STATEMENT OF WORK
FOR OFAC SCREENING MODULE ENHANCEMENT
Exhibit B to Amendment No. 1 to Master Services Agreement Contract No. VA-BRB-2023-0044
SOW Reference Number: VA-BRB-2025-SOW-002
by and between
BELMONT RIDGE BANK NATIONAL ASSOCIATION a National Banking Association OCC Charter No. 48271
("BRB" or "Client")
and
VERIDIAN ANALYTICS INC. a Delaware corporation 1900 Embarcadero Road, Suite 400 Palo Alto, CA 94303
("Veridian" or "Provider")
Effective Date: ____ (To be inserted upon execution — target March 2025)
Master Agreement Reference: Master Services Agreement dated September 1, 2023 Contract No. VA-BRB-2023-0044 as amended by Amendment No. 1 dated concurrently herewith
Prepared by Calderwood & Harkness LLP, 1285 Avenue of the Americas, 40th Floor, New York, NY 10019, as outside counsel to Belmont Ridge Bank National Association.
KEY CONTACTS
Belmont Ridge Bank National Association:
Veridian Analytics Inc.:
Right-click to update Table of Contents
SECTION 1: BACKGROUND AND PURPOSE
1.1 Regulatory Context
Belmont Ridge Bank National Association ("BRB") is a federally chartered national bank regulated by the Office of the Comptroller of the Currency ("OCC"). BRB operates a diversified banking platform encompassing retail banking, commercial lending, wealth management, and a significant Banking-as-a-Service ("BaaS") business line through which BRB sponsors fintech partner companies operating under BRB's national banking charter.
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 (the "Consent Order") against BRB. The Consent Order identified significant deficiencies in BRB's sanctions screening protocols administered by the Office of Foreign Assets Control ("OFAC"), with particular emphasis on transaction flows processed through BRB's BaaS fintech partnership channels. The Consent Order represents a material supervisory action requiring prompt and comprehensive remediation.
Among the core findings of the Consent Order, the OCC determined that BRB's existing OFAC screening system failed to screen one hundred percent (100%) of transactions processed through its BaaS channels. Specifically, the OCC found that approximately twelve percent (12%) of transactions originated through NovaPay Technologies Inc. ("NovaPay"), one of BRB's largest BaaS partners by volume, were not screened against applicable OFAC sanctions lists. This screening gap encompassed approximately 3,800,000 out of 31,700,000 total NovaPay transactions during calendar year 2023. The OCC determined that this gap resulted from inadequate integration between BRB's existing transaction monitoring and sanctions screening platform and the NovaPay transaction processing infrastructure, compounded by insufficient monitoring and testing of screening coverage by BRB's compliance function.
BRB currently operates fourteen (14) active BaaS fintech partner relationships. In calendar year 2024, BRB's aggregate BaaS transaction volume was approximately $74.3 billion, representing a material and growing portion of BRB's overall business activity. The scale and complexity of BRB's BaaS operations require a robust, fully integrated sanctions screening capability that covers all transaction types across all partner channels without exception.
The Consent Order requires full remediation of BRB's OFAC screening capabilities across all business lines and BaaS channels. The Consent Order mandates that BRB achieve full operationalization of enhanced OFAC screening no later than November 1, 2025. Failure to meet this deadline exposes BRB to additional supervisory action, potential civil money penalties, and reputational harm.
1.2 Current State of OFAC Screening
BRB currently operates Veridian TMS version 8.3 ("TMS v.8.3") for transaction monitoring and sanctions screening purposes. TMS v.8.3 has been BRB's primary transaction monitoring and OFAC screening platform since its initial deployment under the Master Services Agreement (Contract No. VA-BRB-2023-0044) entered into between the parties.
The TMS v.8.3 system was last independently validated in March 2021 by Caldera & Pope LLP, BRB's independent BSA/AML testing firm. The system was last tuned — meaning its screening parameters, fuzzy matching thresholds, and detection scenarios were last adjusted — in October 2022. In the intervening period, BRB's business profile has changed substantially, including a significant expansion of its BaaS platform, the addition of multiple new BaaS partners, and material increases in transaction volume, types, and complexity.
In calendar year 2024, the OFAC screening module within TMS v.8.3 generated 14,320 potential hits. Of these, only twelve (12) were confirmed as true matches requiring blocking or rejection action. This yields a false-positive rate of approximately 99.9%, calculated as (14,320 – 12) ÷ 14,320. This extraordinarily high false-positive rate imposes substantial operational burden on BRB's compliance team, consuming analyst time and resources on the review and disposition of alerts that do not represent actual sanctions exposure, while simultaneously creating risk that true matches may be missed or inadequately addressed amid the volume of false positives.
The OCC's examination identified that the existing OFAC module within TMS v.8.3 lacked adequate integration points for real-time screening of certain BaaS partner transaction flows. In particular, the system did not have API connectivity to intercept and screen all NovaPay transaction types prior to execution. This architectural deficiency led directly to the twelve percent (12%) screening gap identified in the Consent Order. The OCC further noted that BRB had received a Matter Requiring Immediate Attention ("MRIA") in November 2023 that specifically cited OFAC screening gaps related to BaaS channels. BRB's remediation efforts in response to the November 2023 MRIA were determined by the OCC to be inadequate, contributing to the escalation of supervisory action to the Consent Order.
1.3 Purpose of This SOW
This Statement of Work ("SOW") defines the scope, deliverables, milestones, acceptance criteria, and related terms for the enhancement of Veridian's OFAC sanctions screening module as an integrated component of the Veridian TMS version 10.0 ("TMS v.10.0") upgrade. The TMS v.10.0 upgrade is the comprehensive platform modernization being deployed under Amendment No. 1 to the Master Services Agreement, and the OFAC module enhancement described herein is a critical, integrated workstream within that broader upgrade.
The OFAC module enhancement is a core component of BRB's Comprehensive Remediation Action Plan (the "Action Plan"), which BRB is required to submit to the OCC by May 15, 2025, in compliance with the Consent Order. The Action Plan will describe, among other things, BRB's plan to achieve full OFAC screening coverage across all business lines and all BaaS partner channels. The commitments and timelines set forth in this SOW will be reflected in the Action Plan and must therefore be achievable and realistic.
The Enhanced OFAC Module must be fully operational for all BaaS channels no later than November 1, 2025, per the Consent Order timeline. This is a firm, non-negotiable deadline established by the OCC, and both parties acknowledge the critical importance of timely performance under this SOW.
This SOW is attached as Exhibit B to Amendment No. 1 to the MSA (Contract No. VA-BRB-2023-0044) and is subject to all terms and conditions thereof, except as expressly modified or supplemented herein. In the event of any conflict between this SOW and the MSA (as amended), the MSA shall govern, except where this SOW expressly provides more specific requirements applicable to the OFAC Module enhancement, in which case the more specific provisions of this SOW shall control to the extent of the inconsistency.
SECTION 2: DEFINITIONS
Capitalized terms used in this SOW and not otherwise defined herein shall have the meanings ascribed to them in the MSA (Contract No. VA-BRB-2023-0044), as amended by Amendment No. 1. The following terms shall have the meanings set forth below for purposes of this SOW:
"BaaS Channels" means all transaction flows originated, processed, or facilitated through BRB's fourteen (14) active Banking-as-a-Service fintech partner relationships, including but not limited to NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. For the avoidance of doubt, BaaS Channels include all transaction types processed through any BaaS Partner's platform under BRB's national banking charter, regardless of the origination method, processing pathway, or settlement mechanism.
"BaaS Partners" means, collectively, the fourteen (14) active fintech sponsors operating through BRB's national banking charter pursuant to BaaS program agreements with BRB, including the following named partners:
(a) NovaPay Technologies Inc., a Delaware corporation, with principal offices at 450 Mission Street, Suite 1200, San Francisco, CA 94105;
(b) FairLend Digital LLC, a Delaware limited liability company, with principal offices at 100 Summer Street, Suite 800, Boston, MA 02110;
(c) VaultEdge Inc., a Delaware corporation, with principal offices at 2200 Ross Avenue, Suite 3600, Dallas, TX 75201; and
(d) Eleven (11) additional partners as identified in Appendix 1 to this SOW.
"Consent Order" means OCC Consent Order No. OCC-2025-003, effective January 15, 2025, issued by the Office of the Comptroller of the Currency against Belmont Ridge Bank National Association.
"Critical Path Milestones" means those milestones identified in Section 5.2 of this SOW as being directly tied to the deadlines established by the Consent Order.
"Full Operationalization" means the state in which one hundred percent (100%) of applicable transactions across all BaaS Channels and all BRB business lines (retail banking, commercial lending, wealth management, and BaaS) are screened against all applicable OFAC Sanctions Lists in accordance with the requirements of this SOW, and such screening has been validated and confirmed through testing, including User Acceptance Testing and System Integration Testing, with no Critical or High defects remaining unresolved.
"Hit" means any potential match identified by the OFAC screening module between a screened data element (including, without limitation, customer name, alias, address, identification number, vessel name, or country of origin) and an entry on an applicable OFAC Sanctions List.
"OFAC" means the Office of Foreign Assets Control of the U.S. Department of the Treasury.
"OFAC Module" or "Enhanced OFAC Module" means the upgraded sanctions screening component within Veridian TMS v.10.0 to be designed, developed, configured, tested, deployed, and supported by Veridian pursuant to this SOW.
"Sanctions Lists" means, collectively, the SDN List, Consolidated Sanctions List, Sectoral Sanctions Identifications List, Non-SDN Lists (including the Foreign Sanctions Evaders List, Palestinian Legislative Council List, Non-SDN Menu-Based Sanctions List, Capta List, Non-SDN Chinese Military-Industrial Complex Companies List, and all other Non-SDN lists as published by OFAC), and any successor or supplementary lists published by OFAC from time to time. A complete inventory of Sanctions Lists as of the Effective Date is set forth in Appendix 2.
"SDN List" means the Specially Designated Nationals and blocked Persons List maintained and published by OFAC.
"TMS v.10.0" means Veridian TMS version 10.0, the upgraded transaction monitoring system being deployed under the MSA as amended by Amendment No. 1.
"True Match" means a confirmed match between a screened data element and an OFAC Sanctions List entry, as validated through the hit disposition workflow, requiring blocking, rejection, or other interdiction action in accordance with applicable OFAC regulations and BRB's compliance policies and procedures.
"UAT" means User Acceptance Testing, the formal testing process conducted by BRB to validate that the Enhanced OFAC Module meets the acceptance criteria and functional requirements specified in this SOW.
SECTION 3: SCOPE OF WORK
3.1 Overview
Veridian shall design, develop, configure, test, deploy, and support the Enhanced OFAC Module as a fully integrated component of Veridian TMS v.10.0. The Enhanced OFAC Module shall provide comprehensive sanctions screening capabilities that address the specific deficiencies identified in the Consent Order and that satisfy all applicable OFAC regulatory requirements.
The Enhanced OFAC Module must screen one hundred percent (100%) of applicable transactions across all BRB business lines and all fourteen (14) BaaS partner channels, with no screening gaps. The elimination of screening gaps — particularly the twelve percent (12%) gap in NovaPay transaction screening identified by the OCC — is the fundamental objective of this engagement and the primary measure of success.
The solution must support both real-time screening (intercepting and screening transactions prior to execution or settlement) and batch processing workflows (including customer onboarding screening, periodic re-screening, and retrospective screening upon Sanctions List updates). The system architecture must be designed to accommodate growth in BaaS transaction volumes, the addition of new BaaS partners, and changes in OFAC Sanctions Lists, without degradation in screening coverage or performance.
The Enhanced OFAC Module must directly and fully address the specific deficiency identified in the Consent Order regarding unscreened BaaS channel transactions. Veridian acknowledges that the design and implementation of the Enhanced OFAC Module will be subject to scrutiny by the OCC, the OCC-mandated independent consultant (Thornfield Consulting Group LLC), and BRB's independent BSA/AML testing firm (Caldera & Pope LLP), and Veridian shall design and document the system accordingly.
3.2 Transaction Types in Scope
The Enhanced OFAC Module must screen the following transaction types across all applicable channels, including all BRB proprietary business lines (retail banking, commercial lending, wealth management) and all fourteen (14) BaaS partner channels:
(a) Wire Transfers. All domestic and international wire transfers, both inbound and outbound, including Fedwire, CHIPS, and SWIFT-processed transactions, and including all wire transfers originated or received through BaaS partner platforms.
(b) ACH Transactions. All Automated Clearing House transactions, including both origination and receipt, across all SEC codes, and including all ACH transactions processed through BaaS partner platforms.
(c) Card Transactions. All debit and credit card transactions, at both the authorization and settlement stages, including point-of-sale transactions, online transactions, and ATM transactions, to the extent such transactions are processed through BRB's systems or through BaaS partner platforms operating under BRB's charter.
(d) BaaS Partner-Originated Transactions. All transaction types originated, processed, or facilitated through any of BRB's fourteen (14) active BaaS partner platforms, regardless of transaction type or amount. This category encompasses all transactions processed through BRB's charter on behalf of BaaS Partners and their end-user customers.
(e) Peer-to-Peer (P2P) Transfers. All P2P transfer flows, including specifically NovaPay consumer P2P transfer flows, which represented approximately $30.5 billion in transaction volume in calendar year 2024.
(f) Loan Originations and Disbursements. All loan originations and disbursement transactions, including specifically FairLend Digital online small-business lending flows, which represented approximately $1.4 billion in loan originations in fiscal year 2024. This includes screening of borrower information at origination and screening of disbursement transactions.
(g) Deposit Account Activity. All deposit account activity, including specifically VaultEdge digital savings and neobanking account flows, encompassing approximately 870,000 deposit accounts. This includes screening at account opening, for ongoing transactional activity, and for periodic re-screening of account holders.
(h) Correspondent Banking and Interbank Transfers. All correspondent banking transactions and interbank transfer activity processed through BRB's systems.
(i) Internal Account Transfers. Internal account transfers above configurable thresholds, with threshold levels to be determined by BRB during the design phase and configured within the Enhanced OFAC Module.
For the avoidance of doubt, the foregoing list is inclusive of all material transaction types currently processed by BRB and its BaaS Partners. In the event that BRB identifies additional transaction types during the design phase that are not specifically enumerated above, such transaction types shall be incorporated into the screening scope through the change order process described in Section 8.2, provided that any transaction types already being processed through BRB's charter as of the Effective Date shall be deemed within the scope of this SOW without the need for a change order.
3.3 Real-Time Screening Integration
Veridian shall implement real-time OFAC sanctions screening capability that intercepts and screens applicable transactions prior to execution or settlement. Real-time screening is the primary mechanism by which the Enhanced OFAC Module will ensure that no transaction is executed without first being screened against all applicable OFAC Sanctions Lists.
Real-time screening must be integrated into each BaaS partner's transaction flow via API integration. For each of the fourteen (14) BaaS Partners, Veridian shall configure dedicated API endpoints and partner-specific screening profiles. The API architecture shall be designed to accommodate the diverse technical environments and data formats of BRB's BaaS partner ecosystem, while maintaining consistent screening coverage and performance across all partners.
The real-time screening latency requirement is a maximum of two hundred (200) milliseconds per transaction for a screening decision (pass or hold for review). This latency target applies to the round-trip time from receipt of the transaction screening request by the Enhanced OFAC Module to the issuance of a screening decision response, measured at the API endpoint. Veridian shall design the system architecture to meet this latency requirement at peak transaction volumes, including provisions for horizontal scaling during volume spikes.
Transactions generating a potential Hit must be automatically held and queued pending manual review and disposition by BRB compliance staff. The hold mechanism must prevent the transaction from being executed, settled, or released until a disposition decision has been made by an authorized BRB compliance analyst or until an automated release condition is satisfied. The system must provide real-time notification to BRB compliance staff when transactions are held due to potential Hits.
The system must support configurable auto-release functionality for transactions below defined risk thresholds after a no-hit determination. Auto-release parameters, including risk thresholds, transaction types eligible for auto-release, and any time-based release rules, shall be configurable by BRB and subject to BRB's sole approval. Veridian shall provide recommendations regarding auto-release configuration during the design phase, but all final configuration decisions shall be made by BRB in consultation with its compliance team.
3.4 Batch Processing Capabilities
In addition to real-time screening, Veridian shall implement comprehensive batch screening capabilities within the Enhanced OFAC Module. Batch processing serves as a critical complementary screening mechanism, ensuring that customer databases are continuously screened against current Sanctions Lists and that any transactions not captured in real-time processing are identified and addressed.
Veridian shall implement batch screening capabilities for the following use cases:
(a) Customer Onboarding Screening. All new customers, including BaaS partner end-user customers, shall be screened against all applicable Sanctions Lists at the time of account opening or onboarding.
(b) Periodic Re-Screening of Existing Customer Databases. The system shall support automated periodic re-screening of BRB's full customer base, including all BaaS partner end-user accounts, on a frequency configurable by BRB (daily, weekly, or as otherwise determined by BRB's risk-based approach).
(c) Retrospective Screening Upon List Updates. Upon publication of updated Sanctions Lists by OFAC (including updates to the SDN List, Consolidated Sanctions List, Sectoral Sanctions List, and all Non-SDN Lists), the system shall automatically trigger retrospective screening of the full customer base against the updated list entries.
(d) End-of-Day Reconciliation Screening. The system shall perform end-of-day reconciliation screening to identify and screen any transactions that were not captured in real-time processing due to system errors, API timeouts, or other exceptions. This reconciliation function is critical to ensuring that no screening gaps exist.
Batch processing must be capable of screening BRB's full customer base, which includes approximately 47,000 high-risk accounts identified during BRB's concurrent CDD/EDD remediation efforts, as well as all BaaS partner end-user accounts. The total population for batch screening includes approximately 2.1 million NovaPay end-user accounts, approximately 870,000 VaultEdge end-user accounts, FairLend borrower accounts, and all customer accounts associated with BRB's remaining eleven (11) BaaS Partners and BRB's proprietary business lines.
Batch processing must be completed within a maximum of four (4) hours for a full customer base re-screen triggered by a Sanctions List update. This four-hour window is measured from the time the updated Sanctions List is ingested by the system to the time all screening results are available for review and disposition.
OFAC Sanctions List updates must be ingested by the system within one (1) hour of publication by OFAC. The system must monitor OFAC's data distribution system for list updates on a continuous or near-continuous basis (no less frequently than every fifteen (15) minutes) and must automatically download, parse, validate, and ingest updated list data upon detection of a new publication.
3.5 Sanctions List Management
The Enhanced OFAC Module shall support automated ingestion, management, and archiving of all OFAC Sanctions Lists. Comprehensive sanctions list management is essential to ensuring that the screening system operates against current, complete, and accurate sanctions data at all times.
The system shall support the following OFAC Sanctions Lists:
(a) Specially Designated Nationals and blocked Persons (SDN) List;
(b) Consolidated Sanctions List;
(c) Sectoral Sanctions Identifications (SSI) List;
(d) Non-SDN Lists, including:
(i) Foreign Sanctions Evaders (FSE) List;
(ii) Palestinian Legislative Council (PLC) List;
(iii) Non-SDN Menu-Based Sanctions (NS-MBS) List;
(iv) Capta List (NS-CAPTA);
(v) Non-SDN Chinese Military-Industrial Complex Companies (NS-CMIC) List; and
(vi) Any other Non-SDN lists published by OFAC as of the Effective Date or published during the term of this SOW;
(e) Any additional or successor lists published by OFAC during the term of this SOW.
A complete inventory of all Sanctions Lists to be supported, together with their update frequencies, data formats, and OFAC data distribution sources, is set forth in Appendix 2 to this SOW. Veridian shall update Appendix 2 during the design phase to reflect the most current OFAC list inventory.
List Update Automation. The system must automatically pull updated Sanctions Lists from OFAC's data distribution system upon publication. The system shall support multiple ingestion methods, including direct download from OFAC's website, API-based retrieval (to the extent OFAC provides API access), and manual upload as a fallback mechanism. The system shall validate the integrity of ingested list data against OFAC-published checksums or other validation mechanisms, and shall generate alerts if validation fails.
Historical List Archiving. The system must maintain historical snapshots of all Sanctions Lists for audit and lookback purposes. Each snapshot shall be timestamped and retained for a minimum period of seven (7) years, or such longer period as may be required by applicable law or regulation, or as directed by BRB. Historical snapshots must be searchable and retrievable, enabling BRB to determine the state of any Sanctions List at any point in time for purposes of regulatory examination, litigation, or internal investigation.
Secondary Sanctions Screening. The system must support secondary sanctions screening and jurisdiction-specific requirements as configured by BRB. This includes the ability to screen against secondary sanctions designations and to apply jurisdiction-specific screening rules based on the nature of the transaction, the counterparties involved, and the applicable sanctions program.
3.6 Hit Disposition Workflow
Veridian shall implement a configurable hit disposition workflow within the Enhanced OFAC Module that enables BRB compliance analysts to efficiently and accurately review, investigate, and dispose of potential Hits. The hit disposition workflow is a critical operational component that directly impacts BRB's ability to comply with OFAC blocking and rejection requirements while managing the operational burden of false-positive alerts.
The hit disposition workflow shall include the following capabilities:
(a) Automated Scoring and Ranking. The system shall automatically score and rank potential Hits based on configurable match criteria, including name matching (exact and fuzzy), alias matching, address matching, identification number matching (including passport numbers, national ID numbers, and tax identification numbers), vessel name matching, and country matching. Scores shall reflect the confidence level of the match and shall be used to prioritize analyst review.
(b) Fuzzy Matching Algorithms. The system shall employ advanced fuzzy matching algorithms with configurable sensitivity thresholds. Fuzzy matching must account for common name variations, transliterations, misspellings, abbreviations, and alternative character sets. Veridian shall provide BRB with detailed documentation of the fuzzy matching algorithms used and the rationale for default threshold settings.
(c) Workflow Queuing and Assignment. Potential Hits shall be automatically queued and assigned to BRB compliance analysts based on configurable rules, including risk tier (high, medium, low), transaction type, BaaS partner, and analyst workload balancing. The system shall support multiple concurrent queues and shall allow supervisors to reassign cases as necessary.
(d) Disposition Options. The workflow shall support the following disposition options:
(i) True Match — Block or reject the transaction and initiate blocking procedures, including the OFAC 10-day blocking report workflow;
(ii) False Positive — Release the transaction with documentation of the analyst's rationale for the false-positive determination; and
(iii) Escalation — Escalate the case to BRB BSA Officer Thomas Ikeda, the OFAC compliance lead, or other designated senior compliance personnel for further review and decision.
(e) Audit Trail. The system shall maintain a complete, immutable audit trail for all Hit dispositions, including the identity of the analyst who reviewed the Hit, the timestamp of each action taken, the rationale documented for the disposition decision, and any supervisory review or approval. The audit trail must satisfy the recordkeeping requirements of 31 C.F.R. Part 501 and must be accessible to BRB's internal audit function, the OCC, Thornfield Consulting Group LLC, and Caldera & Pope LLP.
(f) Automated Escalation Triggers. The system shall include configurable automated escalation triggers for high-confidence matches that exceed defined score thresholds, requiring immediate blocking action and notification to senior compliance personnel. Escalation triggers shall be designed to ensure that no high-confidence True Match is delayed by normal queue processing times.
(g) blocking Report Integration. The system shall integrate with BRB's ten (10) business day OFAC blocking report workflow, facilitating the preparation and submission of blocking reports to OFAC within the required timeframe for all blocked transactions.
(h) False-Positive Tuning. The system shall include false-positive tuning capabilities designed to address the current 99.9% false-positive rate (14,320 Hits with only 12 True Matches in calendar year 2024 under TMS v.8.3). The goal of false-positive tuning is to achieve a measurable reduction in false-positive volume through enhanced matching algorithms, improved scoring methodologies, and the application of contextual filters, while maintaining or improving the True Match detection rate. Target false-positive metrics shall be agreed upon during the design phase and documented in the Detailed Design Document (D-1).
3.7 BaaS Partner-Specific Configuration
Recognizing that BRB's fourteen (14) active BaaS Partners represent a diverse ecosystem of fintech business models, transaction types, volumes, and technical architectures, Veridian shall configure partner-specific screening profiles within the Enhanced OFAC Module for each BaaS Partner. Partner-specific configuration is essential to ensuring complete screening coverage while optimizing performance and minimizing false positives across the BaaS portfolio.
For each of the fourteen (14) active BaaS Partners, Veridian shall configure screening profiles that account for:
(a) The transaction types and volumes specific to each partner;
(b) Partner-specific data formats, field mappings, and API specifications;
(c) Risk-based screening intensity, configurable by BRB based on BRB's risk ratings assigned to each BaaS Partner; and
(d) Any partner-specific regulatory requirements or compliance conditions.
The three (3) BaaS Partners with the highest transaction volumes require priority integration and are designated as Tier 1 partners:
(a) NovaPay Technologies Inc. — NovaPay represents approximately forty-one percent (41%) of BRB's total BaaS transaction volume, with approximately $30.5 billion in transaction volume in calendar year 2024. NovaPay's platform supports consumer payments and P2P transfer flows across approximately 2.1 million end-user accounts. NovaPay integration is of particular urgency given the twelve percent (12%) screening gap specifically identified in the Consent Order.
(b) FairLend Digital LLC — FairLend represents approximately twenty-eight percent (28%) of BRB's total BaaS transaction volume. FairLend operates an online small-business lending platform under BRB's charter, with approximately $1.4 billion in loan originations in fiscal year 2024. FairLend integration requires screening at both the borrower onboarding/origination stage and the loan disbursement/repayment transaction stage.
(c) VaultEdge Inc. — VaultEdge represents approximately eighteen percent (18%) of BRB's total BaaS transaction volume. VaultEdge operates a digital savings and neobanking platform under BRB's charter, with approximately 870,000 deposit accounts. VaultEdge integration requires screening at account opening, for ongoing transactional activity, and for periodic re-screening of all account holders.
Together, the three Tier 1 partners represent approximately eighty-seven percent (87%) of BRB's total BaaS transaction volume (41% + 28% + 18%).
The remaining eleven (11) BaaS Partners (collectively representing approximately thirteen percent (13%) of BaaS transaction volume, or approximately $9.7 billion in calendar year 2024) are designated as Tier 2 partners and shall be integrated per the phased schedule set forth in Section 5.
Veridian shall develop partner-specific reporting dashboards for each BaaS Partner, displaying screening volumes, Hit rates, True Match rates, false-positive rates, and disposition statistics. These dashboards shall be accessible to BRB compliance personnel and shall be configurable to support partner-level performance monitoring and regulatory reporting.
3.8 Reporting and Analytics
The Enhanced OFAC Module must include comprehensive reporting and analytics capabilities that support BRB's operational needs, management reporting requirements, board-level oversight obligations, and regulatory examination readiness. Reporting is a critical component of the Consent Order remediation, as the OCC has required BRB to demonstrate ongoing monitoring and measurement of OFAC screening effectiveness.
The Enhanced OFAC Module must include the following reporting capabilities:
(a) Real-Time Dashboard. A real-time operational dashboard displaying current screening volumes, Hit counts, pending dispositions, blocked transactions, and system health indicators. The dashboard shall be accessible to authorized BRB compliance personnel via a web-based interface.
(b) Periodic Aggregate Reports. Daily, weekly, monthly, and quarterly aggregate reports summarizing OFAC screening activity, including total transactions screened, Hits generated, True Matches identified, false positives cleared, average disposition time, and screening coverage metrics.
(c) Partner-Specific Reports. Dedicated screening reports for each of the fourteen (14) BaaS Partners, enabling BRB to monitor and report on OFAC screening performance at the partner level. Partner-specific reports shall include screening volumes, Hit rates, True Match rates, and disposition statistics.
(d) Hit Rate Analytics. OFAC Hit rate analytics displaying Hits as a percentage of screened transactions, segmented by BaaS Partner, transaction type, Sanctions List, and match criteria. These analytics shall support BRB's ongoing assessment of screening effectiveness and false-positive tuning efforts.
(e) True Match vs. False-Positive Ratio Tracking. Historical trending of the True Match to false-positive ratio over time, enabling BRB to measure improvement in screening precision and to demonstrate progress to regulators.
(f) Board Compliance Committee Reporting. Metrics and reports suitable for presentation to the BRB Board Compliance Committee, chaired by James Rutherford, including OFAC screening Hit rates, risk ratings by BaaS Partner, True Match statistics, and overall screening coverage metrics, as required under the Consent Order. Reports shall be formatted for executive-level consumption and shall include summary narratives, trend charts, and risk indicators.
(g) Audit-Ready Reports. Reports designed to satisfy the documentation and reporting requirements of OCC examinations and Thornfield Consulting Group LLC independent consultant review. Audit-ready reports shall include detailed screening activity logs, disposition records, system configuration records, and Sanctions List update histories.
(h) FinCEN SAR Integration Data. The system shall flag sanctions-related suspicious activity for potential Suspicious Activity Report ("SAR") filing coordination. Where a True Match or other sanctions-related alert may also warrant SAR filing, the system shall facilitate the transfer of relevant data and case documentation to BRB's SAR filing workflow.
3.9 System Integration Requirements
The Enhanced OFAC Module must be fully integrated with BRB's existing technology infrastructure and with the Veridian TMS v.10.0 platform. System integration is essential to ensuring seamless screening coverage, data consistency, and operational efficiency. The following integration requirements apply:
(a) Veridian TMS v.10.0 Platform. The Enhanced OFAC Module shall be natively integrated with the Veridian TMS v.10.0 transaction monitoring system, which is the core platform upgrade being deployed under Amendment No. 1 to the MSA. The OFAC Module shall share the TMS v.10.0 data infrastructure, user interface framework, and administrative tooling.
(b) BRB Core Banking System. API integration with BRB's core banking system to enable real-time screening of transactions processed through BRB's proprietary banking operations (retail, commercial, and wealth management).
(c) BaaS Partner Platforms. Dedicated API integrations with each of the fourteen (14) BaaS partner platforms, enabling real-time interception and screening of BaaS partner-originated transactions prior to execution. API specifications for each partner shall be documented in the API Integration Specifications deliverable (D-2).
(d) Customer Information File (CIF) System. Integration with BRB's CIF system to enable customer-level screening, including matching of customer records against Sanctions Lists and enrichment of screening data with customer profile information.
(e) Case Management System. Integration with BRB's case management system for Hit disposition workflow, enabling seamless case creation, assignment, investigation, and closure.
(f) Compliance Data Warehouse. Data feeds to BRB's compliance data warehouse for analytics, regulatory reporting, and historical data retention.
(g) Wire Transfer System. Integration with BRB's existing wire transfer processing system to enable real-time screening of all domestic and international wire transfers.
(h) ACH Processing System. Integration with BRB's ACH processing system to enable screening of all ACH originations and receipts.
(i) Card Processing System. Integration with BRB's card processing system to enable screening of card transactions at the authorization and/or settlement stage, as configured by BRB.
All system integrations shall be coordinated with Linda Petrosian, BRB Chief Information Officer / Chief Technology Officer, or her designated technical lead. Veridian shall work collaboratively with BRB's technology team and with BaaS partner technical teams to design, develop, test, and deploy all required integrations.
SECTION 4: DELIVERABLES
4.1 Deliverable Schedule
The following table sets forth the deliverables to be provided by Veridian under this SOW, together with the applicable due dates. All due dates calculated from the Effective Date are measured in calendar days unless otherwise specified. Due dates that fall on a weekend or federal holiday shall be extended to the next business day.
4.2 Documentation Deliverables
In addition to the software and system deliverables identified in Section 4.1, Veridian shall provide the following documentation deliverables, each of which shall be of professional quality, complete, accurate, and suitable for use by BRB personnel, regulators, and independent consultants:
(a) Detailed Design Document. A comprehensive design document (delivered as part of D-1) including system architecture diagrams, data flow diagrams, API specifications, database schema documentation, screening logic descriptions, fuzzy matching algorithm documentation, and configuration parameter definitions.
(b) Configuration Guide. A detailed configuration guide for all screening parameters, fuzzy matching thresholds, match scoring criteria, list management settings, auto-release parameters, and partner-specific screening profiles. The configuration guide shall enable BRB administrators to modify screening configurations without Veridian assistance.
(c) User Guide for Compliance Analysts. A user guide designed for BRB compliance analysts responsible for reviewing and disposing of potential Hits. The user guide shall include step-by-step procedures for Hit review, investigation, disposition, escalation, and blocking report preparation.
(d) Administrator Guide. A technical administrator guide for BRB technology personnel responsible for system configuration, list management, API management, reporting administration, and system operations.
(e) API Integration Guide. A technical guide for BaaS partner connectivity, including API endpoint documentation, authentication procedures, data format specifications, error handling protocols, and testing procedures. This guide shall be suitable for distribution to BaaS partner technical teams.
(f) Testing Documentation. Complete testing documentation including test plans, test cases, test data specifications, and test results for both System Integration Testing (SIT) and User Acceptance Testing (UAT). Testing documentation shall be maintained for regulatory examination and independent consultant review purposes.
(g) Operational Runbook. A runbook for OFAC list update procedures, system operations, monitoring procedures, incident response procedures, and escalation protocols. The runbook shall be designed for use by BRB's technology operations team for day-to-day system management.
All documentation shall be delivered in electronic format (Microsoft Word and/or PDF) and shall be maintained in a shared document repository accessible to authorized BRB personnel. Veridian shall update all documentation to reflect any changes made during the UAT, deployment, and hypercare phases.
SECTION 5: IMPLEMENTATION TIMELINE AND MILESTONES
5.1 Phased Implementation Schedule
The implementation of the Enhanced OFAC Module shall be executed in four (4) phases, as described below. The phased approach is designed to ensure orderly development and deployment while meeting the critical Consent Order deadlines.
Phase A — Design and Development (Months 1–3 from Effective Date)
Phase A encompasses the foundational design, requirements finalization, and core module development activities. Key activities during Phase A include:
(a) Requirements finalization and detailed design, culminating in delivery of the OFAC Module Detailed Design Document (D-1). This activity includes workshops with BRB compliance, technology, and business stakeholders to confirm functional requirements, screening parameters, and workflow design.
(b) Development of API integration specifications for all fourteen (14) BaaS Partners (D-2), including coordination with each partner's technical team to confirm data formats, API protocols, and integration architecture.
(c) Core module development, encompassing:
(i) Sanctions List Management Module (D-3) — development of automated list ingestion, validation, archiving, and update notification capabilities;
(ii) Real-Time Screening Engine (D-4) — development of the API-based transaction interception, screening logic, fuzzy matching algorithms, match scoring engine, and pass/hold decision engine;
(iii) Batch Processing Module (D-5) — development of customer onboarding screening, periodic re-screening, retrospective list-update screening, and end-of-day reconciliation screening capabilities; and
(iv) Hit Disposition Workflow (D-6) — development of the case queuing, analyst assignment, disposition, escalation, audit trail, and blocking report integration capabilities.
Phase B — Integration and Testing (Months 3–5)
Phase B encompasses the integration of the Enhanced OFAC Module with BaaS partner platforms, completion of remaining module development, and comprehensive system integration testing. Key activities during Phase B include:
(a) Priority BaaS partner integrations (D-7): NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. These three Tier 1 partners represent approximately eighty-seven percent (87%) of BRB's total BaaS transaction volume (41% + 28% + 18% respectively). NovaPay integration is of highest priority given the specific screening gap identified in the Consent Order.
(b) Remaining eleven (11) Tier 2 BaaS partner integrations (D-8): development, configuration, and integration testing for each of the remaining BaaS Partners per the schedule to be finalized during the design phase.
(c) Reporting and Analytics Module completion (D-9): finalization and testing of all reporting capabilities, dashboards, and analytics functions.
(d) System Integration Testing (D-10): comprehensive end-to-end testing across all components, all BaaS partner integrations, core banking system integration, CIF integration, case management integration, and data warehouse feeds. SIT shall verify that the complete system operates as designed, with 100% screening coverage across all transaction types and all channels, meeting all performance and accuracy requirements.
Phase C — UAT and Deployment (Months 5–8)
Phase C encompasses User Acceptance Testing, defect remediation, and staged production deployment. This is the most critical phase from a Consent Order compliance perspective, as it culminates in Full Operationalization by the November 1, 2025 deadline. Key activities during Phase C include:
(a) User Acceptance Testing (D-11), aligned with the Veridian TMS v.10.0 UAT completion target of August 1, 2025. UAT shall be conducted by BRB with support from Veridian and shall cover all transaction types across all fourteen (14) BaaS partner integrations, as well as regression testing to confirm no degradation of existing TMS v.10.0 transaction monitoring functionality.
(b) Remediation of any UAT defects identified during testing, prioritized by severity (Critical, High, Medium, Low) in accordance with the defect resolution SLAs set forth in Section 10.
(c) Staged production deployment by BaaS partner, with NovaPay Technologies Inc. deployed first given the identified twelve percent (12%) screening gap that was the focus of the Consent Order. Following successful NovaPay deployment, FairLend Digital and VaultEdge shall be deployed, followed by the remaining eleven (11) Tier 2 partners.
(d) Full Production Deployment (D-12) by November 1, 2025, constituting Full Operationalization as defined in Section 2. This is the Consent Order deadline for OFAC screening to be fully operational for all BaaS channels and all BRB business lines, with 100% screening coverage confirmed.
Phase D — Stabilization (Months 8–10)
Phase D encompasses post-go-live stabilization, performance optimization, and final documentation delivery. Key activities during Phase D include:
(a) Post-go-live hypercare support (D-13), during which Veridian shall maintain a dedicated support team providing enhanced monitoring, immediate defect resolution, and priority support for the Enhanced OFAC Module. The hypercare period extends from November 1, 2025 through January 31, 2026.
(b) Performance tuning and false-positive optimization, including analysis of production screening data, adjustment of fuzzy matching thresholds and scoring parameters, and iterative refinement of screening precision.
(c) Final documentation delivery (D-14), including updated user guides, administrator guides, configuration documentation, and operational runbooks reflecting the final production configuration.
(d) Support for the independent model validation scheduled to commence on or about October 1, 2025, covering TMS v.10.0 including the Enhanced OFAC Module. Veridian shall provide all required documentation, system access, and personnel availability to support the validation process.
5.2 Critical Path Milestones Tied to Consent Order