WORKSTREAM 2
SAR BACKLOG CLEARANCE & PROCESS IMPROVEMENT PLAN
Remediation Action Plan
Belmont Ridge Bank National Association
Component of the Comprehensive Remediation Action Plan Prepared in Response to OCC Consent Order No. OCC-2025-003
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 OCC Charter No. 48271 FDIC Certificate No. 31845
May 15, 2025 For Submission to the Office of the Comptroller of the Currency as Part of the Comprehensive Remediation Action Plan
ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT This document and all attachments are protected by the attorney-client privilege and/or the work-product doctrine. This document was prepared by Calderwood & Harkness LLP at the direction of Belmont Ridge Bank National Association in anticipation of litigation and for the purpose of providing legal advice in connection with the regulatory remediation described herein. No portion of this document may be disclosed, copied, or distributed without the express prior written consent of Calderwood & Harkness LLP and Belmont Ridge Bank National Association.
Authors:
Philip Hartmann, Responsible Partner Yuki Nakamura, Lead Associate Carlos Espinoza, Working Associate
Right-click to update Table of Contents
1. Executive Summary
This Workstream 2 plan addresses the suspicious activity report ("SAR") filing deficiencies identified in OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or "Belmont Ridge"). The Consent Order identified pervasive and longstanding deficiencies in BRB's suspicious activity monitoring and reporting processes, including an unacceptable accumulation of unreviewed transaction monitoring alerts and systemic failures in SAR filing timeliness. This plan sets forth a comprehensive strategy and detailed implementation roadmap designed to achieve full remediation of these deficiencies within the timeframes mandated by the Consent Order and in accordance with the expectations of the Office of the Comptroller of the Currency (the "OCC") and the Financial Crimes Enforcement Network ("FinCEN").
The plan is organized around two core objectives. First, BRB will complete the clearance of the backlog of approximately 2,400 unreviewed suspicious activity alerts that had accumulated as of the OCC examination date of September 2024. Second, BRB will implement systematic process improvements designed to reduce the average SAR filing time from the current 78-day average to within 30 days of alert generation, consistent with FinCEN guidance and OCC supervisory expectations regarding timely filing. These objectives are interrelated: backlog clearance is a necessary predicate to the restoration of normal-course compliance operations, and process improvement is essential to ensure that a backlog of this nature does not recur.
To accomplish these objectives, the plan encompasses the following principal components:
• A comprehensive SAR lookback project covering the period from January 1, 2022 through September 30, 2024, with an estimated budget of $5,500,000, designed to identify and remediate any previously undetected suspicious activity that should have been reported during the period when BRB's SAR processes were deficient;
• The deployment of 30 temporary full-time-equivalent ("FTE") compliance analysts through Pinnacle Compliance Solutions LLC ("Pinnacle"), a managed services provider, to augment BRB's existing BSA/AML compliance staff during the remediation period;
• The implementation of enhanced quality review standards for SAR narratives, alert dispositions, and investigation documentation;
• The development and adoption of revised SAR policies and procedures reflecting regulatory expectations and best practices; and
• The establishment of a sustainable post-remediation quality assurance framework designed to maintain compliance beyond the conclusion of the remediation period.
The key milestone for backlog clearance is June 30, 2025, by which date all 2,400 unreviewed alerts must be fully reviewed, dispositioned, and, where warranted, associated SAR filings completed and submitted to FinCEN. An interim milestone requires submission of an interim SAR backlog status report to the OCC by March 31, 2025, providing the OCC with visibility into the progress of backlog clearance during the critical early phase of remediation.
This workstream is closely coordinated with Thornfield Consulting Group LLC ("Thornfield"), the independent consultant engaged pursuant to the Consent Order under engagement reference TCG-BRB-2025-001. Thornfield's preliminary gap assessment, due April 15, 2025, will inform the refinement of the lookback scope and methodology described in Section 5 of this plan. Dr. Vivian Castellano, Managing Director at Thornfield, serves as the lead engagement director and will review and validate the SAR remediation methodology and outcomes as part of Thornfield's broader independent assessment.
The total SAR-related remediation investment contemplated by this plan is substantial. The SAR lookback project carries an estimated budget of $5,500,000. In addition, BRB will bear a proportional share of the Pinnacle staffing costs, which total $3,600,000 for a 12-month engagement across all remediation workstreams, as well as the costs associated with internal headcount additions of 15 permanent FTEs planned under Workstream 5. These expenditures are within the Board-approved remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty imposed under the Consent Order, bringing total financial outlay including the CMP to $57,000,000).
For context, BRB filed 3,847 SARs in calendar year ("CY") 2024, a 32% increase from the 2,914 SARs filed in CY 2023. BRB's transaction monitoring system generated 41,500 transaction monitoring alerts in CY 2024, yielding a SAR conversion rate of approximately 9.3%. Notably, BaaS-related SARs accounted for 2,108 of the 3,847 total SARs filed in CY 2024, representing 54.8% of all SAR filings — a proportion that underscores the disproportionate risk concentration in BRB's fintech partner channels and the need for heightened monitoring and reporting in these areas. BRB also filed 28,612 currency transaction reports ("CTRs") in CY 2024.
FinCEN is monitoring BRB's SAR filing remediation through FinCEN Associate Director Angela Drummond of the Enforcement Division. While no separate FinCEN enforcement action has been filed as of the date of this plan, FinCEN has expressly reserved enforcement rights in coordination with the OCC. Calderwood & Harkness has prepared a separate FinCEN Coordination Strategy Memorandum addressing the strategy for proactive engagement with FinCEN throughout the remediation period. The prospect of a separate FinCEN enforcement action remains a material risk that must be managed through demonstrated, tangible progress on SAR remediation, timely and transparent reporting, and careful privilege management.
This plan is submitted to the OCC on May 15, 2025, as a component of the Comprehensive Remediation Action Plan. It should be read in conjunction with the other workstream plans, the master remediation timeline, and the governance framework documents referenced herein.
2. Background and Regulatory Context
2.1 Consent Order Findings — SAR Deficiencies
OCC Consent Order No. OCC-2025-003, issued January 15, 2025, identified significant deficiencies in BRB's suspicious activity monitoring and SAR filing program. The Consent Order was the culmination of a multi-year supervisory process during which the OCC identified, escalated, and ultimately determined that BRB had failed to adequately remediate critical weaknesses in its Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program.
The Consent Order's findings with respect to SAR deficiencies are detailed and specific. The OCC identified the following principal deficiencies:
Backlog of Unreviewed Alerts. As of the OCC examination date of September 2024, BRB had accumulated a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed. These alerts had been generated by BRB's transaction monitoring system and through manual referrals from business lines, BaaS partner escalations, and law enforcement inquiries, but had not been subjected to the investigation and disposition process required by BRB's own BSA/AML policies and procedures, FinCEN regulations, and OCC supervisory expectations. The existence of a backlog of this magnitude represents a fundamental failure to perform the core compliance function of investigating potentially suspicious activity.
SAR Filing Timeliness. The OCC found that BRB's average SAR filing time was 78 days from alert generation. This average far exceeds the regulatory expectation of timely filing, which is typically within 30 days of initial detection of facts that may constitute a basis for filing a SAR, consistent with 31 C.F.R. § 1020.320(b)(3) and FinCEN guidance. While the BSA regulations do not prescribe a specific number of days for initial detection and investigation, the OCC's supervisory expectations, informed by FinCEN guidance, establish 30 days from alert generation as the benchmark for timely filing. A 78-day average indicates systemic process failure rather than isolated delays.
Insufficient Monitoring Infrastructure. The Consent Order found that BRB's suspicious activity monitoring infrastructure was insufficient to support the volume and complexity of BRB's transaction flows. This finding is particularly significant in light of the approximately $74.3 billion in total Banking-as-a-Service ("BaaS") transaction volume processed through BRB's charter in CY 2024. The scale and velocity of BaaS transactions, combined with the inherent complexity of monitoring activity conducted through third-party fintech platforms, require a monitoring infrastructure with substantially greater capacity than what BRB had deployed.
BaaS Risk Concentration. BaaS-related SARs totaled 2,108 in CY 2024, representing 54.8% of all 3,847 SARs filed during the same period. This disproportionate concentration of suspicious activity reporting in fintech partner channels reflects the elevated risk profile of BaaS operations generally and highlights BRB's failure to allocate monitoring and investigation resources commensurate with the risk concentration in these channels. The OCC specifically cited the volume and complexity of BaaS-originated transactions as a contributing factor to the SAR processing deficiencies.
2.2 Prior Supervisory History
The Consent Order did not arise in isolation. Rather, it represents the most recent and most severe action in a progression of supervisory interventions that began in June 2022 and escalated through November 2023.
June 2022 — Matter Requiring Attention (MRA). In June 2022, the OCC issued a Matter Requiring Attention regarding BSA/AML transaction monitoring deficiencies, including specific findings related to alert disposition timeliness. The MRA required BRB to develop and implement a corrective action plan addressing, among other things, the timeliness of alert review and SAR filing. The MRA was the first formal supervisory finding regarding transaction monitoring deficiencies and establishes the earliest date at which BRB was on notice of the need for remediation in this area.
November 2023 — Matter Requiring Immediate Attention (MRIA). In November 2023, approximately 17 months after the initial MRA, the OCC elevated its supervisory concerns to a Matter Requiring Immediate Attention. While the MRIA was principally directed at OFAC screening gaps (addressed in Workstream 1 of the Comprehensive Remediation Action Plan), it also cited inadequate resources for SAR processing as a contributing factor to the overall BSA/AML program deficiencies. The escalation from MRA to MRIA status reflected the OCC's determination that BRB had not made sufficient progress in remediating the deficiencies identified in the June 2022 MRA and that the deficiencies posed an immediate risk requiring urgent attention.
The Consent Order expressly cites BRB's failure to adequately remediate these prior supervisory actions. The OCC noted that BRB's remediation efforts under its former outside regulatory counsel, Drayton Mercer LLP, were insufficient. Drayton Mercer's engagement was terminated in January 2025 following the issuance of the Consent Order, and Calderwood & Harkness LLP was retained as successor regulatory counsel.
Additionally, the independent BSA/AML test completed by Caldera & Pope LLP in September 2024, which was conducted pursuant to BRB's existing independent testing program, also identified SAR filing timeliness and backlog deficiencies. The Caldera & Pope findings echoed and corroborated the OCC's own examination findings, further underscoring the systemic nature of the deficiencies and the inadequacy of BRB's prior remediation efforts.
2.3 Current State Assessment
As of January 2025, BRB's BSA/AML compliance program is structured as follows:
Staffing. The BSA/AML Department has a total headcount of 62 FTEs. The department is led by BSA Officer Thomas Ikeda, who was appointed in March 2023 and reports to Chief Compliance Officer Patricia Langston, who was appointed in January 2024. Mr. Ikeda holds primary responsibility for the day-to-day management of BRB's BSA/AML program, including transaction monitoring, SAR filing, and related compliance functions. Ms. Langston, as CCO, has executive oversight responsibility for all compliance functions, including BSA/AML.
Transaction Monitoring System. BRB uses the Veridian TMS v.8.3 transaction monitoring system, operated under Contract No. VA-BRB-2023-0044. The Veridian TMS model was last independently validated in March 2021 — more than four years prior to the date of this plan — and the tuning parameters for the model were last updated in October 2022. The gap between the last model validation and tuning update and the present date is a significant contributing factor to the deficiencies identified in the Consent Order, as discussed further in Section 6 below. The planned upgrade to Veridian TMS v.10.0, addressed in Workstream 4 of the Comprehensive Remediation Action Plan, is targeted for deployment by August 1, 2025.
CY 2024 Operating Statistics. In CY 2024, BRB's transaction monitoring system generated 41,500 alerts. Of these, 3,847 resulted in SAR filings, yielding a SAR conversion rate of approximately 9.3%. BRB also filed 28,612 CTRs during the same period. For comparison, BRB filed 2,914 SARs in CY 2023, indicating a 32% year-over-year increase in SAR filing volume.
SAR Filing Timeliness. The average SAR filing time was 78 days from alert generation, as noted above. This average encompasses the full pipeline from alert generation through triage, investigation, SAR narrative drafting, quality review, and filing. Delays were observed at multiple stages of the pipeline, reflecting systemic process deficiencies rather than bottlenecks at any single stage.
Alert Backlog. As of September 2024, approximately 2,400 alerts remained unreviewed. These alerts spanned a timeframe of generation from approximately January 2024 through September 2024 and included alerts generated through automated transaction monitoring rules, manual referrals from business lines, BaaS partner escalations, and law enforcement subpoenas and inquiries.
Primary Contributors to Backlog. The root causes of the alert backlog include: (i) insufficient analyst staffing relative to alert volumes, with 62 FTEs responsible for the investigation and disposition of 41,500 annual alerts; (ii) high alert volumes originating from BaaS channels, particularly NovaPay Technologies Inc., which represents 41% of BaaS transaction volume at approximately $30.5 billion in CY 2024; and (iii) an inadequately tuned transaction monitoring model that generated elevated false-positive volumes, contributing to alert fatigue and diversion of analyst resources to low-value investigations. The combination of these factors created a compounding effect in which alert volumes consistently outpaced the department's capacity to review and dispose of alerts in a timely manner.
2.4 FinCEN Monitoring
FinCEN is conducting parallel monitoring of BRB's SAR filing remediation. FinCEN Associate Director Angela Drummond of the Enforcement Division has been designated as the FinCEN point of contact for BRB's SAR remediation efforts. FinCEN's monitoring is being conducted in coordination with the OCC and reflects FinCEN's independent enforcement authority under the Bank Secrecy Act.
FinCEN has expressly reserved enforcement rights with respect to the SAR filing deficiencies identified in the Consent Order. While no separate FinCEN enforcement action has been filed as of the date of this plan, the risk of a separate FinCEN action remains if FinCEN determines that BRB's SAR remediation is insufficient in scope, pace, or quality. A separate FinCEN enforcement action could result in additional civil money penalties, enhanced monitoring requirements, or other sanctions.
Calderwood & Harkness has prepared a separate FinCEN Coordination Strategy Memorandum that addresses the strategy for proactive engagement with FinCEN throughout the remediation period. The strategy contemplates regular progress updates to Associate Director Drummond, coordinated through the OCC's Examiner-in-Charge, and is designed to demonstrate BRB's commitment to comprehensive and timely SAR remediation. Proactive engagement is a critical element of managing the risk of a separate FinCEN enforcement action.
3. Objectives and Success Criteria
3.1 Primary Objectives
This Workstream 2 plan is designed to achieve five primary objectives, each of which is essential to the overall remediation of the SAR deficiencies identified in the Consent Order:
1. Backlog Clearance. Complete the review, disposition, and — where warranted — SAR filing for all approximately 2,400 unreviewed suspicious activity alerts that had accumulated as of the September 2024 OCC examination date. The target date for full backlog clearance is June 30, 2025. This objective requires the systematic triage, investigation, and resolution of every alert in the backlog, with full documentation of the disposition rationale for each alert, whether the disposition results in a SAR filing or a determination that no SAR is warranted.
2. Filing Timeliness. Reduce the average SAR filing time from the current 78-day average to within 30 days of alert generation on a sustained basis. This objective requires fundamental changes to BRB's alert-to-SAR workflow, including the implementation of automated routing and prioritization, streamlined investigation processes, and enhanced staffing capacity. The target date for achieving the 30-day filing standard on a sustained basis is August 1, 2025, aligned with the planned deployment of Veridian TMS v.10.0 under Workstream 4.
3. Lookback Completion. Conduct a comprehensive SAR lookback project covering the period from January 1, 2022 through September 30, 2024 (approximately 33 months), designed to identify and remediate any previously undetected suspicious activity that should have been reported during the period when BRB's SAR processes were deficient. The lookback is a critical component of the remediation, as it addresses the risk that suspicious activity may have gone undetected and unreported during the period of deficiency.
4. Quality Enhancement. Establish and implement enhanced SAR quality review standards to ensure that all SAR narratives meet FinCEN quality expectations for completeness, accuracy, and analytical rigor. Quality enhancement encompasses both the immediate remediation period (during which backlog and lookback SARs are being filed at elevated volumes) and the post-remediation steady state.
5. Sustainable Compliance. Build a staffing model, process infrastructure, and governance framework that sustains compliance beyond the remediation period. The Consent Order requires BRB to achieve and maintain full compliance through February 15, 2026 (the date of the final self-certification) and on an ongoing basis thereafter. Sustainable compliance requires a permanent increase in BSA/AML staffing, modernized technology, and robust governance and quality assurance mechanisms.
3.2 Quantitative Success Criteria
To provide objective, measurable benchmarks against which remediation progress can be assessed, the following quantitative success criteria have been established:
• 100% of 2,400 backlogged alerts reviewed and dispositioned by June 30, 2025. No alert in the backlog may remain unreviewed beyond this date.
• Average SAR filing time ≤30 days from alert generation for all new alerts generated after remediation processes are fully implemented. This standard applies on a rolling average basis, measured monthly, and must be achieved on a sustained basis commencing no later than August 1, 2025.
• SAR quality review error rate ≤5% on random sampling conducted pursuant to the quality review framework described in Section 8. The error rate is defined as the percentage of reviewed dispositions (both SAR filings and no-SAR closures) that contain material deficiencies requiring correction.
• Zero tolerance for unreviewed alerts exceeding 45 days from generation during the post-remediation steady state. Any alert that remains unreviewed for more than 45 days from generation will be treated as a compliance exception requiring immediate escalation to the BSA Officer and documentation of the cause and corrective action.
• Lookback SARs filed within 30 days of identification of previously undetected suspicious activity. Any suspicious activity identified through the lookback process must be documented and a SAR filed within 30 days of the date on which the activity is identified as suspicious, consistent with the general 30-day filing standard.
3.3 Key Milestones and Deadlines
The following table sets forth the key milestones and deadlines for this workstream:
These milestones are interdependent with milestones in other workstreams of the Comprehensive Remediation Action Plan. In particular, the August 1, 2025 filing timeliness target is contingent on the successful deployment of Veridian TMS v.10.0 under Workstream 4, and the sustainable staffing model is contingent on the hiring plan under Workstream 5. Any material delays in those workstreams may necessitate adjustments to the milestones set forth above, which would be communicated to the OCC through the quarterly reporting process.
4. Backlog Clearance Plan
4.1 Scope of Backlog
The backlog subject to this clearance plan consists of approximately 2,400 suspicious activity alerts that remained unreviewed as of the OCC examination date of September 2024. These alerts represent a cross-section of BRB's transaction monitoring output and manual referral activity during the period from approximately January 2024 through September 2024.
The alerts in the backlog were generated from the following sources:
• Veridian TMS v.8.3 automated rules: The majority of alerts were generated by the automated transaction monitoring rules configured in the Veridian TMS. These rules are designed to detect potentially suspicious patterns across multiple transaction types and channels.
• Manual referrals from business lines: A subset of alerts was generated through manual referrals from BRB business line personnel who identified potentially suspicious activity in the course of their duties. These referrals include reports from relationship managers, branch personnel, and operations staff.
• BaaS partner escalations: Alerts escalated by BRB's fintech partners pursuant to their contractual obligations to report suspicious or unusual activity observed on their platforms. These escalations are a critical input to BRB's monitoring program given the volume and complexity of BaaS-channel transactions.
• Law enforcement subpoenas and inquiries: Alerts generated in response to law enforcement subpoenas, grand jury subpoenas, National Security Letters, and informal law enforcement inquiries that identified BRB customers or accounts as subjects of investigation.
The alert types represented in the backlog span the full range of BRB's transaction monitoring scenarios, including wire transfers (both domestic and international), ACH transactions, card transactions, peer-to-peer transfers (particularly those processed through the NovaPay platform), structuring scenarios, unusual loan activity (particularly loan originations through FairLend Digital), and rapid movement of funds patterns. The diversity of alert types in the backlog requires investigators with a broad range of BSA/AML expertise.
The timeframe of alert generation for the backlogged alerts is estimated to range from approximately January 2024 through September 2024, although precise dating of individual alerts will be confirmed during the triage process.
4.2 Triage Methodology
Given the volume and diversity of the backlogged alerts, a structured, risk-based triage methodology is essential to ensure that the highest-risk alerts are addressed first. The triage methodology is set forth in detail in the SAR Backlog Triage Protocol prepared by Calderwood & Harkness (Appendix A), which provides operational-level guidance for the triage process. The following summarizes the key elements of the triage framework.
Alerts will be assigned to one of three priority tiers based on risk indicators present in the alert data:
Tier 1 — Highest Priority. Tier 1 encompasses alerts that present the most significant regulatory, legal, and reputational risk. The following categories of alerts will be classified as Tier 1:
• Alerts involving a potential sanctions nexus, including any indication of transactions with sanctioned persons, entities, or jurisdictions, or any overlap with the OFAC screening gaps identified in Workstream 1;
• Alerts generated in response to or associated with law enforcement requests, subpoenas, grand jury subpoenas, National Security Letters, or other governmental inquiries;
• Alerts involving individual transactions or aggregate transaction amounts exceeding $500,000;
• Alerts associated with NovaPay Technologies Inc. (which represents 41% of BaaS transaction volume at approximately $30.5 billion in CY 2024) or other fintech partners identified as high-risk based on BRB's BaaS partner risk assessment;
• Alerts involving customers or transactions with known high-risk jurisdictions, as defined by BRB's BSA/AML country risk rating matrix and consistent with FinCEN advisories and FATF lists.
Tier 2 — Elevated Priority. Tier 2 encompasses alerts that, while not meeting the highest-risk criteria of Tier 1, nonetheless present elevated risk warranting priority review. The following categories of alerts will be classified as Tier 2:
• Alerts involving structuring patterns or other potential violations of the CTR reporting requirements;
• Alerts involving individual transactions or aggregate transaction amounts between $100,000 and $500,000;
• Alerts associated with the remaining top BaaS partners, including FairLend Digital (which represents approximately 28% of BaaS transaction volume) and VaultEdge (which represents approximately 18% of BaaS transaction volume);
• Alerts involving customers whose Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") records are incomplete or deficient, as cross-referenced to the approximately 47,000 high-risk accounts identified in Workstream 3 as lacking adequate CDD/EDD documentation.
Tier 3 — Standard Priority. Tier 3 encompasses all remaining alerts that do not meet the criteria for Tier 1 or Tier 2 classification. These alerts include lower-dollar-value anomalies, internal referrals below defined thresholds, and alerts presenting lower risk indicators based on the available data.
Based on a preliminary assessment of the alert population, the estimated distribution across tiers is approximately 400 Tier 1 alerts, 800 Tier 2 alerts, and 1,200 Tier 3 alerts. These estimates are subject to refinement upon completion of the initial triage assessment, which may reveal that certain alerts initially categorized in one tier are more appropriately assigned to another based on a more detailed review of the underlying data.
The triage process is targeted for completion within the first two weeks of the Pinnacle deployment — that is, by approximately March 14, 2025. Completion of triage within this timeframe is essential to enable the risk-based sequencing of the full backlog review and to support the preparation of the interim SAR backlog status report due to the OCC by March 31, 2025.
4.3 Alert Review and Disposition Process
Following triage, each alert will be subjected to a structured investigation workflow designed to ensure thorough, consistent, and well-documented investigation and disposition. The workflow consists of the following sequential steps:
Step 1 — Alert Assignment. Each alert will be assigned to an analyst based on the alert's triage tier and the analyst's skill level and subject-matter expertise. Tier 1 alerts will be assigned to the most experienced analysts, including designated Pinnacle senior investigators and BRB senior analysts. Tier 2 and Tier 3 alerts will be assigned based on complexity and subject matter, with appropriate supervisory oversight.
Step 2 — Customer and Account Review. The assigned analyst will conduct a comprehensive review of the customer and account associated with the alert. This review encompasses: verification of customer identity, review of the customer's risk rating and risk assessment history, examination of CDD and EDD documentation (with notation of any deficiencies for cross-referencing to Workstream 3), review of prior SAR filing history for the customer, and identification of any related accounts or beneficial owners.
Step 3 — Transaction Analysis. The analyst will perform a detailed analysis of the transactions that triggered the alert, including review of supporting documentation (wire instructions, ACH origination/receipt details, card transaction records, peer-to-peer transfer details), identification of source and destination of funds, identification and analysis of counterparties, and assessment of the economic rationale (or lack thereof) for the transactions.
Step 4 — Narrative Analysis and Determination. Based on the customer and account review and the transaction analysis, the analyst will prepare a narrative analysis and make one of three determinations:
(a) SAR filing is warranted — the analyst has identified facts constituting a basis for filing a SAR, and the alert will proceed to SAR drafting;
(b) No SAR is warranted — the analyst has determined, based on the available facts, that the activity does not meet the threshold for SAR filing, and the alert will be closed with a documented rationale explaining the basis for the no-file determination; or
(c) Escalation — the alert presents complexities or ambiguities that require review and determination by a senior analyst, the BSA Officer, or legal counsel, and the alert will be escalated to the appropriate individual for further review.
Step 5 — SAR Drafting. For alerts where a SAR filing determination is made, the analyst will draft a SAR narrative compliant with FinCEN Form 111 (SAR) requirements and the enhanced SAR narrative quality standards described in Section 8.2 of this plan. The narrative must clearly identify the suspicious activity, provide complete subject information, set forth comprehensive transaction details, articulate why the activity is suspicious, and reference any prior SAR filings on the same subject.
Step 6 — Quality Review. Each alert disposition — whether resulting in a SAR filing or a no-file closure — will be subjected to the quality review process described in Section 8 of this plan. Quality review is designed to ensure the accuracy and completeness of the investigation, the appropriateness of the disposition determination, and the quality of the SAR narrative (where applicable).
Step 7 — Filing and Documentation. For alerts resulting in SAR filings, the SAR will be filed electronically with FinCEN through the BSA E-Filing system. Complete documentation of the investigation, disposition rationale, SAR narrative, and filing confirmation will be maintained in the Veridian TMS case management module and in BRB's centralized compliance records. For no-file closures, the documented rationale and supporting analysis will be retained in the case management system for future reference and audit purposes.
Based on BRB's CY 2024 SAR conversion rate of 9.3%, it is estimated that approximately 220 to 250 of the 2,400 backlogged alerts will result in SAR filings. However, this estimate is subject to significant uncertainty given the age and composition of the backlog. Alerts that have remained unreviewed for extended periods may exhibit different characteristics than alerts reviewed in the ordinary course, and the actual SAR conversion rate for the backlog population may differ materially from the overall conversion rate. Contingency planning for a higher-than-expected conversion rate is addressed in Section 11.
The target timeline for completion of alert dispositions by tier is as follows:
• Tier 1 (Highest Priority) — approximately 400 alerts: All dispositioned by April 30, 2025
• Tier 2 (Elevated Priority) — approximately 800 alerts: All dispositioned by May 31, 2025
• Tier 3 (Standard Priority) — approximately 1,200 alerts: All dispositioned by June 30, 2025
4.4 Staffing for Backlog Clearance
The staffing strategy for backlog clearance combines temporary augmentation through Pinnacle Compliance Solutions LLC with BRB's existing internal BSA/AML staff and planned permanent headcount additions.
Pinnacle Compliance Solutions LLC
Pinnacle Compliance Solutions LLC ("Pinnacle"), located at 90 Broad Street, 20th Floor, New York, NY 10004, has been engaged under Statement of Work Reference PCS-BRB-2025-0012 to provide managed BSA/AML compliance staffing services. The key contact at Pinnacle is Andrea Solis, Director of Managed Services. The principal terms of the Pinnacle engagement are as follows:
• Headcount: 30 full-time-equivalent BSA/AML analysts deployed under the Managed Services Agreement.
• Contract Value: $3,600,000 for a 12-month engagement term (calculated as 30 FTEs × $10,000 per month per FTE = $300,000 per month × 12 months).
• Allocation to Workstream 2: Approximately 20 of the 30 Pinnacle FTEs will be dedicated primarily to backlog clearance and the SAR lookback project during the March through June 2025 period, when backlog clearance is the highest priority. The remaining 10 Pinnacle FTEs will support ongoing alert review across other workstreams.
• Analyst Roles: The 30 Pinnacle FTEs are allocated across the following functional roles: SAR investigators (15 FTEs), KYC/CDD analysts (8 FTEs, shared with Workstream 3), and transaction monitoring reviewers (7 FTEs).
• Deployment Timeline: Deployment commences March 1, 2025, aligned with the start of Thornfield's on-site assessment. The full complement of 30 FTEs is targeted to be operational by approximately March 15, 2025, following completion of onboarding, system access provisioning, and BRB-specific training.
BRB Internal Staff
BRB's existing 62 FTEs in the BSA/AML department will continue to perform normal-course compliance operations during the remediation period. These operations include the review and disposition of newly generated alerts (separate from the backlog), ongoing SAR filing for current-period activity, CTR filing, and other routine BSA/AML functions. By maintaining the existing staff on normal-course operations, BRB ensures that new alerts do not accumulate into a secondary backlog during the period in which the existing backlog is being cleared.
In addition, 15 permanent FTE additions are planned under Workstream 5 of the Comprehensive Remediation Action Plan, at an estimated annual fully loaded cost of $2,250,000 ($150,000 average per FTE). The initial hires are planned to phase in beginning in Q2 2025 to support the transition from temporary Pinnacle staffing to permanent internal staffing as the remediation progresses.
Supervisory Structure. The supervisory structure for backlog clearance is designed to ensure accountability, quality, and appropriate escalation:
• Pinnacle analysts will report to Thomas Ikeda, BSA Officer and AML Program Director, through designated BRB team leads who will serve as day-to-day supervisors for the temporary staff.
• Quality review supervision will be performed by BRB senior analysts and Patricia Langston, CCO, in accordance with the quality review framework described in Section 8.
• Calderwood & Harkness will provide strategic oversight and advisory support throughout the backlog clearance process. Yuki Nakamura, lead associate, will serve as the day-to-day Calderwood & Harkness contact for backlog clearance coordination and will participate in weekly status calls with BRB compliance leadership.
4.5 Systems and Tools
The backlog clearance process will be supported by the following systems and tools:
Primary Platform. Alert review will be conducted using the case management module of the Veridian TMS v.8.3 platform, which is BRB's current transaction monitoring system. While the Veridian TMS v.8.3 platform has limitations that are being addressed through the planned upgrade to v.10.0 (Workstream 4), it remains the system of record for alert management and investigation and will be used for the duration of the backlog clearance process.
Supplemental Investigation Tools. Analysts will utilize a range of supplemental tools to support their investigations, including: BRB's core banking system (for customer and account data, transaction history, and documentation); payment processing platforms (for wire, ACH, and card transaction details); BaaS partner data feeds (for transaction-level and customer-level data from NovaPay, FairLend Digital, VaultEdge, and other fintech partners); public records and adverse media databases (for customer and counterparty due diligence); and OFAC/sanctions screening results (cross-referenced with Workstream 1 data).
System Access. Pinnacle analysts will require system access credentials for each of the foregoing platforms. Provisioning of system access will be coordinated through Linda Petrosian, Chief Information Officer and Chief Technology Officer, pursuant to the Access & Cooperation Protocol that governs technology access for all remediation personnel.
Case Tracking and Reporting. A dedicated backlog clearance dashboard will be developed and maintained to provide real-time visibility into progress metrics. The dashboard will track, at a minimum, the number of alerts reviewed, the number of alerts dispositioned (by disposition type), the number of SARs filed, the number of alerts pending investigation, and the average time from alert assignment to disposition. Daily progress metrics will be reported to Thomas Ikeda and the BSA/AML team leads. Weekly summary reports will be circulated to Patricia Langston, Gregory Nardone (General Counsel), and Philip Hartmann (Calderwood & Harkness). A sample report format for the dashboard is provided in Appendix G.
5. SAR Lookback Project
5.1 Scope and Purpose
In addition to the clearance of the existing alert backlog, a comprehensive lookback is required to identify potentially suspicious activity that was not detected, investigated, or reported during the period when BRB's SAR processes were deficient. The lookback is a distinct undertaking from the backlog clearance: while the backlog clearance addresses alerts that were generated but not reviewed, the lookback addresses the risk that BRB's deficient monitoring processes failed to generate alerts for activity that should have been flagged.
The SAR lookback project has an estimated budget of $5,500,000, as detailed in the budget allocation set forth in Section 10 of this plan. This budget covers data extraction and analytics, dedicated investigator staffing, SAR drafting and filing, quality review and validation, project management, and contingency.
The purpose of the lookback is straightforward: to identify and file any SARs that should have been filed during the lookback period but were not, due to the deficiencies identified in the Consent Order. The lookback is both a regulatory imperative — the OCC expects a comprehensive review of the period during which deficiencies existed — and a prudential measure, as the failure to identify and report suspicious activity exposes BRB to ongoing regulatory, legal, and reputational risk.
5.2 Lookback Period
The proposed lookback period extends from January 1, 2022 through September 30, 2024, a span of approximately 33 months. The rationale for this period is as follows:
• Start Date — January 1, 2022: The lookback period commences from the beginning of the calendar year in which the June 2022 MRA was issued. The June 2022 MRA was the first formal supervisory finding regarding transaction monitoring deficiencies, and it establishes the earliest date at which BRB was on formal notice of the need for enhanced monitoring and reporting. Beginning the lookback from January 1, 2022, rather than from the exact date of the MRA, provides a reasonable buffer to capture activity that may have been occurring in the months prior to the formal finding.
• End Date — September 30, 2024: The lookback period extends through the conclusion of the OCC examination in September 2024, which is the date as of which the alert backlog was measured and the date through which the OCC's findings were based. Activity occurring after September 30, 2024, is addressed through BRB's ongoing monitoring processes and the backlog clearance plan.
The lookback period is subject to refinement based on the findings of Thornfield Consulting's preliminary gap assessment, which is due April 15, 2025. If Thornfield's assessment identifies grounds for extending or narrowing the lookback period — for example, if evidence suggests that deficiencies existed prior to January 2022 — the lookback scope will be adjusted accordingly. Any adjustments to the lookback period will be documented and communicated to the OCC.
5.3 Transaction Types and Customer Populations in Scope
The lookback will encompass the following transaction types and customer populations:
Transaction Types. The lookback will cover the full range of transaction types processed through BRB's systems during the lookback period, with particular emphasis on the following categories:
• Wire transfers (domestic and international): Wire transfers are a primary vector for potential money laundering and other financial crimes and are a core focus of transaction monitoring. Both outgoing and incoming wires will be reviewed.
• ACH transactions: Automated Clearing House transactions, including both originations and receipts, will be included in the lookback scope.
• Card transactions: Credit and debit card transactions processed through BRB's card programs will be reviewed, with particular attention to high-volume or high-value card activity.
• Peer-to-peer transfers processed through BaaS partners: This category encompasses the high-volume transfer activity processed through BRB's fintech partners, particularly NovaPay, and represents a significant portion of the transaction activity most likely to have been inadequately monitored during the lookback period.
• Loan originations through FairLend Digital: FairLend Digital originated approximately $1.4 billion in loans through BRB's charter in fiscal year 2024. The lookback will review loan origination activity for indicators of suspicious activity, including fraudulent applications, straw borrower activity, and loan proceeds used for illicit purposes.
• Deposits and withdrawals exceeding defined thresholds: Cash and non-cash deposits and withdrawals above defined dollar thresholds will be included in the lookback scope to identify potential structuring activity and other cash-intensive money laundering methodologies.
Customer Populations. The lookback will focus on the following customer populations:
• All BaaS-partner-onboarded customers: Customers onboarded through all 14 active fintech partners will be in scope, with emphasis on the three largest partners: NovaPay (approximately 2.1 million end-user accounts; $30.5 billion in CY 2024 transaction volume), FairLend Digital (approximately $1.4 billion in loan originations), and VaultEdge (approximately 870,000 deposit accounts). The BaaS customer population is the highest-risk segment due to the volume and velocity of transactions, the indirect nature of the customer relationship, and the challenges inherent in monitoring activity conducted through third-party platforms.
• Retail banking customers with inadequately investigated alerts: Retail banking customers who were flagged by the transaction monitoring system during the lookback period but whose alerts were closed without adequate investigation will be re-reviewed to determine whether the closure was appropriate or whether a SAR should have been filed.
• Customers identified in the 47,000 high-risk accounts lacking adequate CDD/EDD: Cross-referencing with Workstream 3, the lookback will prioritize review of customers among the 47,000 high-risk accounts identified as lacking adequate Customer Due Diligence or Enhanced Due Diligence documentation. Incomplete CDD/EDD may have obscured suspicious activity patterns, and these accounts warrant heightened scrutiny in the lookback.
• Customers involved in CTR filings who were not subject to SAR review: BRB filed 28,612 CTRs in CY 2024. The lookback will identify CTR filers who were not also subject to SAR review to determine whether the underlying cash activity warranted further investigation. Particular attention will be given to customers with multiple CTR filings or CTR filings in amounts just above the $10,000 reporting threshold.
• Customers with multiple alerts that did not result in SARs: Customers who triggered multiple transaction monitoring alerts during the lookback period but for whom no SAR was filed will be reviewed to assess whether the cumulative pattern of alerts, even if individually below the SAR filing threshold, indicated suspicious activity that should have been reported.
5.4 Sampling Methodology
Given the volume of transactions and customers in scope, a census review of all activity is neither feasible nor necessary. Instead, the lookback will employ a risk-based, stratified sampling approach that combines census review of the highest-risk populations with statistical sampling of broader populations.
Census Review (100% Review)
A full census review will be conducted for the following categories:
(a) OFAC-related transactions: All transactions involving sanctioned or high-risk jurisdictions that passed through the 12% OFAC screening gap in NovaPay transactions (approximately 3,800,000 unscreened transactions in CY 2023, representing 12% of the approximately 31.7 million total NovaPay transactions processed during that period). This census review is essential to identify any transactions that may have involved sanctions violations and that should have been both blocked and reported. This review is conducted in close coordination with Workstream 1 (OFAC Sanctions Screening Remediation).
(b) Law enforcement-related accounts: All accounts that were the subject of law enforcement inquiries, subpoenas, grand jury subpoenas, National Security Letters, or other governmental requests during the lookback period. These accounts present the highest individual risk and require a complete review of all associated activity.
(c) Accounts with prior SARs: All accounts that were previously the subject of SAR filings where additional activity occurring during the lookback period was not reviewed. Continuing SARs (SAR filings on ongoing activity by previously reported subjects) are a critical component of the SAR program, and the failure to review and report continuing activity is a deficiency requiring remediation.
Statistical Sampling. For broader transaction and customer populations, the lookback will employ stratified random sampling:
(a) BaaS-channel transactions: Transactions will be stratified by fintech partner, transaction type, and transaction amount. Random samples will be drawn from each stratum for detailed investigation.
(b) Retail and commercial banking transactions: Transactions will be stratified by customer risk rating (as assigned in BRB's CDD/EDD framework) and transaction amount. Random samples will be drawn from each stratum.
(c) Closed alerts where no SAR was filed: A random sample of alerts that were generated and closed during the lookback period without a SAR filing will be reviewed for adequacy of the closure rationale. This sample will assess whether the investigation and disposition process for these alerts was sufficient and whether any of the closed alerts should have resulted in SAR filings.
Sample sizes will be determined based on statistical confidence levels of 95% with a margin of error of ±3%, applied to each stratum. The specific sample sizes will be finalized upon receipt of Thornfield Consulting's preliminary gap assessment, which may identify additional strata or risk factors that warrant adjustment to the sampling plan.
The lookback will be supported by automated data extraction from the Veridian TMS v.8.3 platform and supplemental analytics tools. Data extraction protocols will be developed in coordination with Linda Petrosian (CIO/CTO) and validated by the lookback project team.
5.5 Lookback SAR Filing
Any suspicious activity identified through the lookback will be documented and a SAR filed within 30 days of the date on which the activity is identified as suspicious. This filing standard applies regardless of the age of the underlying transactions and regardless of whether the account or customer is still active at BRB.
Lookback SARs will include narrative disclosure that the filing results from a remediation lookback conducted by BRB in connection with the OCC Consent Order. This disclosure is consistent with FinCEN expectations and ensures transparency in the SAR filings. The lookback SAR narratives will otherwise comply with the same quality standards applicable to all SAR filings, as described in Section 8.2 of this plan.
All lookback findings — including both identified suspicious activity and conclusions that no additional suspicious activity was found — will be documented in a master lookback report. The master lookback report will be prepared for submission to the OCC and for review by Thornfield Consulting as part of its independent assessment. The report will include a summary of the lookback methodology, the scope and coverage of the review, statistical analyses of the results, and a detailed inventory of all lookback SARs filed.
5.6 Lookback Project Governance
The SAR lookback project will be managed by Thomas Ikeda, BSA Officer, with executive oversight from Patricia Langston, CCO, and strategic advisory support from Calderwood & Harkness. The governance structure ensures clear lines of authority and accountability:
• Project Management: Thomas Ikeda serves as the project manager for the lookback, responsible for day-to-day direction of the lookback team, monitoring of progress against milestones, and resolution of operational issues.
• Dedicated Lookback Team: A subset of the 30 Pinnacle FTEs will be dedicated to the lookback project, with the specific allocation determined based on the phasing of backlog clearance and lookback activities. During the March through June 2025 period, the primary focus of Pinnacle resources will be on backlog clearance, with lookback activities ramping up as backlog clearance progresses.
• Weekly Status Reporting: The lookback project team will provide weekly status reports to the Calderwood & Harkness engagement team, covering progress against the lookback plan, findings identified, SARs filed, and any issues or risks to the timeline.
• Independent Validation: Thornfield Consulting will review and validate the lookback methodology, sampling approach, and findings as part of its independent assessment. Dr. Vivian Castellano and Robert Eastman (Thornfield Senior Director, AML Transaction Monitoring) will participate in periodic reviews of lookback progress and methodology. Thornfield's validation is essential to establishing the credibility of the lookback with the OCC and FinCEN.
6. Process Improvement — Reducing SAR Filing Time
6.1 Root Cause Analysis of 78-Day Average Filing Time
A thorough root cause analysis has been conducted to identify the factors contributing to BRB's 78-day average SAR filing time. Understanding the root causes is essential to designing effective process improvements that address the underlying problems rather than merely treating symptoms. Seven key contributing factors have been identified:
1. Insufficient Staffing. With 62 FTEs responsible for processing 41,500 annual alerts, each analyst was responsible for approximately 670 alerts per year, or roughly 13 alerts per week. While this workload figure may appear manageable in the abstract, it must be understood in the context of the complexity and documentation requirements associated with each alert investigation. Many alerts, particularly those originating from BaaS channels, require extensive transaction analysis, counterparty research, and coordination with fintech partners. The staffing level did not provide adequate senior analyst capacity for the complex investigations that constitute a disproportionate share of the overall workload.
2. Manual, Paper-Based Workflows. BRB's alert-to-SAR process relied heavily on manual case file assembly and lacked automated routing and escalation capabilities. Analysts were required to manually compile transaction data from multiple systems, assemble case documentation in physical or semi-electronic files, and manually route cases through the review and approval chain. These manual processes introduced delays at each stage of the pipeline and created opportunities for cases to stall at handoff points between team members.
3. Inadequate TMS Tuning. The Veridian TMS v.8.3 transaction monitoring model was last tuned in October 2022, more than two years before the OCC examination. During the intervening period, BRB's transaction volumes and patterns had changed significantly, particularly due to the rapid growth of BaaS-channel activity. The failure to retune the model resulted in excessive false-positive alert generation, which consumed analyst time and attention on low-value investigations at the expense of legitimate alerts. As an illustration of the broader tuning issues across BRB's compliance systems, the OFAC screening module produced 14,320 screening hits in CY 2024, of which only 12 were true matches — a false-positive rate of 99.9%.
4. Lack of Prioritization. BRB did not have a formalized triage or risk-ranking system for alert disposition. Alerts were reviewed on a largely first-in, first-out basis without systematic assessment of relative risk or priority. This approach meant that high-risk alerts involving potential sanctions violations or large-dollar suspicious activity were not prioritized over lower-risk alerts, and analysts had no structured framework for allocating their time and attention to the most consequential investigations.
5. Quality Review Bottleneck. BRB's quality review process consisted of a single review layer with limited senior analyst capacity. The bottleneck at the quality review stage introduced delays of days or weeks for alerts that had been fully investigated and for which SAR narratives had been drafted but which were awaiting review and sign-off. The single-layer review structure also provided insufficient assurance of quality, as there was no differentiation between first-line review and second-line quality assurance testing.
6. BaaS Data Challenges. The investigation of BaaS-originated alerts was frequently impeded by incomplete or delayed transaction data from fintech partners. NovaPay, FairLend Digital, and VaultEdge — BRB's three largest BaaS partners — did not consistently provide real-time or near-real-time transaction data to BRB, and analysts were often required to request supplemental data on a case-by-case basis, introducing delays of days or weeks in the investigation process. The lack of standardized data formats across partners further complicated the investigation process.
7. Board Oversight Gap. BRB did not have a dedicated Compliance Committee at the Board level to drive accountability for SAR timeliness metrics. BSA/AML reporting to the Board of Directors was provided on a quarterly basis and did not include SAR filing timeliness data or backlog metrics. The absence of Board-level visibility into SAR filing timeliness meant that there was no governance mechanism to identify deteriorating performance and mandate corrective action before the backlog accumulated to the level identified by the OCC.
6.2 Process Redesign — Target State
The target state for BRB's alert-to-SAR process is designed to achieve an average SAR filing time of 30 days or less from alert generation, with zero tolerance for any alert remaining unreviewed beyond 45 days. Achieving this target requires fundamental changes to the workflow, staffing, technology, data infrastructure, and governance framework. The following key process changes will be implemented:
1. Automated Alert Routing and Prioritization. Upon deployment of Veridian TMS v.10.0 (targeted for August 1, 2025, under Workstream 4), alerts will be automatically routed and prioritized based on a risk-scoring algorithm that assigns each alert a risk score based on multiple factors, including transaction amount, customer risk rating, counterparty risk indicators, geographic risk, and historical alert and SAR filing data. The automated triage will replace the current manual, first-in/first-out approach and ensure that the highest-risk alerts are assigned to the most experienced analysts and are reviewed first. Pending the TMS upgrade, an interim manual triage protocol (described in Section 6.3) will be implemented to approximate the target-state functionality.