FIRST AMENDMENT TO MASTER SERVICES AGREEMENT
Contract No. VA-BRB-2023-0044
This First Amendment to Master Services Agreement (this "Amendment") is entered into as of March 14, 2025 (the "Amendment Effective Date"), by and between:
BELMONT RIDGE BANK NATIONAL ASSOCIATION, a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022 (hereinafter referred to as "Client" or the "Bank");
and
VERIDIAN ANALYTICS INC., a Delaware corporation, with its principal office located at 1900 Embarcadero Road, Suite 400, Palo Alto, CA 94303 (hereinafter referred to as "Vendor" or "Veridian").
The Bank and Vendor are sometimes referred to herein individually as a "Party" and collectively as the "Parties."
REFERENCE TO UNDERLYING AGREEMENT: This Amendment amends that certain Master Services Agreement dated September 8, 2023, by and between the Bank and Vendor, designated as Contract No. VA-BRB-2023-0044, as previously unamended (the "MSA" or the "Original Agreement").
PREPARED BY: Calderwood & Harkness LLP, 1285 Avenue of the Americas, 40th Floor, New York, NY 10019, as outside counsel to the Bank.
RECITALS
WHEREAS, the Bank and Vendor entered into the MSA (Contract No. VA-BRB-2023-0044), effective as of September 8, 2023, pursuant to which Vendor provides the Bank with its proprietary transaction monitoring system known as the Veridian Transaction Monitoring System (the "Veridian TMS") and related sanctions screening platform capabilities; the existing version of the Veridian TMS currently deployed in the Bank's production environment is Veridian TMS v.8.3;
WHEREAS, the MSA provides for an annual contract value of Four Million One Hundred Thousand Dollars ($4,100,000) per year (the "Base Licensing Fee") under a three-year term commencing January 1, 2024, and expiring December 31, 2026, and the MSA has not been previously amended;
WHEREAS, the Office of the Comptroller of the Currency (the "OCC") issued Consent Order No. OCC-2025-003 against the Bank, effective January 15, 2025 (the "Consent Order"), which identified, among other deficiencies in the Bank's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program, that the Bank's transaction monitoring model (Veridian TMS v.8.3) had not been independently validated since March 2021 and that the tuning parameters governing alert generation and scenario thresholds were last updated in October 2022, and further identifying inadequate sanctions screening protocols maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") for the Bank's fintech Banking-as-a-Service ("BaaS") transaction flows;
WHEREAS, the Consent Order requires the Bank to implement a comprehensive remediation of its BSA/AML and OFAC compliance program within specified timeframes, including, without limitation, upgrading its transaction monitoring and sanctions screening technology, engaging an independent consultant, and submitting a Comprehensive Remediation Action Plan to the OCC;
WHEREAS, the Bank desires to upgrade from Veridian TMS v.8.3 to the next-generation Veridian TMS v.10.0 platform and to implement an enhanced OFAC sanctions screening module in order to address the deficiencies identified in the Consent Order and to strengthen the Bank's overall BSA/AML and OFAC compliance infrastructure, and Vendor has agreed to provide such upgrade and enhancement on the terms and conditions set forth herein;
WHEREAS, the Bank's remediation timeline, as established by the Consent Order and the Bank's forthcoming Comprehensive Remediation Action Plan, requires that the upgraded TMS v.10.0 complete User Acceptance Testing and be deployed into the Bank's production environment by August 1, 2025, and that OFAC sanctions screening be fully operational for all BaaS Channels by November 1, 2025;
WHEREAS, the Bank has engaged Thornfield Consulting Group LLC as the OCC-mandated independent consultant pursuant to Article VII of the Consent Order, and the Bank has further engaged Calderwood & Harkness LLP as outside counsel and Caldera & Pope LLP as its external BSA/AML independent testing firm, each of whom may require access to information regarding Vendor's systems and the implementation contemplated herein;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS AND INTERPRETATION
Section 1.1 — Amended and New Definitions
For purposes of this Amendment, the following terms shall have the meanings set forth below. To the extent any definition set forth below conflicts with a definition of the same term in the MSA, the definition in this Amendment shall control:
(a) "Amended ACV" means the new annual contract value of Six Million Dollars ($6,000,000) per year, consisting of the existing Base Licensing Fee of Four Million One Hundred Thousand Dollars ($4,100,000) per year plus the Incremental Licensing Fee of One Million Nine Hundred Thousand Dollars ($1,900,000) per year, as further described in Article 3 of this Amendment.
(b) "BaaS Channels" means all transaction flows processed through the Bank's Banking-as-a-Service partnerships, including all payment types (wire transfers, Automated Clearing House transactions, card transactions, and other payment types), currently consisting of fourteen (14) active fintech sponsor relationships, including but not limited to NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc., and any additional BaaS partner relationships entered into by the Bank during the term of this Amendment.
(c) "Base Licensing Fee" means the existing annual licensing fee of Four Million One Hundred Thousand Dollars ($4,100,000) per year payable by the Bank to Vendor under the MSA for the Veridian TMS and related services.
(d) "Consent Order" means OCC Consent Order No. OCC-2025-003, effective January 15, 2025, as may be amended, modified, or superseded by further OCC action.
(e) "Go-Live Date" means August 1, 2025, which is the date by which TMS v.10.0 must successfully complete User Acceptance Testing and be deployed into the Bank's production environment, as further described in Article 4 of this Amendment.
(f) "Implementation Fee" means the one-time fee of Two Million Eight Hundred Thousand Dollars ($2,800,000) payable by the Bank to Vendor for the TMS v.10.0 upgrade and OFAC Module Enhancement, as set forth in Section 3.1 of this Amendment.
(g) "Incremental Licensing Fee" means One Million Nine Hundred Thousand Dollars ($1,900,000) per year for the TMS v.10.0 upgrade and OFAC Module Enhancement, commencing upon the Go-Live Date, as further described in Section 3.2 of this Amendment.
(h) "Independent Consultant" means Thornfield Consulting Group LLC, the OCC-mandated independent consultant engaged by the Bank pursuant to Article VII of the Consent Order, currently led by Dr. Vivian Castellano, Managing Director.
(i) "OFAC" means the U.S. Department of the Treasury's Office of Foreign Assets Control.
(j) "OFAC Full Operationalization Date" means November 1, 2025, which is the date by which OFAC sanctions screening must be fully operational for one hundred percent (100%) of transactions processed through all BaaS Channels, as further described in Article 4 of this Amendment.
(k) "OFAC Module Enhancement" means the upgraded OFAC sanctions screening module to be implemented by Vendor, as described in Section 2.2 of this Amendment and further detailed in the Statement of Work attached hereto as Exhibit A.
(l) "TMS v.8.3" means Version 8.3 of the Veridian Transaction Monitoring System, which is the version currently deployed in the Bank's production environment as of the Amendment Effective Date.
(m) "TMS v.10.0" means Version 10.0 of the Veridian Transaction Monitoring System, which is the upgraded version to be deployed pursuant to this Amendment, including all enhanced transaction monitoring capabilities, updated analytics engines, improved model tuning capabilities, and the OFAC Module Enhancement.
(n) "UAT" means User Acceptance Testing, as further described in Section 5.3 of this Amendment.
Section 1.2 — Interpretation
(a) All capitalized terms used but not defined in this Amendment shall have the meanings ascribed to them in the MSA. In the event of any conflict or inconsistency between the terms and conditions of this Amendment and the terms and conditions of the MSA, the terms and conditions of this Amendment shall control and govern with respect to the subject matter hereof.
(b) References in this Amendment to "Articles," "Sections," and "Exhibits" are to Articles, Sections, and Exhibits of this Amendment, unless otherwise expressly stated. References to the "MSA" or the "Original Agreement" are to the Master Services Agreement dated September 8, 2023 (Contract No. VA-BRB-2023-0044), without giving effect to this Amendment, unless the context otherwise requires.
(c) The headings of Articles and Sections in this Amendment are for convenience of reference only and shall not affect the interpretation or construction of any provision hereof. As used in this Amendment, the words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation." The word "or" is not exclusive.
(d) All references to dollar amounts in this Amendment are to United States dollars unless otherwise specified. All references to days shall mean calendar days unless "business days" is expressly specified.
ARTICLE 2 — SCOPE OF UPGRADE
Section 2.1 — TMS v.10.0 Upgrade
Vendor shall upgrade the Bank's existing Veridian TMS v.8.3 installation to Veridian TMS v.10.0. The upgrade shall encompass all core transaction monitoring functionality enhancements included in the TMS v.10.0 platform, including but not limited to updated analytics engines, enhanced detection scenario libraries, improved behavioral analytics capabilities, modernized case management functionality, and improved model tuning capabilities. The TMS v.10.0 platform shall include all generally available features, modules, and updates released by Vendor as part of the TMS v.10.0 product offering as of the Go-Live Date.
The upgrade shall specifically address the deficiencies identified in the Consent Order with respect to model validation and tuning parameters by, among other things, enabling configurable tuning parameter management that permits the Bank's BSA/AML compliance team to adjust detection scenario thresholds, alert parameters, and risk-scoring weights through a documented and auditable change management process. The upgraded system shall maintain a comprehensive audit trail of all tuning parameter changes, including the identity of the individual making the change, the date and time of the change, the prior parameter value, the new parameter value, and any associated rationale or documentation. This audit trail capability is essential to the Bank's ability to demonstrate to the OCC ongoing compliance with model risk management requirements and to facilitate timely independent model validations going forward.
Section 2.2 — OFAC Module Enhancement
Vendor shall implement the OFAC Module Enhancement as detailed in the Statement of Work attached hereto as Exhibit A, which shall include the following capabilities:
(a) Real-Time Sanctions Screening. Real-time sanctions screening integration for all BaaS Channel transaction flows, covering all payment types including wire transfers, Automated Clearing House (ACH) transactions, card transactions (including debit and prepaid card transactions), and all other payment types originated, processed, or facilitated through the Bank's BaaS partnerships. Real-time screening shall be performed prior to transaction settlement or completion, as applicable to each transaction type.
(b) Batch Processing. Batch processing capability for retrospective screening and end-of-day screening operations, enabling the Bank to perform comprehensive screening sweeps against updated sanctions lists and to conduct periodic look-back reviews as may be required by the Bank's OFAC compliance policies or by regulatory directive.
(c) List Management. Comprehensive list management capabilities covering all applicable OFAC sanctions lists, including but not limited to the Specially Designated Nationals and blocked Persons List (the "SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List (the "SSI List"), the Foreign Sanctions Evaders List, the Non-SDN Menu-Based Sanctions List, the Non-SDN Palestinian Legislative Council List, and such other OFAC-published lists as may be designated by the Bank from time to time.
(d) Hit Disposition Workflow Engine. A hit disposition workflow engine that routes all potential sanctions matches to the Bank's OFAC compliance team with complete transaction data, detailed match information (including the specific list entry matched, the matching algorithm score, and the data elements that triggered the match), scoring rationale, and configurable disposition options (including true match, false positive, escalation, and hold/block actions).
(e) BaaS Channel Integration. Integration with all fourteen (14) active BaaS partner transaction feeds, including the transaction feeds of NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., and the eleven (11) additional active BaaS partner relationships maintained by the Bank as of the Amendment Effective Date. Integration shall be designed to accommodate additional BaaS partner onboarding without material system reconfiguration.
The OFAC Module Enhancement must be capable of screening one hundred percent (100%) of all transactions processed through all BaaS Channels. The Parties acknowledge that the OCC identified, as a specific deficiency in the Consent Order, that approximately twelve percent (12%) of NovaPay Technologies Inc. transactions were not subjected to OFAC screening during calendar year 2023, representing approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions during that period. The OFAC Module Enhancement is intended to eliminate this screening gap and to ensure comprehensive, real-time or batch-mode screening of all BaaS Channel transactions, across all partners and all payment types, without exception.
Section 2.3 — Statement of Work
The detailed technical specifications, system architecture requirements, deliverables, milestone schedules, acceptance criteria, resource plans, and testing protocols for the TMS v.10.0 upgrade and the OFAC Module Enhancement are set forth in the Statement of Work attached hereto as Exhibit A (the "Statement of Work" or "SOW"), which is incorporated herein by reference and made a part of this Amendment. In the event of any conflict between the body of this Amendment and the Statement of Work, the body of this Amendment shall control unless the Statement of Work expressly states that a specific provision is intended to supplement or modify a provision of this Amendment, in which case the Statement of Work provision shall control with respect to that specific matter.
Section 2.4 — Regulatory Context
The Parties acknowledge and agree that the upgrade contemplated by this Amendment is being undertaken in direct connection with the Bank's compliance with the Consent Order and the Bank's Comprehensive Remediation Action Plan, which the Bank is required to submit to the OCC by May 15, 2025. The Parties further acknowledge that the timely and successful completion of the TMS v.10.0 upgrade and the OFAC Module Enhancement is a critical component of the Bank's overall remediation program and that failure to meet the implementation deadlines set forth herein could result in additional regulatory enforcement action against the Bank, including potential civil money penalties, further supervisory restrictions, or other adverse consequences.
Vendor acknowledges the critical regulatory nature of the implementation timeline established by this Amendment and agrees to use commercially reasonable best efforts to meet all deadlines, milestones, and deliverable dates specified herein. Vendor further acknowledges that it has been informed of the existence and general substance of the Consent Order and the Bank's remediation obligations, and that Vendor has taken such information into account in agreeing to the scope, timeline, and pricing set forth in this Amendment.
ARTICLE 3 — FEES AND PAYMENT TERMS
Section 3.1 — Implementation Fee
The Bank shall pay Vendor a one-time Implementation Fee of Two Million Eight Hundred Thousand Dollars ($2,800,000) for the TMS v.10.0 upgrade and OFAC Module Enhancement, inclusive of all software development, configuration, integration, data migration, testing support, documentation, and training services described in this Amendment and the Statement of Work (Exhibit A). The Implementation Fee shall be payable in four (4) equal milestone-based installments as set forth below:
(a) First Installment — Twenty-Five Percent (25%) ($700,000): Payable upon execution of this Amendment by both Parties.
(b) Second Installment — Twenty-Five Percent (25%) ($700,000): Payable upon completion of the system design and configuration milestone, as described in Section 4.2 of this Amendment (targeted for on or about April 15, 2025), upon certification by Vendor's project manager that the system design, configuration specifications, and integration architecture for TMS v.10.0 and the OFAC Module Enhancement have been completed and presented to the Bank's project team.
(c) Third Installment — Twenty-Five Percent (25%) ($700,000): Payable upon commencement of User Acceptance Testing in the Bank's test environment, as described in Section 4.2 of this Amendment (targeted for on or about June 15, 2025).
(d) Fourth Installment — Twenty-Five Percent (25%) ($700,000): Payable upon successful completion of User Acceptance Testing and deployment to the Bank's production environment (Go-Live) on or before August 1, 2025, as confirmed by the Bank's written acceptance of the UAT results in accordance with Section 5.3 of this Amendment.
For the avoidance of doubt, the fourth installment of the Implementation Fee shall not be invoiced or payable unless and until the Bank has provided its written acceptance of the UAT results and Go-Live has been achieved in accordance with the terms of this Amendment.
Section 3.2 — Incremental Licensing Fee
Commencing on the Go-Live Date, the Bank shall pay Vendor an Incremental Licensing Fee of One Million Nine Hundred Thousand Dollars ($1,900,000) per year, in addition to the existing Base Licensing Fee of Four Million One Hundred Thousand Dollars ($4,100,000) per year. The Amended ACV following the Go-Live Date shall therefore be Six Million Dollars ($6,000,000) per year, calculated as the sum of the Base Licensing Fee ($4,100,000) and the Incremental Licensing Fee ($1,900,000).
The Incremental Licensing Fee shall be payable in equal quarterly installments of Four Hundred Seventy-Five Thousand Dollars ($475,000) each, with quarterly installments due on the first business day of each calendar quarter following the Go-Live Date. If the Go-Live Date occurs on a date other than the first day of a calendar quarter, the first quarterly installment of the Incremental Licensing Fee shall be pro-rated on a daily basis to cover the period from the Go-Live Date through the last day of the calendar quarter in which the Go-Live Date occurs.
Section 3.3 — Existing Base Licensing Fee
The existing Base Licensing Fee of Four Million One Hundred Thousand Dollars ($4,100,000) per year shall continue unchanged under the terms and conditions of the MSA and shall remain payable in accordance with the payment schedule and terms set forth in the MSA through the existing MSA term ending December 31, 2026. Nothing in this Amendment shall be construed to modify, reduce, or otherwise affect the Bank's obligation to pay the Base Licensing Fee under the MSA.
The Incremental Licensing Fee term shall be coterminous with the existing MSA term, such that both the Base Licensing Fee and the Incremental Licensing Fee shall expire on December 31, 2026, unless the MSA and this Amendment are renewed in accordance with Section 8.2 of this Amendment.
Section 3.4 — Invoicing and Payment
All invoices for fees payable under this Amendment shall be submitted by Vendor on a monthly basis, and payment terms shall remain net thirty (30) days from the date of the Bank's receipt of a properly submitted invoice, consistent with the invoicing and payment provisions of the MSA. Implementation Fee milestone payments shall be invoiced by Vendor upon achievement of the applicable milestone and certification by Vendor's designated project manager. All invoices shall contain sufficient detail to enable the Bank to verify the amounts invoiced and the milestone or services to which the invoice relates.
Late payments not disputed in good faith shall bear interest at the rate specified in the MSA, or, if no rate is specified, at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law.
Section 3.5 — Taxes
All fees set forth in this Amendment are exclusive of applicable sales, use, value-added, and other similar taxes, duties, or governmental charges, which shall be borne by the Bank, consistent with the tax provisions of the MSA. Vendor shall separately identify all applicable taxes on each invoice. The Bank shall be responsible for any applicable withholding taxes only to the extent required by law, and the Bank shall provide Vendor with documentation of any such withholding as reasonably requested.
ARTICLE 4 — IMPLEMENTATION TIMELINE AND MILESTONES
Section 4.1 — Project Plan
Within ten (10) business days following execution of this Amendment, Vendor shall deliver to the Bank a detailed project plan (the "Project Plan") specifying all tasks, work streams, resource assignments, dependencies, risk factors, and milestone dates necessary to achieve the implementation timeline set forth in this Article 4. The Project Plan shall be consistent with the milestone dates specified in Section 4.2 and shall be subject to review and comment by the Bank's project team. Vendor shall update the Project Plan on at least a bi-weekly basis during the implementation period and shall promptly distribute updated versions to the Bank's project contacts.
The Bank's primary project contacts for the implementation shall be:
• Linda Petrosian, Chief Information Officer / Chief Technology Officer, responsible for overall technology oversight and executive sponsorship of the implementation;
• Thomas Ikeda, BSA Officer / AML Program Director, responsible for BSA/AML program requirements, detection scenario validation, model tuning oversight, and regulatory liaison;
• Warren Ashby, Head of Fintech Partnerships / BaaS Division, responsible for BaaS partner coordination, BaaS Channel integration requirements, and partner communication.
Vendor's primary project contact shall be Priya Subramanian, Vice President of Client Solutions, who shall serve as the overall engagement lead and primary point of contact for the Bank with respect to all matters arising under this Amendment.
Section 4.2 — Key Milestones
The following table sets forth the key milestones for the TMS v.10.0 upgrade and OFAC Module Enhancement implementation. Target dates designated as "hard deadlines" are firm dates tied to the Bank's obligations under the Consent Order and the Comprehensive Remediation Action Plan and are subject to the liquidated damages and termination provisions of Article 6.
Section 4.3 — Critical Path Deadlines
The August 1, 2025 Go-Live Date and the November 1, 2025 OFAC Full Operationalization Date are firm, non-negotiable deadlines that are directly tied to the Bank's obligations under the Consent Order and the Bank's Comprehensive Remediation Action Plan to be submitted to the OCC by May 15, 2025. Vendor acknowledges the regulatory criticality of these deadlines and expressly agrees that time is of the essence with respect to the Go-Live Date and the OFAC Full Operationalization Date. Vendor further acknowledges that failure to meet these deadlines could expose the Bank to significant adverse regulatory consequences, including but not limited to additional enforcement actions by the OCC, civil money penalties, restrictions on the Bank's activities (including restrictions on BaaS partnerships), reputational harm, and increased costs associated with alternative remediation measures.
Section 4.4 — Status Reporting
During the implementation period (from the Amendment Effective Date through the later of the Go-Live Date or the OFAC Full Operationalization Date), Vendor shall provide the Bank with written status reports on a weekly basis, delivered no later than the close of business each Friday. Each status report shall include, at a minimum: (i) a summary of progress against each milestone in the Project Plan; (ii) a description of all tasks completed during the reporting period; (iii) identification of any issues, risks, or impediments to progress, together with proposed mitigation strategies; (iv) resource allocation and utilization data; (v) any anticipated delays or schedule variances; and (vi) an updated summary of open action items.
In addition to the weekly status reports, Vendor shall participate in bi-weekly project steering committee meetings with the Bank's project team, which meetings may be held in person at the Bank's offices in New York or by videoconference at the Bank's election. At the Bank's request, representatives of Calderwood & Harkness LLP (the Bank's outside counsel), Thornfield Consulting Group LLC (the Independent Consultant), and/or Caldera & Pope LLP (the Bank's external auditor/independent BSA/AML testing firm) may attend and participate in such steering committee meetings. Vendor shall not unreasonably object to the participation of such third parties in project discussions to the extent such participation is related to the Bank's regulatory remediation obligations.
ARTICLE 5 — PERFORMANCE BENCHMARKS AND ACCEPTANCE CRITERIA
Section 5.1 — TMS v.10.0 Performance Benchmarks
TMS v.10.0 shall meet or exceed the following performance benchmarks, as further specified in the Statement of Work (Exhibit A):
(a) Transaction Processing Capacity. TMS v.10.0 must be capable of processing the Bank's full transaction volume, including all retail banking, commercial banking, wealth management, and BaaS Channel transaction volumes, without material degradation in system performance. For reference, total BaaS Channel transaction volume was approximately Seventy-Four Billion Three Hundred Million Dollars ($74,300,000,000) in calendar year 2024, and overall Bank transaction volumes (across all channels) exceeded One Hundred Forty Billion Dollars ($140,000,000,000) during the same period. TMS v.10.0 must be designed to accommodate transaction volume growth of at least twenty percent (20%) above current levels without requiring additional hardware procurement or material system reconfiguration.
(b) Alert Generation Accuracy. False-positive and false-negative rates shall be tested against agreed-upon thresholds during UAT. Specific alert generation accuracy thresholds, detection scenario performance metrics, and benchmarking methodologies shall be defined in the Statement of Work (Exhibit A). At a minimum, TMS v.10.0 shall demonstrate measurable improvement over TMS v.8.3 in both false-positive reduction and true-positive detection accuracy across all core detection scenarios.
(c) Model Tuning Configurability. TMS v.10.0 must support configurable tuning parameters with full audit trail functionality, enabling the Bank's BSA/AML compliance team and model risk management function to perform periodic model validation reviews and to implement tuning parameter updates in a controlled, documented, and auditable manner, as required by the Consent Order and applicable OCC guidance on model risk management (OCC Bulletin 2011-12, as updated).
(d) System Availability. TMS v.10.0 shall achieve a system availability rate of not less than ninety-nine and one-half percent (99.5%) uptime, measured on a monthly basis, excluding scheduled maintenance windows. Scheduled maintenance windows shall be defined by mutual agreement of the Parties and shall not exceed eight (8) hours per calendar month, scheduled during off-peak hours. Unplanned downtime exceeding the 99.5% availability threshold shall be subject to the service level credit provisions set forth in the Statement of Work (Exhibit A).
Section 5.2 — OFAC Module Performance Benchmarks
The OFAC Module Enhancement shall meet or exceed the following performance benchmarks, as further specified in the Statement of Work (Exhibit A):
(a) Screening Coverage. One hundred percent (100%) of all transactions across all channels — including retail banking, commercial banking, wealth management, and all fourteen (14) BaaS partner transaction flows — must be screened against applicable OFAC sanctions lists. Screening shall occur in real-time for transaction types requiring pre-settlement screening and in batch mode for end-of-day or retrospective screening, as applicable and as specified in the Statement of Work.
(b) List Update Frequency. The OFAC Module Enhancement shall include automated list update functionality that ensures all applicable OFAC sanctions lists (including the SDN List, Consolidated Sanctions List, SSI List, and other designated lists) are updated within twenty-four (24) hours of OFAC's publication of any change, addition, or modification to such lists. The system shall maintain a log of all list updates, including the date and time of publication, the date and time of system ingestion, and the specific entries affected.
(c) Hit Disposition Workflow. All potential sanctions hits shall be routed to the Bank's OFAC compliance team through the hit disposition workflow engine, accompanied by complete transaction data, detailed match information (including the specific list entry matched, the data elements triggering the match, the matching algorithm score, and the confidence level), and scoring rationale sufficient to enable the Bank's OFAC analysts to make informed and timely disposition decisions.
(d) False-Positive Management. The OFAC Module Enhancement shall include tunable matching algorithms that enable the Bank to manage and reduce false-positive rates while maintaining screening integrity and minimizing the risk of false negatives. The Parties acknowledge that the Bank's calendar year 2024 false-positive rate was approximately 99.9%, reflecting approximately 14,320 OFAC screening hits of which only twelve (12) were confirmed as true matches. Improvement in true-match identification accuracy, reduction of false-positive volume, and overall screening efficiency are key objectives of the OFAC Module Enhancement.
Section 5.3 — Acceptance Testing Procedures
(a) UAT shall be conducted over a minimum period of six (6) weeks, commencing no later than June 15, 2025, and concluding no later than July 31, 2025 (one day prior to the Go-Live Date). The Bank shall designate a UAT team, which shall include representatives from the Bank's BSA/AML department, IT department, BaaS Division, and model risk management function.
(b) The Bank shall develop and provide Vendor with detailed UAT acceptance criteria within fifteen (15) business days following completion of the system design milestone (i.e., on or about May 7, 2025). The acceptance criteria shall define the test cases, scenarios, expected outcomes, and pass/fail thresholds applicable to each functional area of TMS v.10.0 and the OFAC Module Enhancement.
(c) Acceptance of TMS v.10.0 and the OFAC Module Enhancement shall require successful completion of all critical test cases, defined as those test cases designated as "Priority 1" or "Critical" in the UAT acceptance criteria. Acceptance shall require zero (0) unresolved critical defects (defined as defects that prevent core functionality from operating as designed, result in data integrity issues, or pose a risk of regulatory non-compliance) and no more than ten (10) unresolved non-critical defects (defined as defects that do not materially impair system functionality but require remediation within a defined timeframe post-Go-Live).
(d) If UAT reveals one or more critical defects, Vendor shall commence remediation efforts immediately upon notification by the Bank and shall remediate all critical defects within ten (10) business days of notification. Upon completion of remediation, the affected test cases shall be re-executed and must pass the applicable acceptance criteria. If critical defects are not resolved within the ten (10) business day remediation period, the provisions of Article 6 (Remedies for Implementation Delays) shall apply, including the accrual of liquidated damages if the Go-Live Date is not achieved by August 1, 2025.
(e) The Bank's written acceptance of the UAT results (the "UAT Acceptance Notice") shall constitute confirmation that TMS v.10.0 has met the acceptance criteria and is approved for deployment to the Bank's production environment. The Bank shall not unreasonably withhold, condition, or delay the issuance of the UAT Acceptance Notice if all critical test cases have been passed and the number of unresolved non-critical defects does not exceed the threshold specified in subparagraph (c) above.
Section 5.4 — Independent Model Validation Cooperation
Vendor shall provide all documentation, technical specifications, model methodology descriptions (including algorithmic logic, scoring methodologies, and detection scenario architectures), parameter configurations, calibration data, test results, and performance metrics necessary for the Bank to conduct, or cause to be conducted through a qualified third party, an independent model validation of TMS v.10.0, as required by the Consent Order and OCC guidance on model risk management. The Bank's target date for completion of the independent model validation is October 1, 2025.
Vendor shall make qualified technical personnel — including but not limited to the lead architects, data scientists, and product managers responsible for the design and development of TMS v.10.0 — available for interviews, technical inquiries, and working sessions with the Bank's internal model validation team and/or the Independent Consultant (Thornfield Consulting Group LLC, led by Dr. Vivian Castellano). Vendor shall respond to validation-related information requests within five (5) business days of receipt, or such shorter period as may be reasonably necessary to maintain the validation timeline.
ARTICLE 6 — REMEDIES FOR IMPLEMENTATION DELAYS
Section 6.1 — Delay Notification
Vendor shall promptly notify the Bank in writing (and in no event later than two (2) business days after becoming aware) of any circumstance, event, or condition that may reasonably be expected to delay the achievement of any milestone specified in Article 4, including but not limited to the Go-Live Date or the OFAC Full Operationalization Date. Such notification shall include a detailed explanation of the cause of the delay, the expected duration of the delay, the milestones affected, and a proposed mitigation plan setting forth the specific actions Vendor intends to take to minimize or eliminate the delay and restore the project to the agreed timeline.
Section 6.2 — Liquidated Damages for Go-Live Delay
If Vendor fails to achieve the Go-Live Date of August 1, 2025 (other than as a result of Bank-caused delays as described in Section 6.6 or a Force Majeure event as defined in the MSA), Vendor shall pay the Bank liquidated damages in the amount of Fifty Thousand Dollars ($50,000) per calendar day of delay, commencing on August 2, 2025, and continuing for each calendar day thereafter until the earlier of (i) the date on which Go-Live is achieved or (ii) the date on which the aggregate liquidated damages under this Section 6.2 reach the maximum amount of One Million Five Hundred Thousand Dollars ($1,500,000) (representing thirty (30) calendar days of delay).
The Parties acknowledge and agree that the liquidated damages set forth in this Section 6.2 represent a reasonable estimate of the Bank's damages resulting from delay in achieving the Go-Live Date, considering the regulatory consequences of non-compliance with Consent Order deadlines (including the risk of additional enforcement action by the OCC, potential civil money penalties, supervisory restrictions, and loss of BaaS partner relationships), reputational harm to the Bank and its parent holding company (Belmont Ridge Financial Group, Inc.), increased costs of alternative remediation measures, and other foreseeable consequences of delay. The Parties further acknowledge that actual damages resulting from such delay would be difficult or impossible to determine with precision. The liquidated damages set forth herein are intended as a genuine pre-estimate of damages and not as a penalty.
Section 6.3 — Liquidated Damages for OFAC Full Operationalization Delay
If Vendor fails to achieve the OFAC Full Operationalization Date of November 1, 2025 (other than as a result of Bank-caused delays as described in Section 6.6 or a Force Majeure event as defined in the MSA), Vendor shall pay the Bank liquidated damages in the amount of Fifty Thousand Dollars ($50,000) per calendar day of delay, commencing on November 2, 2025, and continuing for each calendar day thereafter until the earlier of (i) the date on which OFAC Full Operationalization is achieved or (ii) the date on which the aggregate liquidated damages under this Section 6.3 reach the maximum amount of One Million Five Hundred Thousand Dollars ($1,500,000) (representing thirty (30) calendar days of delay).
The same acknowledgments regarding the reasonableness of the liquidated damages set forth in Section 6.2 shall apply with equal force to the liquidated damages set forth in this Section 6.3.
Section 6.4 — Termination for Material Delay
If any milestone specified in Article 4 is delayed by more than forty-five (45) calendar days beyond the applicable target date specified in Section 4.2 (other than as a result of Bank-caused delays as described in Section 6.6 or a Force Majeure event as defined in the MSA), the Bank shall have the right, exercisable at its sole discretion, to terminate this Amendment and the upgrade engagement contemplated hereby upon fifteen (15) days' prior written notice to Vendor. Upon the effective date of such termination, the following provisions shall apply:
(a) Vendor shall refund to the Bank all Implementation Fee installments paid by the Bank to date, less the fair value of work actually completed by Vendor and accepted by the Bank as of the date of the termination notice. The fair value of completed work shall be determined by mutual agreement of the Parties or, in the absence of agreement, by an independent third-party appraiser mutually selected by the Parties (or, failing agreement on an appraiser, by an appraiser appointed by the American Arbitration Association upon application by either Party).
(b) The Bank shall have no obligation to pay any Implementation Fee installment(s) not yet invoiced as of the date of the termination notice.
(c) The existing MSA (Contract No. VA-BRB-2023-0044), including TMS v.8.3 and the existing Base Licensing Fee of Four Million One Hundred Thousand Dollars ($4,100,000) per year, shall remain in full force and effect through its existing term ending December 31, 2026, and shall not be affected by the termination of this Amendment.
(d) The Bank shall retain all rights to pursue alternative technology solutions for its BSA/AML transaction monitoring and OFAC sanctions screening requirements, including but not limited to engagement of Ridgeline Data Systems LLC or other vendors, without restriction. Vendor shall provide reasonable cooperation in facilitating any such transition, including providing data exports and technical assistance necessary to ensure continuity of the Bank's compliance operations.
Section 6.5 — Escalation Procedure
Prior to invoking the liquidated damages provisions of Sections 6.2 or 6.3 or the termination rights of Section 6.4, the Bank shall first escalate the delay to senior management of both Parties for a good-faith resolution period of ten (10) business days. The designated senior management representatives for purposes of this escalation shall be:
• For the Bank: Linda Petrosian, Chief Information Officer / Chief Technology Officer
• For Vendor: Priya Subramanian, Vice President of Client Solutions, or her designated executive escalation contact (currently Rajesh Chandar, Senior Vice President and General Manager, Financial Services Division)
During the escalation period, the designated representatives shall meet (in person or by videoconference) at least twice to discuss the delay, evaluate mitigation options, and attempt in good faith to agree upon a revised implementation plan that addresses the Bank's regulatory timeline requirements. If the Parties are unable to resolve the delay through the escalation process within the ten (10) business day period, the Bank may thereafter exercise its rights under Sections 6.2, 6.3, and/or 6.4 without further obligation to engage in additional escalation discussions.
Section 6.6 — Bank-Caused Delays
The milestone dates and deadlines set forth in Article 4 assume timely cooperation and performance by the Bank with respect to all Bank responsibilities identified in this Amendment and the Statement of Work (Exhibit A), including without limitation the provision of data, system access (including access to the Bank's test and production environments), testing resources and personnel, BaaS partner coordination, approvals, and feedback. If a delay in the achievement of any milestone is caused by the Bank's failure to timely perform its obligations (a "Bank-Caused Delay"), the affected milestone date(s) shall be extended on a day-for-day basis by the duration of the Bank-Caused Delay, and liquidated damages shall not accrue during any period attributable to a Bank-Caused Delay. Vendor shall promptly notify the Bank in writing of any circumstance that Vendor believes constitutes or is likely to result in a Bank-Caused Delay, and the Parties shall cooperate in good faith to resolve such issues.
ARTICLE 7 — VENDOR OBLIGATIONS AND COOPERATION
Section 7.1 — Dedicated Resources
Vendor shall assign a dedicated project manager and a full implementation team for the duration of the upgrade engagement, from the Amendment Effective Date through the later of the Go-Live Date or the OFAC Full Operationalization Date. The named key personnel assigned to this engagement, together with their respective roles and qualifications, shall be identified in the Statement of Work (Exhibit A).
Key personnel may not be reassigned, removed, or replaced by Vendor without the Bank's prior written consent, which consent shall not be unreasonably withheld. If the Bank consents to the replacement of a key personnel member, Vendor shall ensure that the replacement individual possesses qualifications and experience at least equivalent to those of the individual being replaced, and Vendor shall provide the Bank with a reasonable transition period (not less than two (2) weeks of overlap) during which both the departing and incoming personnel are available to facilitate a smooth transition.
Section 7.2 — Regulatory Cooperation
Vendor acknowledges that the Bank is a national bank subject to the supervision and examination authority of the OCC and that the Bank is also subject to the requirements of the Bank Secrecy Act, the USA PATRIOT Act, and other applicable federal and state laws and regulations administered by the Financial Crimes Enforcement Network ("FinCEN"), OFAC, and other regulatory agencies. The OCC, FinCEN, and other regulators may, from time to time, require access to information about the Bank's technology systems, vendor relationships, and compliance infrastructure, including information relating to TMS v.10.0 and the OFAC Module Enhancement.
Vendor shall cooperate with reasonable requests from the Bank's regulators for information, documentation, and examination access relating to the services provided under this Amendment and the MSA, consistent with OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), as updated, and any successor or supplementary guidance. Such cooperation shall include, without limitation, making Vendor personnel available for interviews, responding to written information requests, providing access to relevant documentation and system records, and permitting on-site or virtual examinations of Vendor's facilities and operations to the extent related to the services provided to the Bank.
Vendor shall further cooperate with the Bank's Independent Consultant (Thornfield Consulting Group LLC, led by Dr. Vivian Castellano, Managing Director) and the Bank's external auditor and independent BSA/AML testing firm (Caldera & Pope LLP, engagement partner Franklin Dorsey) as reasonably requested by the Bank. Such cooperation shall include responding to information requests, participating in interviews and technical discussions, and providing access to system documentation, configuration data, and test results relevant to the Independent Consultant's assessment of the Bank's BSA/AML and OFAC compliance program.
Section 7.3 — Documentation and Training
Vendor shall provide comprehensive technical documentation, user manuals, system administrator guides, configuration guides, and API integration documentation for TMS v.10.0 and the OFAC Module Enhancement. All documentation shall be delivered in electronic format and shall be kept current throughout the implementation period and the warranty period described in the Statement of Work.
Vendor shall provide training to Bank personnel sufficient to enable the Bank to independently operate, configure, maintain, and perform day-to-day administration of the upgraded system. Training shall be provided to the following Bank personnel groups:
(a) BSA/AML Department Staff: Currently consisting of sixty-two (62) full-time equivalent employees, plus an additional fifteen (15) new hires planned in connection with the Consent Order remediation. Training for this group shall cover system functionality, alert investigation workflows, case management, OFAC hit disposition, reporting, and model tuning parameter management.
(b) Information Technology Staff: Training shall cover system administration, technical configuration, data management, integration monitoring, system health monitoring, and incident response procedures.
(c) BaaS Division Staff: Training shall cover BaaS Channel integration management, partner feed monitoring, OFAC screening coverage verification, and exception handling for BaaS-related transactions.
The scope, schedule, delivery methodology (classroom, virtual, or self-paced), and duration of training shall be detailed in the Statement of Work (Exhibit A), with all training to be completed on or before the Go-Live Date for TMS v.10.0 core functionality and on or before the OFAC Full Operationalization Date for OFAC Module-specific functionality.
Section 7.4 — Data Migration
Vendor shall ensure seamless migration of all historical data from TMS v.8.3 to TMS v.10.0, including but not limited to historical transaction data, alert histories, investigation records, case files, Suspicious Activity Report (SAR) filing records, configuration settings, tuning parameters, detection scenario definitions, user accounts and permissions, and audit trail records. Data migration shall be performed in a manner that preserves data integrity, referential integrity, and chronological accuracy.
Vendor shall develop and execute a data migration plan, subject to the Bank's review and approval, that includes data mapping specifications, transformation rules, validation procedures, and rollback contingency plans. Upon completion of data migration, Vendor shall provide the Bank with a data integrity validation report confirming that all migrated data has been verified for completeness and accuracy.
ARTICLE 8 — TERM AND RENEWAL
Section 8.1 — Amendment Term
This Amendment shall be effective as of the Amendment Effective Date and shall remain in effect for the duration of the MSA term (through December 31, 2026), subject to earlier termination as provided in this Amendment or the MSA and subject to renewal as provided in Section 8.2 below.
Section 8.2 — Renewal
The Incremental Licensing Fee for TMS v.10.0 and the OFAC Module Enhancement shall renew on the same terms and conditions as the Base Licensing Fee under the MSA, unless either Party provides written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term. Upon renewal, pricing for the Incremental Licensing Fee shall be subject to good-faith negotiation between the Parties, provided, however, that annual increases to the Incremental Licensing Fee shall not exceed five percent (5%) per year above the then-current Incremental Licensing Fee, absent the mutual written agreement of both Parties. The same annual increase cap shall apply to each successive renewal term, if any.
Section 8.3 — Survival
The following provisions of this Amendment shall survive the expiration or termination of this Amendment for any reason: Article 6 (Remedies for Implementation Delays, to the extent any claims have accrued prior to expiration or termination), Article 9 (Confidentiality), Article 10 (Representations and Warranties, to the extent any claims have accrued prior to expiration or termination), Article 11 (Indemnification and Limitation of Liability), and Article 13 (Governing Law and Dispute Resolution).
ARTICLE 9 — CONFIDENTIALITY
Section 9.1 — Existing Confidentiality Provisions
The confidentiality provisions set forth in the MSA shall apply with full force and effect to all information exchanged by the Parties pursuant to this Amendment, including without limitation all technical specifications, system documentation, pricing information, implementation plans, testing data, and other materials disclosed by either Party in connection with the TMS v.10.0 upgrade and OFAC Module Enhancement.
Section 9.2 — Regulatory Disclosures
Notwithstanding the confidentiality provisions of the MSA or this Amendment, the Bank may disclose information regarding the upgrade, including this Amendment, the Statement of Work, pricing information, implementation status, and related documentation, to the following parties without Vendor's prior consent and without any obligation to provide prior notice to Vendor:
(a) The Office of the Comptroller of the Currency (OCC);
(b) The Financial Crimes Enforcement Network (FinCEN);
(c) Any other federal or state regulatory authority with supervisory or examination authority over the Bank;
(d) The Bank's Independent Consultant (Thornfield Consulting Group LLC);
(e) The Bank's outside counsel (Calderwood & Harkness LLP);
(f) The Bank's external auditor and independent BSA/AML testing firm (Caldera & Pope LLP);
(g) The Bank's parent holding company (Belmont Ridge Financial Group, Inc.) and its board of directors and audit committee; and
(h) Any other person or entity to whom disclosure is required by applicable law, regulation, court order, or regulatory directive.
Section 9.3 — Consent Order
Vendor acknowledges that the Bank has disclosed, and may continue to disclose, the existence and substance of the Consent Order and the Bank's remediation program in its public filings with the U.S. Securities and Exchange Commission ("SEC"), including Current Reports on Form 8-K, Annual Reports on Form 10-K, and Quarterly Reports on Form 10-Q filed by the Bank's parent holding company, Belmont Ridge Financial Group, Inc. (NYSE ticker symbol: BRFG). Vendor acknowledges that such disclosures may include references to the Bank's technology remediation efforts, including the upgrade contemplated by this Amendment, and Vendor shall not assert that any such disclosure constitutes a breach of the confidentiality provisions of the MSA or this Amendment.
ARTICLE 10 — REPRESENTATIONS AND WARRANTIES
Section 10.1 — Vendor Representations and Warranties
Vendor represents and warrants to the Bank as follows:
(a) Performance Conformity. TMS v.10.0 and the OFAC Module Enhancement, when properly installed, configured, and operated in accordance with the documentation provided by Vendor, will materially perform in accordance with the functional specifications, performance benchmarks, and acceptance criteria set forth in this Amendment and the Statement of Work (Exhibit A).
(b) Qualified Personnel. The TMS v.10.0 upgrade and OFAC Module Enhancement will be performed by qualified personnel with demonstrated experience in the design, implementation, and support of BSA/AML transaction monitoring systems and OFAC sanctions screening solutions for financial institutions subject to OCC supervision and federal banking regulations.
(c) Feasibility of Timeline. Vendor has reviewed the performance requirements, regulatory context, implementation timeline, and deliverable expectations described in this Amendment and believes in good faith, based on its current knowledge and experience, that the TMS v.10.0 upgrade and OFAC Module Enhancement can be completed within the timelines and in accordance with the milestones specified in Article 4.
(d) Screening Completeness. The OFAC Module Enhancement is designed and will be configured to enable one hundred percent (100%) screening of all transaction types across all channels, including all BaaS Channel transaction flows across all fourteen (14) active BaaS partner relationships.
(e) No Impediments. As of the Amendment Effective Date, Vendor is not aware of any legal, contractual, regulatory, or technical impediment that would prevent or materially impair Vendor's timely performance of its obligations under this Amendment.
(f) Authority. Vendor has the corporate power and authority to enter into this Amendment and to perform its obligations hereunder. The execution, delivery, and performance of this Amendment have been duly authorized by all necessary corporate action on the part of Vendor.
(g) No Litigation. There is no pending or, to Vendor's knowledge, threatened litigation, arbitration, or regulatory proceeding that could reasonably be expected to materially affect Vendor's ability to perform its obligations under this Amendment.
Section 10.2 — Bank Representations and Warranties
The Bank represents and warrants to Vendor as follows:
(a) Authority. The Bank has the corporate power and authority to enter into this Amendment and to perform its obligations hereunder. The execution, delivery, and performance of this Amendment have been duly authorized by all necessary corporate action on the part of the Bank, including any required approvals by the Bank's board of directors or designated committee thereof.
(b) Cooperation. The Bank will provide timely cooperation, data, system access, and resources necessary for Vendor to perform its obligations under this Amendment, in accordance with the responsibilities assigned to the Bank in this Amendment and the Statement of Work (Exhibit A).
(c) Qualified Personnel. The Bank will designate qualified project personnel with appropriate expertise and decision-making authority to support the implementation of the TMS v.10.0 upgrade and OFAC Module Enhancement.
Section 10.3 — Disclaimer
EXCEPT AS EXPRESSLY SET FORTH IN THIS AMENDMENT AND THE MSA, VENDOR DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, VENDOR DOES NOT WARRANT THAT TMS v.10.0 OR THE OFAC MODULE ENHANCEMENT WILL OPERATE WITHOUT INTERRUPTION OR ERROR, OR THAT ALL DEFECTS WILL BE CORRECTED, EXCEPT TO THE EXTENT EXPRESSLY PROVIDED IN THE ACCEPTANCE CRITERIA AND SERVICE LEVEL COMMITMENTS SET FORTH IN THIS AMENDMENT AND THE STATEMENT OF WORK.
ARTICLE 11 — INDEMNIFICATION AND LIMITATION OF LIABILITY
Section 11.1 — Vendor Indemnification
Vendor shall indemnify, defend, and hold harmless the Bank and its parent company (Belmont Ridge Financial Group, Inc.), and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Bank Indemnitees"), from and against all losses, damages, liabilities, claims, demands, actions, judgments, settlements, and expenses (including reasonable attorneys' fees and costs of litigation or arbitration) (collectively, "Losses") arising from or relating to:
(a) Any material breach by Vendor of its representations, warranties, covenants, or obligations under this Amendment;
(b) Any negligent act or omission or willful misconduct by Vendor or its employees, agents, or subcontractors in the performance of Vendor's obligations under this Amendment; or
(c) Any claim by a third party that the Bank's use of TMS v.10.0 or the OFAC Module Enhancement, as contemplated by this Amendment, infringes, misappropriates, or otherwise violates any patent, copyright, trade secret, trademark, or other intellectual property right of such third party.
Vendor's indemnification obligations under this Section 11.1 shall be subject to the following conditions: (i) the Bank shall provide Vendor with prompt written notice of any claim for which indemnification is sought; (ii) the Bank shall provide reasonable cooperation (at Vendor's expense) in the defense of such claim; and (iii) Vendor shall have sole control of the defense and settlement of such claim, provided that Vendor shall not agree to any settlement that imposes any obligation or liability on the Bank without the Bank's prior written consent, which shall not be unreasonably withheld.
Section 11.2 — Limitation of Liability