APPENDIX A
SCOPE OF WORK
Independent Consultant Engagement
Thornfield Consulting Group LLC
for
Belmont Ridge Bank National Association
Engagement Reference: TCG-BRB-2025-001
February 10, 2025
Right-click to update Table of Contents
1. INTRODUCTION AND PURPOSE
This Appendix A (the "Scope of Work" or "SOW") is attached to and forms an integral part of the Independent Consultant Engagement Agreement, dated February 10, 2025 (the "Engagement Agreement"), between Belmont Ridge Bank National Association ("BRB" or the "Bank"), OCC Charter No. 48271, FDIC Certificate No. 31845, headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, and Thornfield Consulting Group LLC ("Thornfield" or the "Independent Consultant"), a Delaware limited liability company with principal offices at 200 Park Avenue South, 15th Floor, New York, NY 10003. This Scope of Work is assigned Engagement Reference TCG-BRB-2025-001 and is deemed effective as of February 10, 2025 (the "Effective Date").
The purpose of this Scope of Work is to define in detail the scope, deliverables, timeline, methodology, and operational framework for the independent assessment, validation, and reporting services to be performed by Thornfield in connection with Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025 (the "Consent Order"), pursuant to Article VII thereof. Article VII of the Consent Order requires BRB to engage a qualified independent consultant, acceptable to the OCC, to assess the Bank's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance programs, to validate remediation efforts, and to report findings and conclusions directly to both the Bank and the OCC.
Calderwood & Harkness LLP ("C&H"), with offices at 1285 Avenue of the Americas, 40th Floor, New York, NY 10019, serves as outside regulatory counsel to BRB in connection with the Consent Order and related regulatory matters. Philip Hartmann, Responsible Partner, Banking & Finance, is the primary C&H contact for purposes of this engagement and shall serve as coordinating counsel for all matters arising under this Scope of Work, the Engagement Agreement, and the related protocols and side letters described herein. All references in this Scope of Work to communications or actions taken "via C&H" shall mean communications or actions coordinated through Mr. Hartmann or his designee, Yuki Nakamura, Senior Associate, Banking & Finance, at C&H.
The OCC's formal non-objection to the engagement of Thornfield Consulting Group LLC as the independent consultant was received by BRB on February 5, 2025, in a letter from Jonathan Frey, National Bank Examiner and Examiner-in-Charge, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. The non-objection confirmed that Thornfield meets the qualifications, independence, and experience requirements set forth in Article VII of the Consent Order.
All work performed by Thornfield under this Scope of Work shall be conducted in strict accordance with the terms and requirements of the Consent Order, all applicable OCC supervisory guidance and bulletins, applicable federal banking laws and regulations, and the terms and conditions of the Engagement Agreement, including all appendices, exhibits, protocols, and side letters attached thereto or executed in connection therewith.
2. BACKGROUND
2.1 Regulatory Context
The OCC conducted a targeted BSA/AML examination of Belmont Ridge Bank National Association commencing in March 2024 and concluding in September 2024, representing a six-month examination cycle focused on the Bank's BSA/AML compliance program, OFAC sanctions screening operations, customer due diligence practices, transaction monitoring systems, and governance and oversight structures. The examination was led by Jonathan Frey, National Bank Examiner, serving as Examiner-in-Charge, from the OCC Northeastern District Office located at 340 Madison Avenue, New York, NY 10017.
The targeted examination was initiated in the context of BRB's prior supervisory history, which includes the following significant supervisory actions:
(a) In June 2022, the OCC issued a Matter Requiring Attention ("MRA") to BRB regarding deficiencies in the Bank's BSA/AML transaction monitoring program. The MRA identified inadequate tuning and validation of the Bank's transaction monitoring system, insufficient staffing in the BSA/AML department, and gaps in alert disposition documentation. The MRA required BRB to develop and implement a remediation plan addressing these deficiencies within a specified timeframe.
(b) In November 2023, the OCC escalated its supervisory concerns by issuing a Matter Requiring Immediate Attention ("MRIA") to BRB regarding gaps in the Bank's OFAC sanctions screening program. The MRIA specifically identified that BRB's OFAC screening processes were not capturing the full universe of transactions processed through its fintech Banking-as-a-Service ("BaaS") channels, creating a material gap in sanctions screening coverage. The MRIA required immediate corrective action and directed BRB to provide a written response and remediation plan within sixty (60) days.
The Consent Order explicitly cites BRB's failure to adequately remediate the deficiencies underlying both the June 2022 MRA and the November 2023 MRIA as a significant aggravating factor in the OCC's enforcement decision. The OCC found that despite having received these prior supervisory actions, BRB did not implement effective corrective measures, and the underlying deficiencies persisted and, in certain respects, worsened during the intervening period.
In addition to the OCC's own examination, Caldera & Pope LLP, an independent professional services firm, completed an independent BSA/AML test of BRB's compliance program in September 2024 pursuant to the requirements of 12 C.F.R. § 21.21. The Caldera & Pope independent test identified multiple deficiencies that were subsequently echoed in the Consent Order's findings, including material gaps in OFAC screening coverage for BaaS transactions, a substantial backlog of unreviewed suspicious activity alerts, incomplete customer due diligence documentation for high-risk accounts, and deficiencies in the Bank's transaction monitoring model validation practices.
As a result of the foregoing examination findings and the Bank's supervisory history, the OCC issued Consent Order No. OCC-2025-003 on January 15, 2025, which became effective on that date. The Consent Order, among other things, assessed a civil money penalty in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000), payable by BRB to the United States Treasury on or before March 16, 2025, and imposed a comprehensive set of remedial requirements as described more fully in Section 2.2 below.
2.2 Core Deficiency Categories Identified in the Consent Order
The Consent Order identifies five core categories of deficiency that collectively define the scope of the Independent Consultant's assessment under this Scope of Work. Each deficiency category corresponds to one or more articles of the Consent Order and is summarized below with relevant quantitative details:
Deficiency Category 1: OFAC Sanctions Screening Deficiencies. The OCC found that BRB's OFAC screening system failed to screen one hundred percent (100%) of transactions processed through the Bank's fintech Banking-as-a-Service channels. In particular, the examination determined that approximately twelve percent (12%) of transactions originated through NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS fintech partner by volume, were not subjected to OFAC screening during Calendar Year 2023. This gap represented approximately 3,800,000 unscreened transactions out of a total of 31,700,000 NovaPay-originated transactions processed through BRB's systems during that period. The failure to screen these transactions against applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications ("SSI"), and the Non-SDN Lists, constituted a significant violation of OFAC compliance requirements and presented an unacceptable risk that BRB may have processed transactions involving sanctioned persons, entities, or jurisdictions without detection.
Deficiency Category 2: SAR Filing Deficiencies. The OCC found that BRB maintained a substantial backlog of potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned. As of September 2024, the conclusion of the examination period, approximately 2,400 transaction monitoring alerts remained in an unreviewed status, representing a significant accumulation of potentially actionable alerts that had not been subjected to the Bank's investigation and SAR filing processes. The OCC further found that the average elapsed time between alert generation and SAR filing was approximately seventy-eight (78) days, far exceeding the regulatory expectation of timely filing, which the OCC and FinCEN guidance generally contemplate to be within thirty (30) days of the determination that activity is suspicious. For reference, BRB filed a total of 3,847 Suspicious Activity Reports during Calendar Year 2024 and 2,914 Suspicious Activity Reports during Calendar Year 2023, reflecting a year-over-year increase that itself raised concerns about the adequacy of the Bank's prior monitoring and filing practices.
Deficiency Category 3: CDD/EDD Failures. The OCC found that approximately 47,000 customer accounts designated as high risk — predominantly accounts onboarded through BRB's fintech BaaS partner channels — lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. The deficiencies included, among other things, incomplete or missing beneficial ownership information, insufficient documentation of the purpose and expected activity of accounts, inadequate risk-rating justifications, and failure to conduct periodic reviews and updates of customer information as required by the Bank's own policies and by the FinCEN Customer Due Diligence Rule (31 C.F.R. § 1010.230). The concentration of these deficiencies in BaaS-originated accounts raised particular concerns about the effectiveness of BRB's oversight of delegated CDD/EDD functions performed by its fintech partners.
Deficiency Category 4: Transaction Monitoring Model Validation Deficiencies. The OCC found that BRB's transaction monitoring system — specifically, Veridian Analytics Inc. TMS version 8.3, operating under Contract No. VA-BRB-2023-0044 — had not been subjected to an independent model validation since March 2021, a period of more than three (3) years prior to the commencement of the examination. Additionally, the system's tuning parameters and alert-generating thresholds had not been updated since October 2022. The absence of periodic independent validation and timely tuning raised significant concerns about the system's effectiveness in detecting suspicious activity, particularly in light of material changes to BRB's business profile during the intervening period, including the rapid growth of its BaaS business lines and the corresponding increase in transaction volumes, customer types, and risk profiles.
Deficiency Category 5: Board Oversight Deficiencies. The OCC found that BRB's Board of Directors did not maintain a dedicated Compliance Committee responsible for BSA/AML oversight. BSA/AML matters were addressed by the full Board only on a quarterly basis, and the information provided to the Board did not include key performance and risk metrics such as SAR filing volumes and timeliness trends, OFAC screening hit and false-positive rates, risk ratings and compliance assessments by individual BaaS partner, staffing metrics for the BSA/AML department, or the status of outstanding supervisory actions (MRAs and MRIAs). The Consent Order found that this governance structure was inadequate for an institution of BRB's size, complexity, and risk profile, particularly given the Bank's significant and growing BaaS operations.
2.3 BRB Institution Profile (Relevant to Scope)
To provide context for the scope and scale of the Independent Consultant's assessment, the following summary describes relevant characteristics of BRB's operations and BSA/AML program as of the dates indicated:
Financial Profile (as of December 31, 2024). BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion. The Bank's core business lines comprise retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service partnerships. The BaaS business line has experienced significant growth in recent years and now represents a material portion of the Bank's revenue and transaction volumes.
BaaS Partnership Profile. BRB currently maintains fourteen (14) active BaaS fintech partner sponsor relationships operating under BRB's national bank charter. The three largest BaaS partners by transaction volume are as follows:
(a) NovaPay Technologies Inc. — Representing approximately 41% of BRB's total BaaS transaction volume (approximately $30.5 billion in Calendar Year 2024). NovaPay is the partner at the center of the OFAC screening gap identified in the Consent Order.
(b) FairLend Digital LLC — Representing approximately 28% of BRB's total BaaS transaction volume.
(c) VaultEdge Inc. — Representing approximately 18% of BRB's total BaaS transaction volume.
The remaining eleven (11) BaaS partners collectively account for approximately 13% of total BaaS transaction volume. Total BaaS transaction volume processed through BRB during Calendar Year 2024 was approximately $74.3 billion. BaaS-related revenue to BRB during Calendar Year 2024 was $127.4 million.
BSA/AML Department Profile (as of January 2025). BRB's BSA/AML department has a current headcount of sixty-two (62) full-time equivalent employees ("FTEs"). The Bank's post-remediation staffing plan targets seventy-seven (77) permanent FTEs, representing an increase of fifteen (15) positions. In addition, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide thirty (30) temporary compliance staff to support backlog clearance and CDD/EDD remediation activities during the remediation period (SOW Ref: PCS-BRB-2025-0012).
The Bank's BSA Officer is Thomas Ikeda, who was appointed to the role in March 2023. The Chief Compliance Officer is Patricia Langston, who was appointed in January 2024.
Calendar Year 2024 Operational Statistics. The following key BSA/AML operational statistics provide context for the Independent Consultant's assessment:
These statistics underscore the volume and complexity of the compliance environment in which the Independent Consultant's work will be conducted and inform the risk-based prioritization of assessment and monitoring activities described in subsequent sections.
3. THORNFIELD ENGAGEMENT TEAM
Thornfield shall staff this engagement with a dedicated team of experienced BSA/AML, OFAC, and financial crimes compliance professionals. The core engagement team is as follows:
Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory — Engagement Lead. Dr. Castellano shall serve as the overall Engagement Lead and shall bear primary responsibility for engagement management, quality assurance, liaison with the OCC, coordination with C&H and BRB management, and final review and signature of all formal deliverables, including the Preliminary Gap Assessment Report, the RAP Review Memorandum, Monthly Status Memoranda, and the Final Validation Report. Dr. Castellano shall serve as the primary point of contact for all substantive communications with the OCC, subject to the coordinating role of C&H as described in Section 7 below.
Robert Eastman, Senior Director, AML Transaction Monitoring. Mr. Eastman shall be responsible for leading Workstream 2 (SAR Process and Backlog) and Workstream 4 (Transaction Monitoring Model Validation). His responsibilities include the assessment and ongoing monitoring of the Bank's suspicious activity reporting processes, SAR backlog clearance, alert investigation workflows, SAR filing timeliness and quality, the Veridian TMS v.8.3 architecture and performance, the planned upgrade to Veridian TMS v.10.0, and the independent model validation process.
Jennifer Hwang, Director, Sanctions & OFAC Compliance. Ms. Hwang shall be responsible for leading Workstream 1 (OFAC Sanctions Screening Assessment and Validation). Her responsibilities include the assessment of OFAC screening technology and processes, screening coverage across all transaction types and BaaS channels, interdiction and blocking procedures, false-positive management, OFAC-related recordkeeping and reporting, and the validation of remediation activities designed to achieve 100% BaaS transaction screening coverage.
Nathaniel Burgess, Director, Fintech & Payments Compliance. Mr. Burgess shall be responsible for leading Workstream 3 (CDD/EDD Remediation) and Workstream 5 (Governance, Training, and Board Oversight). His responsibilities include the assessment of the 47,000 high-risk customer accounts requiring CDD/EDD remediation, the review of customer identification and onboarding processes, the evaluation of BaaS partner compliance oversight, and the assessment of governance structures, training programs, and Board and Compliance Committee reporting.
Thornfield may engage additional staff members and sub-consultants as needed to fulfill the requirements of this Scope of Work, subject to the terms of the Engagement Agreement, including any applicable OCC non-objection requirements for key personnel. Any such additions to the engagement team shall be communicated to BRB and C&H in writing.
Thornfield's outside counsel for this engagement is Hargrove & Stein PC, located at 7 Times Square, 34th Floor, New York, NY 10036. Hargrove & Stein shall provide legal advice to Thornfield as needed regarding the engagement and shall participate in the common-interest privilege framework established in the Privilege & Confidentiality Side Letter referenced in Section 8 below.
4. ENGAGEMENT PHASES AND TIMELINE
4.1 Overview of Phases
The engagement shall be organized into four sequential phases over a total engagement period of twelve (12) months, commencing in February 2025 and concluding in February 2026. The phases, their descriptions, and target dates are set forth in the following table:
The total engagement period runs from the Effective Date of February 10, 2025 through February 15, 2026, with Thornfield performing preliminary mobilization and planning activities between the Effective Date and the commencement of Phase I on March 1, 2025.
The engagement timeline is driven by the following key Consent Order deadlines, which establish the critical milestones against which the Bank's remediation progress will be measured and the Independent Consultant's monitoring and validation activities will be structured:
The foregoing milestones are incorporated into Thornfield's work plan and will serve as the benchmarks against which Thornfield assesses BRB's progress during Phase III monitoring and Phase IV final validation activities.
4.2 Phase I: On-Site Assessment & Preliminary Gap Analysis (March 1, 2025 – April 15, 2025)
4.2.1 Objectives. The objectives of Phase I are as follows:
(a) To conduct a comprehensive on-site assessment of BRB's current BSA/AML and OFAC compliance program across all business lines and channels, including but not limited to retail banking, commercial lending, wealth management, and all fourteen (14) fintech BaaS partnerships.
(b) To identify and document all gaps, deficiencies, and weaknesses as measured against the specific requirements of the Consent Order, applicable federal banking laws and regulations — including the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), its implementing regulations (31 C.F.R. Chapter X), OCC regulations (12 C.F.R. Part 21), and OFAC regulations (31 C.F.R. Part 500 et seq.) — and relevant OCC supervisory guidance, including the FFIEC BSA/AML Examination Manual and applicable OCC Bulletins.
(c) To review and assess the adequacy of the Bank's existing policies, procedures, internal controls, risk assessments, governance structures, staffing levels, technology infrastructure, and training programs as they relate to BSA/AML and OFAC compliance.
(d) To evaluate the Bank's prior remediation efforts relating to the June 2022 MRA regarding BSA/AML transaction monitoring deficiencies and the November 2023 MRIA regarding OFAC screening gaps, in order to understand why those prior supervisory actions were not adequately remediated and to identify systemic or root-cause factors that may have contributed to the failure.
4.2.2 Scope of Assessment Activities — Workstream 1: OFAC Sanctions Screening
Workstream 1, led by Jennifer Hwang, shall encompass the following assessment activities relating to BRB's OFAC sanctions screening program:
(a) Screening Technology and Process Review. A comprehensive review of the OFAC screening technology and processes currently deployed by BRB, including the Veridian Analytics Inc. TMS version 8.3 and its associated OFAC screening module. This review shall encompass the system's architecture, configuration, screening algorithms (including fuzzy-logic matching parameters and scoring thresholds), list management processes (including the frequency and completeness of OFAC list updates), and operational procedures for screening execution.
(b) Screening Coverage Assessment. An assessment of OFAC screening coverage across all transaction types processed by BRB, including wire transfers (both domestic and international), ACH transactions (credits and debits), card transactions (debit, credit, and prepaid), and all transaction flows originated through or processed on behalf of the Bank's fourteen (14) BaaS fintech partners. The assessment shall specifically evaluate whether 100% of transactions are subjected to screening against applicable OFAC sanctions lists.
(c) NovaPay Transaction Screening Gap Analysis. A focused analysis of the OFAC screening gap identified by the OCC with respect to NovaPay Technologies Inc. transactions. This analysis shall determine the root cause(s) of the failure to screen approximately 3,800,000 NovaPay-originated transactions (representing approximately 12% of the 31,700,000 total NovaPay transactions processed in Calendar Year 2023), the technical and operational factors that allowed the gap to persist, the period over which the screening gap existed, and the risk exposure resulting from the unscreened transactions.
(d) OFAC List Coverage Evaluation. An evaluation of the comprehensiveness of screening against all applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List ("SSI"), and the Non-SDN Lists (including the Foreign Sanctions Evaders List, the Palestinian Legislative Council List, and others as applicable).
(e) Interdiction, blocking, and Rejection Procedures. A review of the Bank's procedures for interdicting, blocking, and rejecting transactions that generate positive OFAC screening matches, including the timeliness of disposition, the adequacy of escalation protocols, and compliance with reporting requirements for blocked and rejected transactions.
(f) False-Positive Management Assessment. An assessment of the Bank's processes for managing false-positive screening hits, including the investigation and disposition workflow, the adequacy of documentation, and the effectiveness of ongoing tuning to reduce the false-positive rate. As noted in Section 2.3 above, BRB's OFAC screening operations generated 14,320 hits in Calendar Year 2024, of which only 12 were determined to be true matches, yielding a false-positive rate of approximately 99.9%. The assessment shall evaluate whether this rate is indicative of over-broad screening parameters, inadequate list management, or other factors, and whether the high false-positive volume may be contributing to alert-fatigue and operational inefficiencies.
(g) Recordkeeping and Reporting Review. A review of the Bank's OFAC-related recordkeeping and reporting practices, including blocked property reports, rejected transaction records, OFAC annual reports, and voluntary self-disclosure procedures and history.
4.2.3 Scope of Assessment Activities — Workstream 2: SAR Process and Backlog
Workstream 2, led by Robert Eastman, shall encompass the following assessment activities relating to BRB's suspicious activity reporting processes and alert backlog:
(a) Alert-to-SAR Workflow Assessment. A comprehensive assessment of the end-to-end workflow from transaction monitoring alert generation through investigation, decision-making, SAR filing (or alert closure), and post-filing activity, including the clarity of documented procedures, the effectiveness of quality assurance mechanisms, and the adequacy of management oversight at each stage.
(b) Backlog Evaluation. An in-depth evaluation of the 2,400-alert unreviewed backlog as of September 2024, including the composition of the backlog by alert type, risk category, transaction channel (BaaS versus non-BaaS), and generating scenario; the aging profile of the backlog (i.e., the distribution of alerts by time elapsed since generation); and a risk stratification of the backlog to identify any alerts that may involve elevated-risk counterparties, sanctioned jurisdictions, or patterns indicative of potential money laundering, terrorist financing, or other financial crimes.
(c) SAR Filing Timeliness. A review and analysis of SAR filing timeliness metrics, including the average, median, and distribution of elapsed time between alert generation and SAR filing. As noted in Section 2.2, the average filing time as of the examination period was approximately seventy-eight (78) days, compared to the regulatory expectation of approximately thirty (30) days. The assessment shall evaluate the causes of the delay, including resource constraints, process inefficiencies, management bottlenecks, and technology limitations.
(d) SAR Narrative Quality and Completeness. An assessment of the quality and completeness of SAR narratives filed by BRB, including the adequacy of the description of suspicious activity, the inclusion of relevant supporting information, the identification of subjects and related accounts, and compliance with FinCEN filing requirements and guidance.
(e) Monitoring Rules and Scenarios. An evaluation of the suspicious activity monitoring rules, scenarios, and thresholds deployed within the Veridian TMS v.8.3 system, including an assessment of whether the scenarios are appropriately calibrated to detect the types of suspicious activity relevant to BRB's risk profile, customer base, product set, and transaction channels — with particular attention to scenarios designed to detect risks associated with BaaS-originated transactions.
(f) BaaS-Related SAR Activity. A focused review of BaaS-related SAR activity, which accounted for 2,108 of 3,847 total SARs filed in Calendar Year 2024 (approximately 54.8% of total SARs), including the distribution of BaaS SARs by fintech partner, the types of suspicious activity identified, and the effectiveness of information-sharing and coordination between BRB's BSA/AML department and its BaaS partners.
(g) Staffing and Workload Assessment. An assessment of staffing levels and workload distribution within BRB's BSA/AML department, including the adequacy of the current sixty-two (62) FTE headcount relative to alert volumes, case investigation requirements, SAR filing obligations, and other departmental responsibilities. The assessment shall evaluate whether the existing staffing model is sustainable and sufficient to prevent future backlog accumulation.
(h) Pinnacle Temporary Staffing Review. A review of the Pinnacle Compliance Solutions LLC temporary staffing deployment plan (SOW Ref: PCS-BRB-2025-0012), including the qualifications and training of the thirty (30) temporary FTEs, their integration into BRB's BSA/AML operations, the scope of their responsibilities, and the quality oversight mechanisms applicable to their work product.
4.2.4 Scope of Assessment Activities — Workstream 3: CDD/EDD
Workstream 3, led by Nathaniel Burgess, shall encompass the following assessment activities relating to BRB's customer due diligence and enhanced due diligence practices:
(a) High-Risk Account Assessment. A detailed assessment of the approximately 47,000 high-risk customer accounts that the OCC identified as lacking adequate CDD or EDD documentation. This assessment shall include an analysis of the composition of these accounts by BaaS partner, product type, account vintage, geographic location, and risk category, as well as a determination of the specific documentation deficiencies present (e.g., missing beneficial ownership information, incomplete source-of-funds documentation, absent or outdated risk assessments).
(b) Customer Identification Program Review. An evaluation of the Bank's Customer Identification Program ("CIP") across all channels, including direct retail and commercial onboarding as well as BaaS partner-facilitated onboarding, to assess compliance with CIP requirements under 31 C.F.R. § 1020.220 and the Bank's own policies and procedures.
(c) Risk Rating Methodology. A review of the Bank's customer risk-rating methodology, including the risk factors considered, the scoring model and assignment criteria, the frequency and triggers for risk-rating updates, and the effectiveness of the methodology in accurately categorizing customer risk levels — particularly for customers onboarded through BaaS channels.
(d) Beneficial Ownership Collection. An assessment of the Bank's processes for collecting, verifying, and maintaining beneficial ownership information in accordance with the FinCEN Customer Due Diligence Rule (31 C.F.R. § 1010.230), including the adequacy of procedures for identifying and verifying the identity of beneficial owners of legal entity customers.
(e) Ongoing Monitoring and Periodic Review. An assessment of the Bank's processes for ongoing monitoring of customer relationships and periodic review of CDD/EDD information, including trigger events for enhanced review, the frequency of periodic reviews, and the effectiveness of risk-based prioritization.
(f) BaaS Partner CDD/EDD Responsibilities. An evaluation of the allocation and delegation of CDD/EDD responsibilities between BRB and its BaaS fintech partners, with specific focus on NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. The assessment shall evaluate the contractual provisions governing CDD/EDD delegation, the Bank's oversight of partner performance, the quality and completeness of information shared between partners and the Bank, and the effectiveness of the Bank's controls to ensure that delegated CDD/EDD functions are performed to the standard required by applicable law and the Bank's policies.
(g) Onboarding Processes and Data Integrity. A review of onboarding processes and data integrity for fintech-originated accounts, including the adequacy of data capture at onboarding, the integrity and consistency of customer data maintained in the Bank's systems of record, and the presence of any data quality issues that may have contributed to the CDD/EDD deficiencies identified by the OCC.
4.2.5 Scope of Assessment Activities — Workstream 4: Transaction Monitoring Model Validation
Workstream 4, led by Robert Eastman, shall encompass the following assessment activities relating to the Bank's transaction monitoring system and model validation practices:
(a) TMS Architecture and Configuration Review. A comprehensive review of the Veridian Analytics Inc. TMS version 8.3 system architecture, including its rule sets, detection scenarios, alerting thresholds, parameters, data ingestion processes, and output reporting capabilities.
(b) Prior Model Validation Review. An assessment of the findings, recommendations, and remediation actions arising from the last independent model validation, which was completed in March 2021 — more than three (3) years prior to the commencement of the OCC examination. The assessment shall evaluate whether the recommendations from that validation were fully implemented and whether the extended gap between validations contributed to the degradation of system effectiveness.
(c) Prior Tuning Review. A review of the last tuning exercise performed on the Veridian TMS v.8.3, which was completed in October 2022, including the scope of the tuning, the parameter changes implemented, the rationale and supporting analysis for those changes, and any subsequent modifications to system parameters.
(d) Model Governance Framework. An evaluation of the Bank's model governance framework for the transaction monitoring system, including the adequacy of model documentation, change management controls, model performance monitoring, escalation procedures for model-related issues, and the role and responsibilities of the model owner, model risk management function, and independent validation parties.
(e) Data Quality Assessment. An assessment of the quality, completeness, and integrity of the data inputs feeding into the Veridian TMS v.8.3, including transaction data feeds from all channels — with particular focus on BaaS channel data, which the OCC examination indicated may have been incomplete or inconsistently formatted.
(f) Above-the-Line and Below-the-Line Testing. A review of the Bank's above-the-line testing (testing of alerts generated by the system to assess the appropriateness of alerting) and below-the-line testing (testing of transactions that did not generate alerts to assess whether the system is failing to detect potentially suspicious activity), including the frequency, methodology, and results of such testing.
(g) Veridian TMS v.10.0 Upgrade Assessment. An initial evaluation of the Bank's planned upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including the implementation budget of $2,800,000, the incremental licensing cost of $1,900,000 per year (bringing the new annual contract value to $6,000,000 per year), the scope of functionality enhancements, and the planned implementation timeline (UAT completion by August 1, 2025).
(h) Upgrade Adequacy Assessment. An assessment of whether the planned upgrade to Veridian TMS v.10.0 adequately addresses the specific deficiencies identified in the Consent Order and the June 2022 MRA, including enhancements to detection scenarios, improved data ingestion capabilities for BaaS transaction data, enhanced reporting functionality, and improved model governance and tuning tools.
4.2.6 Scope of Assessment Activities — Workstream 5: Governance, Training, and Board Oversight
Workstream 5, led by Nathaniel Burgess, shall encompass the following assessment activities relating to BSA/AML governance, training, and Board oversight:
(a) Board and Senior Management Governance Review. A comprehensive review of the governance structure for BSA/AML compliance at the Board and senior management levels, including the roles and responsibilities of the Board of Directors, relevant Board committees, the Chief Compliance Officer, the BSA Officer, the Chief Risk Officer, and other senior management positions with BSA/AML responsibilities.
(b) Compliance Committee Assessment. An assessment of the newly established dedicated Compliance Committee of the Board, which the Consent Order requires to be established by Board Resolution on or before February 28, 2025. The Compliance Committee is to be chaired by James Rutherford. Thornfield shall evaluate the Committee's charter, composition, meeting frequency, reporting lines, and the adequacy of its mandate to provide effective oversight of the Bank's BSA/AML and OFAC compliance program.
(c) Board Reporting Review. A review of existing and planned BSA/AML reporting to the Board and the Compliance Committee, including the frequency of reporting, the metrics and key performance indicators included, the quality and completeness of the information presented, and the extent to which reporting enables the Board and Committee to fulfill their oversight responsibilities. The Consent Order specifically noted that prior Board reporting did not include key metrics such as SAR volumes, OFAC screening hit rates, or risk ratings by BaaS partner.
(d) BSA Officer Authority and Independence. An evaluation of the BSA Officer's (Thomas Ikeda, appointed March 2023) authority, independence, and reporting lines within BRB's organizational structure, including the BSA Officer's access to the Board and Compliance Committee, the adequacy of the BSA Officer's resources and staffing authority, and the BSA Officer's ability to escalate issues without interference from business-line management.
(e) CCO Oversight Framework. An assessment of the Chief Compliance Officer's (Patricia Langston, appointed January 2024) oversight framework and her role in coordinating BSA/AML compliance across BRB's business lines and BaaS partnerships.
(f) Training Program Assessment. A review of the Bank's existing BSA/AML and OFAC training programs and the identification of gaps, including an evaluation of training curriculum content, delivery methods, frequency, audience segmentation (e.g., front-line staff, BaaS relationship managers, compliance staff, senior management, Board members), completion rates, and testing or assessment mechanisms.
(g) Internal Audit Coverage. An evaluation of the Internal Audit function's BSA/AML audit coverage, including the scope and frequency of audits, the adequacy of audit methodologies, the qualifications and independence of the audit team, and the effectiveness of issue tracking and follow-up processes. Derek Ballard, Head of Internal Audit, shall be interviewed as part of this assessment.
(h) Caldera & Pope Independent Test Review. A review of the findings and recommendations from Caldera & Pope LLP's September 2024 independent BSA/AML test (annual testing fee: $1,100,000), including an assessment of BRB's response to those findings and the extent to which the Caldera & Pope findings have been or are being addressed through the Bank's remediation efforts.
4.2.7 Key BRB Personnel for Phase I Interviews and Document Requests
During Phase I, Thornfield shall conduct structured interviews with and submit document requests to the following key BRB personnel, among others:
• Patricia Langston, Chief Compliance Officer
• Thomas Ikeda, BSA Officer / AML Program Director
• Warren Ashby, Head of Fintech Partnerships / BaaS Division
• Linda Petrosian, Chief Information Officer / Chief Technology Officer
• Melissa Chu, Chief Risk Officer
• Derek Ballard, Head of Internal Audit
• Gregory Nardone, General Counsel & Corporate Secretary
• Samantha Reeves, Chief Financial Officer (for financial controls and reporting matters)
In addition to the foregoing, Thornfield may request interviews with such additional BRB personnel as are identified during the course of the Phase I assessment, including but not limited to line-level BSA/AML analysts and investigators, BaaS relationship managers, technology and operations staff, and other subject-matter experts whose input is relevant to the assessment. BRB shall make such additional personnel available in accordance with the Access & Cooperation Protocol described in Section 7 below.
4.2.8 Phase I Deliverable: Preliminary Gap Assessment Report
Due Date: April 15, 2025.
Content: Thornfield shall prepare and deliver a comprehensive written report (the "Preliminary Gap Assessment Report") documenting the findings of the Phase I on-site assessment across all five workstreams. The report shall identify all gaps, deficiencies, and weaknesses identified relative to the requirements of the Consent Order, applicable laws and regulations, and OCC supervisory guidance. Each identified gap shall be risk-ranked based on its severity, potential regulatory exposure, and operational significance. The report shall also include preliminary recommendations for remediation, organized by workstream.
Distribution: The Preliminary Gap Assessment Report shall be delivered to BRB (through C&H coordinating counsel, Philip Hartmann), with a copy provided directly to the OCC (Jonathan Frey, Examiner-in-Charge) in accordance with the reporting requirements of the Consent Order.
Format: The Preliminary Gap Assessment Report shall be delivered in the form of a written narrative report, accompanied by supporting appendices including, as applicable, data analysis summaries, interview summaries, a documentation inventory, and risk-ranking matrices.
4.3 Phase II: Remediation Action Plan Review & Validation (April 16, 2025 – May 31, 2025)
4.3.1 Objectives. The objectives of Phase II are as follows:
(a) To review in detail BRB's draft Comprehensive Remediation Action Plan (the "RAP"), which will be prepared by BRB management with the assistance of C&H and is due for submission to the OCC on or before May 15, 2025.
(b) To validate that the RAP adequately and specifically addresses all deficiencies identified in the Consent Order and all gaps identified in Thornfield's Preliminary Gap Assessment Report, across each of the five deficiency categories.
(c) To assess the reasonableness and feasibility of the remediation timelines, milestones, and benchmarks proposed in the RAP, including an assessment of whether the allocated resources — including the total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty) — are sufficient to achieve the planned remediation objectives within the required timeframes.
(d) To assess the clarity and specificity of accountability assignments in the RAP, including whether each remediation activity has a designated responsible party, defined deliverables, and measurable success criteria.
(e) To provide written commentary and recommendations to BRB in advance of the May 15, 2025 OCC submission, to enable the Bank to incorporate Thornfield's input before filing the RAP with the OCC.
4.3.2 Specific Review Activities
Thornfield's Phase II review activities shall include the following:
Workstream-Specific Plan Reviews. Thornfield shall review each of the five workstream-specific remediation plans within the RAP:
(a) Workstream 1: OFAC Sanctions Screening Remediation Plan. Validation of the Bank's proposed approach to achieving 100% BaaS transaction screening by the November 1, 2025 deadline, including the technical remediation of the NovaPay screening gap, the deployment of enhanced OFAC screening capabilities across all fourteen (14) BaaS partners, and the implementation of ongoing screening monitoring and quality assurance processes.
(b) Workstream 2: SAR Backlog Clearance & Process Improvement Plan. Validation of the Bank's proposed approach to clearing the 2,400-alert backlog by the June 30, 2025 target and reducing average SAR filing time to thirty (30) days or less, including the deployment of Pinnacle temporary staff, process redesign initiatives, technology enhancements, and quality control mechanisms.
(c) Workstream 3: CDD/EDD Remediation Plan. Validation of the Bank's proposed phased approach to remediating the 47,000 high-risk customer accounts, including the 50% remediation milestone of 23,500 accounts by July 15, 2025 and the 100% remediation milestone of all 47,000 accounts by January 15, 2026. The review shall assess the prioritization methodology, remediation workflows, data collection procedures, and quality assurance processes.
(d) Workstream 4: Transaction Monitoring Model Validation & Tuning Plan. Validation of the Bank's proposed approach to upgrading from Veridian TMS v.8.3 to Veridian TMS v.10.0, including the UAT completion target of August 1, 2025 and the independent model validation completion target of October 1, 2025. The review shall assess the adequacy of the implementation plan, testing protocols, data migration strategy, and ongoing model governance framework.
(e) Workstream 5: BSA/AML Program Governance & Training Enhancement Plan. Validation of the Bank's proposed governance restructuring, including the establishment and operationalization of the Compliance Committee, enhanced Board reporting, revised organizational structure, new hire onboarding, and the design and delivery of a comprehensive training curriculum covering all relevant audience segments.
Cross-Cutting Reviews. In addition to the workstream-specific plan reviews, Thornfield shall conduct the following cross-cutting assessments:
(f) Staffing Adequacy Assessment. An assessment of whether the planned staffing model — comprising sixty-two (62) existing permanent FTEs, fifteen (15) planned new permanent hires, and thirty (30) Pinnacle Compliance Solutions LLC temporary staff — is adequate to execute the RAP and sustain ongoing compliance following the completion of remediation activities.
(g) Technology Implementation Review. A review of the technology implementation plans underlying the RAP, including the Veridian TMS v.10.0 upgrade timeline, OFAC screening module enhancements, and any other technology deployments or enhancements contemplated by the RAP.
(h) Contingency Planning Assessment. An assessment of the adequacy of the Bank's contingency planning arrangements, including the proposed engagement of Ridgeline Data Systems LLC as a contingency technology provider ($7,200,000 per year for a five-year term, representing a total commitment of $36,000,000), to address risks associated with potential delays or failures in the primary technology remediation path.
(i) Vendor Management and Third-Party Oversight. A review of the vendor management and third-party oversight provisions within the RAP, including the Bank's processes for managing and overseeing Veridian Analytics Inc., Pinnacle Compliance Solutions LLC, Ridgeline Data Systems LLC, and other third-party service providers whose performance is critical to the remediation effort.
4.3.3 Phase II Deliverable: RAP Review Memorandum
Due Date: On or before May 10, 2025, to permit BRB and C&H to review and incorporate Thornfield's comments and recommendations into the RAP prior to its submission to the OCC by the May 15, 2025 deadline.
Content: Thornfield shall prepare and deliver a written memorandum (the "RAP Review Memorandum") identifying: (i) areas of the RAP that Thornfield considers adequate and well-designed; (ii) areas of concern, deficiency, or ambiguity in the RAP; and (iii) specific recommended modifications, additions, or enhancements to the RAP. The memorandum shall address each of the five workstream-specific plans as well as the cross-cutting themes identified above.
Distribution: The RAP Review Memorandum shall be delivered to BRB (through C&H coordinating counsel, Philip Hartmann), with a summary provided to the OCC as appropriate and in accordance with the Consent Order's requirements for independent consultant reporting.
4.4 Phase III: Ongoing Monitoring & Testing (June 1, 2025 – January 31, 2026)
4.4.1 Objectives. Phase III represents the longest and most operationally intensive phase of the engagement, spanning eight months during which BRB will be executing its Remediation Action Plan. The objectives of Phase III are as follows:
(a) To monitor BRB's execution of the Remediation Action Plan on an ongoing basis across all five workstreams, assessing the adequacy, quality, and timeliness of remediation activities.
(b) To conduct periodic testing and validation of specific remediation activities across all five workstreams, using a combination of document review, data analysis, sample testing, system observation, and interviews.
(c) To assess BRB's progress against the Consent Order milestones set forth in Section 4.1 above, identifying any delays, deficiencies, or deviations from the approved RAP.
(d) To identify emerging risks, implementation challenges, or new issues in real time, enabling timely escalation and corrective action.
(e) To support BRB's preparation of the two quarterly progress reports required by the Consent Order — the first due September 15, 2025, and the second due December 15, 2025 — by providing Thornfield's independent observations and assessments for incorporation into or submission alongside those reports.
4.4.2 Monitoring Activities — Workstream 1: OFAC Sanctions Screening
During Phase III, Thornfield shall conduct the following monitoring and testing activities with respect to OFAC sanctions screening:
(a) Test OFAC screening coverage for all BaaS channels following the deployment of the Veridian OFAC module enhancements, including validation that all transaction types (wire transfers, ACH transactions, card transactions, and other payment flows) processed through each of the fourteen (14) BaaS partners are being screened in real time or through batch processing, as applicable.
(b) Validate that both real-time and batch OFAC screening processes are fully operational for all BaaS partners, with specific and detailed focus on the three largest partners — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — and on the resolution of the NovaPay screening gap that was the subject of the Consent Order findings.
(c) Conduct sample testing of screening effectiveness against applicable OFAC lists (SDN, Consolidated, Sectoral Sanctions, and Non-SDN lists), using test scenarios designed to evaluate the system's ability to detect a range of match types, including exact matches, partial matches, name variations, and alias matches.
(d) Validate the Bank's interdiction and blocking procedures through the execution of test scenarios that simulate the processing of transactions involving sanctioned persons, entities, or jurisdictions, confirming that such transactions are properly interdicted, blocked, or rejected, and that required notifications and reports are generated.
(e) Confirm full operationalization of OFAC screening across all BaaS channels by the November 1, 2025 Consent Order deadline, with specific validation that the 100% screening coverage requirement has been met and that no material gaps remain.
4.4.3 Monitoring Activities — Workstream 2: SAR Process
During Phase III, Thornfield shall conduct the following monitoring and testing activities with respect to SAR processes:
(a) Monitor progress on clearing the 2,400-alert unreviewed backlog against the June 30, 2025 target, including tracking the volume of alerts dispositioned on a weekly and monthly basis, the quality of disposition decisions, and any obstacles or delays encountered.
(b) Assess the quality of SAR filings produced during the remediation period, including targeted review of SAR narratives for completeness, accuracy, and compliance with FinCEN filing requirements and guidance.
(c) Test SAR filing timeliness on an ongoing basis, comparing actual filing times against the thirty (30)-day target, tracking trends over time, and identifying any systemic issues that may be impeding timely filing.
(d) Evaluate the execution of the SAR lookback project (budgeted at $5,500,000), including the scope and methodology of the lookback, the prioritization of high-risk transactions and customers, the quality of lookback investigations, and the filing of any additional SARs warranted by the lookback.
(e) Review quarterly SAR volume and conversion rate trends to assess whether the Bank's monitoring and investigation processes are functioning effectively and consistently.
4.4.4 Monitoring Activities — Workstream 3: CDD/EDD
During Phase III, Thornfield shall conduct the following monitoring and testing activities with respect to CDD/EDD remediation:
(a) Track the remediation progress of the 47,000 high-risk customer accounts against the Consent Order milestones, specifically: the July 15, 2025 milestone (50% remediation, or 23,500 accounts) and the January 15, 2026 milestone (100% remediation, or all 47,000 accounts).
(b) Conduct quality sampling of remediated CDD/EDD files to assess the completeness, accuracy, and adequacy of remediated documentation, including beneficial ownership information, risk assessments, and ongoing monitoring plans. Sampling shall be statistically valid and risk-weighted to prioritize the highest-risk accounts and the largest BaaS partner populations.
(c) Review updated risk-rating assignments for remediated accounts to confirm that risk ratings accurately reflect the customer's risk profile and that appropriate EDD measures have been applied to accounts rated high risk.
(d) Assess the effectiveness of revised CDD/EDD policies and procedures as implemented, including the clarity of written guidance, the effectiveness of workflow tools, and the consistency of application across different customer segments and BaaS partner populations.
4.4.5 Monitoring Activities — Workstream 4: Transaction Monitoring Model
During Phase III, Thornfield shall conduct the following monitoring and testing activities with respect to the transaction monitoring model:
(a) Monitor the progress of the Veridian TMS v.10.0 implementation toward the August 1, 2025 UAT completion target, including tracking of key implementation milestones, resolution of identified issues and defects, and adherence to the planned deployment timeline.
(b) Observe and assess User Acceptance Testing ("UAT") procedures and results, including the adequacy of test scripts and scenarios, the comprehensiveness of testing coverage, the documentation of test results, and the criteria for system acceptance and production deployment.
(c) Participate in, or independently review the results of, the independent model validation to be completed by October 1, 2025, assessing the scope, methodology, and findings of the validation and the adequacy of any recommended model adjustments.
(d) Evaluate post-deployment performance metrics following the Veridian TMS v.10.0 go-live, including alert volumes, false-positive rates, scenario effectiveness, detection rates, and system stability and performance.
(e) Assess the Bank's ongoing model governance and tuning procedures for the upgraded system, including the establishment of a recurring tuning cadence, model performance monitoring protocols, and change management controls.
4.4.6 Monitoring Activities — Workstream 5: Governance and Training
During Phase III, Thornfield shall conduct the following monitoring and testing activities with respect to governance, training, and Board oversight:
(a) Attend, or receive complete materials from, Compliance Committee meetings (chaired by James Rutherford), and assess the effectiveness of Committee deliberations, the quality of materials presented, and the adequacy of Committee oversight activities.
(b) Review Board of Directors and Compliance Committee reporting packages for completeness and accuracy of BSA/AML metrics, including SAR volumes and timeliness, OFAC screening hit rates, CDD/EDD remediation progress, BaaS partner risk ratings, staffing metrics, and status of Consent Order compliance.
(c) Assess the implementation of the revised organizational structure and the onboarding and integration of the fifteen (15) new permanent FTE hires into the BSA/AML department, including the adequacy of their qualifications, training, and integration into existing workflows.
(d) Monitor the delivery and completion rates of the Bank's BSA/AML and OFAC training programs across all audience segments, including front-line bank staff, BaaS relationship managers, compliance department staff, senior management, and members of the Board of Directors.
(e) Review the Internal Audit function's (led by Derek Ballard, Head of Internal Audit) BSA/AML testing plans and results, and assess whether the internal audit program provides effective independent assurance over the remediated compliance program.
4.4.7 Monitoring Cadence and Reporting
Thornfield shall maintain the following monitoring cadence and reporting schedule during Phase III:
Bi-Weekly Status Calls. Thornfield shall participate in bi-weekly status calls with BRB management (Patricia Langston, Chief Compliance Officer, and Thomas Ikeda, BSA Officer) and C&H (Philip Hartmann, Responsible Partner, and Yuki Nakamura, Senior Associate). These calls shall serve as the primary forum for discussing ongoing monitoring observations, progress against milestones, emerging issues, and coordination matters.
Monthly Written Status Memoranda. Thornfield shall prepare and deliver monthly written status memoranda to BRB (through C&H coordinating counsel) summarizing monitoring observations, progress against Consent Order milestones, areas of concern or delay, and any recommendations for corrective action. Monthly status memoranda shall be delivered for each month from June 2025 through January 2026 (eight memoranda total).
Quarterly Formal Written Progress Assessments. Thornfield shall prepare formal written progress assessments aligned with the OCC's quarterly reporting deadlines, as follows:
(a) For the first quarterly progress report due to the OCC on September 15, 2025, Thornfield shall deliver its written progress assessment to BRB (through C&H) on or before September 8, 2025, to allow sufficient time for incorporation into the Bank's submission.
(b) For the second quarterly progress report due to the OCC on December 15, 2025, Thornfield shall deliver its written progress assessment to BRB (through C&H) on or before December 8, 2025.
Immediate Escalation. In the event that Thornfield identifies material issues, significant delays in milestone achievement, or conditions that may present imminent risk to the Bank's ability to comply with the Consent Order, Thornfield shall immediately escalate such matters to BRB's General Counsel (Gregory Nardone), Chief Compliance Officer (Patricia Langston), and C&H coordinating counsel (Philip Hartmann), with notification to the OCC as required by the Consent Order and the Oversight & Communication Protocol.