PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION PLAN
Prepared for: Belmont Ridge Bank National Association OCC Charter No. 48271
Prepared by: Calderwood & Harkness LLP C&H Matter No. 1045-00002
May 2025
For Inclusion in Comprehensive Remediation Action Plan Submitted to the Office of the Comptroller of the Currency Due Date: May 15, 2025
Consent Order Reference: OCC Consent Order No. OCC-2025-003 Effective January 15, 2025
Authors:
Reviewed by:
Right-click to update Table of Contents
I. Executive Summary
This document sets forth a detailed remediation plan (the "OFAC Screening Remediation Plan" or "Workstream 1") that addresses all deficiencies in OFAC sanctions screening identified by the Office of the Comptroller of the Currency ("OCC") in Consent Order No. OCC-2025-003 (the "Consent Order"), which became effective on January 15, 2025. This Workstream 1 plan is one of five workstreams comprising the Comprehensive Remediation Action Plan (the "Comprehensive Plan") being filed by Belmont Ridge Bank National Association ("BRB" or the "Bank") with the OCC by May 15, 2025, in accordance with the timeline established by the Consent Order.
The scope of this remediation plan is enterprise-wide, encompassing OFAC sanctions screening across all BRB business lines — retail banking, commercial lending, wealth management, and, most critically, all fourteen (14) active Banking-as-a-Service ("BaaS") fintech partnerships. The BaaS channel is the principal area of identified deficiency and the primary focus of the remediation activities described herein.
The core finding underlying this Workstream 1 is that BRB's OFAC screening system failed to achieve one hundred percent (100%) coverage of transactions processed through fintech BaaS channels. The most significant quantified gap relates to NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner by transaction volume. Approximately twelve percent (12%) of NovaPay wire and ACH transactions were not screened against OFAC sanctions lists during calendar year 2023 — representing approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed through BRB during that period. This deficiency was first identified by the OCC in a Matter Requiring Immediate Attention ("MRIA") issued in November 2023 specifically regarding OFAC screening gaps in BaaS channels. The Consent Order explicitly cites BRB's failure to adequately remediate that prior supervisory action as a basis for the current enforcement action.
The Consent Order establishes a firm deadline of November 1, 2025, for full OFAC screening operationalization across all BaaS channels. To meet this deadline, the remediation plan centers on a major technology upgrade: the deployment of Veridian Analytics Inc.'s ("Veridian") Transaction Monitoring System ("TMS") version 10.0, including an enhanced OFAC screening module, under an amended Master Services Agreement (Contract No. VA-BRB-2023-0044). User Acceptance Testing ("UAT") for the Veridian TMS v.10.0 upgrade is targeted for completion by August 1, 2025, with a three-month post-deployment validation period running through October 31, 2025. The total cost of the Veridian technology upgrade is $2,800,000 in one-time implementation fees plus $1,900,000 per year in incremental licensing costs, bringing the total annual contract value from $4,100,000 to $6,000,000 per year.
As a prudent contingency measure, BRB has identified Ridgeline Data Systems LLC ("Ridgeline") as an alternative vendor under evaluation. A mutual nondisclosure agreement has been executed, and Ridgeline has provided a preliminary proposal of $7,200,000 per year under a five-year term ($36,000,000 total contract value). The decision point for contingency activation is August 15, 2025 — two weeks after the Veridian UAT deadline — at which time BRB will assess whether the Veridian upgrade path remains viable or whether migration to Ridgeline is warranted, notwithstanding the timeline risks such migration would entail.
Beyond the technology upgrade, this plan encompasses comprehensive revisions to OFAC policies and procedures, staffing and organizational enhancements (including the addition of dedicated OFAC sanctions analyst positions as part of fifteen (15) new permanent BSA/AML department hires), BaaS partner integration and cooperation requirements, board-level and Compliance Committee governance enhancements, and ongoing testing and validation protocols. The total BRB Board-approved remediation budget across all five workstreams is $42,500,000, exclusive of the $14,500,000 civil money penalty assessed under the Consent Order. The combined total outlay, including the civil money penalty, is $57,000,000.
This plan should be read in conjunction with the four other workstream plans constituting the Comprehensive Plan and with the separate attorney-client privileged memorandum addressing OFAC enforcement risk and voluntary self-disclosure considerations.
II. Background and Regulatory Context
A. Consent Order Findings Related to OFAC Sanctions Screening
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order identified multiple categories of BSA/AML compliance deficiencies, among which inadequate OFAC sanctions screening protocols for fintech BaaS transaction flows was identified as a core deficiency category requiring immediate and comprehensive remediation.
Specifically, the Consent Order found that BRB's OFAC sanctions screening system did not achieve one hundred percent (100%) coverage of transactions processed through BaaS fintech partner channels. The OCC quantified this deficiency with particular reference to NovaPay Technologies Inc., BRB's largest BaaS partner by transaction volume. The Consent Order determined that approximately twelve percent (12%) of NovaPay wire and ACH transactions were not screened against applicable OFAC sanctions lists during calendar year 2023. In absolute terms, this represents approximately 3,800,000 unscreened transactions out of a total of approximately 31,700,000 NovaPay transactions processed during that period.
The significance of this gap is amplified by NovaPay's scale within BRB's BaaS operations. NovaPay accounts for approximately forty-one percent (41%) of total BaaS transaction volume processed by BRB. In calendar year 2024, NovaPay processed approximately $30,500,000,000 in transaction volume through BRB, out of a total of approximately $74,300,000,000 in aggregate BaaS volume across all fourteen (14) active BaaS partner relationships. NovaPay operates a consumer payments and peer-to-peer ("P2P") transfer application with approximately 2,100,000 end-user accounts. NovaPay was onboarded as a BaaS partner by BRB in 2021. NovaPay's chief executive officer is Ethan Garrison, and its principal office is located at 450 Mission Street, Suite 1200, San Francisco, California 94105.
The Consent Order further identified that the OFAC screening deficiencies were not limited to NovaPay. The OCC found that screening gaps extended across BRB's other BaaS partner integrations, albeit the NovaPay gap was the most significant both in absolute transaction volume and in the percentage of transactions that bypassed screening. The Consent Order characterized these deficiencies as presenting material risks to the safety and soundness of BRB and as constituting violations of the Bank's obligations under the Bank Secrecy Act and the regulations of the Office of Foreign Assets Control.
B. Prior Supervisory History — Escalation to Consent Order
The OFAC screening deficiencies cited in the Consent Order did not arise in a vacuum. Rather, they represent the culmination of an escalating series of supervisory actions by the OCC spanning multiple examination cycles.
In June 2022, the OCC issued a Matter Requiring Attention ("MRA") regarding BSA/AML transaction monitoring broadly. While this MRA was not exclusively focused on OFAC sanctions screening, it encompassed sanctions screening within its scope and identified concerns regarding the adequacy of BRB's transaction monitoring capabilities across certain business lines, including nascent BaaS operations.
The supervisory concern was materially escalated in November 2023, when the OCC issued a Matter Requiring Immediate Attention ("MRIA") specifically targeting OFAC screening gaps in BaaS channels. This MRIA identified, with substantial specificity, the failure of BRB's screening architecture to capture the full universe of NovaPay transactions flowing through BRB's payment infrastructure. The MRIA directed BRB to take immediate corrective action to close these screening gaps and to report progress to the OCC within prescribed deadlines.
The Consent Order explicitly cites BRB's failure to adequately remediate the November 2023 MRIA as a significant factor in the decision to escalate from supervisory findings to a formal enforcement action. The OCC determined that BRB's response to the MRIA was insufficient in scope, timeliness, and effectiveness, and that the underlying screening gaps persisted and, in certain respects, expanded as BaaS transaction volumes continued to grow without commensurate improvements in screening coverage.
It is relevant to note that prior remediation efforts in response to the June 2022 MRA and the November 2023 MRIA were managed under the direction of BRB's former outside regulatory counsel, Drayton Mercer LLP, with Helen Frazier serving as lead partner on the engagement. Following the issuance of the Consent Order in January 2025, BRB's Board of Directors and management determined that a change in outside regulatory counsel was warranted. The Drayton Mercer engagement was terminated, and Calderwood & Harkness LLP was retained effective February 10, 2025, with Philip Hartmann designated as Responsible Partner.
The OCC's determination to issue the Consent Order was further informed by a targeted BSA/AML examination conducted from March 2024 through September 2024. This examination was led by Examiner-in-Charge Jonathan Frey of the OCC's Northeastern District Office, located at 340 Madison Avenue, New York, New York 10017. The examination included detailed transaction-level analysis of BaaS channel flows and specifically tested OFAC screening coverage rates across multiple BaaS partner integrations. The examination confirmed that the screening gaps identified in the November 2023 MRIA had not been adequately remediated and quantified the scope of the deficiency at the levels reflected in the Consent Order.
Additionally, an independent BSA/AML test conducted by Caldera & Pope LLP, with Franklin Dorsey serving as Engagement Partner, was completed in September 2024. This independent assessment identified multiple OFAC screening deficiencies that were subsequently echoed in the Consent Order's findings. The Caldera & Pope findings provided an independent corroboration of the OCC's examination conclusions and highlighted systemic weaknesses in BRB's OFAC screening architecture, governance, and oversight.
C. Current State of OFAC Screening Program
As of the date of this plan, BRB's incumbent technology platform for transaction monitoring and OFAC sanctions screening is the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"). This platform includes an integrated OFAC screening module that performs both real-time and batch-processing sanctions screening functions.
The current Veridian contract carries an annual contract value ("ACV") of $4,100,000 under a three-year term agreement ending December 2026. The contract governs both the transaction monitoring system (which is the subject of Workstream 4: Transaction Monitoring System Upgrade) and the integrated OFAC screening module (which is the subject of this Workstream 1).
Veridian TMS v.8.3 was last independently validated in March 2021 — a period of over three years prior to the commencement of the OCC targeted examination in March 2024. The OFAC screening module's tuning parameters, including fuzzy matching algorithms, scoring thresholds, and screening filter configurations, were last updated in October 2022. This means that, during the critical period in which NovaPay and other BaaS partner transaction volumes were experiencing significant growth, the OFAC screening system was operating under parameters that had not been refreshed to account for evolving transaction patterns, list updates, or integration architecture changes.
Calendar year 2024 OFAC screening statistics illustrate both the operational burden of the current system and the nature of the screening deficiency. In CY 2024, the OFAC screening module generated 14,320 screening hits — i.e., instances in which a transaction or counterparty was flagged as a potential match against an OFAC sanctions list. Of these 14,320 hits, only twelve (12) were determined to be true matches requiring blocking or rejection action. This yields a false-positive rate of approximately 99.9% (calculated as (14,320 − 12) ÷ 14,320). While this false-positive rate is not atypical for OFAC screening systems deployed at BRB's transaction volumes, it imposes substantial operational burden on the BSA/AML department's screening hit review and disposition processes and underscores the need for enhanced screening logic and tuning as part of the TMS v.10.0 upgrade.
Critically, the existing system architecture failed to route certain NovaPay wire and ACH transaction flows through the OFAC screening engine. As detailed in Section III below, this failure was attributable to the manner in which NovaPay's transaction flows were integrated into BRB's payment processing infrastructure through a separate API gateway that did not feed all transaction types into the Veridian OFAC screening queue. This integration failure created the twelve percent (12%) gap in screening coverage that is at the center of the Consent Order's OFAC-related findings.
OFAC screening for BRB's legacy business lines — retail banking, commercial lending, and wealth management — appears to have operated at or near one hundred percent (100%) coverage during the relevant period. The screening gaps identified by the OCC and in independent testing are concentrated in the BaaS channel integrations. This concentration of the deficiency in the BaaS channel underscores the systemic nature of the root cause: the OFAC screening infrastructure was designed for BRB's legacy banking operations and was not adequately adapted when the Bank significantly expanded into BaaS partnerships beginning in 2021.
As of the date of this plan, no voluntary self-disclosure ("VSD") has been filed with OFAC regarding the unscreened NovaPay transactions or any other BaaS-related screening gaps. The question of whether to file a VSD is addressed in a separate companion memorandum prepared by Calderwood & Harkness LLP under attorney-client privilege. The analysis of VSD considerations is ongoing and involves assessment of OFAC enforcement guidelines, the nature and scope of the potential apparent violations, available mitigating factors, and strategic considerations related to the parallel OCC enforcement action and FinCEN monitoring.
D. Parallel Regulatory Monitoring
In addition to the OCC Consent Order, BRB's OFAC screening remediation activities are subject to monitoring by other federal regulatory agencies. Understanding this multi-agency landscape is essential to the effective implementation of this remediation plan.
The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring BRB's remediation progress. Associate Director Angela Drummond of FinCEN's Enforcement Division has been identified as the primary point of contact for FinCEN's monitoring activities. FinCEN has reserved its enforcement rights in coordination with the OCC — meaning that, while no separate FinCEN enforcement action has been filed as of February 10, 2025 (the date of Calderwood & Harkness's engagement), FinCEN has not waived or foreclosed the possibility of taking independent enforcement action based on the same or related facts. The strategic implications of FinCEN's reserved enforcement posture are addressed in a separate FinCEN Coordination Strategy Memorandum prepared by Calderwood & Harkness.
OFAC enforcement risk remains under separate assessment. The approximately 3,800,000 unscreened NovaPay transactions in CY 2023 create potential apparent violations exposure under OFAC regulations. To the extent that any of those unscreened transactions involved a counterparty on an OFAC sanctions list, BRB could face strict liability for apparent violations of OFAC-administered sanctions programs. The probability and magnitude of this exposure depend on factors including the identities and geographic profiles of the counterparties involved in the unscreened transactions, which are currently being assessed through a retroactive transaction review being coordinated with BRB's BSA/AML department.
As of the Calderwood & Harkness engagement date of February 10, 2025, no criminal referral by the OCC to the United States Department of Justice ("DOJ") has been made. However, the Consent Order does not preclude future referral, and the existence of the Consent Order and the nature of the identified deficiencies create a factual predicate that could support a referral determination in the future if the OCC or other agencies determine that the circumstances warrant criminal investigation. This risk factor further underscores the importance of timely, complete, and well-documented remediation.
III. Root Cause Analysis
Calderwood & Harkness, in conjunction with BRB's BSA Officer Thomas Ikeda, Chief Compliance Officer Patricia Langston, and CIO/CTO Linda Petrosian, and informed by the preliminary findings of Thornfield Consulting Group LLC's on-site assessment, has conducted a comprehensive root cause analysis of the OFAC screening deficiencies identified in the Consent Order. The root causes fall into four principal categories: (A) technology architecture gaps; (B) governance and oversight gaps; (C) staffing and expertise gaps; and (D) policy and procedures deficiencies. Each category is discussed in detail below. Effective remediation requires that all four root cause categories be addressed concurrently, as they are interconnected and mutually reinforcing.
A. Technology Architecture Gaps
The technology architecture gaps represent the most direct and proximate cause of the OFAC screening failures. Veridian TMS v.8.3's OFAC screening module was originally configured for BRB's legacy retail banking transaction flows, including wire transfers, ACH transactions, check processing, and card transactions. These legacy transaction flows were integrated into the Veridian screening engine through well-established data feeds and processing pipelines that had been in place since BRB's initial deployment of the Veridian platform.
When NovaPay Technologies Inc. was onboarded as a BaaS partner in 2021, however, NovaPay's P2P transfer and consumer payment transaction flows were integrated into BRB's payment processing infrastructure through a separate API gateway. This API gateway was designed to accommodate the high-volume, high-velocity characteristics of NovaPay's consumer-facing payment application. Critically, this API gateway did not feed all transaction types into the Veridian OFAC screening queue. The integration was implemented by BRB's technology team in coordination with NovaPay's engineering staff, and the OFAC screening implications of the chosen integration architecture were not adequately assessed prior to or during implementation.
Specifically, NovaPay's ACH origination files and certain wire instructions processed through NovaPay's proprietary payment interface bypassed the Veridian real-time screening engine entirely. These transactions were routed directly to the Federal Reserve payment rail without being subjected to pre-screening against OFAC sanctions lists. The architectural flaw was not one of intentional circumvention but rather of inadequate planning and integration design: the API gateway was configured to prioritize transaction throughput and processing speed, and the requirement for universal OFAC pre-screening was not embedded as a non-negotiable constraint in the system architecture.
BRB's batch-processing OFAC screening — designed as a secondary catch mechanism to complement real-time screening — was configured only for end-of-day settlement files. This configuration meant that transactions that cleared on an intra-day basis (i.e., those processed and settled before the end-of-day batch run) were not captured by the batch screening process either. The result was a compound failure: transactions that bypassed real-time screening also bypassed the batch screening safety net, leaving them entirely unscreened.
The technology architecture gaps are not limited to the NovaPay integration. Similar integration deficiencies exist to varying degrees across other BaaS partners. Of particular concern are:
FairLend Digital LLC. FairLend represents approximately twenty-eight percent (28%) of total BaaS transaction volume. FairLend is a digital lending platform that originated approximately $1,400,000,000 in loans through BRB in fiscal year 2024. FairLend's chief executive officer is Aisha Okonkwo, and its principal office is located at 100 Summer Street, Suite 800, Boston, Massachusetts 02110. FairLend's loan disbursement wire and ACH transactions were integrated through a separate processing pathway that presents OFAC screening coverage concerns similar in nature (though smaller in magnitude) to those identified for NovaPay.
VaultEdge Inc. VaultEdge represents approximately eighteen percent (18%) of total BaaS transaction volume and operates approximately 870,000 deposit accounts through BRB. VaultEdge's chief executive officer is Marcus Tan, and its principal office is located at 2200 Ross Avenue, Suite 3600, Dallas, Texas 75201. VaultEdge's deposit account funding, withdrawal, and internal transfer transactions require integration into the OFAC screening engine, and the current integration has identified gaps, particularly for internal transfer transactions between VaultEdge-originated accounts.
The remaining eleven (11) BaaS partners collectively represent approximately thirteen percent (13%) of BaaS transaction volume. While their individual transaction volumes are lower, the same architectural vulnerabilities potentially exist in their integrations, and each must be individually assessed and validated as part of this remediation plan.
B. Governance and Oversight Gaps
The technology architecture gaps described above were permitted to arise, and to persist undetected for an extended period, due to fundamental weaknesses in BRB's governance and oversight structures as they relate to OFAC compliance and BaaS operations.
Prior to the issuance of the Consent Order, BRB lacked a dedicated Compliance Committee at the Board of Directors level. BSA/AML compliance matters were reported to the Board on a quarterly basis, typically as a component of broader compliance or risk management presentations. These quarterly reports did not include OFAC screening hit rates, coverage metrics, or BaaS-partner-specific screening data. As a result, the Board of Directors did not have visibility into the OFAC screening gaps in BaaS channels and was not positioned to exercise informed oversight or to direct corrective action.
At the management level, the BaaS Division, led by Warren Ashby (Head of Fintech Partnerships), did not have a formal OFAC screening validation process for new BaaS partner integrations. When NovaPay and subsequent BaaS partners were onboarded, the BaaS Division's focus was on commercial, operational, and technical integration requirements. OFAC screening coverage was not included as a standard validation checkpoint in the BaaS partner onboarding process. This omission reflected a broader organizational failure to embed compliance requirements — and specifically OFAC screening requirements — into the BaaS partner lifecycle management framework.
No formal change management protocol existed for reviewing OFAC screening coverage when new fintech partners were onboarded or when existing partners modified their transaction processing workflows. BaaS partners routinely introduced new transaction types, modified payment flows, or adjusted API integrations over time. Each such change carried the potential to affect OFAC screening coverage, but there was no systematic mechanism for identifying, assessing, and validating the screening implications of such changes.
Additionally, the technology function under CIO/CTO Linda Petrosian was not integrated into the OFAC compliance review process for new BaaS integrations. Technology decisions regarding API gateway architecture, data routing, and payment processing workflows were made by the technology team in coordination with BaaS partners' engineering staff, but without systematic input from, or oversight by, the BSA/AML compliance function. The compliance and technology teams operated in organizational silos that prevented effective collaboration on OFAC screening architecture.
C. Staffing and Expertise Gaps
BRB's BSA/AML department was understaffed relative to the complexity and volume of OFAC screening activities required by the Bank's BaaS operations. As of January 2025, the BSA/AML department had a headcount of sixty-two (62) full-time equivalents ("FTEs"). This staffing level was insufficient for the volume of OFAC screening hit review and disposition required — 14,320 hits in CY 2024, each of which required individual analyst review to determine whether it represented a true match or a false positive.
Critically, no dedicated OFAC sanctions analyst role existed within BRB's compliance organizational structure. OFAC screening hit review and disposition were handled as an adjunct function by general BSA/AML analysts whose primary responsibilities encompassed a wide range of transaction monitoring and suspicious activity reporting tasks. These analysts did not receive specialized OFAC training, and the organization lacked personnel with deep subject-matter expertise in OFAC sanctions programs, list structures, or enforcement patterns.
Thomas Ikeda, appointed as BSA Officer in March 2023, brought significant experience in BSA/AML compliance. However, Mr. Ikeda did not have direct visibility into BaaS-specific OFAC screening coverage metrics. The information flows to the BSA Officer regarding OFAC screening performance were limited to aggregate metrics that did not disaggregate screening coverage by channel, partner, or transaction type. This information gap prevented the BSA Officer from identifying the BaaS-specific screening deficiencies that were subsequently identified by the OCC.
D. Policy and Procedures Deficiencies
The governance, technology, and staffing gaps described above were compounded by fundamental deficiencies in BRB's written OFAC compliance policies and procedures.
BRB's existing OFAC compliance policy did not include BaaS-channel-specific screening requirements. The policy was drafted to address BRB's legacy banking operations and was not updated when the Bank entered the BaaS business. As a result, the policy provided no guidance on how OFAC screening should be applied to transactions processed through fintech partner channels, what coverage standards applied, or how screening architecture should be designed and validated for BaaS integrations.
The screening procedures manual lacked documentation of real-time versus batch processing workflows for fintech partner transaction flows. Operational staff did not have access to documented procedures specifying how each BaaS partner's transaction types were routed through the screening engine, what transaction types were covered by real-time screening versus batch screening, or how to identify and escalate potential coverage gaps.
No OFAC-specific testing protocol existed for validating one hundred percent (100%) screening coverage of BaaS transactions. While BRB conducted periodic testing of certain BSA/AML program components, there was no standing test plan that specifically targeted OFAC screening coverage rates across BaaS channels.
Finally, BRB's OFAC list management procedures — governing the ingestion, deployment, and maintenance of the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, Sectoral Sanctions Identifications Lists ("SSI"), and non-SDN lists (such as the Foreign Sanctions Evaders List and the Palestinian Legislative Council List) — were not updated to reflect the volume, velocity, and complexity of BaaS transaction processing. List updates were applied within twenty-four (24) hours of OFAC publication, but no expedited process existed for critical SDN updates, and there was no mechanism for verifying that list updates were propagated across all screening nodes, including those serving BaaS transaction flows.
IV. Remediation Objectives
Based on the Consent Order requirements, the root cause analysis set forth in Section III above, and the consultative input of Thornfield Consulting Group LLC's on-site assessment team, Calderwood & Harkness and BRB management have defined the following eight (8) remediation objectives for Workstream 1. These objectives are designed to comprehensively address each identified deficiency and to establish a sustainable OFAC screening program that meets regulatory expectations on a going-forward basis.
Objective 1: Achieve 100% OFAC Sanctions Screening Coverage for All Transaction Types Across All Business Lines. The foundational objective of this remediation plan is to ensure that every transaction processed through BRB — across retail banking, commercial lending, wealth management, and all fourteen (14) active BaaS fintech partner channels — is screened against all applicable OFAC sanctions lists prior to execution, or, where real-time pre-screening is not technically feasible, through a comprehensive batch-processing secondary screening mechanism that ensures no transaction passes through BRB's payment infrastructure without being screened.
Objective 2: Eliminate the Technology Architecture Gap. The specific technology integration failures that permitted approximately twelve percent (12%) of NovaPay transactions (and transactions from other BaaS partners) to bypass the OFAC screening engine must be eliminated through fundamental redesign of the API gateway architecture and transaction routing logic. This objective encompasses not only the NovaPay integration but all BaaS partner integrations, and extends to ensuring that the screening architecture is resilient against future integration changes.
Objective 3: Deploy the Veridian TMS v.10.0 Upgrade with Enhanced OFAC Module. The primary technology remediation mechanism is the deployment of Veridian TMS v.10.0, which includes a substantially enhanced OFAC screening module designed to support real-time and batch screening for all BaaS partner transaction flows. User Acceptance Testing for the upgraded platform is targeted for completion by August 1, 2025, with production deployment concurrent with UAT completion.
Objective 4: Implement Robust OFAC Screening Procedures. BRB must develop and implement comprehensive, written OFAC screening procedures that cover the full lifecycle of screening operations, including real-time interdiction, batch processing, hit review and disposition, escalation protocols, blocking and rejection actions, OFAC reporting requirements (including ten-day blocking reports), voluntary self-disclosure procedures, and recordkeeping requirements.
Objective 5: Establish Ongoing OFAC Screening Testing and Validation Protocols. To ensure sustained compliance, BRB must implement a standing OFAC screening testing framework that includes quarterly independent testing of screening coverage across all channels, independent model validation, and continuous monitoring of screening performance metrics.
Objective 6: Complete Full OFAC Screening Operationalization by November 1, 2025. All remediation activities must converge on the Consent Order deadline of November 1, 2025, by which date OFAC screening must be fully operational across all BaaS channels with demonstrated one hundred percent (100%) coverage.
Objective 7: Revise Enterprise-Wide OFAC Policies and Procedures and Train All Relevant Personnel. BRB's OFAC compliance policy, screening procedures manual, and BaaS-specific screening protocols must be comprehensively revised, and all relevant personnel — including BSA/AML staff, BaaS relationship managers, technology staff, and front-line employees — must be trained on the revised policies and procedures.
Objective 8: Implement Board-Level and Compliance Committee Reporting on OFAC Screening Metrics. The governance framework must be enhanced to provide the Board of Directors and the Board Compliance Committee with regular, detailed reporting on OFAC screening metrics, including coverage rates, hit rates, true-match rates, false-positive rates, blocking and rejection actions, list update timeliness, and BaaS-partner-specific screening data.
V. Remediation Action Items and Implementation Plan
This Section V sets forth the specific remediation action items and implementation steps that BRB will undertake to achieve the eight remediation objectives identified in Section IV. The action items are organized into five categories: (A) Technology Upgrade; (B) BaaS Channel Integration Requirements; (C) Policy and Procedure Revisions; (D) Staffing and Organizational Enhancements; and (E) Board and Governance Enhancements.
A. Technology Upgrade — Veridian TMS v.10.0 and OFAC Module Enhancement
The technology upgrade is the most complex and time-critical element of the remediation plan. BRB's ability to meet the November 1, 2025 deadline is predicated on the successful deployment of the Veridian TMS v.10.0 upgrade, including the enhanced OFAC screening module, within the timeline set forth below.
A.1. Veridian MSA Amendment and SOW Execution
BRB will execute an amendment to its existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) to govern the TMS v.10.0 upgrade. The amendment addresses the following key commercial and technical terms:
One-Time Implementation Cost. The TMS v.10.0 upgrade carries a one-time implementation cost of $2,800,000. This amount covers software licensing, configuration, customization for BRB's specific architecture, integration development for all fourteen (14) BaaS partner transaction flows, testing support, and deployment assistance. This implementation cost is shared across Workstream 1 (OFAC Screening Remediation) and Workstream 4 (Transaction Monitoring System Upgrade), as the TMS v.10.0 platform encompasses both OFAC screening and broader transaction monitoring capabilities.
Incremental Annual Licensing. The TMS v.10.0 upgrade will increase BRB's annual licensing fees by $1,900,000, bringing the total annual contract value from $4,100,000 to $6,000,000 per year. The incremental licensing covers the enhanced OFAC module, expanded transaction processing capacity, additional screening nodes required for BaaS transaction flows, and enhanced list management and hit disposition workflow functionality.
Separate Statement of Work. A separate Statement of Work ("SOW") for the OFAC module enhancement has been developed and is being negotiated with Veridian. The SOW details the specific requirements for the OFAC screening upgrade, including: (i) real-time screening integration for all fourteen (14) BaaS partner transaction flows; (ii) batch processing capabilities covering all intra-day and end-of-day transaction files; (iii) enhanced list management for the SDN List, Consolidated Sanctions List, Sectoral Sanctions Identifications Lists, and all non-SDN lists; and (iv) hit disposition workflow enhancements, including tiered review, automated routing, case management, and reporting.
The key Veridian contact for the engagement is Priya Subramanian, Vice President of Client Solutions, located at Veridian's principal office at 1900 Embarcadero Road, Suite 400, Palo Alto, California 94303. Ms. Subramanian has served as BRB's primary Veridian relationship manager since the inception of the engagement.
The MSA amendment and SOW have been negotiated and drafted by Calderwood & Harkness, with particular attention to performance benchmarks and contractual remedies for implementation delays. Given the criticality of the August 1, 2025 UAT deadline to BRB's ability to meet the November 1, 2025 Consent Order deadline, the MSA amendment includes liquidated damages provisions and milestone-based payment holdbacks designed to incentivize timely delivery by Veridian. Carlos Espinoza of Calderwood & Harkness transmitted the draft MSA amendment and SOW to Priya Subramanian on March 5, 2025. Negotiations are ongoing, with a target execution date of April 30, 2025.
A.2. Real-Time Screening Integration for BaaS Channels
The core technical remediation activity is the redesign of BRB's API gateway architecture to ensure that all BaaS partner transaction types are routed through the Veridian OFAC screening engine before reaching any payment rail. This redesign must be comprehensive, covering every transaction type processed by every BaaS partner, and must be implemented in a manner that eliminates the possibility of future bypass due to integration changes or partner workflow modifications.
The integration requirements are specific to each major BaaS partner and must address the unique transaction processing characteristics of each partner's platform:
NovaPay Technologies Inc. The NovaPay integration is the highest priority given NovaPay's status as BRB's largest BaaS partner (41% of BaaS transaction volume) and the specific identification of NovaPay in the Consent Order findings. The integration redesign must ensure that all NovaPay wire and ACH origination files, as well as all P2P transfer instructions processed through NovaPay's proprietary payment interface, are routed through the Veridian real-time OFAC screening engine prior to submission to the Federal Reserve payment rail or any other payment network. This addresses the twelve percent (12%) gap — representing approximately 3,800,000 unscreened transactions in CY 2023 out of approximately 31,700,000 total NovaPay transactions. The integration must also accommodate NovaPay's continued transaction volume growth, which is projected to exceed 35,000,000 transactions in CY 2025 based on current trends.
FairLend Digital LLC. The FairLend integration must capture all loan disbursement wires and ACH transactions, as well as borrower payment processing flows, in the Veridian OFAC screening engine. FairLend's digital lending model involves disbursement of loan proceeds to borrower accounts through BRB's payment infrastructure, and each such disbursement must be screened against OFAC sanctions lists before execution.
VaultEdge Inc. The VaultEdge integration must capture deposit account funding transactions, withdrawal transactions, and internal transfers between VaultEdge-originated accounts. Internal transfers present particular integration challenges because they may not traverse traditional payment rails and may instead be processed as book entries within BRB's core banking system.
Remaining Eleven (11) BaaS Partners. Each of the remaining BaaS partners requires individual transaction type mapping and integration validation. While their collective volume (13% of BaaS transactions) is lower than the three major partners identified above, each integration must achieve one hundred percent (100%) OFAC screening coverage, and none may be treated as a lower priority from a compliance perspective.
BRB's CIO/CTO, Linda Petrosian, is responsible for the internal technology infrastructure changes and API reconfiguration necessary to implement the redesigned screening architecture. Ms. Petrosian's technology team will work in close coordination with Veridian's implementation team and with each BaaS partner's engineering staff.
A critical technical requirement is that real-time screening must achieve sub-second latency to avoid introducing unacceptable delays into payment processing workflows. Consumer-facing payment applications, such as NovaPay's P2P transfer platform, have low latency tolerance, and any screening-induced delay that materially degrades the end-user experience could have commercial consequences for both BRB and its BaaS partners. The Veridian TMS v.10.0 OFAC module is designed to achieve sub-second screening latency for individual transactions, but this capability must be validated under production-level transaction volumes during UAT.
A.3. Batch Processing Redesign
While real-time screening is the primary screening mechanism, batch processing serves as an essential secondary screening layer. The batch processing architecture must be fundamentally redesigned to eliminate the current limitation that restricts batch screening to end-of-day settlement files.
The redesigned batch processing protocol will implement multiple daily batch screening runs, with a minimum frequency of four (4) runs per day: an opening-of-business batch, a midday batch, an end-of-day batch, and an overnight batch. This frequency ensures that transactions processed during any intra-day period are subjected to batch screening within hours, rather than awaiting the next end-of-day cycle.
Additionally, the batch screening process must be configured to provide retrospective screening coverage during any period of real-time screening outage or system degradation. In the event that the real-time screening engine experiences downtime, whether due to planned maintenance, unplanned system failure, or performance degradation, all transactions processed during the outage period must be queued for immediate batch screening upon system restoration. Transactions identified as potential matches during retrospective batch screening must be flagged for immediate review and potential recall or blocking action.
The batch processing redesign will also incorporate enhanced list management propagation verification, ensuring that any OFAC list updates published between batch runs are applied to the next batch cycle and that the list version used for each batch run is logged for audit trail purposes.
A.4. OFAC List Management Enhancement
Effective OFAC screening requires timely and accurate deployment of all applicable sanctions lists. The Veridian TMS v.10.0 upgrade will include substantially enhanced list management capabilities.
The upgraded system will support automated ingestion and deployment of all OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, the Sectoral Sanctions Identifications List ("SSI List"), and all non-SDN lists, including the Foreign Sanctions Evaders List, the Palestinian Legislative Council List, the Non-SDN Menu-Based Sanctions List, and any additional lists published by OFAC.
List update frequency will be enhanced from the current standard of within twenty-four (24) hours of OFAC publication to a target of within four (4) hours for SDN List updates. The SDN List represents the most critical and frequently updated sanctions list, and expedited deployment of SDN updates is essential to maintaining screening effectiveness. For other list types, the twenty-four (24) hour deployment standard will be maintained as a maximum, with best-efforts deployment within twelve (12) hours.
The fuzzy matching algorithm will be tuned as part of the TMS v.10.0 upgrade to reduce the false-positive rate while maintaining — and, where possible, enhancing — detection sensitivity. As noted in Section II.C above, the current false-positive rate of approximately 99.9% (14,320 hits with only 12 true matches in CY 2024) imposes substantial operational burden and risks desensitizing analysts through alert fatigue. The tuning process will be conducted in phases, with each phase followed by a validation assessment to ensure that sensitivity has not been compromised. The tuning approach will balance false-positive reduction against the imperative of maintaining zero tolerance for false-negative outcomes (i.e., true matches that are not flagged by the screening engine).
A.5. Hit Disposition Workflow Enhancement
The Veridian TMS v.10.0 upgrade will include significant enhancements to the OFAC screening hit disposition workflow, replacing the current manual and fragmented processes with an automated, tiered review framework.
The enhanced workflow will incorporate automated alert routing and case management within the TMS platform. Each OFAC screening hit will be automatically assigned a risk score and routed to the appropriate review tier based on the score and the characteristics of the flagged transaction.
The tiered review framework consists of three levels:
Level 1 — Analyst Review. Level 1 review is conducted by junior BSA/AML analysts and is focused on the disposition of obvious false positives. Level 1 analysts will be provided with standardized decision criteria and disposition templates to enable efficient and consistent review. Given the current 99.9% false-positive rate, the majority of screening hits are expected to be disposed of at Level 1.
Level 2 — Senior Analyst Review. Level 2 review is conducted by senior BSA/AML analysts with OFAC-specific training and is reserved for hits that cannot be definitively classified as false positives at Level 1 — i.e., potential matches that require additional research, data gathering, or analysis. Level 2 analysts will have access to enhanced research tools and databases to support their determinations.
Level 3 — BSA Officer / OFAC Compliance Officer Escalation. Level 3 escalation is triggered for confirmed or probable matches. At this level, the BSA Officer (Thomas Ikeda) or a designated OFAC compliance officer will make the final determination regarding blocking, rejection, or other required action. Level 3 escalation includes notification to the Chief Compliance Officer (Patricia Langston) and, where warranted, to the General Counsel (Gregory Nardone) and outside counsel (Calderwood & Harkness).
The hit disposition workflow will be fully integrated with BRB's payment processing systems to enable real-time interdiction of confirmed matches. When a Level 3 determination results in a blocking or rejection action, the system will automatically block the transaction and prevent it from reaching the payment rail. For transactions that have already been processed (e.g., those identified through batch screening), the system will generate alerts for recall or blocking action in accordance with OFAC regulations.
The upgraded system will also include automated generation of ten-day OFAC blocking reports, which are required to be filed with OFAC within ten (10) business days of any blocking action. Automated report generation will ensure that filing obligations are met consistently and that all required data elements are captured accurately.
B. BaaS Channel Integration Requirements
B.1. Partner-by-Partner Integration Mapping
A foundational prerequisite to the technology upgrade is the comprehensive mapping of all transaction types processed by each of the fourteen (14) BaaS partners. This mapping exercise will identify the full universe of transaction types that must be routed through the OFAC screening engine and will reveal any current screening coverage gaps for each partner.
The integration mapping deliverable for each BaaS partner will include: (i) a complete inventory of transaction types processed through BRB (wire, ACH, card, P2P, loan disbursement, deposit funding, withdrawal, internal transfer, and any other transaction types); (ii) the current data routing path for each transaction type, including identification of whether each type is currently routed through the Veridian OFAC screening engine for real-time screening, batch screening, or neither; (iii) identification of current screening coverage gaps, quantified by transaction volume where data is available; and (iv) development of integration specifications for each partner's transaction flows into the upgraded Veridian OFAC screening engine, including API documentation, data field mapping, message format specifications, and latency requirements.
The integration mapping will be conducted in priority order based on each partner's share of BaaS transaction volume: NovaPay (41%), FairLend Digital (28%), VaultEdge (18%), and then the remaining eleven (11) partners (13% collectively). The mapping exercise for all fourteen partners is targeted for completion by March 31, 2025, with Warren Ashby (Head of Fintech Partnerships / BaaS Division) and Linda Petrosian (CIO/CTO) jointly responsible for delivery.
B.2. BaaS Partner Cooperation and Data Sharing
The success of the OFAC screening remediation depends on the active cooperation of BRB's BaaS partners. Each partner must provide complete and standardized transaction data feeds that enable BRB to achieve one hundred percent (100%) OFAC screening coverage. To secure this cooperation, BRB is taking the following actions:
Compliance Remediation Letters. Calderwood & Harkness, on behalf of BRB, has issued formal compliance remediation letters to NovaPay Technologies Inc. (addressed to Ethan Garrison, Chief Executive Officer) and FairLend Digital LLC (addressed to Aisha Okonkwo, Chief Executive Officer). These letters inform each partner of the OFAC screening deficiencies identified in the Consent Order, describe the remediation requirements, and demand enhanced cooperation, data sharing, and compliance commitments. The letters also identify the potential consequences of non-cooperation, including contractual remedies and possible termination of the BaaS partnership.
Model Compliance Addendum. Calderwood & Harkness is drafting a model compliance addendum to be executed with all fourteen (14) BaaS partners. This addendum will supplement each partner's existing BaaS agreement and will impose explicit OFAC compliance obligations, including: requirements for complete transaction data feeds in standardized formats; obligations to cooperate with BRB's OFAC screening processes; data sharing provisions enabling BRB to screen all transactions prior to execution; audit rights allowing BRB (and its regulators) to verify the completeness and accuracy of partner data feeds; and remediation cooperation obligations requiring each partner to support BRB's implementation of the Veridian TMS v.10.0 upgrade.
Partner Engagement Coordination. Warren Ashby (Head of Fintech Partnerships / BaaS Division) will serve as the primary coordinator for BaaS partner engagement throughout the remediation period. Mr. Ashby will manage the execution of compliance addenda, coordinate technical integration activities between BaaS partner engineering teams and BRB's technology organization, and serve as the escalation point for partner non-cooperation issues.
B.3. New BaaS Partner Onboarding OFAC Screening Validation
To prevent recurrence of the identified deficiencies, BRB will implement mandatory OFAC screening integration testing and validation requirements for any new BaaS partner onboarding going forward. These requirements will be embedded in BRB's BaaS partner onboarding process and will include:
Pre-Launch Integration Testing. Any new BaaS partner must undergo comprehensive OFAC screening integration testing prior to processing any live transactions through BRB. This testing must demonstrate that all transaction types processed by the new partner are routed through the Veridian OFAC screening engine and that screening coverage is at one hundred percent (100%).
Change Management Protocol. A formal change management protocol will be established requiring OFAC screening coverage re-validation whenever an existing BaaS partner modifies its transaction processing workflows, introduces new transaction types, changes its API integration, or otherwise alters the manner in which transactions flow through BRB's payment infrastructure. This protocol addresses the root cause identified in Section III.B regarding the absence of change management processes for OFAC screening coverage.
BSA Officer Certification. No new BaaS partner will be permitted to process live transactions through BRB until the BSA Officer (Thomas Ikeda) has issued a written pre-launch certification confirming that one hundred percent (100%) OFAC screening coverage has been achieved and validated for all of the new partner's transaction types.
C. Policy and Procedure Revisions
C.1. Revised OFAC Compliance Policy
Calderwood & Harkness, in collaboration with BRB's Chief Compliance Officer (Patricia Langston) and BSA Officer (Thomas Ikeda), is drafting a comprehensive revised OFAC compliance policy that addresses all business lines and transaction channels, including the BaaS channel. The revised policy will establish BRB's enterprise-wide OFAC compliance framework and will serve as the authoritative policy document governing all OFAC-related activities across the organization.
The revised policy will address the following core areas:
(a) Sanctions screening requirements for all transaction types across all business lines (retail banking, commercial lending, wealth management, and BaaS);
(b) Interdiction and blocking procedures, including real-time interdiction for confirmed matches and procedures for blocking property of designated persons or entities;
(c) Escalation and reporting protocols, including the ten-day OFAC blocking report filing requirement, procedures for voluntary self-disclosures, and annual OFAC reporting obligations;
(d) List management requirements, including list ingestion frequency, deployment verification, and record retention;
(e) BaaS partner obligations, including data sharing requirements, integration standards, pre-launch certification, and change management protocols;
(f) Recordkeeping requirements, including maintenance of screening results, hit disposition records, blocking actions, and correspondence with OFAC; and
(g) Roles and responsibilities of key personnel, including the BSA Officer, Chief Compliance Officer, OFAC analysts, BaaS relationship managers, and the Board Compliance Committee.
The revised policy will be finalized and adopted by BRB management with the approval of the Board Compliance Committee, chaired by James Rutherford.
C.2. OFAC Screening Procedures Manual
Complementing the revised OFAC compliance policy, Calderwood & Harkness is developing a detailed OFAC screening procedures manual that will provide operational guidance for all personnel involved in OFAC screening activities. The manual will include:
(a) Operational procedures for real-time and batch processing screening workflows for all transaction types, including wire transfers, ACH transactions, card transactions, P2P transfers, loan disbursements, and all BaaS partner transaction flows;
(b) Hit review and disposition procedures with role-specific instructions for Level 1 analysts, Level 2 senior analysts, and Level 3 escalation to the BSA Officer and OFAC compliance officer;
(c) False-positive management protocols, designed to enable efficient disposition of the high volume of false-positive alerts while maintaining rigorous detection standards (addressing the current 99.9% false-positive rate);
(d) Escalation procedures to the BSA Officer (Thomas Ikeda) and Chief Compliance Officer (Patricia Langston), with clearly defined escalation triggers, response timeframes, and documentation requirements;
(e) OFAC reporting procedures, covering the preparation and filing of ten-day blocking reports, voluntary self-disclosures, and any other required reports to OFAC; and
(f) Quality assurance procedures for ongoing monitoring of screening accuracy, completeness, and timeliness.
C.3. BaaS-Specific OFAC Screening Addendum
In addition to the enterprise-wide OFAC compliance policy and screening procedures manual, a dedicated BaaS-Specific OFAC Screening Addendum will be developed. This addendum will address the unique screening challenges and requirements associated with BaaS partner transaction flows, including:
(a) Detailed procedures for OFAC screening of each BaaS partner's transaction flows, organized by partner and transaction type;
(b) Partner-specific screening parameters where warranted by risk assessment (e.g., enhanced screening for higher-risk transaction types, geographic concentrations, or partner-specific risk factors);
(c) Procedures for handling screening outages or system degradation in BaaS channels, including mandatory manual screening fallback procedures, transaction hold protocols, and escalation requirements; and
(d) Procedures for ongoing monitoring and validation of BaaS-specific screening coverage, including daily coverage rate reporting and immediate escalation for any identified gaps.
D. Staffing and Organizational Enhancements
BRB will make significant staffing and organizational enhancements to support the OFAC screening remediation and to build sustainable OFAC compliance capacity on a going-forward basis.
As part of the broader BSA/AML department staffing enhancement, BRB will add fifteen (15) new permanent FTE positions, increasing the department headcount from sixty-two (62) to seventy-seven (77) FTEs. The total fully loaded cost for the fifteen new positions is estimated at $2,250,000 (based on an average fully loaded cost of $150,000 per FTE). Of these fifteen new positions, at least four (4) will be dedicated to OFAC sanctions compliance: three (3) dedicated OFAC Sanctions Analyst positions and one (1) OFAC Team Lead position. The estimated fully loaded cost for these four OFAC-dedicated positions is approximately $600,000 per year.
The OFAC Team Lead will report to the BSA Officer (Thomas Ikeda) and will have direct responsibility for the day-to-day management of OFAC screening operations, including hit review and disposition, list management, escalation, and reporting. The dedicated OFAC Sanctions Analysts will be recruited from candidates with specific experience in sanctions compliance, OFAC regulations, and screening technology platforms.
To bridge the staffing gap during the remediation period, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide interim OFAC screening hit review support. The Pinnacle engagement provides thirty (30) temporary FTE analysts over a twelve-month period, at a total contract value of $3,600,000 (calculated as 30 FTEs × $10,000/month × 12 months). The Pinnacle engagement is governed by SOW Reference PCS-BRB-2025-0012 and is managed by Andrea Solis, Director of Managed Services, at Pinnacle's office at 90 Broad Street, 20th Floor, New York, New York 10004. The Pinnacle analysts will supplement BRB's existing BSA/AML staff during the remediation period and will be assigned to OFAC screening hit review and disposition activities to reduce the operational burden on BRB's internal team during the period of heightened screening volume associated with system upgrade, tuning, and validation.
OFAC-specific training will be provided to all screening personnel, BaaS relationship managers, and relevant front-line staff. The training program will cover OFAC sanctions programs, list structures, screening procedures, hit disposition protocols, escalation requirements, and reporting obligations. The training budget is drawn from the overall $1,800,000 training and policy development budget a