter, membership, and responsibilities, and should explain how the Committee's establishment enhances the Board's BSA/AML compliance oversight capabilities.

More broadly, the proxy statement's discussion of the Board's risk oversight function — typically included in the corporate governance section — should specifically address BSA/AML compliance oversight, the Consent Order, and the governance structure for overseeing the remediation program. This discussion should describe the reporting lines from the CCO and BSA Officer to the Compliance Committee and the full Board, the frequency and content of BSA/AML compliance reports to the Board, and the Board's role in overseeing the remediation program's milestones and expenditures.

The proxy statement should also review the director qualifications narratives for each Board member standing for election. Given the Consent Order's findings regarding Board oversight deficiencies, the Company should assess whether any existing Board members possess specific BSA/AML oversight experience and, if so, highlight that experience. Conversely, if the Board determines that additional directors with BSA/AML or financial crimes compliance expertise should be recruited, the proxy statement should disclose any plans to refresh the Board's composition in light of the Consent Order.

C. Executive Compensation

The Compensation Discussion and Analysis ("CD&A") section of the proxy statement should address the Consent Order's implications for executive compensation in several respects.

First, the Company should evaluate whether remediation performance metrics should be incorporated into the executive compensation framework for fiscal year 2025 and beyond. For example, the achievement of remediation milestones (such as the timely submission of the Action Plan, the successful implementation of Veridian TMS v.10.0, or the elimination of the SAR backlog) could be incorporated as qualitative performance factors in the annual incentive compensation program for the CEO, CCO, BSA Officer, and other senior officers directly involved in the remediation.

Second, the Compensation Committee should evaluate whether the BSA/AML deficiencies that led to the Consent Order should affect compensation determinations for fiscal year 2024 or prior years. If any Named Executive Officers' ("NEO") prior compensation was linked to compliance performance metrics — or if the absence of such metrics contributed to the compliance failures — the Compensation Committee should consider whether adjustments to current-year compensation or clawback of prior-year compensation is appropriate. BRFG's clawback policy, as required by NYSE listing standards and SEC Rule 10D-1, should be evaluated to determine whether any triggering conditions have been met.

Third, the CD&A should address the compensation of key compliance officers, including CEO Diane Whitford, CCO Patricia Langston, and BSA Officer Thomas Ikeda, and explain how the Compensation Committee has taken the Consent Order into account in setting their compensation for FY 2025.

D. Related Party Transactions

Based on our preliminary review, no related party transactions have been identified in connection with the remediation program. However, the engagement of Thornfield Consulting Group LLC, Veridian (the transaction monitoring system vendor), Pinnacle Compliance Solutions LLC (temporary staffing provider), and other vendors retained in connection with the remediation should be reviewed to confirm that no director, officer, or greater-than-5% shareholder of BRFG has a material interest in any of these engagements. If any such relationship exists, it must be disclosed in the proxy statement's related party transactions section in accordance with Item 404 of Regulation S-K.

E. Shareholder Proposals and Investor Engagement

We are advised that Brindoval Capital Partners LP ("Brindoval"), BRFG's largest institutional shareholder, has expressed significant concern regarding the Consent Order, the associated remediation costs, potential additional enforcement fines, and the reputational impact on the Company. Brindoval, through its Managing Partner Julian Whitmore, holds approximately 8.3% of BRFG's outstanding common stock (approximately 14,900,000 shares). Brindoval's outside counsel is Amberly Knox LLP (partner Steven Briggs).

The Company should assess the risk that Brindoval or other shareholders may submit shareholder proposals in connection with the annual meeting. Potential proposals could address topics such as enhanced compliance oversight, management accountability for the BSA/AML failures, governance reforms (such as separation of the CEO and Board Chair roles, if applicable), or the adoption of specific compliance performance metrics tied to executive compensation. The Company should also prepare for potential proxy contest activity, although we are not aware of any proxy contest being contemplated at this time.

More broadly, the Company should prepare for heightened investor scrutiny during proxy season. We recommend that the Company develop a proactive investor engagement strategy, including direct outreach to Brindoval and other major institutional shareholders, to discuss the remediation program, governance enhancements, and the Company's commitment to regulatory compliance. All such communications must comply with Regulation FD, as discussed in Section VII.B below.

VI. Materiality Analysis — Comprehensive Framework

A. Quantitative Materiality

The quantitative materiality of the Consent Order-related financial exposure is assessed by measuring the $57,000,000 total outlay against key financial metrics of the Company:

The $14,500,000 CMP, assessed independently:

While the CMP alone falls below the 5% net income threshold, the CMP carries qualitative weight disproportionate to its dollar amount because it is a regulatory penalty. The SEC and federal courts have consistently recognized that fines and penalties imposed by government agencies carry significance beyond their nominal dollar amount, as they signal regulatory findings of wrongdoing and may foreshadow additional sanctions.

Additionally, the BaaS revenue at risk merits consideration. CY 2024 BaaS revenue of $127,400,000 represents 30.9% of FY 2024 net income. While the Company has not experienced any BaaS partner termination to date, the potential for partner attrition or renegotiation as a result of the enhanced compliance requirements represents a material contingent risk. Even a modest reduction in BaaS revenue could have a disproportionate impact on the Company's profitability.

B. Qualitative Materiality

Beyond the quantitative analysis, the Consent Order is unambiguously material under qualitative standards. The SEC has long recognized, through Staff Accounting Bulletin No. 99 ("SAB 99") and related guidance, that a purely quantitative approach to materiality is insufficient and that qualitative factors must be considered. The following qualitative factors weigh heavily in favor of materiality.

Regulatory Significance. OCC enforcement actions against publicly traded national banks are inherently significant. The issuance of a formal consent order — as opposed to an informal supervisory action such as an MRA or MRIA — represents a meaningful escalation in the OCC's supervisory posture and indicates that the OCC views the deficiencies as serious and pervasive. SEC Staff guidance has consistently treated formal banking regulatory enforcement actions as presumptively material for purposes of securities disclosure.

Market Reaction. The 13.9% stock price decline on January 16, 2025 — representing an aggregate market capitalization loss of approximately $1,197,000,000 — is powerful evidence of market-perceived materiality. Courts evaluating materiality in the securities fraud context regularly cite stock price reactions as evidence of materiality, and a 13.9% single-day decline in response to specific news clearly meets any reasonable materiality threshold.

Cascading Regulatory Risk. The Consent Order does not exist in isolation. FinCEN has reserved its enforcement rights and is actively monitoring BRB's SAR filing remediation. The OFAC sanctions screening failures create a distinct risk of OFAC enforcement. And the DOJ has not been precluded from receiving a criminal referral. The potential for cascading enforcement actions by multiple federal agencies amplifies the significance of the Consent Order and creates an indeterminate but potentially substantial additional financial and operational exposure.

Impact on Business Model. The Consent Order's findings are concentrated in the BaaS business line, which is a strategic growth area for the Company. Enhanced compliance requirements, reputational damage, and potential partner attrition could fundamentally alter the risk-return profile of the BaaS business model. This operational impact extends well beyond the quantified $57,000,000 outlay.

Prior Supervisory History. The fact that the Consent Order follows an MRA (June 2022) and an MRIA (November 2023) — and that the OCC specifically cited the failure to remediate these prior findings as an aggravating factor — suggests a pattern of non-compliance that is qualitatively significant. A pattern of regulatory non-compliance is precisely the type of qualitative factor that SAB 99 identifies as relevant to materiality.

Termination of Prior Outside Counsel. The termination of BRB's prior outside regulatory counsel, Drayton Mercer LLP (lead partner Helen Frazier), in January 2025 following the Consent Order's issuance is a qualitative factor that may attract scrutiny from investors and analysts seeking to understand the circumstances that led to the regulatory failure.

Conclusion. The Consent Order and the associated remediation program are unambiguously material to BRFG under both quantitative and qualitative materiality standards. The quantitative analysis alone — with the total outlay representing 13.8% of net income — satisfies the materiality threshold. The qualitative factors, including the market reaction, the cascading regulatory risk, the impact on the BaaS business model, and the prior supervisory history, reinforce this conclusion and leave no doubt that the Consent Order requires robust, transparent, and continuing disclosure across all SEC reporting vehicles.

VII. Ongoing Disclosure Obligations and Monitoring

A. Quarterly Reports (Form 10-Q)

Each quarterly report on Form 10-Q filed by BRFG during the remediation period — which we expect to include at least the Q1 2025, Q2 2025, Q3 2025, and Q4 2025 quarterly filings — must include updated disclosures regarding the Consent Order and remediation program. Specifically, each 10-Q should address the following:

• Remediation Program Status. An update on the status of key remediation milestones, including the submission of the Action Plan to the OCC (due May 15, 2025), the implementation of Veridian TMS v.10.0, the resolution of the SAR backlog, the completion of the CDD/EDD remediation project, and the results of Thornfield's independent assessment.

• Actual Costs Incurred versus Budget. A comparison of actual remediation costs incurred to date against the $42,500,000 Board-approved budget, with an explanation of any material variances. If costs are trending above budget, the 10-Q should disclose the revised estimate and the reasons for the overrun.

• CMP Payment Status. Confirmation that the $14,500,000 CMP has been paid (following the March 16, 2025 payment deadline) and the financial statement treatment of the payment.

• New Regulatory Developments. Disclosure of any new enforcement actions, investigations, or communications from FinCEN, DOJ, OFAC, or the OCC that are material to the Company's financial position or results of operations.

• Updated Risk Factors. The 10-Q should update the risk factors included in the 10-K to reflect any changes in the risk profile — for example, the initiation of a FinCEN enforcement action, the filing of a VSD with OFAC, or the loss of a BaaS partner.

• Updated Loss Contingency Assessment. The notes to the quarterly financial statements should update the loss contingency disclosure under ASC 450 to reflect the Company's current assessment of the range of reasonably possible losses from additional regulatory actions. This assessment should be updated each quarter in consultation with Calderwood & Harkness and the external auditor.

• Liquidity Impact. If the cumulative remediation costs materially impact the Company's liquidity position or capital ratios, such impact should be disclosed in the MD&A section of the 10-Q.

B. Regulation FD Considerations

Regulation FD (17 C.F.R. §§ 243.100-243.103) prohibits the selective disclosure of material non-public information to securities market professionals and certain shareholders. All material non-public information regarding the remediation program, regulatory developments, and financial impact must either be disclosed broadly through SEC filings or press releases, or maintained as confidential.

This obligation is particularly relevant in the context of the Company's communications with Brindoval Capital Partners LP and its counsel, Amberly Knox LLP (Steven Briggs, partner). Brindoval's 8.3% ownership stake and its active engagement with management regarding the Consent Order create a heightened risk of selective disclosure. Any material non-public information shared with Brindoval representatives in the course of investor engagement must be simultaneously disclosed publicly or the Company must obtain a confidentiality agreement from Brindoval covering the information disclosed.

We recommend the preparation of standardized talking points for use by investor relations personnel, senior management, and Board members in all investor communications. These talking points should be designed to ensure consistency and to prevent the inadvertent disclosure of material non-public information. The development of these talking poin

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019 Telephone: (212) 558-4000 Facsimile: (212) 558-3588
February 14, 2025
MEMORANDUM
TO:
Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association / Belmont Ridge Financial Group, Inc. 680 Lexington Avenue, 22nd Floor New York, New York 10022
CC:
Samantha Reeves, Chief Financial Officer, BRB/BRFG Patricia Langston, Chief Compliance Officer, BRB Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
FROM:
Philip Hartmann, Partner, Calderwood & Harkness LLP
RE:
Securities Disclosure Obligations of Belmont Ridge Financial Group, Inc. (NYSE: BRFG) in Connection with OCC Consent Order No. OCC-2025-003
Matter No.: 1045-00002
THIS MEMORANDUM IS PROTECTED BY THE ATTORNEY-CLIENT PRIVILEGE AND CONSTITUTES ATTORNEY WORK PRODUCT. IT IS INTENDED SOLELY FOR THE USE OF THE ADDRESSEE AND THOSE PERSONS COPIED HEREIN. THIS MEMORANDUM SHOULD NOT BE DISCLOSED TO ANY THIRD PARTY WITHOUT THE PRIOR WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP. DISCLOSURE TO ANY THIRD PARTY MAY RESULT IN WAIVER OF THE ATTORNEY-CLIENT PRIVILEGE AND WORK PRODUCT PROTECTION.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the securities disclosure obligations of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") (NYSE: BRFG) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), and the rules and regulations promulgated thereunder by the U.S. Securities and Exchange Commission (the "SEC"), in connection with the consent order issued by the Office of the Comptroller of the Currency (the "OCC") against Belmont Ridge Bank National Association ("BRB" or the "Bank") on January 15, 2025, designated as OCC Consent Order No. OCC-2025-003 (the "Consent Order"). BRB operates under OCC Charter No. 48271 and holds FDIC Certificate No. 31845.
BRFG is a publicly traded bank holding company incorporated in the State of Delaware (EIN 83-2947561) whose common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG." BRFG is the sole parent company and controlling shareholder of BRB (EIN 13-6148320). As a publicly traded reporting company, BRFG is subject to the full panoply of SEC disclosure requirements, including but not limited to current reports on Form 8-K, annual reports on Form 10-K, quarterly reports on Form 10-Q, and proxy statements filed pursuant to Section 14(a) of the Exchange Act.
The Consent Order imposes significant obligations on BRB arising from deficiencies in its Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program and related regulatory frameworks, including failures in Office of Foreign Assets Control ("OFAC") sanctions screening, suspicious activity reporting, customer due diligence and enhanced due diligence, transaction monitoring system model validation, and Board-level compliance oversight. The Consent Order further imposes a civil money penalty ("CMP") of $14,500,000 payable by March 16, 2025. The Board of Directors of BRFG has approved a comprehensive remediation budget of $42,500,000 (exclusive of the CMP), bringing the total estimated financial exposure in connection with the Consent Order to $57,000,000.
The Company disclosed the Consent Order publicly via a Form 8-K filed on January 16, 2025, one business day after the Consent Order's effective date. On the date of disclosure, BRFG's common stock declined from approximately $47.82 per share to approximately $41.15 per share — a decline of approximately $6.67 per share, or 13.9% — confirming the market's assessment of the Consent Order's materiality. As of February 7, 2025, the stock price had partially recovered to $47.82 per share.
The principal disclosure vehicles requiring attention are: (i) the initial Form 8-K filing (already made on January 16, 2025, and subject to review for completeness), (ii) subsequent Form 8-K filings as material developments occur, (iii) the annual report on Form 10-K for fiscal year ended December 31, 2024 ("FY 2024 10-K"), which will be the first annual report filed after the Consent Order's effective date, and (iv) the proxy statement for the Company's upcoming annual meeting of shareholders.
Based on our analysis, we conclude that the Consent Order, CMP, and remediation program are material to BRFG under both quantitative and qualitative standards and require robust, continuing disclosure across all SEC reporting vehicles. The initial Form 8-K disclosure has been filed; however, additional and ongoing disclosure obligations arise in connection with the FY 2024 10-K, quarterly Form 10-Q filings, the proxy statement, and potential future Form 8-K filings as material developments occur throughout the remediation period and beyond. This memorandum sets forth our detailed analysis and recommendations for each of these disclosure obligations.
II. Background
A. The Consent Order
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB. The Consent Order is the culmination of a targeted BSA/AML examination that the OCC conducted from March 2024 through September 2024, during which OCC examiners identified pervasive deficiencies in BRB's BSA/AML compliance infrastructure. The Consent Order identifies five core categories of deficiency, each of which is described below.
First, OFAC Sanctions Screening Failures. The OCC found that approximately 12% of wire transfer and Automated Clearing House ("ACH") transactions processed through BRB's banking-as-a-service ("BaaS") partnership with NovaPay Technologies Inc. ("NovaPay") were not subjected to OFAC sanctions screening. The unscreened transaction volume was approximately 3,800,000 transactions out of a total of approximately 31,700,000 NovaPay transactions processed through BRB in calendar year 2023. The failure to screen these transactions against OFAC's Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC-administered sanctions lists constitutes a serious potential violation of the International Emergency Economic Powers Act ("IEEPA") and OFAC's implementing regulations at 31 C.F.R. Part 500 et seq.
Second, SAR Filing Deficiencies. The OCC identified a significant backlog of unreviewed suspicious activity alerts within BRB's transaction monitoring system. As of September 2024, approximately 2,400 suspicious activity alerts remained unreviewed, and the Bank's average time to file Suspicious Activity Reports ("SARs") with the Financial Crimes Enforcement Network ("FinCEN") was 78 days — substantially exceeding the 30-day regulatory expectation established under FinCEN's SAR filing requirements at 31 C.F.R. § 1020.320.
Third, Customer Due Diligence/Enhanced Due Diligence Failures. The OCC found that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BRB's fintech BaaS partnerships — lacked adequate customer due diligence ("CDD") and enhanced due diligence ("EDD") documentation. These deficiencies implicate the Customer Due Diligence Rule promulgated by FinCEN at 31 C.F.R. § 1010.230, as well as the OCC's Comptroller's Handbook guidance on BSA/AML compliance.
Fourth, Transaction Monitoring Model Validation Deficiencies. The OCC found that BRB's primary transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 and was last tuned in October 2022. Sound risk management practices, as well as interagency guidance on model risk management (OCC Bulletin 2011-12 / Federal Reserve SR 11-7), require periodic independent validation and ongoing tuning of transaction monitoring models. The absence of validation for nearly four years represents a significant control failure.
Fifth, Board Oversight Deficiencies. The OCC found that BRB's Board of Directors had not established a dedicated Compliance Committee and that BSA/AML reporting metrics provided to the Board were inadequate to enable effective oversight. The lack of dedicated Board-level compliance governance is inconsistent with the OCC's heightened supervisory expectations for institutions with significant BSA/AML risk profiles, particularly those engaged in BaaS activities.
The Consent Order also references BRB's prior supervisory history, which amplifies the severity of the current findings. The OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding transaction monitoring deficiencies and a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps. The Consent Order expressly cites BRB's failure to remediate these prior supervisory findings as an aggravating factor.
The Consent Order imposes a civil money penalty of $14,500,000, payable within 60 days of the Consent Order's effective date (i.e., by March 16, 2025). As of the date of this memorandum (February 14, 2025), no criminal referral to the U.S. Department of Justice ("DOJ") has been made in connection with the matters underlying the Consent Order; however, the Consent Order does not preclude such a referral in the future, and the prospect of a DOJ referral remains a material risk factor.
Additionally, FinCEN is separately monitoring BRB's SAR filing remediation efforts. Angela Drummond, Associate Director of FinCEN's Enforcement Division, has been designated as the FinCEN liaison for BRB's remediation. FinCEN has expressly reserved its enforcement rights, meaning that a separate FinCEN enforcement action — potentially including additional civil money penalties — remains possible.
B. Remediation Program
In response to the Consent Order, BRFG and BRB have initiated a comprehensive remediation program. Calderwood & Harkness LLP was formally engaged on February 10, 2025 as outside regulatory counsel to advise the Company and the Bank on all matters related to the Consent Order and remediation.
The OCC has mandated the engagement of an independent consultant to assess BRB's BSA/AML compliance program and oversee certain aspects of the remediation. Thornfield Consulting Group LLC ("Thornfield") has been engaged pursuant to the Consent Order's independent consultant requirement (engagement reference TCG-BRB-2025-001). The OCC issued its formal non-objection to the Thornfield engagement on February 5, 2025. Thornfield's engagement is structured as a fixed-fee arrangement of $6,500,000 plus $400,000 in expenses, for a total of $6,900,000.
The Board of Directors of BRFG approved a comprehensive remediation budget of $42,500,000, exclusive of the $14,500,000 CMP. The approved remediation budget is allocated as follows:
The Consent Order establishes two critical deadlines for the remediation program. First, BRB is required to submit a Comprehensive Remediation Action Plan (the "Action Plan") to the OCC by May 15, 2025. The Action Plan must set forth detailed milestones, responsible personnel, resource allocations, and timelines for each remediation workstream. Second, the Consent Order requires full compliance implementation — meaning completion of all remediation activities and demonstration of sustained compliance — by February 15, 2026, twelve months from the approximate date of remediation commencement.
C. BRFG Financial Profile (as of December 31, 2024)
To contextualize the financial impact of the Consent Order and remediation program, it is helpful to summarize BRFG's key financial metrics as of December 31, 2024:
BRFG's core business lines consist of retail banking, commercial lending, wealth management, and fintech BaaS partnerships. The BaaS business line, while representing a modest percentage of total assets, generates $127,400,000 in annual revenue and processes approximately $74,300,000,000 in annual transaction volume across 14 active fintech partners. This business line is directly implicated by the Consent Order's findings regarding OFAC screening failures, CDD/EDD deficiencies, and transaction monitoring inadequacies, all of which disproportionately affected BaaS-onboarded accounts and transactions.
III. Form 8-K Disclosure Analysis
A. Initial 8-K Filing — January 16, 2025 Disclosure
BRFG publicly disclosed the Consent Order via a Current Report on Form 8-K filed with the SEC on January 16, 2025, one business day after the Consent Order's January 15, 2025 effective date. This section analyzes the applicable Form 8-K triggering items and the timeliness and appropriateness of the filing.
Item 1.01 — Entry into a Material Definitive Agreement. Item 1.01 of Form 8-K requires disclosure when a registrant enters into a "material definitive agreement not made in the ordinary course of business." The threshold question is whether an OCC consent order constitutes a "material definitive agreement" within the meaning of this item. Consent orders are not traditional commercial agreements; they are regulatory orders that impose legally binding obligations on the subject institution, typically arising from the exercise of the OCC's enforcement authority under 12 U.S.C. § 1818. However, courts and SEC staff have recognized that the substance, rather than the form, of an arrangement determines whether it falls within the scope of Item 1.01. A consent order that imposes material financial obligations (here, a $14,500,000 CMP) and significant operational requirements (here, a $42,500,000 remediation program) can, in certain circumstances, be characterized as a "material definitive agreement" for disclosure purposes. Nevertheless, the more customary and appropriate approach for disclosing regulatory enforcement actions is under Item 8.01, as discussed below.
Item 2.06 — Material Impairments. Item 2.06 requires disclosure when the registrant's board of directors, a committee thereof, or authorized officers conclude that a material charge for impairment to one or more of the registrant's assets is required under GAAP. While the $14,500,000 CMP and $42,500,000 remediation budget represent material charges, Item 2.06 is most commonly applied to impairment of goodwill, long-lived assets, or investments, rather than regulatory penalties and remediation costs. Accordingly, Item 2.06 is not the primary disclosure vehicle, although the Company should evaluate whether any assets (such as capitalized software costs related to the Veridian TMS v.8.3 system being replaced) require impairment analysis in connection with the remediation.
Item 7.01 (Regulation FD Disclosure) / Item 8.01 (Other Events). Item 8.01 permits (and, for material events, practically requires) disclosure of events that the registrant "deems of importance to security holders." This is the most appropriate and commonly used item for disclosure of a regulatory consent order by a publicly traded banking institution. Item 8.01 serves as the catch-all provision for material regulatory actions that do not fit neatly within the enumerated 8-K triggering items. Item 7.01, which addresses disclosures made pursuant to Regulation FD (17 C.F.R. §§ 243.100-243.103), would also be applicable if the Company were simultaneously furnishing the information to comply with Regulation FD obligations. We understand that the January 16, 2025 8-K was filed under Item 8.01, which we consider appropriate.
Stock Price Impact and Market Materiality. The market's reaction to the January 16, 2025 disclosure provides compelling evidence of the Consent Order's materiality. BRFG's stock price declined from approximately $47.82 per share to approximately $41.15 per share on the disclosure date, representing a decline of approximately $6.67 per share, or 13.9%. This decline represents an erosion of approximately $1,197,000,000 in aggregate market capitalization in a single trading session. While stock price movements are not the sole determinant of materiality, the magnitude and immediacy of the decline — 13.9% in one day on news of the Consent Order — powerfully corroborates the conclusion that the Consent Order is material to BRFG's investors.
Timeliness of Disclosure. The Company's one-day turnaround from the Consent Order's effective date to the 8-K filing is consistent with best practices for publicly traded banking institutions facing significant regulatory actions. While Item 8.01 technically permits disclosure within four business days, the SEC and market participants expect more prompt disclosure of material regulatory enforcement actions, and one-day disclosure aligns with the Company's obligation to avoid selective disclosure and to maintain fair and transparent public markets. We view the timeliness of the initial filing as appropriate.
B. Content of Initial 8-K — Adequacy Review
While the timeliness of the January 16, 2025 8-K filing was appropriate, we strongly recommend a thorough review of the filed 8-K for completeness, accuracy, and consistency with forward-looking disclosure obligations. The content of the initial 8-K establishes the baseline for all subsequent disclosures; any gaps or inaccuracies in the initial filing can create liability exposure and complicate subsequent reporting.
In our judgment, the following key elements should have been included in the initial 8-K (and, if any were omitted, should be addressed in an amended or supplemental filing or, at a minimum, in the forthcoming 10-K):
1. Description of the Consent Order's Core Findings. The 8-K should describe the five core deficiency categories identified by the OCC: OFAC sanctions screening failures, SAR filing deficiencies, CDD/EDD failures, transaction monitoring model validation deficiencies, and Board oversight deficiencies. While the level of detail may be more condensed in an 8-K than in an annual report, investors should be informed of the nature and scope of the regulatory findings.
2. Civil Money Penalty Amount and Payment Deadline. The 8-K should clearly state the $14,500,000 CMP amount and the March 16, 2025 payment deadline. This is a definite, quantifiable financial obligation that investors need to evaluate.
3. Statement Regarding BRB's Intent to Comply. The 8-K should include a statement that BRB has consented to the order and intends to comply fully with all of its terms. This is standard practice in disclosure of consent orders and signals to investors that the Company is not contesting the findings.
4. Engagement of Independent Consultant. The 8-K should disclose that the Consent Order mandates the engagement of an independent consultant, identify Thornfield as the selected consultant (if the OCC's non-objection had been received prior to filing, which in this case it had not, as the non-objection was received February 5, 2025), and describe the consultant's role. If Thornfield was not yet identified at the time of the initial filing, the disclosure should have noted the requirement and stated that the selection process was underway.
5. Estimated Financial Impact. The 8-K should provide the Board-approved remediation budget of $42,500,000 and the total estimated financial outlay of $57,000,000 (inclusive of the CMP). To the extent that the Board had not yet approved the full remediation budget on January 16, 2025, the 8-K should have noted that the Company expected to incur significant remediation costs and would provide estimates as they became available.
6. Risk Factors Regarding Potential Additional Regulatory Actions. The 8-K should include cautionary language noting the possibility of additional enforcement actions by FinCEN, DOJ, or OFAC, and that the Consent Order does not preclude such actions.
7. Cautionary Language Regarding Forward-Looking Statements. The 8-K should include safe harbor language under the Private Securities Litigation Reform Act of 1995 ("PSLRA"), 15 U.S.C. § 78u-5, identifying forward-looking statements regarding remediation costs, timelines, and outcomes, and cautioning investors that actual results may differ materially from those projected.
We will coordinate with Mr. Nardone's office to review the filed 8-K against these elements and determine whether any amendments or supplemental disclosures are advisable.
C. Subsequent 8-K Filing Obligations
The initial 8-K filing was a critical first step, but BRFG's 8-K obligations do not end with the initial disclosure. As the remediation progresses and the regulatory landscape evolves, a number of potential developments could trigger the need for additional 8-K filings. We set forth below the key triggering events that should be monitored on an ongoing basis.
Payment of the $14,500,000 CMP (March 16, 2025 Deadline). The actual payment of the CMP represents a material cash outflow and the satisfaction of a specific obligation under the Consent Order. While the payment itself is already expected and disclosed, the act of payment may warrant an 8-K update, particularly if the payment is accompanied by any modifications to the Consent Order's terms, or if any issues arise regarding the timing or manner of payment.
Filing of the Comprehensive Remediation Action Plan (May 15, 2025 Deadline). The submission of the Action Plan to the OCC is a significant milestone. If the Action Plan contains material new information — such as significant revisions to the remediation cost estimate, the identification of previously unknown deficiencies, or changes to the remediation timeline — a supplemental 8-K disclosure may be required. Even if the Action Plan does not contain materially new information, the Company should consider a brief 8-K update confirming the timely submission of the Action Plan, as this demonstrates compliance with the Consent Order's terms and provides investors with a positive status update.
Any Separate FinCEN Enforcement Action or DOJ Criminal Referral. A separate enforcement action by FinCEN or a criminal referral by the DOJ would constitute an independently material event requiring immediate 8-K disclosure. Given that FinCEN has reserved its enforcement rights and that no DOJ criminal referral has been precluded, the Company must maintain heightened vigilance for any indications that such actions are forthcoming.
OFAC Enforcement Action or Voluntary Self-Disclosure Outcome. The OFAC sanctions screening failures identified in the Consent Order create a distinct risk of OFAC enforcement. If the Company files a voluntary self-disclosure ("VSD") with OFAC, or if OFAC initiates an enforcement action, either event would be material and would require 8-K disclosure. We note that the analysis of whether to file a VSD with OFAC is being addressed in a separate memorandum (the "OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis"), and the decision to file a VSD could itself be a disclosable event.
Material Changes to the Remediation Budget. The Board-approved remediation budget of $42,500,000 is an estimate, and actual costs may deviate. Under the Calderwood & Harkness engagement letter, cost overruns exceeding 15% of the engagement budget (i.e., overruns exceeding approximately $1,200,000 on the $8,000,000 legal fee estimate, or approximately $9,200,000 in absolute terms across the engagement) require General Counsel approval. More broadly, if aggregate remediation costs materially exceed the $57,000,000 total estimate — for example, due to unexpected scope expansion identified by Thornfield, technology implementation delays, or the discovery of additional compliance deficiencies — an 8-K disclosure of the revised cost estimate may be warranted.
Termination or Material Modification of BaaS Partner Relationships. The remediation program may impose enhanced compliance requirements on BRB's fintech BaaS partners that could lead to partner attrition or renegotiation of existing agreements. Two partnerships warrant particular monitoring. First, the NovaPay Technologies relationship, which processed approximately $30,500,000,000 in transaction volume in CY 2024 (representing approximately 41% of total BaaS volume) and which was specifically identified in the Consent Order as the source of the OFAC screening gap. A termination or material modification of the NovaPay relationship could significantly impact BaaS revenue and transaction volume. Second, the FairLend Digital relationship, through which BRB originated approximately $1,400,000,000 in consumer loans in FY 2024. The loss or restructuring of either partnership would likely require 8-K disclosure.
Material Findings by Thornfield Consulting. During the course of its independent assessment, Thornfield may identify findings that materially alter the scope, cost, or timeline of the remediation program. For example, if Thornfield identifies additional compliance deficiencies not previously disclosed, or if Thornfield concludes that the remediation timeline is insufficient, such findings could constitute material new information requiring 8-K disclosure.
Material Personnel Changes. The departure of key personnel during the critical remediation period could be material, particularly if it disrupts the continuity of remediation efforts or signals deeper institutional dysfunction. Specifically, the departure of CEO Diane Whitford, CCO Patricia Langston, BSA Officer Thomas Ikeda, or other senior officers closely involved in the remediation should be evaluated for 8-K disclosure under Item 5.02 (Departure of Directors or Certain Officers; Election of Directors; Appointment of Certain Officers; Compensatory Arrangements of Certain Officers).
We recommend that the Disclosure Committee establish a standing protocol for monitoring each of the foregoing triggering events and promptly assessing materiality in consultation with outside counsel.
IV. Form 10-K Disclosure Analysis
A. Timing
BRFG's annual report on Form 10-K for the fiscal year ended December 31, 2024 (the "FY 2024 10-K") will be the first annual report filed after the January 15, 2025 effective date of the Consent Order. As such, the FY 2024 10-K must reflect the Consent Order as a subsequent event and must integrate disclosure of the Consent Order and its implications throughout the relevant sections of the filing. The FY 2024 10-K is expected to be filed on or before the applicable SEC deadline, which for large accelerated filers is 60 days after fiscal year end (i.e., March 1, 2025, or the next business day thereafter). Given the significance of the Consent Order and the complexity of the disclosures involved, we strongly recommend that the drafting process for the 10-K be accelerated and that Calderwood & Harkness be given the opportunity to review and comment on all Consent Order-related sections prior to filing.
B. Item 1 — Business Description
Item 1 of the FY 2024 10-K should be updated to provide a clear and comprehensive description of BRB's BSA/AML compliance program and its critical role in supporting the Bank's business lines, with particular emphasis on the fintech BaaS partnerships. The business description should include the following elements:
• A description of BRB's BaaS business model, including the number of active fintech partners (14), the aggregate CY 2024 transaction volume processed through BaaS partnerships (approximately $74,300,000,000), and the aggregate CY 2024 BaaS revenue ($127,400,000).
• A discussion of the regulatory supervision framework applicable to BRB's operations, including the OCC's role as BRB's primary federal banking regulator, FinCEN's oversight of BSA compliance, and OFAC's jurisdiction over sanctions compliance.
• A disclosure of the Consent Order and its impact on BRB's operations and the BaaS business model. This discussion should describe the core findings of the Consent Order, the CMP, the remediation program, and the expected timeline for compliance. The discussion should be written in a manner that provides investors with a clear understanding of how the Consent Order affects BRB's ability to conduct its BaaS business during the remediation period and the potential longer-term implications for the BaaS business line.
• A description of the enhanced compliance infrastructure being built in response to the Consent Order, including the Veridian TMS v.10.0 upgrade, the expansion of BSA/AML staffing, and the establishment of a dedicated Board-level Compliance Committee.
C. Item 1A — Risk Factors
Item 1A of the FY 2024 10-K must be updated to include or expand risk factors addressing the Consent Order and its multifaceted implications. We recommend the following risk factors be included, in addition to any existing risk factor language that may require updating:
1. Regulatory Compliance Risk. The 10-K should include a prominent risk factor disclosing the Consent Order and the required remediation program, and clearly stating the risk that additional enforcement actions may be taken by the OCC (including the potential for more severe sanctions if the Company fails to satisfy the Consent Order's requirements), FinCEN (which has reserved its enforcement rights), the DOJ (which has not been precluded from receiving a criminal referral), or OFAC (in connection with the unscreened NovaPay transactions). This risk factor should disclose the prior supervisory history, including the June 2022 MRA and November 2023 MRIA, and the Company's failure to remediate those findings, which was cited as an aggravating factor in the Consent Order.
2. Financial Risk. A risk factor should address the $57,000,000 total estimated outlay, the potential for cost overruns beyond the Board-approved budget, the non-deductibility of the $14,500,000 CMP under 26 U.S.C. § 162(f) (which increases the effective after-tax cost of the CMP), and the potential for additional financial penalties if FinCEN, OFAC, or other agencies take separate enforcement action. The risk factor should also note that the remediation cost estimates are preliminary and subject to revision as the remediation progresses and as Thornfield completes its independent assessment.
3. Operational Risk. The 10-K should include a risk factor addressing the operational disruption that the remediation program will impose on BRB's day-to-day operations. This includes the risk associated with the technology upgrade from Veridian TMS v.8.3 to v.10.0, which involves a complex system implementation with inherent risk of delays, cost overruns, and integration challenges. It also includes the staffing challenges associated with recruiting and onboarding 15 permanent FTE and 30 temporary FTE from Pinnacle Compliance Solutions during a period of heightened demand for BSA/AML compliance professionals across the banking industry.
4. BaaS / Fintech Partnership Risk. Given the centrality of the BaaS business line to the Consent Order's findings, a dedicated risk factor should address the risk that enhanced compliance requirements may lead to the termination, non-renewal, or renegotiation of fintech partner agreements. This risk factor should specifically address the NovaPay Technologies relationship (given its identification in the Consent Order in connection with the OFAC screening gap and its significance as a revenue driver representing 41% of BaaS transaction volume), as well as the broader risk that the regulatory action may impair BRB's competitive position in the BaaS market.
5. Reputational Risk. A risk factor should address the reputational harm arising from the Consent Order, including negative media coverage, potential loss of investor confidence (as evidenced by the 13.9% stock decline), and the risk of customer attrition in BRB's retail banking, commercial lending, and wealth management businesses.
6. Risk of Additional Regulatory Actions. While partially addressed in the regulatory compliance risk factor, a separate or supplemental risk factor should clearly state that FinCEN has reserved its enforcement rights, that no DOJ criminal referral has been made as of the date of the filing but that a referral is not precluded, and that the OFAC sanctions screening failures may give rise to independent OFAC enforcement. The Company should disclose that the outcome and timing of any such additional actions is uncertain and could result in additional financial penalties, operational restrictions, or reputational harm.
7. Key Personnel Risk. A risk factor should address the Company's reliance on key compliance personnel during the remediation period. CCO Patricia Langston was appointed in January 2024 and BSA Officer Thomas Ikeda was appointed in March 2023 — both are relatively recent appointees to their respective roles, and their continued service during the critical 12-month remediation period is essential to the success of the remediation program. The loss of either individual, or of CEO Diane Whitford, during the remediation period could adversely affect the Company's ability to satisfy the Consent Order's requirements on the mandated timeline.
D. Item 7 — Management's Discussion and Analysis (MD&A)
The MD&A section of the FY 2024 10-K must provide a thorough discussion of the Consent Order's financial impact and the known trends and uncertainties associated with the remediation program. The following topics should be addressed in detail.
Financial Impact. Management should discuss the $14,500,000 CMP, including whether it has been accrued as a liability in the Q4 2024 financial statements or will be recognized as an expense in Q1 2025. To the extent the Company determined, based on the progression of the OCC examination and the likelihood of the Consent Order's issuance, that the CMP was probable and estimable as of December 31, 2024, the CMP should have been accrued in the FY 2024 financial statements as a loss contingency under ASC 450. The MD&A should also discuss the $42,500,000 remediation budget and the expected timing of expenditures, which are anticipated to be incurred over the approximately 12-month period from February 2025 through February 2026. The discussion should differentiate between capital expenditures (such as the Veridian TMS v.10.0 system implementation) and operating expenses (such as temporary staffing, consulting fees, and training costs).
Materiality Analysis. The MD&A should present a transparent assessment of the materiality of the Consent Order-related costs to the Company's financial position and results of operations. We note the following key data points:
The $57,000,000 total outlay represents approximately 13.8% of FY 2024 net income, which exceeds the commonly applied 5% quantitative materiality threshold and clearly satisfies quantitative materiality standards. The CMP alone at 3.5% of net income approaches the quantitative threshold and carries significant qualitative weight as a regulatory penalty. While the total outlay is modest relative to total assets ($38,700,000,000; 0.15%) and market capitalization (approximately $8,580,000,000; 0.66%), the 13.9% stock price decline on the disclosure date unambiguously demonstrates market materiality. The MD&A should address these quantitative metrics transparently and explain the Company's assessment of the overall materiality of the Consent Order-related costs.
Liquidity and Capital Impact. The $57,000,000 total outlay, while significant relative to net income, is manageable in the context of BRFG's overall financial position. The Company maintains $29,400,000,000 in total deposits and an 11.2% Tier 1 capital ratio, both of which provide ample capacity to absorb the remediation costs without jeopardizing the Bank's safety and soundness. However, the MD&A should disclose any impact of the Consent Order-related costs on the Company's capital planning, dividend capacity, or share repurchase programs. If the Board has determined that no modification to the Company's capital return program is necessary, this should be stated affirmatively to reassure investors. Conversely, if the Board has determined to suspend or reduce share repurchases or dividends to conserve capital during the remediation period, this should be disclosed promptly.
Ongoing BSA/AML Program Costs. The MD&A should also address the expected increase in BRB's ongoing (post-remediation) BSA/AML compliance costs. BRB's FY 2024 BSA/AML budget was $18,200,000. Following the remediation, ongoing costs will be substantially higher due to the increased annual contract value for the Veridian TMS system ($6,000,000 per year under v.10.0 versus $4,100,000 per year under v.8.3, representing an increase of $1,900,000 per year) and the permanent expansion of BSA/AML staffing from 62 FTE to 77 FTE. The MD&A should disclose the expected post-remediation run-rate for BSA/AML compliance costs and the impact on the Company's operating expense structure.
Known Trends and Uncertainties. The MD&A must address the known trends and uncertainties associated with the Consent Order and remediation program, consistent with SEC Regulation S-K Item 303(b). Key uncertainties include: (i) the remediation cost estimates are preliminary and subject to change as the Action Plan is developed and as Thornfield's independent assessment progresses; (ii) FinCEN and OFAC may pursue separate enforcement actions, the financial and operational impact of which cannot be predicted; (iii) DOJ criminal referral, while not made as of the date of the filing, has not been precluded; and (iv) the enhanced compliance requirements may impact the Company's BaaS business, including potential partner attrition or renegotiation, the revenue impact of which cannot be estimated with certainty.
E. Item 8 — Financial Statements and Supplementary Data
The FY 2024 financial statements included in the 10-K must reflect the Consent Order and its financial implications in accordance with applicable accounting standards. We address the key accounting and disclosure considerations below.
Accounting Treatment of the CMP. The $14,500,000 CMP should be recognized as a loss contingency under ASC 450-20 (Loss Contingencies). The Consent Order was issued on January 15, 2025, which is after the December 31, 2024 balance sheet date. However, the underlying OCC examination commenced in March 2024, and the Company was on notice of potential enforcement action throughout the second half of 2024. If, as of December 31, 2024, management concluded that the issuance of the Consent Order and the imposition of a CMP were probable and that the amount of the CMP was reasonably estimable, the CMP should have been accrued as a liability in the Q4 2024 financial statements. If the CMP was not accrued as of December 31, 2024, it should be recognized as an expense in Q1 2025.
Remediation Costs. The $42,500,000 remediation budget represents costs that will be incurred over the remediation period (approximately February 2025 through February 2026). These costs should be expensed as incurred, consistent with ASC 450 and general expense recognition principles. Certain technology costs associated with the Veridian TMS v.10.0 implementation may qualify for capitalization under ASC 350-40 (Internal-Use Software) if they meet the applicable capitalization criteria, but the majority of remediation costs (consulting fees, temporary staffing, training, and lookback project costs) will be expensed as incurred.
Note Disclosures — Legal Proceedings. The notes to the financial statements should include a comprehensive legal proceedings disclosure describing the Consent Order, the CMP, the remediation program, and the potential for additional regulatory actions. This note should be drafted with sufficient specificity to enable investors to understand the nature of the regulatory action, the financial obligations it imposes, and the range of potential outcomes. The note should also disclose the engagement of Thornfield as the OCC-mandated independent consultant and the key deadlines under the Consent Order (Action Plan due May 15, 2025; full compliance by February 15, 2026).
Subsequent Events Disclosure (ASC 855). The Consent Order was issued on January 15, 2025, which is after the December 31, 2024 balance sheet date but before the expected date of the financial statements' issuance. Under ASC 855-10 (Subsequent Events), management must evaluate whether the Consent Order represents a recognized subsequent event (Type I) — i.e., an event that provides additional evidence with respect to conditions that existed at the balance sheet date — or a non-recognized subsequent event (Type II) — i.e., an event that provides evidence with respect to conditions that did not exist at the balance sheet date. Given that the OCC examination commenced in March 2024 and the underlying BSA/AML deficiencies existed throughout FY 2024 and prior periods, there is a strong argument that the Consent Order is a Type I event that requires recognition in the December 31, 2024 financial statements (at least to the extent of the CMP). Alternatively, if the Company determines that the conditions giving rise to the specific terms of the Consent Order (i.e., the CMP amount and the specific remediation requirements) did not crystalize until after December 31, 2024, the Consent Order may be treated as a Type II non-recognized subsequent event requiring disclosure but not recognition. This determination should be made in consultation with the Company's external auditor, Caldera & Pope LLP (engagement partner Franklin Dorsey), and should be clearly documented in the Company's accounting records.
Coordination with External Auditor. It is essential that the Company's external auditor, Caldera & Pope LLP, be fully informed of all aspects of the Consent Order, the remediation program, and the associated cost estimates. The auditor will need to evaluate the completeness and accuracy of the Company's legal contingency disclosures, the appropriateness of any loss accrual under ASC 450, and the adequacy of the subsequent events disclosure. The auditor may require management representation letters addressing the completeness of disclosures related to the Consent Order and the Company's assessment of the range of reasonably possible losses from additional regulatory actions. We recommend that a meeting be scheduled with engagement partner Franklin Dorsey at the earliest opportunity to discuss these matters.
F. Item 9A — Controls and Procedures
Item 9A of the FY 2024 10-K requires management's assessment of the effectiveness of the Company's disclosure controls and procedures and internal control over financial reporting ("ICFRR"). The Consent Order raises important questions regarding the adequacy of both sets of controls.
Disclosure Controls and Procedures. The Company must evaluate whether its disclosure controls and procedures were effective as of December 31, 2024. The BSA/AML deficiencies identified in the Consent Order — including the Board oversight deficiency, the failure to remediate prior MRA and MRIA findings, and the inadequacy of compliance reporting metrics — raise questions about whether the Company's internal information-gathering and reporting processes were sufficient to ensure that material BSA/AML compliance information was timely communicated to the officers responsible for SEC disclosures. If the Company concludes that these deficiencies impaired the effectiveness of its disclosure controls and procedures, such conclusion must be disclosed in Item 9A.
Management's Assessment of Internal Controls (ICFRR). The more complex question is whether the BSA/AML deficiencies identified in the Consent Order constitute a material weakness in ICFRR. It is important to note that BSA/AML compliance deficiencies do not automatically constitute ICFRR material weaknesses; ICFRR is principally concerned with the reliability of financial reporting, and BSA/AML compliance is an operational/regulatory function that does not directly affect the accuracy of financial statement line items in most circumstances. However, the scope and severity of the control failures identified in the Consent Order — particularly the Board oversight deficiency, the failure to validate the transaction monitoring model for nearly four years, and the systemic breakdown in OFAC screening processes — may indicate pervasive weaknesses in the Company's overall control environment that could be deemed to rise to the level of an ICFRR material weakness.
We recommend that the Company, in consultation with Head of Internal Audit Derek Ballard and external auditor Caldera & Pope, conduct a thorough assessment of whether the Consent Order findings indicate a material weakness in ICFRR. If a material weakness is identified, the Company must disclose it in the 10-K and describe the remediation plan for addressing the material weakness. The existence of a material weakness would also prevent the Company from concluding that its ICFRR was effective as of December 31, 2024, and the external auditor's report on ICFRR (required for large accelerated filers under Section 404(b) of the Sarbanes-Oxley Act) would include an adverse opinion on ICFRR.
V. Proxy Statement Disclosure Analysis
A. Upcoming Annual Meeting
BRFG's next annual meeting of shareholders is expected to be held in the spring of 2025, and the proxy statement filed in connection with that meeting will be the first proxy filed after the Consent Order's issuance. The proxy statement must address the Consent Order and its implications in multiple contexts, including Board governance and oversight, executive compensation, related party transactions, and shareholder engagement.
B. Board Governance and Oversight
The proxy statement should prominently disclose the establishment of the new dedicated Compliance Committee of the Board of Directors, which the Consent Order requires as a remedial measure for the Board oversight deficiency. The Compliance Committee is expected to be chaired by James Rutherford and is to be established pursuant to a Board Resolution that is due to be adopted by February 28, 2025. The proxy statement should describe the Compliance Committee's charter, membership, and responsibilities, and should explain how the Committee's establishment enhances the Board's BSA/AML compliance oversight capabilities.
More broadly, the proxy statement's discussion of the Board's risk oversight function — typically included in the corporate governance section — should specifically address BSA/AML compliance oversight, the Consent Order, and the governance structure for overseeing the remediation program. This discussion should describe the reporting lines from the CCO and BSA Officer to the Compliance Committee and the full Board, the frequency and content of BSA/AML compliance reports to the Board, and the Board's role in overseeing the remediation program's milestones and expenditures.
The proxy statement should also review the director qualifications narratives for each Board member standing for election. Given the Consent Order's findings regarding Board oversight deficiencies, the Company should assess whether any existing Board members possess specific BSA/AML oversight experience and, if so, highlight that experience. Conversely, if the Board determines that additional directors with BSA/AML or financial crimes compliance expertise should be recruited, the proxy statement should disclose any plans to refresh the Board's composition in light of the Consent Order.
C. Executive Compensation
The Compensation Discussion and Analysis ("CD&A") section of the proxy statement should address the Consent Order's implications for executive compensation in several respects.
First, the Company should evaluate whether remediation performance metrics should be incorporated into the executive compensation framework for fiscal year 2025 and beyond. For example, the achievement of remediation milestones (such as the timely submission of the Action Plan, the successful implementation of Veridian TMS v.10.0, or the elimination of the SAR backlog) could be incorporated as qualitative performance factors in the annual incentive compensation program for the CEO, CCO, BSA Officer, and other senior officers directly involved in the remediation.
Second, the Compensation Committee should evaluate whether the BSA/AML deficiencies that led to the Consent Order should affect compensation determinations for fiscal year 2024 or prior years. If any Named Executive Officers' ("NEO") prior compensation was linked to compliance performance metrics — or if the absence of such metrics contributed to the compliance failures — the Compensation Committee should consider whether adjustments to current-year compensation or clawback of prior-year compensation is appropriate. BRFG's clawback policy, as required by NYSE listing standards and SEC Rule 10D-1, should be evaluated to determine whether any triggering conditions have been met.
Third, the CD&A should address the compensation of key compliance officers, including CEO Diane Whitford, CCO Patricia Langston, and BSA Officer Thomas Ikeda, and explain how the Compensation Committee has taken the Consent Order into account in setting their compensation for FY 2025.
D. Related Party Transactions
Based on our preliminary review, no related party transactions have been identified in connection with the remediation program. However, the engagement of Thornfield Consulting Group LLC, Veridian (the transaction monitoring system vendor), Pinnacle Compliance Solutions LLC (temporary staffing provider), and other vendors retained in connection with the remediation should be reviewed to confirm that no director, officer, or greater-than-5% shareholder of BRFG has a material interest in any of these engagements. If any such relationship exists, it must be disclosed in the proxy statement's related party transactions section in accordance with Item 404 of Regulation S-K.
E. Shareholder Proposals and Investor Engagement
We are advised that Brindoval Capital Partners LP ("Brindoval"), BRFG's largest institutional shareholder, has expressed significant concern regarding the Consent Order, the associated remediation costs, potential additional enforcement fines, and the reputational impact on the Company. Brindoval, through its Managing Partner Julian Whitmore, holds approximately 8.3% of BRFG's outstanding common stock (approximately 14,900,000 shares). Brindoval's outside counsel is Amberly Knox LLP (partner Steven Briggs).
The Company should assess the risk that Brindoval or other shareholders may submit shareholder proposals in connection with the annual meeting. Potential proposals could address topics such as enhanced compliance oversight, management accountability for the BSA/AML failures, governance reforms (such as separation of the CEO and Board Chair roles, if applicable), or the adoption of specific compliance performance metrics tied to executive compensation. The Company should also prepare for potential proxy contest activity, although we are not aware of any proxy contest being contemplated at this time.
More broadly, the Company should prepare for heightened investor scrutiny during proxy season. We recommend that the Company develop a proactive investor engagement strategy, including direct outreach to Brindoval and other major institutional shareholders, to discuss the remediation program, governance enhancements, and the Company's commitment to regulatory compliance. All such communications must comply with Regulation FD, as discussed in Section VII.B below.
VI. Materiality Analysis — Comprehensive Framework
A. Quantitative Materiality
The quantitative materiality of the Consent Order-related financial exposure is assessed by measuring the $57,000,000 total outlay against key financial metrics of the Company:
The $14,500,000 CMP, assessed independently:
While the CMP alone falls below the 5% net income threshold, the CMP carries qualitative weight disproportionate to its dollar amount because it is a regulatory penalty. The SEC and federal courts have consistently recognized that fines and penalties imposed by government agencies carry significance beyond their nominal dollar amount, as they signal regulatory findings of wrongdoing and may foreshadow additional sanctions.
Additionally, the BaaS revenue at risk merits consideration. CY 2024 BaaS revenue of $127,400,000 represents 30.9% of FY 2024 net income. While the Company has not experienced any BaaS partner termination to date, the potential for partner attrition or renegotiation as a result of the enhanced compliance requirements represents a material contingent risk. Even a modest reduction in BaaS revenue could have a disproportionate impact on the Company's profitability.
B. Qualitative Materiality
Beyond the quantitative analysis, the Consent Order is unambiguously material under qualitative standards. The SEC has long recognized, through Staff Accounting Bulletin No. 99 ("SAB 99") and related guidance, that a purely quantitative approach to materiality is insufficient and that qualitative factors must be considered. The following qualitative factors weigh heavily in favor of materiality.
Regulatory Significance. OCC enforcement actions against publicly traded national banks are inherently significant. The issuance of a formal consent order — as opposed to an informal supervisory action such as an MRA or MRIA — represents a meaningful escalation in the OCC's supervisory posture and indicates that the OCC views the deficiencies as serious and pervasive. SEC Staff guidance has consistently treated formal banking regulatory enforcement actions as presumptively material for purposes of securities disclosure.
Market Reaction. The 13.9% stock price decline on January 16, 2025 — representing an aggregate market capitalization loss of approximately $1,197,000,000 — is powerful evidence of market-perceived materiality. Courts evaluating materiality in the securities fraud context regularly cite stock price reactions as evidence of materiality, and a 13.9% single-day decline in response to specific news clearly meets any reasonable materiality threshold.
Cascading Regulatory Risk. The Consent Order does not exist in isolation. FinCEN has reserved its enforcement rights and is actively monitoring BRB's SAR filing remediation. The OFAC sanctions screening failures create a distinct risk of OFAC enforcement. And the DOJ has not been precluded from receiving a criminal referral. The potential for cascading enforcement actions by multiple federal agencies amplifies the significance of the Consent Order and creates an indeterminate but potentially substantial additional financial and operational exposure.
Impact on Business Model. The Consent Order's findings are concentrated in the BaaS business line, which is a strategic growth area for the Company. Enhanced compliance requirements, reputational damage, and potential partner attrition could fundamentally alter the risk-return profile of the BaaS business model. This operational impact extends well beyond the quantified $57,000,000 outlay.
Prior Supervisory History. The fact that the Consent Order follows an MRA (June 2022) and an MRIA (November 2023) — and that the OCC specifically cited the failure to remediate these prior findings as an aggravating factor — suggests a pattern of non-compliance that is qualitatively significant. A pattern of regulatory non-compliance is precisely the type of qualitative factor that SAB 99 identifies as relevant to materiality.
Termination of Prior Outside Counsel. The termination of BRB's prior outside regulatory counsel, Drayton Mercer LLP (lead partner Helen Frazier), in January 2025 following the Consent Order's issuance is a qualitative factor that may attract scrutiny from investors and analysts seeking to understand the circumstances that led to the regulatory failure.
Conclusion. The Consent Order and the associated remediation program are unambiguously material to BRFG under both quantitative and qualitative materiality standards. The quantitative analysis alone — with the total outlay representing 13.8% of net income — satisfies the materiality threshold. The qualitative factors, including the market reaction, the cascading regulatory risk, the impact on the BaaS business model, and the prior supervisory history, reinforce this conclusion and leave no doubt that the Consent Order requires robust, transparent, and continuing disclosure across all SEC reporting vehicles.
VII. Ongoing Disclosure Obligations and Monitoring
A. Quarterly Reports (Form 10-Q)
Each quarterly report on Form 10-Q filed by BRFG during the remediation period — which we expect to include at least the Q1 2025, Q2 2025, Q3 2025, and Q4 2025 quarterly filings — must include updated disclosures regarding the Consent Order and remediation program. Specifically, each 10-Q should address the following:
• Remediation Program Status. An update on the status of key remediation milestones, including the submission of the Action Plan to the OCC (due May 15, 2025), the implementation of Veridian TMS v.10.0, the resolution of the SAR backlog, the completion of the CDD/EDD remediation project, and the results of Thornfield's independent assessment.
• Actual Costs Incurred versus Budget. A comparison of actual remediation costs incurred to date against the $42,500,000 Board-approved budget, with an explanation of any material variances. If costs are trending above budget, the 10-Q should disclose the revised estimate and the reasons for the overrun.
• CMP Payment Status. Confirmation that the $14,500,000 CMP has been paid (following the March 16, 2025 payment deadline) and the financial statement treatment of the payment.
• New Regulatory Developments. Disclosure of any new enforcement actions, investigations, or communications from FinCEN, DOJ, OFAC, or the OCC that are material to the Company's financial position or results of operations.
• Updated Risk Factors. The 10-Q should update the risk factors included in the 10-K to reflect any changes in the risk profile — for example, the initiation of a FinCEN enforcement action, the filing of a VSD with OFAC, or the loss of a BaaS partner.
• Updated Loss Contingency Assessment. The notes to the quarterly financial statements should update the loss contingency disclosure under ASC 450 to reflect the Company's current assessment of the range of reasonably possible losses from additional regulatory actions. This assessment should be updated each quarter in consultation with Calderwood & Harkness and the external auditor.
• Liquidity Impact. If the cumulative remediation costs materially impact the Company's liquidity position or capital ratios, such impact should be disclosed in the MD&A section of the 10-Q.
B. Regulation FD Considerations
Regulation FD (17 C.F.R. §§ 243.100-243.103) prohibits the selective disclosure of material non-public information to securities market professionals and certain shareholders. All material non-public information regarding the remediation program, regulatory developments, and financial impact must either be disclosed broadly through SEC filings or press releases, or maintained as confidential.
This obligation is particularly relevant in the context of the Company's communications with Brindoval Capital Partners LP and its counsel, Amberly Knox LLP (Steven Briggs, partner). Brindoval's 8.3% ownership stake and its active engagement with management regarding the Consent Order create a heightened risk of selective disclosure. Any material non-public information shared with Brindoval representatives in the course of investor engagement must be simultaneously disclosed publicly or the Company must obtain a confidentiality agreement from Brindoval covering the information disclosed.
We recommend the preparation of standardized talking points for use by investor relations personnel, senior management, and Board members in all investor communications. These talking points should be designed to ensure consistency and to prevent the inadvertent disclosure of material non-public information. The development of these talking poin

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts