ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL

ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL
THIRD-PARTY TECHNOLOGY VENDOR DUE DILIGENCE CHECKLIST
AML/SANCTIONS TECHNOLOGY VENDORS
Prepared by:
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
C&H Matter No.: 1045-00002
Philip Hartmann, Responsible Partner Direct: (212) 558-4700 hartmann@calderwoodharkness.com
Prepared for:
BELMONT RIDGE BANK NATIONAL ASSOCIATION 680 Lexington Avenue, 22nd Floor New York, New York 10022
OCC Charter No.: 48271 FDIC Certificate No.: 31845
February 2025
ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — This document was prepared by Calderwood & Harkness LLP at the direction of Belmont Ridge Bank National Association and is protected by the attorney-client privilege and the work product doctrine. This document is not intended for disclosure to any third party without the express written consent of Calderwood & Harkness LLP, except as may be required by applicable law or regulatory directive. Distribution within Belmont Ridge Bank National Association and its parent holding company, Belmont Ridge Financial Group, Inc., should be limited to individuals with a demonstrated need to know.
PURPOSE
This checklist provides a standardized due diligence framework for the evaluation, selection, and ongoing risk assessment of third-party technology vendors providing anti-money laundering ("AML") transaction monitoring and sanctions screening solutions to Belmont Ridge Bank National Association ("BRB" or the "Bank"). This document has been prepared in connection with the Bank's comprehensive compliance program uplift undertaken pursuant to OCC Consent Order No. OCC-2025-003 (effective January 15, 2025) (the "Consent Order"). The checklist is designed to ensure that the Bank's vendor due diligence practices satisfy the heightened expectations of the Office of the Comptroller of the Currency ("OCC") as articulated in the Consent Order and applicable supervisory guidance, and that any AML/sanctions technology vendor engaged by the Bank possesses the capabilities, resources, and risk profile necessary to support the Bank's remediation efforts and ongoing compliance obligations.
REGULATORY BASIS
This checklist has been developed in accordance with the following regulatory guidance and legal authorities:
•  OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as updated and supplemented by OCC Bulletin 2023-17 (Interagency Guidance on Third-Party Relationships: Risk Management), which establishes the OCC's expectations for the risk management lifecycle applicable to third-party relationships, including planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination activities.
•  The Bank Secrecy Act ("BSA"), 31 U.S.C. §§ 5311–5332, and its implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") at 31 C.F.R. Chapter X, including requirements related to suspicious activity reporting, currency transaction reporting, customer due diligence, and recordkeeping.
•  The International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. §§ 1701–1706, and executive orders administered by the Office of Foreign Assets Control ("OFAC"), U.S. Department of the Treasury, including requirements for screening transactions and customers against OFAC sanctions lists and blocking or rejecting prohibited transactions.
•  OCC Consent Order No. OCC-2025-003 (effective January 15, 2025), including the specific remediation requirements and deadlines set forth therein related to the Bank's AML/sanctions compliance program.
APPLICABILITY
This checklist is to be completed for each AML/sanctions technology vendor under evaluation by the Bank, including:
1.  The incumbent vendor: Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044), including the proposed upgrade from Veridian TMS v.8.3 to v.10.0 and the addition of the enhanced OFAC screening module; and
2.  Any alternative vendor under consideration, including Ridgeline Data Systems LLC, which is currently under preliminary evaluation as a potential replacement platform.
The checklist must be refreshed at least annually, or upon the occurrence of material changes in the vendor relationship, the vendor's product or service offering, or the vendor's risk profile. Triggering events for ad hoc reassessment are described in Section 1 below.
Right-click to update Table of Contents
SECTION 1: INSTRUCTIONS FOR USE
1.1 Checklist Structure
This checklist is organized into due diligence domains that are aligned with the OCC's third-party risk management lifecycle as described in OCC Bulletin 2013-29 and OCC Bulletin 2023-17. The lifecycle encompasses the following phases: (i) planning, (ii) due diligence and third-party selection, (iii) contract negotiation, (iv) ongoing monitoring, and (v) termination. Each section of this checklist corresponds to a substantive risk domain that must be assessed at the appropriate phase(s) of the lifecycle.
The checklist is intended to serve as both an initial assessment tool — to be completed prior to vendor engagement or material contract modification — and an ongoing monitoring tool, to be refreshed periodically in accordance with the frequency requirements described below. The structure is as follows:
•  Section 2 addresses vendor identification and general information, establishing the factual predicate for the assessment.
•  Section 3 addresses strategic and operational risk, including strategic alignment with the Bank's compliance program objectives and the Consent Order, operational capacity, and concentration risk.
•  Section 4 addresses the vendor's financial viability, including financial condition, capital and funding, and market reputation.
•  Section 5 addresses information security and data protection, including security certifications, data security controls, data privacy, and incident response.
•  Section 6 addresses business continuity and disaster recovery planning.
•  Section 7 addresses regulatory compliance capabilities, including BSA/AML transaction monitoring, OFAC sanctions screening, CDD/EDD, and regulatory examination support.
•  Section 8 addresses technical architecture and integration capabilities.
•  Section 9 addresses performance monitoring and service level expectations.
•  Section 10 addresses legal and contractual protections.
•  Section 11 addresses the vendor risk rating methodology, approval process, and documentation requirements.
Appendices A through D provide supporting materials, including a standardized document request list, a cross-reference table mapping checklist items to Consent Order requirements, and illustrative sample assessments for the two vendors currently under consideration.
1.2 Roles and Responsibilities
The completion of this checklist is a cross-functional responsibility requiring coordinated input from the following Bank personnel:
The CIO/CTO (Linda Petrosian) shall serve as the lead coordinator for the completion of this checklist and shall be responsible for assembling the cross-functional team, establishing the assessment timeline, and ensuring that all sections are completed with appropriate rigor and supporting documentation. The BSA Officer (Thomas Ikeda) shall serve as the co-lead with specific responsibility for Sections 7.1 through 7.4 (Regulatory Compliance Assessment).
Each individual identified above is responsible for completing the sections within their area of expertise, reviewing and signing off on their respective contributions, and providing prompt responses to requests for additional information or clarification.
1.3 Outside Counsel Review
Calderwood & Harkness LLP ("C&H"), through Philip Hartmann, Responsible Partner, shall review completed checklists for legal sufficiency and regulatory alignment prior to submission for internal approval. The scope of C&H's review shall include:
•  Verification that all checklist items have been addressed and that responses are supported by adequate documentary evidence;
•  Assessment of whether the completed checklist, taken as a whole, provides an adequate basis for the Bank's vendor risk rating determination;
•  Identification of any legal, regulatory, or contractual issues that require further investigation or remediation;
•  Confirmation that the assessment process and documentation satisfy the requirements of the Consent Order, OCC Bulletin 2013-29, and OCC Bulletin 2023-17; and
•  Preparation of a summary memorandum for the Bank's Risk Committee and Board Compliance Committee, as applicable, highlighting any material findings, risk flags, or recommendations.
All communications between BRB personnel and C&H in connection with this checklist are intended to be protected by the attorney-client privilege and the work product doctrine. BRB personnel should mark all related communications as "Attorney-Client Privileged & Confidential" and should not disclose such communications to third parties (including the vendor under evaluation) without the express prior approval of the General Counsel (Gregory Nardone) and C&H.
1.4 Documentation Standards
All responses in this checklist must be supported by documentary evidence. The evidence may be vendor-provided (e.g., vendor response to due diligence questionnaire, vendor-produced reports, vendor certifications) or independently verified (e.g., publicly available financial filings, third-party audit reports, independent testing results). In all cases, the specific source document supporting each response must be cited in the "Evidence / Source" column provided for each checklist item.
The following documentation standards apply:
•  Completeness: Every checklist item must receive a response. If information is not available or not applicable, the assessor must state the reason and note any follow-up actions required to obtain the information.
•  Accuracy: Responses must accurately reflect the current state of the vendor and its product or service. Assessors should not rely on outdated information (e.g., information more than 12 months old unless the item relates to a historical matter).
•  Source Identification: Each response must identify the source document or documents relied upon, including the document title, date, and the identity of the person or entity that produced it.
•  Independent Verification: Where practicable, vendor-provided information should be independently verified through third-party sources, publicly available information, or BRB's own testing and review. The degree of independent verification should be commensurate with the criticality of the checklist item and the overall risk profile of the vendor.
•  Retention: All source documents and supporting evidence must be retained in the Bank's vendor management file in accordance with the retention requirements described in Section 11.3.
1.5 Scoring Methodology
Each checklist item is to be rated using the following three-tier rating scale:
The overall vendor risk rating is derived from the weighted aggregation of individual item scores across all checklist domains, using the following weighting:
The detailed risk rating matrix and overall rating categories are described in Section 11.1.
1.6 Frequency of Use
This checklist is to be completed and/or refreshed at the following intervals:
•  Initial Assessment: Prior to any new vendor engagement, material contract amendment, or significant product upgrade (e.g., Veridian TMS v.8.3 to v.10.0 upgrade; potential Ridgeline Data Systems engagement).
•  Annual Reassessment: At least once every twelve (12) months, timed to coincide with the vendor's annual SOC report cycle and the Bank's annual BSA/AML risk assessment.
•  Ad Hoc Reassessment: Upon the occurrence of any of the following triggering events:
•  A material security incident or data breach involving the vendor;
•  A regulatory finding, enforcement action, or consent order issued against the vendor;
•  A material operational failure, including failure to meet service level agreements;
•  A significant change in the vendor's ownership, management, or financial condition (including mergers, acquisitions, or changes in control);
•  A material change in the vendor's product or service offering;
•  A material amendment to the contract between BRB and the vendor;
•  A significant change in BRB's risk profile, business model, or regulatory requirements that affects the vendor relationship; or
•  A direction from the OCC, the BRB Risk Committee, or the Board Compliance Committee to conduct a reassessment.
1.7 Cross-Reference to Consent Order Requirements
Each section and item in this checklist has been mapped to the applicable articles and requirements of OCC Consent Order No. OCC-2025-003. The detailed cross-reference table is provided in Appendix B. The five core deficiency categories identified in the Consent Order that are directly relevant to the vendor assessment are:
1.  OFAC Sanctions Screening Adequacy — The Consent Order found that the Bank's OFAC sanctions screening program failed to screen all transactions across all channels, with a specific finding that approximately 12% of NovaPay wire and ACH transactions (approximately 3,800,000 of 31,700,000 total NovaPay transactions in CY 2023) were not screened against OFAC sanctions lists. Checklist items addressing this deficiency are concentrated in Sections 7.2 and 8.2.
2.  Transaction Monitoring Model Validation — The Consent Order found that the Bank's transaction monitoring system (Veridian TMS v.8.3) had not undergone an independent model validation since March 2021, and that tuning parameters had not been updated since October 2022. Checklist items addressing this deficiency are concentrated in Sections 7.1 and 8.3.
3.  SAR Filing Process — The Consent Order identified deficiencies in the Bank's suspicious activity reporting process, including backlogs, untimely filings, and inadequate documentation. Checklist items addressing SAR-related vendor capabilities are found in Section 7.1.
4.  CDD/EDD — The Consent Order identified weaknesses in the Bank's customer due diligence and enhanced due diligence processes, particularly with respect to BaaS partner end-user accounts. Checklist items addressing CDD/EDD-related vendor capabilities are found in Section 7.3.
5.  Board-Level Reporting — The Consent Order found that the Bank's board and senior management did not receive adequate, timely, and comprehensive BSA/AML compliance reporting. Checklist items addressing reporting and dashboard capabilities are found in Sections 7.1 and 9.2.
Users of this checklist should pay particular attention to items flagged with the notation "[CO]" in the body of the checklist, which indicates a direct nexus to a Consent Order requirement.
SECTION 2: VENDOR IDENTIFICATION & GENERAL INFORMATION
The following fields are to be completed for each vendor under evaluation. All information must be current as of the date of the assessment and must be supported by documentary evidence as described in Section 1.4.
2.1 Entity Information
2.2 Ownership & Organizational Structure
2.3 Key Contact Information
2.4 Product / Service Information
2.5 Contract & Financial Information
For reference, the following vendor-specific data points are known as of the date of this checklist:
Veridian Analytics Inc. (Incumbent):
•  Full Legal Name: Veridian Analytics Inc.
•  Entity Type: Delaware corporation
•  Principal Office: 1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303
•  Key Contact: Priya Subramanian, VP of Client Solutions
•  Product: Veridian TMS v.8.3 (current); v.10.0 (proposed upgrade) with enhanced OFAC screening module
•  Contract No.: VA-BRB-2023-0044
•  Current ACV: $4,100,000/year
•  Proposed Upgrade Cost: $2,800,000 one-time implementation + $1,900,000/year incremental licensing; new ACV: $6,000,000/year
•  Contract Term: 3-year term ending December 2026
Ridgeline Data Systems LLC (Under Evaluation):
•  Full Legal Name: Ridgeline Data Systems LLC
•  Entity Type: Delaware LLC
•  Principal Office: 500 West Monroe Street, Suite 2800, Chicago, IL 60661
•  Key Contact: David Marchetti, Chief Revenue Officer
•  Product: To be specified upon advancing to detailed evaluation
•  Proposed ACV: $7,200,000/year; 5-year term; total contract value: $36,000,000
SECTION 3: STRATEGIC & OPERATIONAL RISK ASSESSMENT
3.1 Strategic Alignment
The following items assess the degree to which the vendor's product and strategic direction are aligned with BRB's BSA/AML compliance program objectives, the Bank's business model, and the specific remediation requirements of the Consent Order. Each item should be evaluated based on vendor presentations, product demonstrations, written vendor responses, and independent analysis.
3.2 Operational Risk
The following items assess the vendor's operational capacity to deliver and support the proposed solution within the timeframes and at the quality levels required by BRB and the Consent Order. Operational risk assessment should include evaluation of the vendor's implementation track record, staffing model, key-person dependencies, subcontracting practices, and geographic footprint.
3.3 Concentration Risk
The following items assess the degree of concentration risk associated with BRB's reliance on the vendor for critical BSA/AML compliance functions and the availability of viable alternatives.
SECTION 4: FINANCIAL VIABILITY ASSESSMENT
4.1 Financial Condition
A vendor's financial viability is a critical factor in the due diligence assessment, particularly for vendors providing technology solutions that are integral to the Bank's regulatory compliance program. A vendor's financial instability could result in service disruptions, reduced investment in product development and security, or, in an extreme case, vendor insolvency — any of which could impair the Bank's ability to comply with BSA/AML requirements and the Consent Order. The following items are designed to assess the vendor's current and prospective financial health.
4.2 Capital & Funding
4.3 Credit & Market Reputation
SECTION 5: INFORMATION SECURITY & DATA PROTECTION
5.1 Security Framework & Certifications
Given the sensitivity of the data processed by AML/sanctions technology platforms — including customer personally identifiable information ("PII"), transaction data, suspicious activity information, and sanctions screening results — a rigorous assessment of the vendor's information security posture is essential. The Bank processes transaction data for millions of end-user accounts across its BaaS channels, including approximately 2.1 million NovaPay end-user accounts and approximately 870,000 VaultEdge deposit accounts, as well as approximately 47,000 accounts classified as high-risk under the Bank's customer risk rating methodology. The vendor must demonstrate robust security controls commensurate with the sensitivity and volume of the data it will process, store, and transmit on behalf of the Bank.
5.2 Data Security Controls
5.3 Data Privacy & Handling
5.4 Incident Response
SECTION 6: BUSINESS CONTINUITY & DISASTER RECOVERY
6.1 Business Continuity Plan (BCP)
The Bank's AML/sanctions technology platform is a critical system for purposes of the Bank's business continuity planning, as an extended outage or service degradation could prevent the Bank from performing required transaction monitoring, sanctions screening, and suspicious activity reporting functions. A vendor that provides such a critical system must maintain a robust business continuity plan that ensures the continuity of services to BRB under a range of disruption scenarios.
6.2 Disaster Recovery (DR)
6.3 Exit Planning
SECTION 7: REGULATORY COMPLIANCE ASSESSMENT
7.1 BSA/AML Compliance Capabilities
This section addresses the vendor's core BSA/AML compliance capabilities, with particular focus on the areas identified as deficient in the Consent Order. The assessment should be informed by product demonstrations, vendor documentation, independent testing (where feasible at the due diligence stage), and reference checks with comparable banking institution clients.
7.2 OFAC Sanctions Screening Capabilities
This section addresses the vendor's OFAC sanctions screening capabilities, which are the most critical area of vendor assessment given the Consent Order's finding of a material gap in the Bank's sanctions screening coverage. The unscreened transaction finding (approximately 12% of NovaPay transactions in CY 2023) represents a potential OFAC enforcement liability and is a primary driver of the Bank's compliance remediation program.
7.3 CDD/EDD & Customer Screening
7.4 Regulatory Examination & Audit Support
SECTION 8: TECHNICAL ARCHITECTURE & INTEGRATION
8.1 System Architecture
8.2 Integration Capabilities
8.3 Configuration & Customization
SECTION 9: PERFORMANCE MONITORING & SERVICE LEVELS
9.1 Service Level Agreements
9.2 Performance Metrics & Reporting
The minimum KPIs to be tracked are as follows:
9.3 Ongoing Monitoring Program
SECTION 10: LEGAL & CONTRACTUAL PROTECTIONS
10.1 Contractual Requirements Checklist
The contract between BRB and the AML/sanctions technology vendor is a critical risk mitigation tool and must contain provisions that adequately protect the Bank's interests, ensure regulatory compliance, and provide the Bank with appropriate rights and remedies. The following items identify the minimum contractual protections that must be included in any agreement with an AML/sanctions technology vendor. All contract terms should be reviewed by BRB General Counsel (Gregory Nardone) with support from Calderwood & Harkness LLP prior to execution.
10.2 Regulatory Access Provisions
SECTION 11: VENDOR RISK RATING & APPROVAL
11.1 Risk Rating Matrix
The overall vendor risk rating is derived from the weighted aggregation of item-level ratings across all checklist domains. The following weighting methodology applies:
Within each domain, the individual item ratings are aggregated as follows:
•  Satisfactory = 3 points
•  Needs Improvement = 2 points
•  Unsatisfactory = 1 point
The domain score is the average of all item scores within the domain, expressed on the 1–3 scale. The weighted overall score is the sum of (domain score × domain weight) across all domains. The overall vendor risk rating is then assigned as follows:
Important: Regardless of the overall weighted score, any individual item rated "Unsatisfactory" that relates to a Consent Order requirement (items marked [CO]) will automatically elevate the overall risk rating to "High Risk" or "Unacceptable," as determined by the CRO (Melissa Chu), unless a documented and time-bound mitigation plan is approved by the Risk Committee.
When multiple vendors are being evaluated (e.g., Veridian Analytics TMS v.10.0 upgrade vs. Ridgeline Data Systems replacement), the completed checklists should be reviewed side-by-side using the comparison framework below:
11.2 Approval & Escalation
The following approval chain applies to vendor assessments completed using this checklist:
Step 1 — Assessment Completion:
•  Assessment completed by: CIO/CTO (Linda Petrosian) and BSA Officer / AML Program Director (Thomas Ikeda), with input from the cross-functional team identified in Section 1.2.
Step 2 — Review and Concurrence:
•  Review and concurrence by:
•  Chief Compliance Officer (Patricia Langston)
•  Chief Risk Officer (Melissa Chu)
•  Head of Internal Audit (Derek Ballard)
Step 3 — Legal Review:
•  Legal review by: General Counsel (Gregory Nardone), with support from Calderwood & Harkness LLP (Philip Hartmann, Responsible Partner).
Step 4 — Approval:
•  For vendors rated Low Risk or Moderate Risk: Approval by the CIO/CTO, BSA Officer, CCO, and CRO, with legal concurrence from General Counsel.
•  For vendors rated High Risk: Approval by the BRB Risk Committee (Arthur Connelly, Chair). The Risk Committee must receive a written memorandum from the assessment team identifying all "Unsatisfactory" and "Needs Improvement" items, the proposed mitigation plan, and the risk acceptance rationale.
•  For vendors rated Unacceptable: The vendor may not be engaged. If the vendor is an incumbent (e.g., Veridian Analytics), the assessment team must develop a transition plan for consideration by the Risk Committee and Board Compliance Committee.
Step 5 — Board Reporting:
•  The Board Compliance Committee (James Rutherford, Chair) is to be informed of all AML/sanctions technology vendor assessments as part of the Bank's monthly remediation reporting to the Board. The reporting should include: (a) a summary of the assessment findings; (b) the overall vendor risk rating; (c) identification of any "Unsatisfactory" items and associated mitigation plans; and (d) the approval decision. [CO]
Step 6 — Regulatory Notification:
•  Any change in AML/sanctions technology vendor (e.g., replacement of Veridian Analytics with Ridgeline Data Systems or another vendor) must be communicated to the OCC in advance of the change. Depending on the specific requirements of the Consent Order, a non-objection from the OCC may be required before the Bank can proceed with the vendor change. Calderwood & Harkness LLP should be consulted regarding the specific notification and approval requirements under the Consent Order. [CO]
11.3 Documentation & Record Retention
The completed checklist, together with all supporting documentation, source documents, correspondence, and work papers, must be retained in BRB's vendor management file maintained by the Bank's Third-Party Risk Management program within the Enterprise Risk Management function.
The following documentation and retention requirements apply:
•  A copy of the completed checklist and all supporting documentation must be made available to Thornfield Consulting Group LLC as part of the independent consultant's assessment under the Consent Order. [CO]
•  All documentation is subject to review and examination by the OCC and other applicable regulators. The Bank should not assert attorney-client privilege over factual vendor assessment documentation (as opposed to legal analysis and advice, which remain privileged). Consult with Calderwood & Harkness LLP regarding privilege designations.
•  The minimum retention period for all documentation associated with this checklist is seven (7) years from the date of the assessment or from the date of termination of the vendor relationship, whichever is later. This retention period is intended to exceed the standard BSA recordkeeping requirements (five years) and to account for potential future regulatory inquiries or litigation.
•  Documentation must be stored in a secure, controlled-access repository with appropriate access restrictions and audit logging.
APPENDIX A: DOCUMENT REQUEST LIST FOR VENDOR DUE DILIGENCE
The following is a standardized list of documents to be requested from each AML/sanctions technology vendor under evaluation. This list should be provided to the vendor at the outset of the due diligence process, with a target return date of no more than fifteen (15) business days. All documents received from the vendor should be logged, reviewed, and retained in the vendor management file.
APPENDIX B: CONSENT ORDER COMPLIANCE CROSS-REFERENCE TABLE
The following table maps each section and selected checklist items to the specific articles and requirements of OCC Consent Order No. OCC-2025-003 that the vendor assessment is designed to address.
Deficiency Category 1: OFAC Sanctions Screening Adequacy
Deficiency Category 2: SAR Filing Process
Deficiency Category 3: CDD/EDD
Deficiency Category 4: Transaction Monitoring Model Validation
Deficiency Category 5: Board-Level Reporting
Cross-Cutting: Regulatory Access and Independent Consultant
APPENDIX C: SAMPLE COMPLETED ASSESSMENT — VERIDIAN ANALYTICS INC. (PARTIAL ILLUSTRATION)
Note: This appendix provides an illustrative, partially completed assessment for the incumbent vendor, Veridian Analytics Inc., to demonstrate the expected level of detail and documentation rigor. This sample is not a final assessment and is provided for training and reference purposes only. The full assessment is to be completed by the BRB cross-functional team (led by CIO/CTO Linda Petrosian and BSA Officer Thomas Ikeda) with oversight and legal review by Calderwood & Harkness LLP.
Vendor Identification (Section 2 — Illustrative)
Illustrative Risk Flags Identified (For Full Investigation)
The following preliminary risk flags have been identified based on the information currently available. Each flag must be fully investigated and documented in the completed assessment:
Risk Flag 1 — Model Validation Gap [CO]: The last independent model validation of the Veridian TMS was completed in March 2021 — over three years prior to the OCC examination that resulted in Consent Order No. OCC-2025-003. This significantly exceeds the industry best practice and regulatory expectation of independent model validation at least every twelve (12) to eighteen (18) months, or upon material changes in the model or the institution's risk profile. The Consent Order specifically requires that an independent model validation be completed by October 1, 2025.
Preliminary Rating: Unsatisfactory (Item 7.1.7)
Required Follow-Up: (a) Determine whether Veridian TMS v.10.0 will incorporate a materially different model from v.8.3; (b) assess Veridian's ability to provide the model documentation and system access necessary for an independent model validation by the October 1, 2025, deadline; (c) identify the independent model validation firm and confirm engagement timeline; (d) determine whether the model validation can be scoped to cover both v.8.3 (current) and v.10.0 (proposed) or whether separate validations are required.
Risk Flag 2 — Tuning Parameter Staleness [CO]: The tuning parameters for Veridian TMS v.8.3 were last updated in October 2022 — over two years prior to the OCC examination. During this period, BRB's BaaS transaction volumes increased significantly, new fintech partners were onboarded, and the risk environment evolved. The staleness of the tuning parameters may have contributed to alert effectiveness deficiencies and an elevated false positive rate.
Preliminary Rating: Unsatisfactory (Item 7.1.6)
Required Follow-Up: (a) Determine whether Veridian v.10.0 will require new initial tuning or will carry forward v.8.3 parameters; (b) assess Veridian's tuning support capabilities and recommended tuning frequency for v.10.0; (c) establish a contractual commitment for at least semi-annual model tuning going forward; (d) determine whether interim tuning of v.8.3 is warranted during the upgrade period.
Risk Flag 3 — OFAC Screening Coverage Gap [CO]: The Consent Order found that approximately 12% of NovaPay wire and ACH transactions — approximately 3,800,000 of 31,700,000 total NovaPay transactions in CY 2023 — were not screened against OFAC sanctions lists. This represents a material compliance failure attributable, at least in part, to integration and architecture deficiencies in the Veridian TMS v.8.3 platform as deployed for BaaS channel screening. Remediation of this gap is the highest-priority item in the Consent Order.
Preliminary Rating: Unsatisfactory (Item 7.2.8)
Required Follow-Up: (a) Obtain from Veridian a detailed root cause analysis of the screening gap; (b) determine whether the gap was attributable to a platform deficiency, a configuration error, an integration failure, or a combination of factors; (c) assess whether Veridian TMS v.10.0 architecture eliminates the possibility of unscreened transactions through architectural controls (e.g., inline screening with transaction blocking for failed screens); (d) require Veridian to demonstrate 100% screening coverage capability through testing prior to production deployment; (e) establish contractual guarantees and SLAs for screening completeness.
Risk Flag 4 — False Positive Rate [CO]: The CY 2024 OFAC screening data reflects a false positive rate of 99.9% (14,320 total OFAC screening hits, with only 12 true matches and 14,308 false positives). While a high false positive rate is common in sanctions screening, a rate of 99.9% may indicate overly broad screening parameters, inadequate tuning of the matching algorithm, or insufficient use of whitelisting and other false positive reduction techniques. Excessively high false positive rates can overwhelm the compliance team, increase the risk of a true positive being missed in the volume of false hits, and indicate inefficiency in the screening process.
Preliminary Rating: Needs Improvement (Item 7.2.7)
Required Follow-Up: (a) Assess the false positive reduction capabilities of Veridian TMS v.10.0; (b) evaluate whether the OFAC module in v.10.0 includes enhanced matching algorithms, whitelisting, and machine-learning-assisted false positive reduction; (c) establish target false positive rate reduction benchmarks in connection with the v.10.0 upgrade.
Note: The full Veridian Analytics assessment is to be completed by the BRB cross-functional team in accordance with the instructions and standards set forth in Section 1 of this checklist. Calderwood & Harkness LLP will review the completed assessment for legal sufficiency prior to submission for internal approval.
APPENDIX D: SAMPLE VENDOR IDENTIFICATION — RIDGELINE DATA SYSTEMS LLC (FOR EVALUATION)
Note: The following provides placeholder identification data for the alternative vendor, Ridgeline Data Systems LLC, which is under preliminary evaluation as a potential replacement for Veridian Analytics Inc. in the event the Veridian TMS v.10.0 upgrade proves insufficient to meet the Bank's compliance requirements and Consent Order deadlines. This appendix contains only identification data; the full checklist is to be completed upon a decision to advance Ridgeline to the detailed evaluation stage.
Vendor Identification (Section 2 — Placeholder)
Preliminary Considerations
The following preliminary considerations should inform the decision to advance Ridgeline to the detailed evaluation stage:
1.  Cost Differential: Ridgeline's proposed ACV of $7,200,000/year exceeds the proposed Veridian v.10.0 ACV of $6,000,000/year by $1,200,000/year. Over the proposed 5-year term, the total Ridgeline contract value of $36,000,000 would exceed the projected Veridian v.10.0 cost over the same period (approximately $30,000,000, assuming ACV remains stable after the initial upgrade) by approximately $6,000,000. The cost-benefit analysis should account for the implementation costs and risks of transitioning to a new platform versus upgrading the incumbent platform.
2.  Implementation Risk: Transitioning to a new vendor platform introduces significant implementation risk, including the risk of delays that could jeopardize compliance with Consent Order deadlines. The assessment team should evaluate whether a full platform replacement can realistically be completed within the Consent Order timelines (OFAC screening fully operational for all BaaS channels by November 1, 2025).
3.  Operational Continuity: A vendor transition would require parallel running of the old and new platforms during the transition period, imposing additional operational burden on the Bank's BSA, compliance, and technology teams.
4.  Consent Order Notification: As noted in Section 11.2, any change in AML/sanctions technology vendor must be communicated to the OCC in advance, and a non-objection may be required under the Consent Order. This requirement should be factored into the evaluation timeline.
5.  Contingency Planning: Even if the Bank's primary strategy is to proceed with the Veridian v.10.0 upgrade, maintaining Ridgeline as a viable alternative serves a valuable contingency planning function. The Bank should advance Ridgeline to detailed evaluation if, and to the extent that, the Veridian upgrade encounters significant technical, operational, or contractual obstacles that call into question the Bank's ability to achieve Consent Order compliance on the required timeline.
The decision to advance Ridgeline Data Systems LLC to the detailed evaluation stage should be made by the CIO/CTO (Linda Petrosian) and BSA Officer (Thomas Ikeda), in consultation with the CCO (Patricia Langston), CRO (Melissa Chu), and General Counsel (Gregory Nardone), with input from Calderwood & Harkness LLP.
END OF CHECKLIST
ACKNOWLEDGMENT OF RECEIPT AND REVIEW
By signing below, the undersigned acknowledges receipt of this Third-Party Technology Vendor Due Diligence Checklist and confirms their responsibility for completing the sections assigned to them, in accordance with the instructions and standards set forth herein.
Assessment Lead — CIO/CTO
By: ________
Name: Linda Petrosian
Title: Chief Information Officer / Chief Technology Officer
Date: ________
Assessment Co-Lead — BSA Officer
By: ________
Name: Thomas Ikeda
Title: BSA Officer / AML Program Director
Date: ________
Chief Compliance Officer — Review and Concurrence
By: ________
Name: Patricia Langston
Title: Chief Compliance Officer
Date: ________
Chief Risk Officer — Review and Concurrence
By: ________
Name: Melissa Chu
Title: Chief Risk Officer
Date: ________
Head of Internal Audit — Review and Concurrence
By: ________
Name: Derek Ballard
Title: Head of Internal Audit
Date: ________
General Counsel — Legal Review
By: ________
Name: Gregory Nardone
Title: General Counsel
Date: ________
Outside Counsel — Legal Sufficiency Review
CALDERWOOD & HARKNESS LLP
By: ________
Name: Philip Hartmann
Title: Responsible Partner
Date: ________
Risk Committee Chair — Approval (if required)
By: ________
Name: Arthur Connelly
Title: Chair, BRB Risk Committee
Date: ________
Calderwood & Harkness LLP — C&H Matter No. 1045-00002 — Attorney-Client Privileged & Confidential — February 2025
Role | Name | Primary Responsibility
Chief Information Officer / Chief Technology Officer (Lead) | Linda Petrosian | Overall coordination of the vendor assessment process; evaluation of technical architecture, integration capabilities, system performance, and information security
BSA Officer / AML Program Director | Thomas Ikeda | Evaluation of BSA/AML compliance capabilities, including transaction monitoring, OFAC screening, SAR/CTR reporting, and CDD/EDD functionality
Chief Compliance Officer | Patricia Langston | Regulatory compliance review; alignment with Consent Order requirements; coordination with independent consultant
Chief Risk Officer | Melissa Chu | Risk assessment methodology; vendor risk rating; concentration risk evaluation; escalation decisions
Head of Fintech Partnerships / BaaS Division | Warren Ashby | Assessment of vendor's ability to support BaaS business model, including integration with all 14 active fintech partner channels
Head of Internal Audit | Derek Ballard | Independent review of the completed checklist; validation of supporting documentation; ongoing monitoring oversight
General Counsel | Gregory Nardone | Legal review of contractual terms and protections; coordination with outside counsel
Rating | Definition
Satisfactory | The vendor meets or exceeds the Bank's expectations for the checklist item. Documentation is complete and current. No material gaps, weaknesses, or concerns have been identified.
Needs Improvement | The vendor partially meets the Bank's expectations, but one or more gaps, weaknesses, or concerns have been identified that require remediation or further monitoring. A documented remediation plan with target dates must be established for each item rated "Needs Improvement."
Unsatisfactory | The vendor does not meet the Bank's minimum expectations for the checklist item. A material gap, weakness, or concern has been identified that poses a significant risk to the Bank. Items rated "Unsatisfactory" require immediate documented mitigation action or escalation to the BRB Risk Committee (Arthur Connelly, Chair) for determination as to whether the vendor engagement should proceed.
Domain | Weight
Information Security & Data Protection (Section 5) | 25%
Regulatory Compliance Capabilities (Section 7) | 25%
Operational Risk (Section 3) | 15%
Financial Viability (Section 4) | 15%
Business Continuity & Disaster Recovery (Section 6) | 10%
Legal & Contractual Protections (Section 10) | 10%
Item | Response | Evidence / Source
Full legal name of vendor entity
Short name / DBA (if applicable)
Entity type (e.g., corporation, LLC, LP)
Jurisdiction of organization (e.g., State of Delaware)
Principal office address
Year of incorporation / formation
Federal Employer Identification Number (EIN)
Item | Response | Evidence / Source
Ownership structure (private, public, PE-backed, subsidiary, other)
If subsidiary, identify the ultimate parent entity and jurisdiction
If PE/VC-backed, identify the controlling fund(s) and general partner(s)
If publicly traded, identify the stock exchange, ticker symbol, and market capitalization
Organizational chart (attach or reference)
Item | Response | Evidence / Source
Primary engagement contact: Name
Primary engagement contact: Title
Primary engagement contact: Phone
Primary engagement contact: Email
Primary engagement contact: Office address
Secondary / escalation contact: Name and Title
Executive sponsor for the BRB relationship: Name and Title
Item | Response | Evidence / Source
Product(s) / service(s) under evaluation (e.g., transaction monitoring system, sanctions screening platform, OFAC screening module, CDD/EDD platform)
Current product version in use by BRB (if existing relationship)
Proposed product version (if upgrade or new engagement)
Brief description of the product's core functionality
Product release date and most recent update/patch date
Item | Response | Evidence / Source
Contract reference number (if existing relationship)
Current annual contract value ("ACV")
Proposed annual contract value (if new engagement or upgrade)
Proposed one-time implementation or upgrade costs
Total contract value over the full term
Contract term (start and end dates)
Renewal provisions (auto-renewal, mutual option, etc.)
Date of initial engagement / relationship start (if existing)
Date of this assessment
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
3.1.1 | Does the vendor's product roadmap align with BRB's BSA/AML compliance program objectives and remediation requirements under Consent Order No. OCC-2025-003? [CO]
3.1.2 | Can the vendor's solution address all five core deficiency categories identified in the Consent Order: (a) OFAC sanctions screening adequacy, (b) SAR filing process improvements, (c) CDD/EDD enhancements, (d) transaction monitoring model validation support, and (e) board-level BSA/AML reporting? [CO]
3.1.3 | Does the vendor's product support BRB's Banking-as-a-Service (BaaS) business model, including integration with all 14 active fintech partner channels managed by the BaaS Division (Warren Ashby, Head of Fintech Partnerships)? [CO]
3.1.4 | Can the vendor's solution scale to accommodate BRB's current and projected transaction volumes? (Reference: Total BaaS transaction volume CY 2024: approximately $74.3 billion; total transaction monitoring alerts generated CY 2024: approximately 41,500.)
3.1.5 | Does the vendor's product support the specific screening and monitoring requirements associated with BRB's top BaaS partners, including: (a) NovaPay Technologies (consumer payments/P2P; 41% of BaaS volume, approximately $30.5 billion); (b) FairLend Digital (online small-business lending; 28% of BaaS volume; approximately $1.4 billion in loan originations FY 2024); (c) VaultEdge (digital savings/neobanking; 18% of BaaS volume; approximately 870,000 deposit accounts); and (d) remaining 11 fintech partners (13% of BaaS volume)? [CO]
3.1.6 | Does the vendor have experience serving other BaaS-sponsor banks or institutions with similar fintech partnership models?
3.1.7 | Does the vendor's product roadmap contemplate future regulatory developments in AML/sanctions compliance, including FinCEN's proposed beneficial ownership reporting enhancements and emerging guidance on AI/ML-based transaction monitoring?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
3.2.1 | Can the vendor deliver the proposed solution within the Consent Order-driven timelines? Key deadlines include: (a) TMS v.10.0 User Acceptance Testing (UAT) complete by August 1, 2025; (b) independent model validation complete by October 1, 2025; and (c) OFAC screening fully operational for all BaaS channels by November 1, 2025. [CO]
3.2.2 | What is the vendor's implementation track record? Identify the number and scale of comparable deployments at banking institutions of similar size and complexity to BRB (total assets: $38.7 billion). Request and review at least three comparable customer references.
3.2.3 | What is the vendor's proposed staffing and resource commitment for the BRB implementation project? Identify the proposed project manager, technical lead, and key subject matter experts.
3.2.4 | Has the vendor provided a detailed implementation plan, including milestones, deliverables, resource allocation, risk mitigation strategies, and contingency plans?
3.2.5 | Assess key-person risk: Is the vendor's ability to deliver the proposed solution dependent on specific vendor personnel? What measures are in place to mitigate key-person risk (e.g., cross-training, succession planning, contractual key-person commitments)?
3.2.6 | Does the vendor use subcontractors or fourth-party providers for any component of the proposed solution, including development, hosting, data processing, or support? If so: (a) identify all sub-tier vendors; (b) describe the scope of their involvement; (c) assess their risk profile; and (d) determine whether BRB has contractual approval rights over subcontracting.
3.2.7 | Identify the geographic location(s) of the vendor's: (a) corporate headquarters; (b) software development teams; (c) data centers and hosting facilities; (d) customer support and help desk operations; and (e) any other operations relevant to the BRB engagement. Identify any offshore or nearshore components and assess associated risks (e.g., data security, regulatory compliance, geopolitical risk, communication challenges).
3.2.8 | What is the vendor's employee retention rate and average tenure for key technical and implementation staff? Has the vendor experienced significant turnover in the past 12 months?
3.2.9 | Does the vendor have a dedicated financial services practice or team with specialized expertise in banking regulatory compliance, particularly BSA/AML and OFAC sanctions?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
3.3.1 | Describe the degree of BRB's reliance on the vendor for critical BSA/AML compliance functions. Would a failure or significant degradation of the vendor's product or services render BRB unable to comply with BSA/AML regulatory requirements?
3.3.2 | Are there alternative vendors capable of providing comparable AML transaction monitoring and/or OFAC sanctions screening solutions to BRB? Identify at least two alternatives and assess their viability. (Reference: Ridgeline Data Systems LLC is currently under preliminary evaluation as an alternative to Veridian Analytics Inc.)
3.3.3 | What percentage of the vendor's total revenue is attributable to BRB? Is BRB a material client for the vendor? (If BRB represents more than 10% of the vendor's total revenue, this is a concentration risk factor for both BRB and the vendor.)
3.3.4 | What is the vendor's client diversification profile? How many banking institution clients of comparable size and complexity does the vendor serve?
3.3.5 | In the event the vendor relationship must be terminated (whether due to vendor performance failure, regulatory directive, or other cause), what is the estimated timeframe and cost to transition to an alternative vendor?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
4.1.1 | Has the vendor provided audited financial statements for the most recent three fiscal years? If the vendor is a private company, has a non-disclosure agreement been executed to facilitate the exchange of financial information? (Reference: Mutual NDA executed with Ridgeline Data Systems LLC for evaluation purposes.)
4.1.2 | Review the vendor's revenue trends over the most recent three fiscal years. Is revenue growing, stable, or declining? Are revenue trends consistent with vendor representations about market position and growth trajectory?
4.1.3 | Review the vendor's net income and profitability trends over the most recent three fiscal years. Is the vendor profitable? If not, what is the trend, and what is the vendor's path to profitability?
4.1.4 | Assess the vendor's cash flow position. Does the vendor generate positive operating cash flow? Is the vendor's cash flow sufficient to fund ongoing operations, product development, and capital expenditures without reliance on external financing?
4.1.5 | Calculate and assess the vendor's debt-to-equity ratio and overall leverage. Is the vendor's leverage appropriate for its size, stage, and industry? Are there any concerning trends?
4.1.6 | Assess the vendor's liquidity position, including current ratio and quick ratio. Does the vendor have adequate liquid assets to meet short-term obligations?
4.1.7 | Review the independent auditor's report on the vendor's financial statements. Does the report contain a going-concern opinion, qualification, emphasis-of-matter paragraph, or other modification that raises concerns about the vendor's ability to continue as a going concern?
4.1.8 | For vendors that are subsidiaries, assess the financial condition of the parent entity and consider whether the parent's financial condition could adversely affect the subsidiary's ability to perform under the contract with BRB.
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
4.2.1 | Describe the vendor's capitalization structure. For PE/VC-backed vendors, identify recent funding rounds, the lead investors, the amount raised, and the post-money valuation (if available). Assess the stability and sufficiency of the vendor's capital base.
4.2.2 | Is the vendor subject to any material pending or threatened litigation that could adversely affect its financial condition or ability to perform? Request a litigation disclosure or representation.
4.2.3 | Are there any liens, encumbrances, or judgments against the vendor or its assets that could affect its financial stability or its ability to provide the proposed solution?
4.2.4 | Does the vendor maintain adequate insurance coverage? At a minimum, the following coverage types and limits should be verified: (a) commercial general liability (minimum $5,000,000 per occurrence); (b) professional liability / errors and omissions (minimum $10,000,000 per claim); (c) cyber liability / network security and privacy liability (minimum $10,000,000 per claim). Request and review current certificates of insurance.
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
4.3.1 | Obtain and review credit references for the vendor from at least three (3) trade references, including existing banking institution clients.
4.3.2 | Review the vendor's payment history and any Dunmore Enterprises, Penrose Group, or similar commercial credit report.
4.3.3 | Review independent industry analyst assessments, market reports, and product evaluations relevant to the vendor's AML/sanctions technology offerings (e.g., Granite Harbor Consulting Group, Sundial Advisory Group (formerly Hollowell Advisors), Penmark Consulting Group, Penmark Advisors).
4.3.4 | Assess the vendor's market share and competitive positioning within the AML/sanctions technology space. Is the vendor a market leader, a credible mid-market competitor, or a niche player?
4.3.5 | Has the vendor or any of its affiliates been the subject of any regulatory enforcement actions, consent orders, cease-and-desist orders, civil money penalties, or other formal or informal regulatory actions in any jurisdiction? If so, describe the nature and disposition of each such action.
4.3.6 | Has the vendor been the subject of any significant negative media coverage, whistleblower complaints, or public allegations related to its products, services, business practices, or management? Conduct an adverse media screening.
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
5.1.1 | Has the vendor provided its most recent SOC 1 Type II report? Review the report for scope, period covered, control objectives, test results, and any exceptions or qualifications. Identify any exceptions or deviations from control objectives and assess their materiality to the BRB engagement.
5.1.2 | Has the vendor provided its most recent SOC 2 Type II report (Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy)? Review the report for scope, period covered, criteria, test results, and any exceptions or qualifications. Identify any exceptions that affect the security, availability, or confidentiality of BRB data.
5.1.3 | Does the vendor hold a current ISO 27001 certification for its information security management system (ISMS)? If so, verify the certification scope, certifying body, and expiration date. If not, does the vendor plan to obtain ISO 27001 certification, and what is the timeline?
5.1.4 | Has the vendor assessed its cybersecurity program against the NIST Cybersecurity Framework (CSF)? If so, request the most recent assessment results or a summary of the vendor's current maturity profile across the NIST CSF functions (Identify, Protect, Detect, Respond, Recover).
5.1.5 | Has the vendor assessed its IT controls and cybersecurity program against the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook, including the Information Security booklet?
5.1.6 | Does the vendor conduct third-party penetration testing at least annually? Request and review the most recent penetration test results summary (including scope, methodology, findings, severity ratings, and remediation status). Identify any critical or high-severity findings that have not been fully remediated.
5.1.7 | Does the vendor maintain a documented information security program that includes policies, standards, procedures, and guidelines covering, at a minimum: (a) access management; (b) network security; (c) application security; (d) data protection; (e) physical security; (f) security monitoring and logging; (g) incident response; and (h) employee security awareness training?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
5.2.1 | What encryption standards does the vendor employ for BRB data at rest? (Minimum expectation: AES-256 or equivalent.)
5.2.2 | What encryption standards does the vendor employ for BRB data in transit? (Minimum expectation: TLS 1.2 or higher.)
5.2.3 | What encryption key management practices does the vendor follow? Are encryption keys stored separately from encrypted data? Are key rotation and lifecycle management procedures documented?
5.2.4 | What access control mechanisms does the vendor employ? At a minimum, the vendor should implement: (a) multi-factor authentication (MFA) for all access to systems processing BRB data; (b) role-based access control (RBAC) with least-privilege principles; (c) unique user identification and authentication; (d) regular access reviews and recertification; and (e) prompt de-provisioning of access upon personnel changes.
5.2.5 | Describe the vendor's network security architecture, including: (a) firewall configurations; (b) intrusion detection and prevention systems (IDS/IPS); (c) network segmentation; (d) secure remote access mechanisms; and (e) monitoring and logging of network traffic.
5.2.6 | Describe the vendor's vulnerability management program, including: (a) frequency of vulnerability scanning (minimum: monthly for external, quarterly for internal); (b) patching cadence and SLAs for critical, high, medium, and low severity vulnerabilities; (c) remediation tracking and escalation procedures; and (d) use of threat intelligence feeds.
5.2.7 | Does the vendor follow a secure software development lifecycle (SDLC) methodology? Describe the vendor's SDLC practices, including: (a) secure coding standards and training; (b) code review processes; (c) static and dynamic application security testing (SAST/DAST); (d) third-party component and open-source library management; and (e) security testing at each phase of the development lifecycle.
5.2.8 | Does the vendor have data loss prevention (DLP) controls in place to prevent unauthorized exfiltration of BRB data? Describe the DLP solution(s) deployed and the data channels monitored (e.g., email, web, endpoint, cloud storage).
5.2.9 | Does the vendor maintain comprehensive security event logging and monitoring? Are logs retained for a minimum of 12 months? Is a Security Information and Event Management (SIEM) solution deployed? Is the vendor's Security Operations Center (SOC) staffed 24/7?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
5.3.1 | Does the vendor maintain documented data classification and handling procedures? How does the vendor classify BRB data (e.g., confidential, restricted, internal, public)?
5.3.2 | Where is BRB data stored, processed, and accessed? Identify all data center locations, including primary and backup/DR sites. Does data residency comply with any applicable data localization requirements? Is all BRB data stored and processed within the United States?
5.3.3 | Is BRB data logically and/or physically segregated from other vendor clients' data? Describe the data segregation architecture. If BRB data is stored in a multi-tenant environment, what controls are in place to prevent unauthorized cross-tenant data access?
5.3.4 | What are the vendor's data retention policies? How long does the vendor retain BRB data after processing? Do the vendor's retention periods align with BRB's regulatory requirements (minimum five years for BSA records, with longer periods for certain record types)?
5.3.5 | What are the vendor's data destruction procedures upon contract termination? How will the vendor certify that all BRB data (including backups, archives, and any copies) has been securely destroyed or returned to BRB? What is the timeframe for data destruction upon termination?
5.3.6 | Has the vendor conducted a privacy impact assessment related to its processing of BRB data? Does the vendor's data handling comply with the Gramm-Leach-Bliley Act (GLBA) and applicable state privacy laws?
5.3.7 | Describe the vendor's PII handling protocols, with specific attention to: (a) customer data associated with BRB's approximately 47,000 high-risk accounts; (b) BaaS end-user information, including data for NovaPay Technologies' approximately 2.1 million end-user accounts and VaultEdge's approximately 870,000 deposit accounts; and (c) suspicious activity report-related data, which is subject to heightened confidentiality protections under 31 U.S.C. § 5318(g)(2).
5.3.8 | Does the vendor provide access to BRB data to any offshore personnel? If so, what additional controls are in place to manage associated risks (e.g., restricted access, enhanced monitoring, contractual restrictions)?
No. | Checklist Item | Rating | Comments / Findings | Evidence / Source
5.4.1 | Does the vendor maintain a documented incident response plan (IRP)? Request and review the current plan. Does the plan address: (a) incident identification and classification; (b) containment and eradication; (c) recovery; (d) post-incident analysis and lessons learned; (e) communication protocols; and (f) regulatory and client notification requirements?
5.4.2 | What are the vendor's notification requirements and timelines for security incidents affecting BRB data? (Contractual expectation: notification to BRB within four (4) hours of confirmed or