CALDERWOOD & HARKNESS LLP 1700 K Street, N.W., Suite 900 Washington, D.C. 20006
ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE
MEMORANDUM
March 10, 2025
FROM: Philip Hartmann, Partner, and Carlos Espinoza, Associate — Calderwood & Harkness LLP
TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association; Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association; Linda Petrosian, Chief Information Officer / Chief Technology Officer, Belmont Ridge Bank National Association
CC: Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP; Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
RE: Technology Implementation Timeline & Risk Assessment — Veridian Analytics TMS v.10.0 Upgrade and OFAC Module Enhancement Mapped to Consent Order Deadlines
C&H MATTER NO.: 1045-00002
THIS MEMORANDUM IS PROTECTED BY THE ATTORNEY-CLIENT PRIVILEGE AND CONSTITUTES ATTORNEY WORK PRODUCT. IT IS PREPARED AT THE REQUEST OF COUNSEL FOR BELMONT RIDGE BANK NATIONAL ASSOCIATION IN ANTICIPATION OF AND IN CONNECTION WITH ONGOING REGULATORY PROCEEDINGS. THIS MEMORANDUM SHOULD NOT BE DISCLOSED TO ANY THIRD PARTY WITHOUT THE EXPRESS WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP AND BELMONT RIDGE BANK NATIONAL ASSOCIATION.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to map the technology implementation milestones for the Veridian Analytics Inc. ("Veridian") Transaction Monitoring System ("TMS") v.10.0 upgrade and OFAC sanctions screening module enhancement against the mandatory deadlines established in OCC Consent Order No. OCC-2025-003 (the "Consent Order"), which was issued against Belmont Ridge Bank National Association ("BRB" or the "Bank") on January 15, 2025. This memorandum identifies the critical path for implementation, assesses the principal execution risks, and provides recommendations for project governance, escalation triggers, and contingency planning.
Three critical Consent Order deadlines are directly implicated by the technology implementation workstream:
• August 1, 2025 — The Veridian TMS v.10.0 must complete User Acceptance Testing ("UAT") and be fully deployed into production. This deadline represents the foundational prerequisite upon which the two subsequent milestones depend.
• October 1, 2025 — An independent model validation of the upgraded transaction monitoring system must be completed and the validation report finalized. This deadline requires not only that the system be operational, but that sufficient production data has been accumulated to support a meaningful quantitative validation.
• November 1, 2025 — The OFAC sanctions screening module must be fully operational for all Banking-as-a-Service ("BaaS") channels, achieving 100% screening coverage across all 14 active BaaS fintech partner transaction flows, including wire, ACH, and card transactions.
Overall Assessment. Based on our review of the proposed implementation timeline, vendor capabilities, internal resource availability, and the specific requirements of the Consent Order, it is our assessment that the timeline is achievable but carries material execution risk. The implementation plan involves multiple sequential dependencies, limited schedule float at each phase, and reliance on timely performance by both Veridian and BRB's internal teams, as well as the cooperation of third-party BaaS partners. Active and disciplined project management, combined with robust contingency planning, will be essential to meeting all three deadlines.
Contingency Vendor. In the event that the Veridian upgrade proves insufficient or encounters critical delays that render the current timeline unachievable, Ridgeline Data Systems LLC ("Ridgeline") has been identified as the contingency replacement vendor. However, a mid-course platform switch from Veridian to Ridgeline would almost certainly cause BRB to miss one or more Consent Order deadlines. Ridgeline's estimated implementation timeline for a full de novo platform deployment is nine to twelve months, which would push full operational deployment to no earlier than Q1 2026. Accordingly, Ridgeline should be viewed as a longer-term strategic alternative rather than a viable substitute for meeting the existing Consent Order technology milestones.
Recommendation. We recommend that BRB proceed with the Veridian TMS v.10.0 upgrade on an expedited basis, targeting MSA amendment execution by April 1, 2025. In parallel, BRB should establish clearly defined trigger points for escalation and Ridgeline fallback activation, and should implement parallel workstreams wherever possible to preserve schedule margin. Specific recommendations are set forth in Section IX of this memorandum.
II. BACKGROUND
A. Regulatory Context
On January 15, 2025, the Office of the Comptroller of the Currency ("OCC") issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order resulted from an OCC examination that identified significant deficiencies in the Bank's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program and sanctions screening operations.
The key findings relevant to the technology implementation workstream addressed in this memorandum include the following:
(i) Transaction Monitoring Model Validation Deficiency. BRB's transaction monitoring model, Veridian TMS v.8.3, had not been independently validated since March 2021 — more than three years prior to the OCC examination. This extended gap between validations was cited as a core finding in the Consent Order. Moreover, the tuning parameters for the TMS were last updated in October 2022, raising additional concerns about whether the model's detection scenarios and thresholds remained calibrated to BRB's current risk profile, product mix, and transaction volumes.
(ii) OFAC Sanctions Screening Gaps. The OCC determined that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through the Bank's fintech BaaS channels. Specifically, approximately 12% of NovaPay Technologies Inc. ("NovaPay") wire and ACH transactions went unscreened during calendar year 2023. In absolute terms, this represented approximately 3,800,000 unscreened transactions out of approximately 31,700,000 total NovaPay transactions processed during that period. The failure to achieve 100% screening coverage for OFAC sanctions represents a significant compliance gap with direct regulatory and national security implications.
(iii) Model Validation Governance Deficiencies. Beyond the specific validation lapse, the OCC cited systemic weaknesses in BRB's model risk management framework as it pertains to BSA/AML transaction monitoring, including insufficient documentation of model assumptions, inadequate governance over tuning decisions, and a lack of defined schedules for periodic revalidation.
The Consent Order must be understood in the context of BRB's prior supervisory history. The OCC issued a Matter Requiring Attention ("MRA") regarding BSA/AML transaction monitoring in June 2022, which directed BRB to enhance its transaction monitoring capabilities and complete a model validation. Subsequently, the OCC issued a Matter Requiring Immediate Attention ("MRIA") regarding OFAC screening gaps in November 2023, reflecting the agency's escalating concern over BRB's failure to remediate the identified deficiencies. The Consent Order expressly cites BRB's failure to adequately remediate these prior supervisory actions as a basis for the current enforcement action.
The Consent Order requires comprehensive remediation of all identified deficiencies, with full compliance program implementation by February 15, 2026. Within that overall remediation framework, the technology milestones addressed in this memorandum represent the most time-sensitive and technically complex components of the remediation plan.
B. Current Technology Environment
Incumbent Vendor. The Bank's current transaction monitoring and sanctions screening platform is provided by Veridian Analytics Inc., a Delaware corporation with principal offices at 1900 Embarcadero Road, Suite 400, Palo Alto, California 94303. The primary client relationship contact at Veridian is Priya Subramanian, Vice President of Client Solutions.
Current System. BRB currently operates Veridian TMS v.8.3, which serves as both the transaction monitoring system for BSA/AML alert generation and the sanctions screening platform for OFAC compliance. The system was originally implemented in 2018 and has undergone periodic updates, though as noted above, the most recent substantive tuning occurred in October 2022.
Current Contract. The existing Veridian engagement is governed by Contract No. VA-BRB-2023-0044, which provides for an annual contract value ("ACV") of $4,100,000 per year on a three-year term expiring in December 2026. The contract includes standard maintenance and support provisions, as well as access to Veridian's professional services team for configuration changes and system updates.
Identified Deficiencies. The following deficiencies in the current Veridian TMS v.8.3 platform have been identified through the OCC examination, internal reviews, and discussions with the Thornfield Consulting Group independent assessment team:
• Inadequate Tuning. The system's detection scenarios and threshold parameters have not been materially updated since October 2022, despite significant changes in BRB's transaction volumes, BaaS partner portfolio, and product mix during the intervening period.
• Lapsed Independent Model Validation. As noted above, the last independent model validation was completed in March 2021. OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management) and the Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual both contemplate periodic independent validation, typically on an annual or biennial basis.
• Incomplete OFAC Screening Coverage. The OFAC screening module within TMS v.8.3 is not integrated to capture 100% of BaaS partner transaction flows. The architecture of the v.8.3 platform requires transaction data to be routed through specific integration points, and several BaaS partner data feeds — most notably NovaPay's wire and ACH transaction streams — were not properly configured to pass through the OFAC screening engine.
• Alert Volume and SAR Conversion Metrics. In calendar year 2024, the TMS v.8.3 system generated 41,500 alerts, of which 3,847 resulted in Suspicious Activity Report ("SAR") filings — a SAR conversion rate of approximately 9.3%. While SAR conversion rates vary by institution and risk profile, a rate below 10% may suggest over-alerting and insufficient scenario calibration, which in turn diverts scarce investigative resources and increases the risk that genuinely suspicious activity is lost among a high volume of low-quality alerts.
OFAC Screening Metrics (Calendar Year 2024). The OFAC screening module generated 14,320 screening hits during calendar year 2024. Of these, only 12 were determined to be true matches requiring blocking or rejection actions. This yields a false-positive rate of approximately 99.9%, which is exceptionally high even by industry standards and underscores the critical need for improved screening algorithms, enhanced fuzzy-logic matching capabilities, and better list management protocols in the upgraded platform.
C. Planned Upgrade
BRB proposes to upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, which represents a major platform upgrade incorporating a redesigned detection engine, enhanced analytics capabilities, and an integrated OFAC sanctions screening module with improved list management and real-time screening functionality.
The financial terms for the proposed upgrade are as follows:
• One-Time Implementation Fee: $2,800,000, covering system configuration, data migration, scenario library migration and upgrade, testing support, training, and production deployment.
• Incremental Annual Licensing: $1,900,000 per year for the TMS v.10.0 platform and enhanced OFAC screening module, in addition to the existing ACV under Contract No. VA-BRB-2023-0044.
• New Total Annual Contract Value (Post-Upgrade): $4,100,000 (existing ACV) + $1,900,000 (incremental licensing) = $6,000,000 per year.
The MSA amendment and Statement of Work ("SOW") reflecting these terms were transmitted to Veridian on March 5, 2025, per correspondence from Carlos Espinoza of Calderwood & Harkness LLP to Priya Subramanian of Veridian Analytics. Veridian's comments have been requested within two weeks, with a target response date of approximately March 19, 2025. Assuming a brief negotiation period following receipt of Veridian's comments, the target date for full execution of the MSA amendment is April 1, 2025.
D. Contingency Vendor
BRB has identified Ridgeline Data Systems LLC ("Ridgeline") as a contingency replacement vendor in the event that the Veridian upgrade proves infeasible or fails to meet the Bank's requirements. Ridgeline is a Delaware limited liability company with principal offices at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661. The primary contact at Ridgeline is David Marchetti, Chief Revenue Officer.
Ridgeline's proposed commercial terms contemplate an annual contract value of $7,200,000 on a five-year term, for a total contract value of $36,000,000. A mutual non-disclosure agreement has been executed between BRB and Ridgeline, and preliminary evaluation discussions are underway. Calderwood & Harkness is concurrently preparing a separate Term Sheet Review Memorandum analyzing Ridgeline's proposed commercial terms.
It is important to note that a Ridgeline deployment would constitute a full de novo platform implementation, requiring comprehensive data migration from the existing Veridian environment, a ground-up scenario library build-out, new system configuration, and an independent model validation of the new platform. The significantly longer timeline associated with a Ridgeline replacement — estimated at nine to twelve months minimum — makes it a poor candidate for meeting the existing Consent Order technology deadlines, as discussed in greater detail in Section VI below.
III. CONSENT ORDER DEADLINE MAPPING
This section provides a detailed analysis of each of the three technology-related Consent Order deadlines, including the specific requirements, available calendar time, key milestones, dependencies, and schedule float for each.
A. Deadline 1: August 1, 2025 — TMS v.10.0 UAT Complete and Deployed
Consent Order Requirement. The Consent Order requires that the upgraded transaction monitoring system must be fully deployed and operational, with User Acceptance Testing completed and documented, no later than August 1, 2025. This milestone represents the foundational technology deliverable upon which the subsequent model validation and OFAC screening deadlines depend.
Calendar Days Available. Assuming the MSA amendment is executed by April 1, 2025 (which allows for Veridian's two-week comment period, followed by a negotiation period of approximately ten business days), BRB will have approximately 122 calendar days from contract execution to the August 1, 2025 deadline for implementation, configuration, testing, and deployment.
Key Milestones Within This Window. The following milestone schedule has been developed based on discussions with Veridian regarding its standard implementation methodology for TMS v.10.0, adjusted for BRB's specific environment and the compressed timeline required by the Consent Order:
1. MSA Amendment and SOW Finalization and Execution: Target April 1, 2025. This is the gating milestone. Veridian's professional services resources cannot be formally committed, and implementation work cannot commence, until the contractual framework is executed.
2. Environment Provisioning and Data Migration Kickoff: April 7–18, 2025 (approximately two weeks). This phase includes provisioning the TMS v.10.0 environment in Veridian's hosted infrastructure, establishing secure connectivity with BRB's data sources, and initiating the migration of transaction data, customer data, and historical alert records from the v.8.3 platform.
3. System Configuration and Scenario Library Migration/Upgrade: April 21 – May 30, 2025 (approximately six weeks). This is the most labor-intensive phase, involving configuration of the TMS v.10.0 detection engine, migration and upgrade of BRB's existing scenario library (including above-the-line and below-the-line thresholds), configuration of alert management workflows, and integration with BRB's core banking system and BaaS partner data feeds. This phase also includes initial configuration of the OFAC sanctions screening module.
4. Initial System Testing (Unit Testing and Integration Testing): June 2–20, 2025 (approximately three weeks). Veridian's implementation team and BRB's IT team will conduct systematic unit testing of individual system components and integration testing to verify end-to-end data flow from source systems through the detection engine to alert generation and case management.
5. User Acceptance Testing (UAT): June 23 – July 18, 2025 (approximately four weeks). BRB's business users — including BSA/AML analysts, OFAC compliance staff, and IT personnel — will execute a comprehensive UAT plan designed to validate that the system meets all functional requirements, performance specifications, and regulatory expectations. UAT will include scenario-based testing, regression testing, performance/stress testing, and validation of alert disposition workflows.
6. UAT Remediation and Defect Resolution: July 21–28, 2025 (approximately one week). Any defects identified during UAT will be triaged, prioritized, and remediated. Critical and high-severity defects must be resolved prior to production cutover; medium- and low-severity defects may be deferred to a post-deployment patch cycle, subject to documented risk acceptance.
7. Production Cutover and Go-Live: July 29 – August 1, 2025. The production cutover involves final data synchronization, system activation, parallel processing validation, and formal go-live. A rollback plan must be in place in case critical issues are identified during cutover.
Schedule Float. The schedule float for the August 1 deadline is minimal — approximately three to five business days of buffer built into end-of-phase dates across the implementation timeline. This limited float means that any delay in a predecessor phase will likely cascade into subsequent phases and directly threaten the August 1 deadline.
Dependencies. The following dependencies have been identified as critical to successful achievement of the August 1 milestone:
• Timely Execution of MSA Amendment. The entire implementation timeline is predicated on MSA amendment execution by April 1, 2025. Delays in Veridian's legal review process or protracted commercial negotiations would compress the already tight implementation window.
• BRB IT Resource Availability. Linda Petrosian, Chief Information Officer and Chief Technology Officer, must allocate a dedicated project team with sufficient technical expertise to support environment provisioning, data migration, integration testing, and production cutover. BRB's IT department is concurrently supporting multiple remediation workstreams, and resource contention is a material risk.
• Data Quality and Completeness. The migration of transaction monitoring scenarios, rules, customer reference data, and historical alert data from v.8.3 to v.10.0 is dependent on the quality and completeness of the existing data. Given that the v.8.3 system has not been independently validated since March 2021 and was last tuned in October 2022, there may be data integrity concerns that could complicate the migration process.
• Veridian Professional Services Team Availability and Staffing Commitment. Veridian must commit dedicated professional services resources to the BRB implementation and maintain that staffing commitment throughout the project lifecycle. Given that TMS v.10.0 is a major platform upgrade likely being deployed to multiple clients concurrently, resource competition within Veridian is a realistic concern.
• Coordination with Thornfield Consulting Group. The OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"), is conducting an ongoing assessment of BRB's remediation efforts. The relevant Thornfield team members for the technology workstream — Robert Eastman, Senior Director, AML Transaction Monitoring, and his team, particularly Dr. Vivian Castellano's broader oversight — will require observation and assessment access to the implementation process. BRB must accommodate Thornfield's oversight requirements without allowing them to become a bottleneck in the implementation timeline.
• Pinnacle Compliance Solutions Temporary Staffing. Pinnacle Compliance Solutions has been engaged to provide 30 temporary full-time equivalents ("FTEs") under SOW Ref: PCS-BRB-2025-0012 to support BRB's operational compliance workload during the remediation period. These temporary staff may be needed for parallel alert processing during the system transition — specifically, to ensure that alerts generated by the legacy v.8.3 system continue to be investigated and dispositioned while the v.10.0 system is being deployed and stabilized.
B. Deadline 2: October 1, 2025 — Independent Model Validation Complete
Consent Order Requirement. The Consent Order requires that an independent model validation of the upgraded TMS be completed no later than October 1, 2025. The validation must assess whether the upgraded transaction monitoring system is appropriately designed, implemented, and calibrated to detect suspicious activity consistent with BRB's risk profile, and must be performed by a qualified independent party.
Calendar Days Available. From the August 1, 2025 go-live date, BRB will have approximately 61 calendar days until the October 1, 2025 deadline. This is the tightest segment of the overall technology implementation timeline and the one with the least margin for error.
Validation Scope. A comprehensive independent model validation of the TMS v.10.0 platform is expected to encompass the following areas:
• Model methodology and conceptual soundness review
• Scenario design and detection logic assessment
• Tuning parameter evaluation, including both above-the-line (alert-generating) and below-the-line (suppression) thresholds
• Data integrity and completeness verification
• Alert generation accuracy testing
• False-positive rate analysis and benchmarking
• Back-testing against known suspicious activity
• Governance framework and model risk management review
• Documentation adequacy assessment
Validation Entity. The identity of the independent validation firm has not yet been finalized. Two candidates are under consideration:
Thornfield Consulting Group. Thornfield possesses relevant expertise in BSA/AML transaction monitoring through Robert Eastman and his team. However, Thornfield's role as the OCC-mandated independent consultant under the Consent Order may create independence concerns if Thornfield also performs the model validation. Specifically, a firm that is responsible for assessing the adequacy of BRB's remediation efforts may not be able to serve simultaneously as the independent validator of a core component of that remediation, as doing so could be viewed as "self-review" — i.e., Thornfield would be validating a system whose implementation it oversaw and assessed. Calderwood & Harkness is evaluating this independence question and will provide separate guidance.
Caldera & Pope LLP. Caldera & Pope LLP, located at 311 South Wacker Drive, Suite 5400, Chicago, Illinois 60606 (engagement partner Franklin Dorsey, CPA), has performed BRB's prior BSA/AML independent testing, most recently in September 2024 at a fee of $1,100,000. Caldera & Pope has institutional familiarity with BRB's BSA/AML program and transaction monitoring environment, which could accelerate the validation process. However, Caldera & Pope also serves as BRB's external auditor (with an annual audit fee of $3,400,000 in 2024), which raises its own set of independence considerations under generally accepted auditing standards and OCC expectations regarding the separation of audit and consulting functions. Calderwood & Harkness will assess whether Caldera & Pope can serve in this capacity without compromising its audit independence.
If neither Thornfield nor Caldera & Pope can serve as the independent validation firm, BRB will need to identify and engage a third-party firm with relevant BSA/AML model validation expertise. This would add time to the engagement process and increase the risk of delay.
Key Milestones. The following milestones are recommended to maximize the probability of meeting the October 1 deadline:
1. Engage/Confirm Validation Firm: By June 15, 2025. Early engagement is critical to allow the validation firm to begin planning, assign resources, and conduct preliminary documentation review. Waiting until after the August 1 go-live to engage the firm would compress an already tight timeline to an unacceptable degree.
2. Validation Firm Review of Pre-Deployment Documentation and Model Design: June–July 2025 (pre-positioning phase). The validation firm should review the TMS v.10.0 model documentation, scenario design specifications, tuning methodology, and governance framework during the pre-deployment period. This "pre-positioning" activity allows the firm to identify any conceptual soundness concerns before the system goes live and positions the firm to commence quantitative testing immediately upon go-live.
3. Post-Deployment Production Data Analysis and Testing: August 4 – September 5, 2025 (approximately five weeks). Following the August 1 go-live, the validation firm will collect and analyze production data to assess alert generation accuracy, false-positive rates, detection coverage, and threshold calibration. A minimum of 30 days of production data is standard practice for a meaningful quantitative validation.
4. Draft Validation Report: September 8–19, 2025. The validation firm will prepare a draft report summarizing its findings, including any identified deficiencies or recommendations for remediation.
5. Final Validation Report and Remediation of Identified Issues: September 22 – October 1, 2025. BRB and Veridian will review the draft report, address any identified issues or implement recommended adjustments, and the validation firm will finalize its report. The final report must be completed by October 1, 2025.
Schedule Float. The schedule float for the October 1 deadline is very limited — approximately five business days of aggregate buffer across the post-deployment phases. Given the sequential nature of the validation process (production data must accumulate before quantitative testing can begin, and testing must be completed before the report can be drafted), there is limited opportunity to compress the timeline through parallel activities.
Key Risk. The most significant risk to the October 1 deadline is the dependency on sufficient production data from the upgraded TMS. Industry best practice and regulatory expectation is that an independent model validation should be based on a minimum of 30 days of production data. This means that the August 1 go-live date cannot slip by even a single day without directly compressing the production data accumulation window and, consequently, the validation timeline.
Dependency on Deadline 1. Any delay in the August 1 UAT/deployment deadline directly erodes the October 1 validation window on a day-for-day basis. If the August 1 go-live slips by two weeks (to August 15), the available window for the entire validation process would shrink from 61 days to approximately 47 days — which may be insufficient to accumulate adequate production data, conduct rigorous testing, and produce a final report that meets OCC expectations for quality and thoroughness.
C. Deadline 3: November 1, 2025 — OFAC Screening Fully Operational for All BaaS Channels
Consent Order Requirement. The Consent Order requires that OFAC sanctions screening must be fully operational across all 14 active BaaS fintech partner transaction channels by November 1, 2025, achieving 100% screening coverage. This requirement directly addresses the core OFAC finding in the Consent Order, which identified that approximately 3,800,000 NovaPay transactions went unscreened in calendar year 2023.
Calendar Days Available. From the August 1, 2025 go-live date, BRB will have approximately 92 calendar days until the November 1, 2025 deadline. While this is a longer window than the model validation deadline, the OFAC screening operationalization involves significant complexity due to the need to integrate with 14 separate BaaS partner transaction flows.
OFAC Module Specifics. The Veridian TMS v.10.0 OFAC sanctions screening module is designed to provide the following capabilities:
• Real-Time Screening Integration. Real-time, pre-execution screening of all transactions across all 14 BaaS partner transaction flows, including wire transfers, ACH transactions, and card transactions. Each transaction must be screened against applicable sanctions lists before processing is completed.
• Batch Screening Capability. Batch screening functionality for historical account data and transaction records, enabling retroactive screening and periodic re-screening of customer databases against updated sanctions lists.
• List Management. Comprehensive list management covering the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List ("SSI List"), and all non-SDN lists maintained by OFAC. The system must support automated list updates with the ability to ingest new list publications within a defined timeframe (target: within two hours of OFAC publication).
• Hit Disposition Workflow. An integrated hit disposition workflow including automated confidence scoring, analyst review queues, escalation paths, and documentation of dispositioning decisions. The workflow must support audit trail requirements and supervisory review capabilities.
BaaS Partner Transaction Volume Context. The 14 active BaaS fintech partner channels represent varying levels of transaction volume and, consequently, varying levels of risk priority for OFAC screening integration. The three largest BaaS partners by transaction volume are:
• NovaPay Technologies Inc. — Approximately 41% of total BaaS transaction volume, representing approximately $30.5 billion in transaction value in calendar year 2024. NovaPay is the source of the 3,800,000 unscreened transactions identified in the Consent Order and is therefore the highest-priority integration target.
• FairLend Digital — Approximately 28% of total BaaS transaction volume. FairLend's digital lending and payment processing activities generate significant wire and ACH volume that must be captured by the OFAC screening module.
• VaultEdge — Approximately 18% of total BaaS transaction volume. VaultEdge's digital banking platform processes a substantial volume of customer transactions requiring real-time OFAC screening.
Together, these three partners represent approximately 87% of BRB's total BaaS transaction volume. The remaining 11 BaaS partners collectively represent approximately 13% of volume. While all 14 partners must be integrated to achieve the 100% screening coverage required by the Consent Order, prioritization of the top three partners will address the vast majority of the screening gap.
Key Milestones. The following milestones have been established for OFAC screening operationalization:
1. OFAC Module Configuration and BaaS API Integration: This workstream is included within the broader TMS v.10.0 implementation timeline (April–July 2025). During the system configuration phase, the OFAC module will be configured with BRB's screening parameters, list management settings, and hit disposition workflows. Concurrently, API integration specifications will be developed for each of the 14 BaaS partner transaction feeds.
2. BaaS Partner Technical Coordination: This is a parallel workstream that requires active cooperation from all 14 fintech partners on data feeds, API specifications, and transaction format standardization. Each partner must provide transaction data in a format compatible with the Veridian TMS v.10.0 OFAC screening module, and must implement the required API connections to enable real-time screening. NovaPay, FairLend Digital, and VaultEdge are the highest priority partners given their volume concentration.
3. Compliance Remediation Letters. Compliance remediation letters have already been sent to NovaPay (attention: Ethan Garrison, Chief Executive Officer) and FairLend Digital (attention: Aisha Okonkwo, Chief Executive Officer), demanding enhanced cooperation and data sharing in support of the OFAC screening enhancement. The cooperation of BaaS partners is a prerequisite for successful integration, and the remediation letters establish the Bank's expectation that partners will allocate the necessary technical resources and prioritize the integration effort. Similar letters should be sent to VaultEdge and the remaining 11 partners.
4. OFAC Screening Parallel Run (Dual Processing): August 1 – September 15, 2025 (approximately six weeks). During this phase, the upgraded OFAC screening module will process transactions in parallel with the legacy screening system. This parallel-run approach allows BRB to compare screening results between the old and new systems, identify any discrepancies, and validate that the upgraded module is capturing all transactions with appropriate accuracy before the legacy system is retired.
5. OFAC Screening Accuracy Testing and Tuning: September 15 – October 15, 2025 (approximately four weeks). Based on the results of the parallel run, the OFAC module will be tuned to optimize screening accuracy, reduce false-positive rates, and ensure that the hit disposition workflow is functioning correctly. This phase also includes testing of list update processes and verification that all sanctions list sources are being ingested and applied correctly.
6. Full Cutover to Production OFAC Screening for All 14 BaaS Channels: October 15–31, 2025 (approximately two weeks). The legacy OFAC screening system will be retired, and the upgraded module within TMS v.10.0 will become the sole production OFAC screening platform for all BaaS channels. Each of the 14 partner channels will be individually verified for complete integration and 100% transaction coverage.
7. Confirmation of 100% Screening Operationalization: November 1, 2025. BRB will confirm, through system reporting and compliance validation, that all 14 BaaS partner transaction channels are fully integrated with the OFAC screening module and that 100% of transactions are being screened in real time.
Schedule Float. The OFAC screening timeline includes approximately two weeks of float, primarily located in the parallel-run phase (August 1 – September 15). This represents modestly more buffer than the other two deadlines, but the float could be consumed quickly if BaaS partner cooperation is slow or if integration testing reveals unexpected technical challenges.
Dependencies. The following dependencies are critical to the November 1 milestone:
• Fintech Partner Technical Cooperation. The successful integration of all 14 BaaS partner transaction flows is fundamentally dependent on the willingness and technical ability of each partner to provide the necessary data feeds, implement required API connections, and participate in integration testing. NovaPay, as the largest-volume partner and the source of the screening gap identified in the Consent Order, is the single most critical dependency.
• Successful TMS v.10.0 Deployment by August 1. The OFAC screening module is integrated into the TMS v.10.0 platform. If the platform deployment is delayed beyond August 1, the OFAC screening operationalization timeline is correspondingly compressed.
• List Management and Update Frequency Configuration. The OFAC module must be configured to ingest sanctions list updates from all relevant OFAC sources on a timely basis. Configuration and testing of the list management functionality must be completed during the implementation phase.
• BRB Compliance Staff Training. BRB's OFAC compliance staff must be trained on the new hit review and disposition workflows within the upgraded module. Training materials must be developed and training sessions conducted prior to the parallel-run phase.
IV. CRITICAL PATH ANALYSIS
A. Identification of Critical Path
Based on the deadline mapping set forth in Section III, the critical path for the technology implementation runs through the following sequential chain:
MSA Amendment Execution (April 1) → System Configuration and Scenario Library Migration (April–May) → System Testing (June) → User Acceptance Testing (June–July) → Production Deployment (August 1) → Production Data Accumulation (August) → Independent Model Validation (August–October 1)
The August 1 to October 1 segment is the tightest constraint in the overall timeline. With only 61 calendar days to stabilize the production system, accumulate sufficient production data, and complete a comprehensive independent model validation, there is virtually no room for delay. Any slippage in the August 1 deployment directly erodes this window on a day-for-day basis, as discussed in Section III.B above.
The OFAC screening operationalization (November 1) has slightly more float than the model validation deadline, but it is dependent on the same August 1 deployment date for the integrated TMS v.10.0 platform. Accordingly, the August 1 go-live represents the single most important milestone in the entire remediation technology workstream — it is the linchpin upon which both subsequent deadlines depend.
B. Schedule Compression Opportunities
While the overall timeline is compressed, several opportunities exist to accelerate specific workstreams or reduce the effective duration of sequential activities:
• Pre-Positioning of the Model Validation Firm. By engaging the independent model validation firm no later than June 15, 2025, and beginning documentation review and conceptual soundness assessment during June–July 2025 (i.e., before the August 1 go-live), BRB can effectively recover approximately two weeks from the post-deployment validation timeline. The validation firm will arrive at the go-live date already familiar with the model's design, assumptions, and governance framework, and can commence quantitative testing immediately upon availability of production data.
• Parallel BaaS Partner Integration Workstreams. API integration and data feed testing with the 14 BaaS fintech partners can begin in advance of the full TMS v.10.0 deployment, using Veridian's staging environment. This approach allows BRB to identify and resolve technical integration issues before the production system goes live, reducing the risk of integration delays during the parallel-run phase.
• Pre-Release OFAC Module for BaaS Channel Integration Testing. Veridian may be able to provide a beta or pre-release version of the OFAC sanctions screening module for use in BaaS channel integration testing prior to the full platform deployment. This would allow BRB's IT team and BaaS partners to begin testing data feed connectivity and transaction format compatibility in a sandbox environment while the broader TMS v.10.0 configuration is still underway.
• Extended-Hours and Weekend Work During UAT. To compress the UAT testing calendar, BRB should plan for extended-hours and weekend testing sessions during the June 23 – July 18 UAT window. This can effectively increase the number of available testing hours without extending the calendar duration of the UAT phase.
C. Schedule Float Summary Table
The following table summarizes the available calendar days, estimated work duration, and schedule float for each of the three Consent Order technology deadlines:
As reflected in the table, the aggregate schedule float across all three deadlines is modest. The October 1 model validation deadline has the least absolute float and the least relative float (expressed as a percentage of available calendar days), making it the most vulnerable of the three milestones to any upstream delay.
V. RISK ASSESSMENT
This section identifies and assesses the principal risks to BRB's ability to meet the three Consent Order technology deadlines. For each risk, we assess the likelihood of occurrence, the potential impact on the timeline, the current status of any relevant activity, and recommended mitigation measures.
A. Risk 1: MSA Amendment Execution Delay
Description. The Veridian MSA amendment and Statement of Work may not be finalized and executed by the target date of April 1, 2025. Delays could result from protracted legal review by Veridian's internal counsel, disagreements on commercial terms (including implementation fees, licensing costs, service-level commitments, or liability allocation), or internal approval processes at either BRB or Veridian.
Likelihood. Moderate. The MSA amendment and SOW were transmitted to Veridian on March 5, 2025, and comments have been requested by approximately March 19, 2025. While a two-week response period is reasonable, Veridian may request additional time, particularly if the SOW includes provisions that deviate from Veridian's standard terms (such as enhanced staffing commitments, liquidated damages, or accelerated implementation timelines). Commercial negotiations following receipt of Veridian's comments could extend the process by one to two additional weeks.
Impact. High. Each day of delay in MSA amendment execution compresses the entire implementation timeline on a day-for-day basis. Given the minimal schedule float identified in Section IV.C, even a one-week delay in contract execution could make the August 1 deployment deadline extremely difficult to achieve.
Current Status. The MSA amendment and SOW were transmitted to Priya Subramanian at Veridian on March 5, 2025. As of the date of this memorandum, Veridian has acknowledged receipt and indicated that its legal and commercial teams are reviewing the documents. No substantive comments have yet been received.
Mitigation Measures.
• Calderwood & Harkness to prioritize rapid negotiation of the MSA amendment, with Carlos Espinoza serving as the primary negotiation contact and Philip Hartmann available for escalation on material issues.
• If Veridian's comments are not received by March 19, 2025, Carlos Espinoza to follow up directly with Priya Subramanian.
• If comments are not received by March 28, 2025, Philip Hartmann to escalate to Veridian's senior management (Vice President or above) and Gregory Nardone to communicate directly with Veridian's executive team to emphasize the regulatory urgency.
• Pre-order Veridian professional services resources contingent on execution to ensure that implementation staff are reserved and available for the April start date, even if final contract execution is pending.
• Establish a hard deadline of April 7, 2025 for execution, with a BRB management escalation trigger at March 28, 2025 if substantive comments have not been received.
B. Risk 2: Veridian Implementation Resource Constraints
Description. Veridian may lack sufficient professional services resources to staff the BRB implementation on the required timeline. TMS v.10.0 is a major platform upgrade, and Veridian is likely deploying this version to multiple clients concurrently. Resource competition within Veridian's professional services organization could result in insufficient staffing, assignment of less experienced personnel, or delays in key configuration and testing activities.
Likelihood. Moderate. Veridian is a mid-size financial technology company with a finite professional services capacity. The compressed implementation timeline required by BRB's Consent Order deadlines is more aggressive than Veridian's standard implementation methodology, which typically contemplates a six- to nine-month deployment cycle for TMS v.10.0.
Impact. High. Inadequate staffing or assignment of inexperienced resources would directly delay the configuration and testing phases, which are on the critical path to the August 1 deadline. A shortfall in Veridian resources during the UAT phase could also result in slower defect resolution and extend the remediation window.
Mitigation Measures.
• Include explicit resource commitment and staffing guarantees in the MSA amendment, specifying the minimum number of dedicated Veridian professional services FTEs, their qualifications, and the expected duration of their engagement.
• Require Veridian to name a dedicated project manager and implementation team by name in the SOW, with a contractual requirement that named individuals not be reassigned without BRB's prior written consent.
• Include liquidated damages or service-level credits for delays attributable to Veridian staffing shortfalls. Such provisions provide financial incentive for Veridian to maintain its staffing commitment and create a contractual remedy in the event of resource-related delays.
• Establish weekly resource utilization reporting from Veridian's project manager to BRB's Technology Remediation Project Manager.
C. Risk 3: Data Migration and Configuration Complexity
Description. The migration of transaction monitoring scenarios, rules, customer reference data, and historical alert records from Veridian TMS v.8.3 to TMS v.10.0 may encounter data quality issues, schema incompatibilities, or other technical challenges that complicate or delay the migration and configuration process.
Likelihood. Moderate to High. The v.8.3 system has not been independently validated since March 2021 and was last tuned in October 2022. The absence of recent validation and tuning activities suggests that the underlying data environment may contain inconsistencies, outdated configurations, or data integrity issues that have accumulated over time. Additionally, the migration from v.8.3 to v.10.0 involves a major platform architecture change that may not support a straightforward one-to-one mapping of all existing scenarios and configurations.
Impact. Medium to High. Data migration issues could delay the configuration and testing phases by two to four weeks, depending on the nature and severity of the issues encountered. In a worst-case scenario, data quality problems could require a remediation effort before migration can proceed, consuming additional time from the already tight schedule.
Mitigation Measures.
• Conduct a comprehensive data quality assessment and pre-migration audit during March–April 2025, prior to the formal start of the migration process. This assessment should identify data integrity issues, schema incompatibilities, and any data elements that require cleansing or transformation before migration.
• Engage BRB's IT team, under Linda Petrosian's direction, to identify and remediate data quality issues before migration begins. Proactive remediation of known issues will reduce the risk of surprises during the migration phase.
• Include detailed data migration acceptance criteria in the SOW, specifying the standards that must be met for the migration to be deemed complete and successful. These criteria should address data completeness, accuracy, and consistency between the source and target environments.
• Require Veridian to perform a trial or "dry run" migration in a staging environment before the production migration, to identify and resolve technical issues in advance.
D. Risk 4: UAT Defects and Remediation
Description. User Acceptance Testing may identify material defects — including functional errors, performance issues, integration failures, or data accuracy problems — that require remediation extending beyond the July 28 remediation window.
Likelihood. Moderate. Major platform upgrades frequently surface integration and performance issues that are not detected during earlier testing phases. The compressed implementation timeline increases the likelihood that some defects will not be identified until UAT, as the abbreviated configuration and unit testing phases may not provide sufficient coverage to surface all issues.
Impact. High. Material UAT defects that cannot be resolved within the July 21–28 remediation window would directly threaten the August 1 deployment deadline. A decision to deploy with known defects would need to be carefully weighed against the regulatory risk of delaying deployment.
Mitigation Measures.
• Build a severity-based defect classification framework with defined go/no-go criteria for production deployment. Critical defects (system crashes, data loss, regulatory compliance failures) would require resolution before go-live. High-severity defects (significant functional impairments) would require resolution or an approved workaround. Medium- and low-severity defects could be deferred to a post-deployment patch cycle with documented risk acceptance.
• Establish a defect triage committee comprising representatives from BRB IT, BRB Compliance, Veridian implementation team, and Calderwood & Harkness (in an advisory/observer capacity). The triage committee would meet daily during the UAT and remediation phases to assess defect severity, assign remediation priorities, and make go/no-go recommendations.
• Define minimum acceptance thresholds for go-live that balance the risk of deploying with known defects against the regulatory risk of missing the August 1 deadline. These thresholds should be documented in advance and approved by the Steering Committee (see Recommendation 2 in Section IX).
• Document risk acceptance for any deferred defects, including the rationale for deferral, the expected remediation timeline, and any interim compensating controls.
E. Risk 5: Independent Model Validation Compressed Timeline
Description. The 61-day window between the August 1 deployment and the October 1 validation deadline may prove insufficient for a thorough independent model validation, particularly if the validation firm encounters scheduling constraints, if insufficient production data is available, or if the validation identifies issues requiring remediation before the report can be finalized.
Likelihood. Moderate to High. The 61-day window is significantly shorter than the typical model validation engagement, which often spans three to four months. The compressed timeline increases the risk that the validation will be rushed, that the production data sample will be insufficient for robust statistical analysis, or that identified issues cannot be remediated within the available time.
Impact. Very High. Failure to complete the independent model validation by October 1, 2025 would constitute a direct Consent Order deadline miss. Such a miss would be reportable to the OCC and could trigger enhanced regulatory scrutiny, potential extension of the Consent Order, or additional enforcement action. This is arguably the most consequential of the three technology deadlines from a regulatory risk perspective.
Mitigation Measures.
• Pre-engage the validation firm by June 15, 2025, at the latest. The engagement letter and scope of work should be finalized by this date to allow the firm to allocate resources and begin planning.
• Begin documentation review and methodology assessment during the June–July 2025 pre-deployment period. By the time the system goes live on August 1, the validation firm should have completed its conceptual soundness review and be prepared to begin quantitative testing immediately.
• Use the first 30 days of production data (August 1–31) for quantitative testing, with the validation firm conducting analysis concurrently with data accumulation (i.e., interim analysis on rolling production data rather than waiting for the full 30-day dataset before beginning any analysis).
• Target a draft validation report by September 19, 2025, to allow approximately 10 business days for BRB and Veridian to review findings, implement any required remediation, and for the validation firm to finalize its report.
• Conduct a thorough assessment of whether Thornfield Consulting Group or Caldera & Pope LLP (or another firm) is the appropriate validation entity, taking into account independence requirements, relevant expertise, and availability. Calderwood & Harkness will provide a separate recommendation on this question by April 30, 2025.
F. Risk 6: BaaS Partner Cooperation Failures
Description. One or more of the 14 BaaS fintech partners may fail to provide timely API integration, data feeds, or technical cooperation necessary for OFAC screening integration. The risk is most acute for smaller BaaS partners that may lack the technical resources, infrastructure, or institutional motivation to prioritize the integration effort.
Likelihood. Moderate. The three largest partners (NovaPay, FairLend Digital, and VaultEdge) are already aware of the regulatory urgency and have received compliance remediation letters. However, the 11 smaller partners — which collectively represent approximately 13% of BaaS transaction volume — may have limited engineering teams, competing development priorities, or insufficient understanding of the regulatory consequences of non-cooperation. Even one partner's failure to integrate could prevent BRB from certifying 100% screening coverage by November 1.
Impact. Medium to High. Failure to achieve 100% BaaS channel screening by November 1 would constitute a direct Consent Order deadline miss. The severity of the impact depends on the number and volume of unintegrated partners — a failure to integrate a partner representing 0.5% of volume is qualitatively different from a failure to integrate NovaPay at 41% of volume, but the Consent Order requirement is absolute.
Mitigation Measures.
• Compliance remediation letters have already been sent to NovaPay (Ethan Garrison, CEO) and FairLend Digital (Aisha Okonkwo, CEO). Similar letters should be sent promptly to VaultEdge (Marcus Tan, CEO) and the remaining 11 BaaS partners, establishing clear expectations for technical cooperation and data sharing timelines.
• Include contractual cooperation requirements in a revised BaaS program agreement compliance addendum template. Each partner's BaaS agreement should be amended (or, for future partners, should include ab initio) a provision requiring the partner to cooperate with BRB's regulatory compliance obligations, including OFAC screening integration, within specified timeframes and with specified technical requirements.
• Warren Ashby, Head of Fintech Partnerships, should maintain weekly technical coordination calls with the top three partners (NovaPay, FairLend Digital, VaultEdge) and biweekly calls with the remaining 11 partners to track integration progress and identify issues early.
• Establish a clear escalation path, up to and including BaaS partnership termination, for partners that fail to cooperate with the integration effort within required timeframes. While termination is a measure of last resort and carries its own business and operational implications, the existence of a credible termination threat provides leverage to compel cooperation.
G. Risk 7: BRB Internal Resource Constraints
Description. BRB's internal teams — including the IT department, BSA/AML department (currently staffed at 62 FTEs), and broader compliance organization — may be stretched thin across multiple concurrent remediation workstreams. The technology upgrade is only one component of a comprehensive remediation program that also includes SAR backlog clearance, CDD/EDD remediation, policy and procedure enhancements, training, and other initiatives.