PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
Banking & Finance Practice Group 1700 K Street NW, Suite 900, Washington, DC 20006
March 10, 2025
MEMORANDUM
FROM: Philip Hartmann, Responsible Partner, Banking & Finance Practice Group, Calderwood & Harkness LLP Carlos Espinoza, Working Associate, Litigation (General) Practice Group, Calderwood & Harkness LLP
TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA Linda Petrosian, CIO/CTO, Belmont Ridge Bank NA
CC: Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP Marcus Delgado, Billing Partner, Calderwood & Harkness LLP
RE: Comparative Analysis of AML Transaction Monitoring and Sanctions Screening Technology Vendors — Veridian Analytics Inc. (Incumbent Upgrade) vs. Ridgeline Data Systems LLC (Full Replacement)
C&H Matter No.: 1045-00002
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product. It is prepared solely for the use of the named recipients in connection with the legal representation of Belmont Ridge Bank National Association by Calderwood & Harkness LLP. This memorandum contains legal analysis, opinions, and recommendations that are protected by the attorney-client privilege and the work product doctrine. No portion of this memorandum should be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP. Disclosure to any third party, including but not limited to regulatory agencies, vendors, consultants, or auditors, may constitute a waiver of applicable privileges.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum presents Calderwood & Harkness LLP's ("C&H") comparative analysis of two technology paths available to Belmont Ridge Bank National Association ("BRB" or the "Bank") for remediating the transaction monitoring and OFAC sanctions screening deficiencies identified in the Consent Order issued by the Office of the Comptroller of the Currency ("OCC"), Consent Order No. OCC-2025-003 (the "Consent Order"), effective January 15, 2025. The Consent Order requires BRB to implement a series of corrective measures within defined timelines, several of which are directly dependent upon the Bank's anti-money laundering ("AML") transaction monitoring system and Office of Foreign Assets Control ("OFAC") sanctions screening technology platform.
BRB is currently evaluating two options for addressing these technology-related requirements:
Option A — Veridian Analytics Inc. Incumbent Upgrade: Upgrade the Bank's existing transaction monitoring system from Veridian Analytics Inc. ("Veridian") TMS v.8.3 to TMS v.10.0, including an enhanced OFAC sanctions screening module designed to address the specific screening gaps identified in the Consent Order.
Option B — Ridgeline Data Systems LLC Full Platform Replacement: Complete replacement of the Veridian platform with a new transaction monitoring and sanctions screening platform provided by Ridgeline Data Systems LLC ("Ridgeline"), a cloud-native vendor with growing market presence among mid-size banks with fintech partnership programs.
Bottom-Line Recommendation. Based on our analysis of implementation timeline feasibility, Consent Order compliance requirements, total cost of ownership, regulatory perception factors, operational disruption risk, and BaaS channel integration considerations, C&H recommends that BRB proceed with the Veridian Analytics TMS v.10.0 upgrade (Option A) as the primary remediation path, while simultaneously maintaining Ridgeline Data Systems as a documented contingency option to be activated if and only if Veridian fails to meet critical Consent Order milestones as defined in Section VIII of this memorandum.
The key drivers of this recommendation are as follows:
•  Implementation Timeline Alignment. The Veridian upgrade can be implemented within the Consent Order's technology-related deadlines, most critically the August 1, 2025 deadline for transaction monitoring system user acceptance testing ("UAT") completion and production deployment, and the November 1, 2025 deadline for full OFAC screening operationalization across all Banking-as-a-Service ("BaaS") channels. A Ridgeline full replacement cannot meet any of these deadlines, requiring a minimum of 12–18 months for implementation.
•  Lower Transition Risk. Upgrading within the existing vendor ecosystem preserves BRB's current data architecture, BaaS partner integrations, staff proficiency, and institutional knowledge, all of which would need to be reconstructed in a full platform replacement during a period when BRB's BSA/AML compliance operations are already under significant stress.
•  Lower Total Cost of Ownership. The Veridian upgrade is estimated to cost approximately $32,800,000 over a five-year horizon, compared to approximately $47,425,000 for the Ridgeline replacement (inclusive of dual-running overlap costs with the existing Veridian contract). The differential of approximately $14,625,000 is material in the context of BRB's Board-approved remediation budget of $42,500,000.
•  Favorable Regulatory Perception. Demonstrating timely, substantive progress on remediation milestones is critical to BRB's relationship with the OCC, FinCEN, and the independent consultant (Thornfield Consulting Group LLC). Choosing a path that enables BRB to meet every Consent Order deadline sends a strong signal of institutional commitment and competence.
This memorandum should be read in conjunction with the Technology Implementation Timeline & Risk Assessment Memorandum (Appendix 5) and the Comprehensive Remediation Action Plan, specifically Workstream 4: Transaction Monitoring Model Validation & Tuning Plan, both of which are referenced herein but attached separately.
II. BACKGROUND
A. Regulatory Context
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association (OCC Charter No. 48271, FDIC Certificate No. 31845), a national banking association headquartered in Philadelphia, Pennsylvania. The Consent Order followed a series of supervisory findings and enforcement escalation over the preceding three years, culminating in the OCC's determination that BRB had failed to maintain an adequate Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program and had failed to comply with OFAC sanctions requirements, in violation of 12 U.S.C. §§ 1818(b) and 1818(s), 31 U.S.C. § 5318, and the implementing regulations thereunder, including 31 C.F.R. Part 1020 and 31 C.F.R. Part 501.
The Consent Order identifies multiple categories of deficiency, three of which are directly relevant to the technology vendor analysis presented in this memorandum:
OFAC Sanctions Screening Failures. The OCC examination determined that BRB's OFAC screening system, powered by the Veridian TMS v.8.3 platform, failed to screen one hundred percent (100%) of transactions processed through the Bank's fintech BaaS channels. Specifically, the OCC identified a gap in the screening of transactions originated through BRB's partnership with NovaPay Technologies Inc. ("NovaPay"), one of the Bank's largest BaaS partners. The gap affected approximately twelve percent (12%) of NovaPay wire and ACH transactions — approximately 3,800,000 transactions that were not screened against OFAC sanctions lists during calendar year ("CY") 2023, out of a total of approximately 31,700,000 NovaPay transactions processed during that period. This screening gap was attributed to a data feed integration deficiency in the Veridian platform that failed to capture certain transaction types routed through NovaPay's secondary processing channel. The deficiency was not identified by BRB's internal quality assurance processes, nor was it identified by Veridian Analytics during the course of the vendor relationship.
Transaction Monitoring Model Validation Deficiency. The Consent Order found that BRB's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — more than three years prior to the commencement of the OCC's examination. Additionally, the system's tuning parameters were last updated in October 2022, meaning the detection models were operating with calibrations that did not reflect BRB's current transaction volumes, product mix, customer base, or risk profile. The OCC determined that this failure to conduct periodic independent validation and model tuning constituted an unsafe and unsound banking practice and a violation of BRB's obligations under the BSA.
SAR Filing Deficiencies. As of September 2024, BRB had a backlog of approximately 2,400 unreviewed transaction monitoring alerts. The Bank's average Suspicious Activity Report ("SAR") filing time was 78 days from the date of alert generation, compared to the regulatory expectation of approximately 30 days. The Consent Order identified BRB's transaction monitoring system tuning and effectiveness as a direct contributor to these filing delays, noting that the system's over-alerting tendencies generated excessive false positives that consumed investigator capacity while simultaneously failing to detect certain categories of suspicious activity.
The Consent Order was not the first supervisory action taken against BRB in this area. The OCC had previously issued a Matter Requiring Attention ("MRA") in June 2022 regarding BSA/AML transaction monitoring deficiencies, and a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps. The Consent Order expressly cites BRB's failure to adequately remediate these prior supervisory findings as an aggravating factor in the OCC's enforcement determination. In addition to the Consent Order, BRB paid a civil money penalty ("CMP") of $14,500,000 to the OCC.
On February 5, 2025, the OCC provided its non-objection to BRB's engagement of Thornfield Consulting Group LLC ("Thornfield") as the independent consultant required by the Consent Order. Thornfield was formally engaged on February 10, 2025, under the direction of Dr. Vivian Castellano, Managing Director. Thornfield's preliminary gap assessment is due April 15, 2025, and will include an assessment of BRB's technology platform — including the transaction monitoring and sanctions screening system — as part of its review. Thornfield's assessment will be a critical input into the OCC's ongoing evaluation of BRB's remediation progress and the ultimate determination of whether BRB has achieved compliance with the Consent Order's requirements.
B. Current Technology Environment
BRB's current AML transaction monitoring and sanctions screening capabilities are provided by Veridian Analytics Inc. ("Veridian"), a Delaware corporation with principal offices at 1900 Embarcadero Road, Suite 400, Palo Alto, California 94303. BRB's primary point of contact at Veridian is Priya Subramanian, Vice President of Client Solutions. Veridian is a well-established provider of financial crime compliance technology to mid-size and large banking institutions across the United States.
The current system is Veridian TMS v.8.3, which provides both transaction monitoring (suspicious activity detection) and sanctions screening (OFAC list matching) functionality. The system is deployed pursuant to Contract No. VA-BRB-2023-0044, which carries an annual contract value ("ACV") of $4,100,000 per year. The contract is structured as a three-year term ending December 2026, with renewal provisions that would extend the term in one-year increments absent written notice of non-renewal by either party. The contract was most recently renewed effective January 1, 2024.
The system deficiencies identified by the OCC examination and further documented in the independent BSA/AML program test conducted by Caldera & Pope LLP (the "Caldera & Pope Assessment," completed in September 2024 at a cost of approximately $1,100,000 to BRB) include the following:
•  Inadequate OFAC Screening Coverage for BaaS Transaction Flows. As noted above, the Veridian platform failed to screen approximately 12% of transactions originated through NovaPay's secondary processing channel. The Caldera & Pope Assessment confirmed that similar, though less severe, screening gaps existed in transaction flows from BRB's other BaaS partners, including FairLend Digital LLC ("FairLend Digital"), VaultEdge Inc. ("VaultEdge"), and other partners in BRB's BaaS program. The root cause was identified as an incomplete API integration that failed to capture certain transaction message types, compounded by inadequate monitoring of screening completeness metrics.
•  Stale Model Parameters. The transaction monitoring rules and detection scenarios within TMS v.8.3 were last tuned in October 2022, more than two years before the OCC examination commenced. During the intervening period, BRB's BaaS program had grown significantly — total BaaS transaction volume increased from approximately $41,000,000,000 in CY 2022 to approximately $74,300,000,000 in CY 2024 — rendering the existing model parameters inadequate for the Bank's current risk profile and transaction patterns.
•  No Independent Model Validation Since March 2021. The most recent independent validation of the Veridian TMS was conducted in March 2021 by an external firm. Regulatory guidance, including FinCEN guidance and the Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual, calls for periodic independent validation of transaction monitoring models, typically on an annual or biennial basis. The more-than-three-year gap between validations was a significant examination finding.
•  Alert Volume and SAR Conversion Rate Anomalies. In CY 2024, the Veridian TMS generated a total of 41,500 alerts. Of these, 3,847 resulted in SAR filings, yielding a SAR conversion rate of approximately 9.3% (3,847 SARs ÷ 41,500 alerts). While SAR conversion rates vary widely across institutions and are not themselves dispositive, the combination of a relatively low conversion rate (suggesting over-alerting and significant investigator time spent on false positives) and simultaneous under-detection (as evidenced by the OFAC screening gaps and the stale model parameters) indicates fundamental calibration problems with the existing system.
•  OFAC Screening False-Positive Rate. The OFAC screening module within TMS v.8.3 produced 14,320 hits in CY 2024, of which only 12 were determined to be true matches — a false-positive rate of approximately 99.9%. This extraordinarily high false-positive rate imposes a significant operational burden on BRB's OFAC compliance staff, consuming resources that could be deployed more productively while also creating the risk that true matches are overlooked or dismissed in the volume of noise. The Caldera & Pope Assessment identified OFAC screening calibration as a critical area requiring immediate remediation.
C. BaaS Channel Considerations
BRB's BaaS program is a significant and growing component of the Bank's business model, and it is directly implicated in the Consent Order's findings. The Bank currently operates fourteen (14) active BaaS fintech partnerships, through which BRB provides its national bank charter, regulatory licenses, and banking infrastructure to fintech companies that offer consumer- and business-facing financial products and services.
Total BaaS transaction volume in CY 2024 was approximately $74,300,000,000, representing a substantial portion of the Bank's overall transaction processing activity. The three largest BaaS partners by transaction volume are:
1.  NovaPay Technologies Inc. — Approximately 41% of total BaaS volume, or approximately $30,500,000,000 in CY 2024. NovaPay is the partner most directly implicated in the Consent Order's OFAC screening findings.
2.  FairLend Digital LLC — Approximately 28% of total BaaS volume. FairLend Digital provides consumer lending products through BRB's charter.
3.  VaultEdge Inc. — Approximately 18% of total BaaS volume. VaultEdge provides digital banking and savings products.
The remaining eleven (11) BaaS partners collectively represent approximately 13% of total BaaS transaction volume.
BaaS revenue to BRB in CY 2024 was $127,400,000, representing a material revenue stream for the institution. The strategic importance of the BaaS program to BRB's long-term business plan underscores the need for a technology platform that can reliably and comprehensively monitor and screen the full range of BaaS transaction types.
Notably, BaaS channels are disproportionately represented in BRB's suspicious activity reporting. Of the 3,847 total SARs filed by BRB in CY 2024, 2,108 (approximately 54.8%) were related to transactions originating through BaaS channels. This disproportionate SAR volume — relative to BaaS's share of the Bank's total transaction portfolio — highlights both the higher-risk nature of certain fintech partnership activities and the critical importance of a transaction monitoring and sanctions screening platform that can effectively handle the unique data formats, transaction types, and velocity patterns characteristic of fintech-originated transactions.
Any technology replacement or upgrade must seamlessly integrate with all fourteen (14) BaaS partner data feeds and transaction flows. This integration requirement is a critical evaluation criterion for both vendor options under consideration. Failure to achieve comprehensive BaaS integration would perpetuate the very screening and monitoring gaps that gave rise to the Consent Order.
III. OPTION A: VERIDIAN ANALYTICS TMS v.10.0 UPGRADE
A. Scope of Upgrade
Option A involves an upgrade of BRB's existing Veridian Analytics platform from TMS v.8.3 to TMS v.10.0, Veridian's next-generation transaction monitoring and financial crime compliance platform. The upgrade encompasses the following principal components:
Transaction Monitoring System Upgrade. TMS v.10.0 represents a significant generational advancement from v.8.3, incorporating enhanced analytics capabilities, machine learning-assisted detection algorithms, improved alert prioritization and scoring, an upgraded case management interface, and enhanced reporting and audit trail functionality. The upgrade is designed to address the core detection model deficiencies identified in the OCC examination by providing a more flexible and powerful tuning framework, improved scenario libraries, and native support for the types of transaction patterns characteristic of BaaS and fintech partnerships.
Enhanced OFAC Sanctions Screening Module. The upgraded platform includes a substantially redesigned OFAC sanctions screening module that provides real-time screening integration for all BaaS partner transaction flows, including wire transfers, ACH transactions, and card-based transactions. The enhanced module supports both real-time transaction screening and batch processing capabilities, and includes comprehensive list management functionality covering the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications List, and Non-SDN lists. The enhanced screening module is specifically designed to address the data feed integration gaps that resulted in the 12% unscreened NovaPay transaction volume identified in the Consent Order.
Improved Tuning Interface and Model Governance Tools. TMS v.10.0 includes an enhanced model governance dashboard that facilitates ongoing periodic validation and tuning of detection models. This tooling is designed to enable BRB's model risk management function and independent validators to assess model performance, identify parameter drift, and implement tuning adjustments on a regular cadence — directly addressing the Consent Order's findings regarding stale model parameters and the absence of periodic independent validation.
API-Based Integration for BaaS Partner Data Feeds. The upgraded platform features a modernized API architecture specifically designed to support the integration of data feeds from BaaS partner systems. This architecture is relevant for the integration of transaction data from NovaPay, FairLend Digital, VaultEdge, and all other BaaS partners, and is designed to be extensible to accommodate new partner onboarding in the future.
B. Commercial Terms
C&H and BRB's procurement team have negotiated the following commercial terms with Veridian Analytics, subject to formal documentation in the MSA amendment (a draft of which is attached as Appendix 1):
One-Time Implementation Fee: $2,800,000. This fee covers the upgrade deployment, data migration within the Veridian ecosystem, BaaS partner API integration configuration, initial model tuning and calibration, UAT support, and Veridian professional services during the implementation period. The implementation fee is structured as a fixed fee, not to exceed, payable in three installments: (i) $840,000 upon contract amendment execution; (ii) $1,120,000 upon completion of data migration and BaaS channel integration testing; and (iii) $840,000 upon successful completion of UAT and production deployment.
Incremental Annual Licensing for TMS v.10.0 and OFAC Module: $1,900,000 per year. This represents the incremental licensing cost above BRB's existing ACV under Contract No. VA-BRB-2023-0044 for the enhanced TMS v.10.0 platform and the upgraded OFAC screening module.
New Total Annual Contract Value Post-Upgrade: $4,100,000 (existing ACV) + $1,900,000 (incremental licensing) = $6,000,000 per year.
Contract Term. The existing contract (VA-BRB-2023-0044) runs through December 2026. The MSA amendment will incorporate the upgraded platform and pricing into the existing contract structure. The amendment will also include renewal terms that extend the post-upgrade contract through at least December 2029 (for a total of five years from the expected upgrade completion date), subject to negotiation of renewal-period pricing. For purposes of this analysis, we have assumed the $6,000,000 ACV remains constant over the five-year comparison period.
Total Year 1 Cost: $2,800,000 (implementation) + $6,000,000 (ACV) = $8,800,000.
Estimated Three-Year Total Cost (2025–2027, aligned with existing contract term): $2,800,000 + ($6,000,000 × 3) = $20,800,000.
Estimated Five-Year Total Cost (for apples-to-apples comparison with Ridgeline): $2,800,000 + ($6,000,000 × 5) = $32,800,000.
These cost projections do not include BRB internal costs for IT staff allocation, project management, or the independent model validation engagement, which will be incurred regardless of the vendor selected.
C. Implementation Timeline
Veridian has committed to the following milestone schedule based on discussions between C&H, BRB IT leadership (Linda Petrosian), and Veridian's implementation team (Priya Subramanian, VP of Client Solutions). These milestones will be formally incorporated into the MSA amendment as binding performance obligations:
Several factors support confidence in the achievability of this timeline:
First, Veridian's existing familiarity with BRB's data architecture, transaction types, customer data structures, and BaaS partner integrations significantly reduces the implementation ramp-up period. Veridian personnel have been working with BRB's systems since the inception of the vendor relationship, and the upgrade from v.8.3 to v.10.0 involves a migration within the same vendor ecosystem rather than a wholesale data migration from one platform to another.
Second, no data migration from one vendor platform to another is required. The upgrade path preserves existing transaction data, historical alert and case records, model parameters (which will be re-tuned but not reconstructed from scratch), and reporting configurations. This eliminates one of the most time-consuming and risk-prone elements of any technology platform change.
Third, Veridian has represented that it has successfully deployed TMS v.10.0 at other banking institutions of comparable size and complexity, including institutions with significant fintech partnership programs. While C&H has not independently verified these representations in detail, the reference checks conducted by BRB's IT procurement team have been generally consistent with Veridian's claims.
Notwithstanding these favorable factors, the implementation timeline is aggressive and leaves limited margin for error. C&H recommends that the MSA amendment include robust performance milestone provisions, including liquidated damages for failure to meet the August 1, 2025 and November 1, 2025 deadlines, as discussed further in Section IX.A below.
D. Technical Capabilities Assessment
Based on our review of Veridian's product documentation, demonstration sessions attended by C&H and BRB personnel, and vendor representations, TMS v.10.0 offers material improvements over v.8.3 across the key capability areas relevant to BRB's remediation requirements:
Alert Detection and Tuning Flexibility. TMS v.10.0 incorporates an expanded library of detection scenarios and rules, including scenarios specifically designed for BaaS and fintech transaction patterns. The tuning framework allows for more granular parameter adjustment, threshold calibration, and scenario customization than was available in v.8.3. This enhanced flexibility is essential for addressing the over-alerting (41,500 alerts with a 9.3% SAR conversion rate) and under-detection issues simultaneously.
OFAC Screening Capabilities. The enhanced OFAC screening module directly addresses the screening gap identified in the Consent Order by providing real-time screening capability for wire and ACH transactions across all BaaS channels, with comprehensive list coverage and improved matching algorithms. Veridian has represented that the enhanced module's matching algorithms are designed to achieve a materially lower false-positive rate than the 99.9% rate observed in v.8.3, though this claim must be validated through testing and independent review.
Machine Learning-Assisted Anomaly Detection. TMS v.10.0 incorporates machine learning models that supplement rule-based detection scenarios by identifying anomalous transaction patterns that may not be captured by predefined rules. This capability is increasingly expected by regulators and examiners as a component of a state-of-the-art transaction monitoring program.
Enhanced Model Governance Dashboard. The platform includes a dedicated model governance dashboard that provides visibility into model performance metrics, parameter stability, detection effectiveness, and validation status. This tooling is designed to support periodic validation and tuning, directly addressing the Consent Order's findings regarding the absence of independent validation since March 2021 and the staleness of tuning parameters.
Reporting and Audit Trail. TMS v.10.0 includes enhanced regulatory reporting capabilities, including automated generation of SAR-related data fields, alert disposition tracking, and comprehensive audit trail functionality that supports both internal audit review and regulatory examination.
Veridian has represented that v.10.0 has been deployed at other similarly situated banking institutions with BaaS programs, and that the platform has received favorable reviews from clients and, in at least some cases, from regulatory examiners. C&H has not independently verified these representations beyond the reference checks conducted by BRB's procurement function.
E. Risks and Limitations
While C&H recommends the Veridian upgrade as the primary path, several risks and limitations must be acknowledged and managed:
Regulatory Perception Risk — Same Vendor. Veridian was the vendor whose system was found to be deficient by the OCC. There is an inherent risk that OCC examiners, and particularly Examiner-in-Charge Jonathan Frey, may view BRB's decision to remain with the same vendor — even in an upgraded capacity — as insufficiently decisive. The OCC may question whether the upgrade adequately addresses root causes (including potential deficiencies in Veridian's internal quality assurance and client support processes) or merely patches the symptoms. C&H believes this risk can be mitigated through the strength of BRB's overall remediation narrative, including the significant investment in the upgrade, the binding performance milestones, the independent model validation, and the maintenance of Ridgeline as a documented contingency. However, this risk should be addressed proactively in BRB's communications with the OCC and with Thornfield Consulting.
Upgrade vs. Replacement Scrutiny. TMS v.10.0 is a significant upgrade, but it remains within the same vendor ecosystem. OCC examiners and Thornfield may scrutinize whether the upgrade adequately addresses the root causes of the identified deficiencies, or whether it merely applies a newer version of software built on the same foundational architecture that produced the failures. BRB should be prepared to articulate the specific technical differences between v.8.3 and v.10.0, the new capabilities that directly address each Consent Order finding, and the enhanced contractual protections and accountability measures embedded in the MSA amendment.
Implementation Delay Risk. The implementation timeline is aggressive, with limited margin for slippage. Any delay in the data migration, BaaS channel integration testing, or UAT phases could jeopardize the August 1, 2025 production deployment deadline. A delay in the OFAC module deployment could jeopardize the November 1, 2025 deadline. These deadlines are imposed by the Consent Order and cannot be unilaterally extended by BRB. The consequences of failing to meet these deadlines are discussed in Section VI.B below.
Vendor Relationship Management Concerns. Veridian's track record on the BRB account raises questions about vendor accountability. Veridian did not proactively identify the NovaPay screening gap, did not alert BRB to the staleness of model parameters, and did not recommend or facilitate independent model validation during the more-than-three-year gap. These failures suggest deficiencies in Veridian's client support, relationship management, and proactive risk advisory functions. BRB should insist on enhanced service level agreements ("SLAs"), dedicated account management resources, and defined escalation procedures in the MSA amendment.
False-Positive Rate Improvement. The current 99.9% false-positive rate on OFAC screening is operationally unsustainable and has been identified as a deficiency in the Consent Order. Veridian has claimed that v.10.0's improved matching algorithms will materially reduce false-positive rates, but this claim has not been independently validated. BRB should include false-positive rate reduction targets as a performance metric in the MSA amendment and require independent validation of screening performance as part of the October 2025 model validation.
Single-Vendor Concentration Risk. Remaining with Veridian for both transaction monitoring and OFAC sanctions screening concentrates BRB's financial crime compliance technology in a single vendor. If Veridian experiences financial difficulties, a cybersecurity incident, a material product defect, or a failure to maintain its product roadmap, BRB would be exposed to significant operational risk. This concentration risk is a relevant consideration, though it is mitigated somewhat by the availability of Ridgeline as a documented contingency option.
IV. OPTION B: RIDGELINE DATA SYSTEMS LLC FULL PLATFORM REPLACEMENT
A. Vendor Profile
Ridgeline Data Systems LLC ("Ridgeline") is a Delaware limited liability company with principal offices at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661. BRB's primary point of contact at Ridgeline is David Marchetti, Chief Revenue Officer. Ridgeline provides a full-service AML transaction monitoring and sanctions screening platform designed for deployment across the banking sector, with a particular focus on institutions with significant fintech partnership and BaaS operations.
Ridgeline's platform is built on a cloud-native architecture, which provides scalability, flexibility, and rapid deployment capabilities relative to traditional on-premises or legacy cloud-hosted solutions. The platform is known in the market for strong BaaS and fintech integration capabilities, including native API connectors for common fintech data formats and transaction processing protocols.
Ridgeline has a growing market presence among mid-size banks with active fintech partnership programs. While the company is not as well-established as Veridian in the broader financial institution compliance technology market, Ridgeline has attracted attention from institutions seeking purpose-built solutions for the unique challenges of monitoring and screening fintech-originated transaction flows. BRB's preliminary due diligence on Ridgeline has included product demonstrations, reference checks with existing Ridgeline clients, review of Ridgeline's SOC 2 Type II report, and analysis of Ridgeline's financial condition and corporate governance. A mutual non-disclosure agreement ("NDA") has been executed between BRB and Ridgeline (drafted by C&H) to facilitate the evaluation process. The NDA is attached as Appendix 3.
B. Commercial Terms
Ridgeline has proposed the following commercial terms for a full platform deployment at BRB:
Proposed Annual Contract Value: $7,200,000 per year. This ACV covers the full transaction monitoring and sanctions screening platform, including all BaaS partner integrations, list management, case management, reporting, and standard support services.
Proposed Contract Term: Five (5) years.
Total Contract Value: $7,200,000 × 5 = $36,000,000 over the five-year term.
Implementation and Migration Costs: Ridgeline has estimated implementation and data migration costs of $3,500,000 to $5,000,000, based on comparable deployments at institutions of BRB's size and complexity. Ridgeline has not provided a firm, fixed-price quote for implementation, noting that a detailed scoping exercise would be required before a firm price could be established. For purposes of this analysis, C&H has used the midpoint estimate of $4,250,000.
Dual-Running Costs. During any transition period, BRB would continue to owe its existing Veridian ACV of $4,100,000 per year under Contract No. VA-BRB-2023-0044, which runs through December 2026. Given Ridgeline's estimated 12–18 month implementation timeline, BRB could face dual-running costs (paying both the Veridian ACV and the Ridgeline ACV simultaneously) for a period of approximately 18–24 months. The dual-running cost exposure is estimated at $6,150,000 to $8,200,000, depending on the length of the overlap period and whether BRB is able to negotiate an early termination of the Veridian contract (which would likely involve termination penalties, as discussed below).
Estimated Five-Year Total Cost Including Implementation: $36,000,000 (Ridgeline ACV) + $4,250,000 (implementation midpoint) + $7,175,000 (Veridian overlap midpoint) = $47,425,000. This estimate is subject to significant variability depending on the final implementation cost, the length of the dual-running period, and any termination penalties or credits negotiated with Veridian.
C. Implementation Timeline
Ridgeline has estimated that full implementation at a bank of BRB's size and complexity — with 14 active BaaS partners and approximately $74,300,000,000 in annual BaaS transaction volume — would require 12 to 18 months from contract execution to production deployment. This estimate is consistent with Ridgeline's experience at comparable institutions, as reported by David Marchetti and confirmed by reference checks.
Assuming a best-case scenario in which BRB and Ridgeline execute a definitive agreement by April 2025 and commence implementation immediately thereafter, the earliest possible full deployment date would be approximately April 2026. More realistically, given the complexity of data migration, the need to integrate 14 BaaS partner data feeds, and the requirement for comprehensive UAT and model validation, production deployment would likely not occur until Q3 2026 (July–September 2026).
This implementation timeline is fundamentally incompatible with the Consent Order's technology-related deadlines:
•  August 1, 2025 — TMS UAT Complete and Deployed to Production: A Ridgeline implementation starting in April 2025 cannot achieve UAT completion and production deployment by August 1, 2025. This deadline cannot be met with Ridgeline.
•  October 1, 2025 — Independent Model Validation of New TMS Complete: Independent model validation cannot be performed until the system is in production. Since production deployment cannot occur by August 1, 2025, the October 1, 2025 validation deadline cannot be met.
•  November 1, 2025 — OFAC Screening Fully Operational for All BaaS Channels: Full OFAC screening operationalization requires not only platform deployment but also comprehensive integration testing with all 14 BaaS partner data feeds and validation of screening completeness. This cannot be achieved by November 1, 2025 under the Ridgeline timeline.
•  February 15, 2026 — Full Compliance Implementation; Thornfield Final Validation Report; Self-Certification Due: Even under the most optimistic implementation timeline, Ridgeline's platform would be in the early stages of production deployment (at best) by February 2026. A system that has been in production for only a few weeks or months would not be in a position to support the Thornfield final validation report or BRB's self-certification of full compliance.
A Ridgeline replacement would therefore require BRB to seek a modification or extension of the Consent Order's technology-related deadlines from the OCC. Such a request is fraught with uncertainty and risk. The OCC has discretion to grant or deny deadline modifications, and any request would need to be accompanied by a compelling justification. Given the OCC's prior frustration with BRB's failure to remediate the June 2022 MRA and November 2023 MRIA, a request for timeline extension early in the remediation process could be perceived as a continuation of the Bank's pattern of delayed and inadequate compliance response. C&H considers this a significant strategic risk.
Alternatively, BRB could continue running Veridian TMS v.8.3 in parallel during the Ridgeline implementation period. However, this approach does not address the underlying system deficiencies identified in the Consent Order, and the OCC would likely view continued reliance on the deficient v.8.3 platform — even as a bridge solution — as inconsistent with the remediation requirements.
D. Technical Capabilities Assessment
Notwithstanding the timeline limitations, Ridgeline's platform offers strong technical capabilities that merit consideration, particularly in the context of BRB's long-term technology strategy:
Purpose-Built BaaS and Fintech Integration. Ridgeline's platform was designed from the ground up for banks with significant fintech and BaaS operations. The platform offers strong native API integrations for common fintech data formats and transaction processing protocols, reducing the integration complexity and ongoing maintenance burden associated with BaaS partner data feeds.
Advanced Sanctions Screening. Ridgeline's sanctions screening module features tunable matching algorithms that, according to Ridgeline's representations and reference checks, achieve materially lower false-positive rates compared to Veridian's current v.8.3 module. Lower false-positive rates would reduce the operational burden on BRB's OFAC compliance staff and improve screening effectiveness.
Comprehensive Model Governance and Validation Tooling. Ridgeline's platform includes integrated model governance and validation tools that support ongoing periodic validation, model performance monitoring, and automated tuning recommendations. These capabilities are well-aligned with regulatory expectations for transaction monitoring model risk management.
Real-Time Transaction Monitoring. The platform provides real-time transaction monitoring with configurable rule sets and machine learning capabilities, including the ability to implement complex, multi-factor detection scenarios tailored to BaaS transaction patterns.
Reporting and Case Management. Ridgeline offers strong reporting and case management features, including customizable dashboards, automated regulatory report generation, and comprehensive audit trail functionality.
However, it is important to note that BRB has not completed a full technical proof-of-concept ("POC") with Ridgeline. The evaluation to date has been based on product demonstrations, reference checks with existing Ridgeline clients, documentation review, and vendor representations. A full POC would typically involve deploying the platform in a test environment with BRB's actual data, testing BaaS partner integrations, and evaluating detection effectiveness and false-positive rates against BRB's real transaction population. This evaluation work has not been performed, and the current assessment of Ridgeline's technical capabilities should therefore be understood as preliminary.
E. Risks and Limitations
The following risks and limitations apply to Option B:
Critical Timeline Risk. As discussed in detail in Section IV.C above, Ridgeline cannot meet the Consent Order's technology-related deadlines. This is the single most significant disqualifying factor for Ridgeline as BRB's primary remediation path. The inability to meet the August 1, 2025, October 1, 2025, November 1, 2025, and February 15, 2026 deadlines creates an unacceptable risk of Consent Order non-compliance and the associated enforcement consequences.
Implementation Complexity. A full platform replacement involves substantial implementation complexity beyond what is required for an upgrade within the existing vendor ecosystem. Specific challenges include: (a) full data migration from the Veridian platform, including historical transaction data, alert and case records, and model parameters; (b) re-integration of all 14 BaaS partner data feeds into a new platform architecture, requiring coordination with each partner's technical teams; (c) historical data porting and reconciliation to ensure continuity of regulatory records; and (d) comprehensive UAT across all transaction types, BaaS channels, and screening scenarios.
Dual-Running Costs. As quantified in Section IV.B above, BRB would face dual-running costs during the transition period, as the existing Veridian contract continues through December 2026. These costs add $6,150,000 to $8,200,000 to the total cost of the Ridgeline option and represent a significant use of limited remediation budget.
Staff Disruption and Retraining. BRB currently employs 62 full-time BSA/AML compliance staff, supplemented by 30 temporary staff from Pinnacle Consulting and 15 planned new hires. All current staff are trained on the Veridian platform. A full platform replacement would require comprehensive retraining of all BSA/AML staff on the new Ridgeline system, consuming significant time and resources during a period when BRB's compliance operations are already under extreme stress from the Consent Order remediation workload — including the clearing of the 2,400-alert backlog and the improvement of SAR filing timeliness. Retraining during active remediation creates material operational risk.
No Established Relationship or Track Record. Ridgeline is a new vendor relationship for BRB, with no track record of service delivery to the institution. While reference checks have been generally positive, the absence of an established working relationship introduces vendor onboarding risk, including the potential for misalignment of expectations, communication breakdowns, and unforeseen integration challenges.
Higher Total Cost of Ownership. As detailed in Section V below, the estimated five-year total cost of the Ridgeline option ($47,425,000) is approximately $14,625,000 higher than the Veridian upgrade option ($32,800,000). This differential is significant in the context of BRB's Board-approved remediation budget and the institution's overall financial position.
Regulatory Perception. While a vendor change could potentially be viewed by the OCC as a decisive commitment to systemic improvement, the more likely regulatory perception — given the tight Consent Order timelines — is that switching vendors mid-remediation signals instability, indecisiveness, or an inability to execute a disciplined remediation plan. OCC examiners, including Examiner-in-Charge Jonathan Frey, and Thornfield Consulting, including Robert Eastman, Senior Director, AML Transaction Monitoring, may view a mid-stream vendor change as introducing unnecessary risk and complexity into an already challenging remediation effort.
V. TOTAL COST OF OWNERSHIP COMPARISON
A. Cost Summary Table
The following table summarizes the estimated total cost of ownership for each option over a five-year horizon:
Notes on Veridian Option A Cost Structure. BRB's existing Veridian contract (VA-BRB-2023-0044) carries an ACV of $4,100,000 per year and runs through December 2026. BRB is obligated to pay this ACV regardless of whether it proceeds with the upgrade or the replacement. The incremental cost of the Veridian upgrade in Years 1 and 2 is therefore the $1,900,000 per year incremental licensing fee plus the $2,800,000 one-time implementation fee. In Years 3 through 5 (assuming contract renewal at the $6,000,000 ACV level), BRB would be paying the full $6,000,000 ACV as a new obligation (the existing $4,100,000 contract having expired). The five-year total of $32,800,000 includes both the existing contractual obligations and the incremental upgrade costs.
Notes on Ridgeline Option B Cost Structure. The Ridgeline five-year total of $47,425,000 includes three cost categories: (i) the Ridgeline contract value of $36,000,000 ($7,200,000/yr × 5); (ii) estimated implementation and migration costs of $4,250,000 (midpoint of the $3,500,000–$5,000,000 range); and (iii) estimated Veridian overlap costs of $7,175,000 (midpoint of the $6,150,000–$8,200,000 range), reflecting approximately 18–24 months of dual-running during the transition period at BRB's existing Veridian ACV of $4,100,000 per year. If BRB were to negotiate an early termination of the Veridian contract, termination penalties under VA-BRB-2023-0044 would need to be assessed; such penalties could partially offset or potentially exceed the dual-running costs, depending on the penalty structure. C&H has not yet analyzed the termination provisions in detail pending a decision on the primary remediation path.
B. Budget Context
The cost comparison must be evaluated in the context of BRB's overall remediation budget and financial position:
Board-Approved Remediation Budget. The BRB Board of Directors has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty paid to the OCC. This budget encompasses all remediation workstreams, including staffing, technology, consulting, legal, and operational enhancements. The technology upgrade allocation within the remediation budget is $4,700,000, which consists of $2,800,000 for implementation and $1,900,000 for Year 1 incremental licensing — figures that are calibrated specifically for the Veridian upgrade path.
A Ridgeline replacement would require a technology expenditure of approximately $11,450,000 in Year 1 alone ($4,250,000 implementation + $7,200,000 Ridgeline ACV, net of any Veridian overlap attributable to Year 1), which would exceed the allocated technology budget by a significant margin and require Board re-approval. Given the overall remediation budget of $42,500,000 and the numerous competing demands on that budget (staffing augmentation, Thornfield Consulting engagement, Caldera & Pope follow-up testing, enhanced training programs, policy and procedure redesign, and other workstreams), a material increase in the technology allocation would necessitate reductions in other remediation areas or a budget increase.
Total BRB Financial Outlay. Total BRB outlay including the CMP is $57,000,000 ($42,500,000 remediation budget + $14,500,000 CMP). Additional technology costs associated with a Ridgeline replacement would increase pressure on BRB's financial position. For context, BRB reported net income of $412,000,000 for fiscal year 2024 and total assets of $38,700,000,000. While the Bank's financial position is sound, the incremental costs are not trivial and would be subject to Board and shareholder scrutiny.
Shareholder Considerations. Brindoval Capital Partners LP, BRB's largest institutional shareholder with an approximately 8.3% ownership stake (approximately 14,900,000 shares), has already expressed concern regarding the magnitude of remediation costs through its Managing Partner, Julian Whitmore. Material budget increases beyond the Board-approved $42,500,000 could trigger additional shareholder scrutiny, including potential engagement from Brindoval and other institutional shareholders on capital allocation, management accountability, and Board oversight of the remediation process.
VI. CONSENT ORDER TIMELINE ALIGNMENT ANALYSIS
A. Critical Deadlines Mapping
The following table maps each Consent Order technology-related deadline against achievability for each vendor option:
The contrast between the two options is stark. The Veridian upgrade path enables BRB to meet every technology-related Consent Order deadline, whereas the Ridgeline replacement path fails to meet any of them. This fundamental timeline incompatibility is the single most important factor in C&H's recommendation.
B. Risk of Consent Order Non-Compliance
The consequences of failing to meet Consent Order deadlines are severe and multifaceted:
Additional Enforcement Actions. The OCC has the authority to pursue additional enforcement actions against BRB for failure to comply with the terms of the Consent Order, including the imposition of additional civil money penalties, the issuance of further orders (including cease and desist orders), or the pursuit of more severe remedies under 12 U.S.C. § 1818.
Potential Additional Civil Money Penalties. Under 12 U.S.C. § 1818(i)(2), the OCC may impose civil money penalties for violations of cease and desist orders (which include consent orders) of up to $1,000,000 per day per violation for Tier 3 penalties involving knowing violations or reckless disregard. Even Tier 1 penalties of up to approximately $50,000 per day could accumulate to significant amounts over the course of a missed deadline period.
Referral to DOJ. In cases involving willful or egregious violations of BSA/AML requirements, or patterns of non-compliance, the OCC and FinCEN may refer matters to the U.S. Department of Justice ("DOJ") for criminal investigation and potential prosecution. While C&H does not believe that a missed technology implementation deadline would, standing alone, constitute a basis for criminal referral, a pattern of non-compliance — including the prior MRA, MRIA, and now the Consent Order — increases the risk that any further failures could be viewed through a more serious lens.
Regulatory Credibility. The OCC's Examiner-in-Charge, Jonathan Frey, and FinCEN's Associate Director for Enforcement, Angela Drummond, are actively monitoring BRB's remediation. Missed deadlines would severely undermine BRB's credibility with these key regulatory contacts and could result in increased examination scrutiny, more prescriptive remediation requirements, and reduced institutional discretion in the design and execution of the remediation plan.
Thornfield Validation. Thornfield Consulting's final validation report, due February 15, 2026, must confirm that BRB has fully implemented the remediation requirements specified in the Consent Order. A technology platform migration that is still in progress as of that date would preclude a favorable validation finding, potentially extending the Consent Order's duration and the independent consultant engagement — with associated costs and reputational harm.
VII. REGULATORY PERCEPTION ANALYSIS
A. OCC and Examiner Considerations
Regulatory perception is a critical factor in the vendor selection analysis, separate from the technical and financial considerations discussed above. BRB's relationship with the OCC and its examination team will be shaped in significant part by the nature, speed, and quality of BRB's remediation response to the Consent Order.
OCC examiners generally view decisive, demonstrable remediation progress favorably. An institution that responds to a Consent Order with a clear plan, adequate resource commitment, and timely execution of milestones is more likely to receive favorable treatment in ongoing supervisory interactions, including the potential for early termination of the Consent Order upon demonstrated compliance.
Upgrading the incumbent transaction monitoring system to a materially improved version demonstrates responsiveness to the OCC's findings while maintaining operational continuity. This approach allows BRB to show the OCC a deployed, functioning system that addresses the specific deficiencies identified in the Consent Order — upgraded detection models, enhanced OFAC screening, improved model governance — within the deadlines established by the Consent Order. The ability to point to a system that is live, tested, and validated is a significantly more powerful regulatory narrative than a system that is under construction.
A full vendor replacement mid-remediation could be viewed by the OCC in one of two ways: (a) as a strong signal of BRB's commitment to systemic change and willingness to make bold, potentially costly decisions to ensure compliance; or (b) as an unnecessary disruption that delays remediation, introduces new risks, and reflects a lack of disciplined execution. Given the tight Consent Order timelines, C&H believes the latter interpretation is substantially more likely than the former. An institution that chooses a remediation path it knows cannot meet the regulatory deadlines invites scrutiny of its judgment, planning, and commitment to timely compliance.
Additionally, the OCC's interagency guidance on third-party risk management (OCC Bulletin 2013-29, as revised and supplemented by OCC Bulletin 2023-17) requires banking organizations to conduct thorough due diligence on new vendor relationships, including assessments of the vendor's financial condition, information security posture, business continuity capabilities, regulatory compliance history, and operational capacity. A rushed vendor selection process — undertaken under the pressure of Consent Order deadlines and without the benefit of a full technical proof-of-concept — could itself raise regulatory concerns about BRB's third-party risk management practices. The OCC could reasonably question whether BRB conducted adequate due diligence on Ridgeline if the decision was made under time pressure to switch vendors mid-remediation.
B. Thornfield Consulting Perspective
Thornfield Consulting Group LLC, engaged as the independent consultant required by the Consent Order, will play a pivotal role in evaluating BRB's technology platform as part of both its preliminary gap assessment (due April 15, 2025) and its ongoing validation of BRB's remediation progress. Thornfield's team, led by Dr. Vivian Castellano, Managing Director, and Robert Eastman, Senior Director, AML Transaction Monitoring, brings extensive experience in BSA/AML compliance program assessment and is well-positioned to evaluate the adequacy of BRB's technology infrastructure.
Thornfield's ability to validate BRB's remediation depends on the existence of a stable, deployed, and functioning transaction monitoring and sanctions screening system. A system that is in mid-implementation — with data migration ongoing, BaaS partner integrations incomplete, and detection models not yet calibrated and validated — cannot be meaningfully assessed or validated by Thornfield. The February 15, 2026 deadline for Thornfield's final validation report requires that the technology platform be fully deployed and operational with sufficient time for Thornfield to conduct its assessment, which C&H estimates requires a minimum of two to three months of system operation and performance data.
C&H recommends that BRB engage proactively with Thornfield on the technology vendor decision. Specifically, we recommend that BRB brief Dr. Castellano and Mr. Eastman on the Veridian upgrade plan, the rationale for selecting the upgrade path over a full replacement, and the maintenance of Ridgeline as a contingency option. This proactive engagement will enable Thornfield to incorporate the technology decision into its preliminary gap assessment, provide early feedback on the adequacy of the upgrade approach, and plan its own validation activities around the expected implementation timeline.
C. FinCEN Considerations
FinCEN, through Associate Director of Enforcement Angela Drummond, is actively monitoring BRB's remediation progress, with particular focus on SAR filing timeliness and quality. The transaction monitoring system is the foundational technology that generates the alerts that drive SAR investigations. Any delay in deploying an improved transaction monitoring system extends the period during which BRB's SAR filing may remain deficient — characterized by the current 78-day average filing time, the 2,400-alert backlog, and the system's simultaneous over-alerting and under-detection tendencies.
Each day that BRB operates on the deficient v.8.3 platform increases the institution's exposure to FinCEN enforcement risk. FinCEN has independent authority to impose civil money penalties for BSA violations under 31 U.S.C. § 5321 and has demonstrated a willingness to pursue enforcement actions against institutions that fail to maintain adequate transaction monitoring and SAR filing programs. The fastest path to a functioning, validated, and effective transaction monitoring system — which the Veridian upgrade provides — is therefore also the path that most effectively mitigates FinCEN enforcement risk.
VIII. CONTINGENCY FRAMEWORK: RIDGELINE AS FALLBACK
While C&H recommends the Veridian upgrade as the primary remediation path, prudent risk management requires BRB to maintain a documented contingency plan in the event that the Veridian upgrade fails to meet critical milestones. The following framework defines the trigger events, activation process, and pre-positioning steps for transitioning to Ridgeline as the primary technology vendor if the Veridian path proves unviable.
A. Trigger Events for Activating Ridgeline Contingency
The Ridgeline contingency should be activated upon the occurrence of any of the following defined trigger events:
1.  Veridian UAT Delivery Failure. Veridian fails to deliver TMS v.10.0 in a state suitable for commencement of user acceptance testing by July 1, 2025 — one month before the August 1, 2025 Consent Order deadline. This one-month buffer is necessary to provide adequate time for UAT completion and issue remediation before the production deployment deadline.
2.  OFAC Module Integration Failure. The Veridian OFAC module fails integration testing with BaaS partner transaction flows by September 1, 2025 — two months before the November 1, 2025 Consent Order deadline. This buffer is necessary to allow for remediation of integration issues and comprehensive screening validation before the full operationalization deadline.
3.  Thornfield Architectural Insufficiency Finding. Thornfield Consulting's preliminary gap assessment, due April 15, 2025, concludes