workstream-3-cdd-edd-remediation-plan.docx

1045-00002 · Calderwood & Harkness LLP · documents

workstream-3-cdd-edd-remediation-plan.docx DOCUMENT Antitrust

82 / 84 ← → ✕

Contract analysis Extract to table

WORKSTREAM 3

CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE REMEDIATION PLAN

Prepared in Response to OCC Consent Order No. OCC-2025-003

Prepared by:

Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019

C&H Matter No.: 1045-00002

Prepared for:

Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022

DRAFT — For Inclusion in Comprehensive Remediation Action Plan to be Submitted to the Office of the Comptroller of the Currency by May 15, 2025

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

Right-click to update Table of Contents

1. Executive Summary

This document constitutes the Workstream 3 remediation plan (the "Plan") and addresses Deficiency Category (iii) as identified in Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order identified, among other matters, BRB's failure to maintain adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") documentation for a substantial population of high-risk customer accounts, the preponderance of which were onboarded through the Bank's fintech Banking-as-a-Service ("BaaS") partnership channel. This Plan has been developed by Calderwood & Harkness LLP ("C&H") in close consultation with BRB management and sets forth the detailed framework, procedures, governance, staffing, budget, and timeline required to achieve full remediation of the identified deficiencies within the timeframes mandated by the Consent Order.

Based upon the findings of the OCC's targeted BSA/AML examination, which concluded in September 2024, approximately 47,000 high-risk customer accounts have been identified as lacking adequate CDD or EDD documentation as of the examination conclusion date. These deficient accounts are overwhelmingly concentrated in the BaaS channel, which encompasses fourteen (14) active fintech sponsor partners operating under BRB's national bank charter. The deficiencies span a range of documentation failures, including incomplete Customer Identification Program ("CIP") records, absent or stale beneficial ownership information, missing customer risk ratings, insufficient EDD for accounts warranting heightened scrutiny, and overdue periodic reviews. The magnitude and systemic nature of these deficiencies reflect structural weaknesses in the allocation and supervision of CDD/EDD responsibilities between BRB and its fintech sponsor partners — weaknesses that this Plan is designed to address both through retrospective remediation and through the adoption of a comprehensive Revised CDD/EDD Policy on a going-forward basis.

This Plan establishes a risk-based prioritization methodology and a phased remediation approach that will proceed in two phases:

Phase A (Priority Remediation): Fifty percent (50%) of the affected account population — 23,500 accounts — will be fully remediated by July 15, 2025, consistent with the interim milestone set forth in the Consent Order.

Phase B (Full Remediation): One hundred percent (100%) of the affected account population — all 47,000 accounts — will be fully remediated by January 15, 2026, consistent with the final remediation deadline set forth in the Consent Order.

The total budget allocated to Workstream 3 is $4,300,000, which encompasses temporary staffing costs, internal headcount additions dedicated to CDD/EDD functions, technology and data management expenditures, BaaS partner outreach and customer communication costs, and related operational expenses. This budget has been approved by the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), BRB's parent holding company, as part of the $42,500,000 total remediation budget authorized by the Board Resolution dated February 28, 2025.

This Plan is a component of the Comprehensive Remediation Action Plan ("RAP") required under Article VII of the Consent Order, which mandates submission to the OCC by May 15, 2025. The RAP is to be submitted to Jonathan Frey, National Bank Examiner, Examiner-in-Charge, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. The successful execution and completion of this Plan will be subject to independent validation by the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield") (Engagement Ref: TCG-BRB-2025-001), under the leadership of Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with support from Nathaniel Burgess, Director, Fintech & Payments Compliance. Thornfield's validation will encompass review of the prioritization methodology, interim assessment at the 50% milestone, and final validation at the 100% remediation milestone, with findings to be incorporated into Thornfield's final validation report due to the OCC on February 15, 2026.

The remainder of this Plan details the regulatory background and context for the CDD/EDD deficiencies, the precise scope of the remediation effort, the governance and accountability framework, the risk-based prioritization methodology, the step-by-step remediation process, staffing and resource allocation, the budget, the master timeline, quality assurance protocols, the Revised CDD/EDD Policy, technology and data management infrastructure, BaaS partner-specific remediation considerations, regulatory reporting obligations, risk mitigation strategies, and interdependencies with the other four workstreams of the Comprehensive RAP.

2. Background and Regulatory Context

2.1 Consent Order Findings — CDD/EDD Deficiencies

The OCC's targeted BSA/AML examination of BRB commenced in March 2024 and concluded in September 2024. The examination was conducted by the OCC Northeastern District Office under the direction of Jonathan Frey, National Bank Examiner, Examiner-in-Charge, and was prompted in part by the Bank's failure to satisfactorily remediate prior supervisory actions (as discussed in Section 2.2 below), as well as by the rapid growth and increasing complexity of BRB's BaaS business line. The examination was comprehensive in scope, encompassing BRB's BSA/AML program governance, CIP and CDD practices, EDD processes, OFAC sanctions screening infrastructure, suspicious activity monitoring and reporting, and Board-level oversight.

Among the examination's central findings was the determination that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation as of the examination conclusion date. The OCC's examination team identified pervasive deficiencies across multiple dimensions of CDD/EDD compliance, including but not limited to: accounts lacking completed CIP records meeting the requirements of 31 CFR § 1020.220; accounts for which required beneficial ownership information under 31 CFR § 1010.230 had not been collected, verified, or updated; accounts for which no customer risk rating had been assigned; accounts that had been rated as high risk but for which no documented EDD had been performed; and accounts that had not undergone periodic review within the cycles prescribed by BRB's own policies.

The vast majority of the 47,000 deficient accounts were onboarded through BRB's fintech BaaS partner channels. The OCC concluded that these deficiencies reflected systemic weaknesses in the division of CDD/EDD responsibilities between BRB and its fintech sponsors — specifically, BRB's failure to ensure that its BaaS partners were collecting, maintaining, and transmitting to BRB the CDD/EDD documentation required to meet the Bank's regulatory obligations as the chartered institution of record. The OCC further found that BRB lacked adequate policies, procedures, and internal controls to supervise BaaS partners' CDD/EDD functions, to validate the completeness and accuracy of partner-sourced CDD/EDD data, and to identify and remediate gaps in a timely manner.

The Consent Order issued on January 15, 2025, identifies CDD/EDD deficiencies as one of five core deficiency categories requiring remediation. The five categories are:

(i) OFAC sanctions screening failures, including the approximately 3,800,000 unscreened transactions in the NovaPay channel in CY 2023;

(ii) SAR filing deficiencies, including a backlog of approximately 2,400 unreviewed suspicious activity alerts and late-filed SARs;

(iii) CDD/EDD documentation failures for approximately 47,000 high-risk customer accounts;

(iv) Transaction monitoring model validation gaps, including the absence of independent model validation for BRB's Veridian TMS v.8.3 transaction monitoring system; and

(v) Board-level oversight deficiencies, including the absence of a dedicated Compliance Committee and inadequate BSA/AML reporting to the Board of Directors.

The severity of the CDD/EDD deficiency category is underscored by its intersection with other deficiency categories. The same customer population affected by CDD/EDD gaps is also the population subject to OFAC screening failures and SAR filing deficiencies, reflecting the concentration of risk in the BaaS channel. BaaS-related Suspicious Activity Reports constituted 2,108 of the 3,847 total SARs filed by BRB in calendar year 2024, representing approximately 54.8% of all SAR filings. This disproportionate SAR activity within the BaaS customer population underscores the elevated risk profile of BaaS-onboarded customers and the critical importance of maintaining robust CDD/EDD documentation for this segment.

2.2 Prior Supervisory History

The Consent Order did not arise in a vacuum. BRB has been the subject of escalating supervisory concern over the past three years, with prior OCC supervisory actions that the Bank failed to remediate in a timely and satisfactory manner.

In June 2022, BRB received a Matter Requiring Attention ("MRA") from the OCC regarding deficiencies in the Bank's BSA/AML transaction monitoring program. The MRA identified inadequacies in the calibration and validation of BRB's transaction monitoring scenarios, as well as insufficient documentation of the Bank's transaction monitoring methodology. BRB submitted a remediation plan in response to the MRA, but the OCC's subsequent supervisory review found that the remediation efforts were incomplete and did not fully address the identified concerns.

In November 2023, the OCC issued a Matter Requiring Immediate Attention ("MRIA") — a more serious supervisory action indicating an elevated level of concern — regarding gaps in BRB's OFAC sanctions screening program. The MRIA identified specific instances in which BaaS partner-originated transactions were not being screened against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") in a manner consistent with BRB's regulatory obligations. The MRIA demanded immediate corrective action and enhanced Board reporting on OFAC screening controls.

The Consent Order issued in January 2025 explicitly references BRB's failure to remediate these prior supervisory actions as a material consideration in the OCC's decision to escalate to formal enforcement. The Consent Order describes a "pattern of escalating deficiency" in which BRB repeatedly failed to marshal the resources, governance, and institutional commitment necessary to address identified compliance weaknesses before they compounded into systemic failures. This history of escalating supervisory concern establishes the backdrop against which the current remediation effort must be understood and underscores the importance of demonstrating to the OCC that BRB is now committed to comprehensive, timely, and sustainable compliance remediation.

BRB's prior outside regulatory counsel, Drayton Mercer LLP (lead partner: Helen Frazier), represented the Bank during the 2023–2024 OCC examination cycle, including during the period in which the MRA and MRIA were outstanding. The Drayton Mercer engagement was terminated in January 2025, following the issuance of the Consent Order, and BRB retained Calderwood & Harkness LLP as successor regulatory counsel effective February 10, 2025. C&H has conducted a thorough review of the Drayton Mercer file and the prior supervisory correspondence to ensure continuity and to identify lessons from the prior remediation efforts that inform the design of this Plan.

2.3 Independent Testing Findings

Caldera & Pope LLP ("C&P") serves as BRB's external auditor and has also been engaged as the Bank's contracted BSA/AML independent testing firm. Franklin Dorsey is the C&P Engagement Partner responsible for both the external audit and the BSA/AML independent test.

C&P completed its most recent BSA/AML independent test in September 2024, contemporaneous with the conclusion of the OCC's targeted examination. The C&P independent test identified multiple CDD/EDD deficiencies that are directly echoed in the OCC Consent Order findings. Specifically, C&P reported that a statistically significant sample of BaaS-onboarded accounts exhibited deficiencies in CIP documentation, beneficial ownership records, and risk-rating assignments. C&P also noted that periodic review cycles for high-risk accounts were not being adhered to consistently and that EDD files for a material number of high-risk accounts were either incomplete or absent. These findings corroborate the scope and severity of the CDD/EDD deficiency and provide an independent data point supporting the 47,000-account remediation population identified by the OCC.

The C&P independent test findings have been shared with Thornfield Consulting Group as part of the independent consultant's baseline assessment, and C&P's work papers and testing methodology are available for Thornfield's review.

2.4 BaaS Channel Profile

BRB operates one of the larger BaaS programs among national banks, maintaining fourteen (14) active BaaS partnerships through which fintech companies offer consumer and small-business financial products under BRB's national bank charter. The BaaS program is overseen by Warren Ashby, Head of Fintech Partnerships and BaaS Division, and generated total transaction volume of approximately $74.3 billion in calendar year 2024.

The three largest BaaS partners by transaction volume are:

NovaPay Technologies Inc. NovaPay (CEO: Ethan Garrison; principal offices at 450 Mission Street, Suite 1200, San Francisco, CA 94105) is BRB's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume — approximately $30.5 billion in CY 2024. NovaPay operates a consumer payments and peer-to-peer transfer platform serving approximately 2.1 million end-user accounts under BRB's charter. NovaPay was onboarded as a BaaS partner in 2021 and has grown rapidly, becoming the dominant contributor to BRB's BaaS revenue and the source of the largest concentration of CDD/EDD-deficient accounts.

FairLend Digital LLC. FairLend (CEO: Aisha Okonkwo; principal offices at 100 Summer Street, Suite 800, Boston, MA 02110) is BRB's second-largest BaaS partner, accounting for approximately 28% of total BaaS transaction volume. FairLend operates a digital lending platform through which BRB originated approximately $1.4 billion in consumer and small-business loans in fiscal year 2024. FairLend was onboarded in 2022 and presents unique CDD/EDD challenges due to the additional documentation requirements associated with lending products, including source-of-funds verification and business-entity due diligence for small-business borrowers.

VaultEdge Inc. VaultEdge (CEO: Marcus Tan; principal offices at 2200 Ross Avenue, Suite 3600, Dallas, TX 75201) is BRB's third-largest BaaS partner, accounting for approximately 18% of total BaaS transaction volume. VaultEdge operates a digital savings and neobanking platform with approximately 870,000 deposit accounts under BRB's charter. VaultEdge was onboarded most recently among the top three partners, in 2023, and the recency of its onboarding raises particular concerns about the adequacy of onboarding controls at inception.

The remaining eleven (11) BaaS partners collectively represent approximately 13% of total BaaS transaction volume. While individually smaller than the top three partners, these partners contribute to the overall CDD/EDD deficiency population and will be assessed and remediated on a risk-prioritized basis as described in this Plan.

Total BaaS revenue to BRB in CY 2024 was $127.4 million, comprised of interchange fees, program fees, and interest income. The BaaS business line thus represents a material revenue contributor to the Bank, which must be balanced against the compliance risks that the channel presents.

Importantly, as the chartered national bank, BRB retains ultimate regulatory responsibility for all BSA/AML and CDD/EDD compliance with respect to customers onboarded through its BaaS partners. This principle — codified in OCC guidance, including OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), OCC Bulletin 2020-10 (Third-Party Relationships: Frequently Asked Questions), and the Interagency Guidance on Third-Party Relationships — is a foundational premise of this Plan. BRB may delegate certain CDD/EDD functions to its BaaS partners through contractual arrangements and operational protocols, but the Bank may not delegate its compliance responsibility. The CDD/EDD deficiencies identified by the OCC are ultimately BRB's deficiencies, regardless of whether the proximate cause was a BaaS partner's failure to collect or transmit documentation.

3. Scope Definition

3.1 In-Scope Account Population

The total in-scope account population for Workstream 3 consists of 47,000 high-risk customer accounts that have been identified as lacking adequate CDD or EDD documentation as of the OCC examination conclusion date in September 2024. This figure was determined through the OCC examination team's review of BRB's account records, BaaS partner data feeds, and compliance files, and has been corroborated by the independent testing findings of Caldera & Pope LLP and by BRB's own preliminary internal analysis.

The 47,000 accounts span a range of product types offered through BRB's BaaS channels, including:

• Consumer deposit accounts (checking, savings, and money market accounts offered through BaaS partner digital platforms);

• Small-business lending accounts (term loans, lines of credit, and other lending products originated through FairLend Digital and other lending-focused BaaS partners);

• Savings and neobanking accounts (high-yield savings and hybrid deposit-investment products offered through VaultEdge and similar partners);

• Peer-to-peer ("P2P") payment accounts (payment and transfer accounts offered through NovaPay and similar payments-focused partners); and

• Other products offered through BaaS channels, including prepaid card programs and payment facilitation accounts.

An account has been classified as having "inadequate CDD/EDD" for purposes of this Plan if the account meets one or more of the following criteria:

(a) The account lacks a completed Customer Identification Program ("CIP") record meeting the requirements of 31 CFR § 1020.220, including verification of the customer's identity through documentary or non-documentary means;

(b) The account lacks beneficial ownership information where required under the FinCEN CDD Rule (31 CFR § 1010.230), including identification and verification of each individual who owns 25% or more of the legal entity customer, and identification of a single individual with significant responsibility to control, manage, or direct the legal entity;

(d) The account has been rated as high risk or very high risk but lacks documented EDD, including source-of-funds or source-of-wealth analysis, enhanced identification verification, purpose-of-account documentation, or an ongoing monitoring plan; or

(e) The account has not undergone periodic review within the review cycle prescribed by BRB's applicable policies (i.e., the account's most recent periodic review is overdue).

Many of the 47,000 accounts exhibit multiple deficiency criteria simultaneously. The remediation process will address all identified deficiencies for each account, not merely the most prominent or easily remediable gap.

3.2 Channel Distribution

Preliminary data analysis, conducted jointly by BRB's BSA/AML department and IT team, has produced the following estimated breakdown of the 47,000 deficient accounts by BaaS partner:

These figures are estimates based on preliminary data extraction and are subject to refinement as the data extraction and reconciliation process described in Section 12.1 is completed. The final account-by-account inventory, broken down by BaaS partner, product type, and risk tier, will be documented in Appendix A upon completion of the data analysis phase.

A smaller number of deficient accounts may originate from BRB's direct retail banking and wealth management channels, which are not part of the BaaS program. These direct-channel accounts are included within the 47,000 total and will be remediated through the same process described in this Plan, albeit without the BaaS partner coordination complexities.

3.3 Exclusions. The following categories of accounts are excluded from, or subject to modified treatment within, the scope of this Plan:

Closed or Closing Accounts. Accounts that have been formally closed, or that are in the process of closure, prior to the remediation commencement date of April 1, 2025, will be logged in the remediation tracking system and documented with a notation of the CDD/EDD deficiency, but will not be subject to full remediation. For these accounts, the deficiency will be recorded in the account closing documentation, and any remaining regulatory obligations (such as SAR filing where suspicious activity indicators are present) will be fulfilled. The number of accounts falling into this category will be tracked and reported as part of the overall remediation metrics.

Accounts Subject to Active Law Enforcement Requests or Subpoenas. Accounts that are currently subject to active law enforcement requests, grand jury subpoenas, National Security Letters, Section 314(a) requests, or other legal process will be handled under separate coordination protocols established between C&H, BRB's General Counsel Gregory Nardone, and, where applicable, the relevant law enforcement agency. Remediation activities for these accounts will be conducted in a manner that does not interfere with pending legal process, and any customer outreach for these accounts will be reviewed by C&H and the General Counsel's office prior to initiation to ensure compliance with applicable legal constraints.

4. Governance and Accountability

4.1 Workstream Leadership

The effective execution of this Plan requires clear lines of authority, defined roles and responsibilities, and robust escalation protocols. The following individuals have been designated as the leadership team for Workstream 3:

Workstream Sponsor: Patricia Langston, Chief Compliance Officer, BRB. Ms. Langston serves as the executive sponsor for Workstream 3 and is ultimately accountable for the successful completion of CDD/EDD remediation within the timeframes mandated by the Consent Order. In her capacity as CCO, Ms. Langston has direct reporting authority to the Compliance Committee of the BRFG Board of Directors and serves as the Bank's principal liaison with the OCC on compliance matters. Ms. Langston is responsible for ensuring that the Workstream Lead has the resources, authority, and organizational support necessary to execute this Plan.

Workstream Lead (Day-to-Day): Thomas Ikeda, BSA Officer / AML Program Director, BRB. Mr. Ikeda is responsible for the day-to-day management and execution of the CDD/EDD remediation effort. This includes supervision of both internal BRB compliance staff and temporary Pinnacle Compliance Solutions analysts assigned to the workstream, management of the remediation workflow, oversight of quality assurance processes, coordination with BaaS partner contacts, and reporting on progress against milestones. Mr. Ikeda reports to Ms. Langston and, through the reporting structure described below, to the Compliance Committee and outside counsel.

BaaS Channel Coordination: Warren Ashby, Head of Fintech Partnerships / BaaS Division, BRB. Mr. Ashby is responsible for coordinating with BaaS partners to facilitate the data sharing, customer outreach, and documentation collection required for remediation. Mr. Ashby serves as the primary BRB point of contact for BaaS partner CEOs and compliance officers and will be instrumental in managing partner relationships throughout the remediation process, including, where necessary, communicating the consequences of partner non-cooperation.

Technology Support: Linda Petrosian, CIO/CTO, BRB. Ms. Petrosian is responsible for the technology infrastructure supporting the remediation effort, including data extraction from core banking systems and BaaS partner data feeds, development of the CDD/EDD Progress Tracking Dashboard, data cleansing and reconciliation, and integration of remediated customer data with BRB's transaction monitoring and screening systems.

Internal Audit Oversight: Derek Ballard, Head of Internal Audit, BRB. Mr. Ballard will provide independent assurance over the remediation process through periodic audit reviews, as described in Section 10.4 of this Plan.

Outside Counsel Oversight: Calderwood & Harkness LLP. C&H's advisory team for this workstream consists of:

• Philip Hartmann, Partner, C&H — responsible partner for the overall BRB engagement, providing strategic guidance, OCC/regulatory interface, and escalation support;

• Yuki Nakamura, Associate, C&H — primary C&H contact for CDD/EDD remediation oversight, policy drafting (including the Revised CDD/EDD Policy), and coordination with BRB's remediation team; and

• Carlos Espinoza, Associate, C&H — supporting analyst coordination, BaaS partner engagement (including drafting of formal compliance remediation letters), and workstream documentation.

Independent Consultant Validation: Thornfield Consulting Group LLC. As mandated by the Consent Order, Thornfield will perform independent validation of the CDD/EDD remediation effort. The Thornfield team is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with support from Nathaniel Burgess, Director, Fintech & Payments Compliance. Thornfield operates under Engagement Ref: TCG-BRB-2025-001.

4.2 Reporting Structure

The governance framework for Workstream 3 is designed to ensure that remediation progress is visible, accountable, and subject to appropriate oversight at every level of the organization:

Weekly Reporting. Thomas Ikeda (Workstream Lead) will prepare and distribute a weekly status report to Patricia Langston (Workstream Sponsor) and Yuki Nakamura (C&H). The weekly report will include: accounts remediated during the reporting period, cumulative accounts remediated to date, accounts in process, accounts pending customer response, accounts escalated for closure, quality review metrics, and any issues or impediments requiring escalation. Weekly remediation team meetings will be held to review progress, address operational issues, and coordinate BaaS partner engagement.

Bi-Weekly Reporting. Status reports will be provided on a bi-weekly basis to Thornfield Consulting Group (Nathaniel Burgess and Dr. Vivian Castellano) to ensure the independent consultant maintains current visibility into remediation progress and can plan periodic validation activities accordingly.

Monthly Reporting. A comprehensive monthly progress report, including the CDD/EDD Progress Tracking Dashboard, will be submitted to the Compliance Committee of the BRFG Board of Directors, chaired by James Rutherford. The monthly report will include all key metrics, trend analysis, and narrative discussion of progress, challenges, and mitigation actions. This reporting obligation is part of the Compliance Committee Reporting Framework established under Workstream 5 (Governance & Training).

Quarterly Reporting. Progress against CDD/EDD remediation milestones will be included in the quarterly progress reports submitted to the OCC pursuant to the Consent Order. The first quarterly progress report is due September 15, 2025; the second is due December 15, 2025. These reports will quantify accounts remediated, percentage completion, remaining accounts, and any deviations from the remediation timeline, and will be reviewed by C&H prior to submission.

4.3 Escalation Protocols

The following escalation protocols have been established to ensure that risks to milestone achievement are identified and addressed promptly:

Milestone Risk Escalation. Any risk of missing the July 15, 2025 (50% remediation) or January 15, 2026 (100% remediation) milestones must be escalated immediately by the Workstream Lead (Ikeda) to the Workstream Sponsor (Langston) and the C&H responsible partner (Hartmann). Upon escalation, Langston and Hartmann will assess the nature and severity of the risk and determine appropriate corrective action, which may include reallocation of resources, acceleration of staffing, modification of the prioritization approach, or other measures.

Board-Level Escalation. If remediation falls more than 10% behind the planned pace at any point during the remediation period — i.e., if the cumulative number of accounts remediated is more than 10% below the target for the applicable reporting period — the Workstream Sponsor (Langston) shall escalate the matter to the Compliance Committee (James Rutherford, Chair) and the Risk Committee (Arthur Connelly, Lead Independent Director and Risk Committee Chair) of the BRFG Board of Directors. Board-level escalation will trigger enhanced oversight, including more frequent reporting and, if necessary, emergency resource allocation.

BaaS Partner Non-Cooperation Escalation. Issues requiring BaaS partner cooperation that are not resolved through routine channels will be escalated by Warren Ashby (Head of Fintech Partnerships) to the relevant partner CEO (Ethan Garrison at NovaPay, Aisha Okonkwo at FairLend, Marcus Tan at VaultEdge, or the relevant contact at other partners). If partner non-cooperation persists, C&H will prepare and issue formal compliance remediation letters (see companion documents: NovaPay Compliance Remediation Letter, FairLend Compliance Remediation Letter) demanding cooperation and outlining potential consequences, including suspension of new account onboarding or program termination. Decisions regarding program suspension or termination will be made by the CCO (Langston) in consultation with the CEO, General Counsel (Nardone), and outside counsel (Hartmann) and will require Compliance Committee notification.

5. Risk-Based Prioritization Methodology

5.1 Prioritization Criteria

Given the magnitude of the remediation population — 47,000 accounts — a risk-based prioritization methodology is essential to ensure that the accounts presenting the greatest risk to BRB, its customers, and the integrity of the financial system are remediated first. This approach is consistent with regulatory expectations for risk-based BSA/AML compliance and ensures that BRB allocates its finite remediation resources to maximum risk-reduction effect.

Accounts will be triaged into three priority tiers based on the following risk factors, each of which has been selected for its relevance to the likelihood and potential severity of BSA/AML risk associated with the account:

1. Customer Risk Rating. Accounts that are currently rated "high" or "very high" risk under BRB's existing risk-rating methodology will receive the highest priority for remediation. Accounts for which no risk rating has been assigned — a deficiency that is itself one of the CDD gaps to be remediated — will be presumed to be high risk pending the assignment of a risk rating during the remediation process. This presumption reflects the conservative principle that accounts whose risk profiles are unknown should be treated as potentially elevated risk until affirmatively assessed.

2. Transaction Volume and Value. Accounts with higher aggregate transaction volumes, and particularly accounts with significant wire transfer and Automated Clearing House ("ACH") transaction activity, will be prioritized. These transaction types are subject to OFAC screening requirements and are commonly associated with higher BSA/AML risk due to their speed, volume, and cross-border capabilities. Accounts with aggregate transaction values exceeding specified thresholds (to be defined in the scoring model in coordination with the CRO) will receive elevated priority scores.

3. BaaS Partner Risk Profile. Accounts onboarded through the BaaS partners assessed as presenting the highest risk will be prioritized. Specifically, accounts from NovaPay Technologies are elevated in priority due to the OFAC sanctions screening gap affecting approximately 3.8 million transactions in CY 2023, which compounds the CDD/EDD deficiency for the NovaPay customer population. Accounts from FairLend Digital are elevated due to the complexity of lending-related CDD/EDD requirements. Accounts from VaultEdge are elevated due to the recency of VaultEdge's onboarding and concerns about onboarding controls at inception. Accounts from lower-risk partners receive correspondingly lower priority scores.

4. Geographic Risk. Accounts with connections to high-risk jurisdictions — including countries on the Financial Action Task Force ("FATF") grey list or black list, jurisdictions subject to OFAC comprehensive or sectoral sanctions, and jurisdictions identified by BRB's own country risk assessment as presenting elevated money laundering or terrorist financing risk — will be elevated in priority. Geographic connections include the customer's country of residence, country of citizenship, country of incorporation (for entity customers), and counterparty jurisdictions for significant transactions.

5. SAR History. Accounts that have been the subject of prior Suspicious Activity Report filings, or that are currently associated with pending transaction monitoring alerts in BRB's Veridian TMS, will be prioritized. The existence of a SAR filing or pending alert indicates that the account has already been identified as presenting potential suspicious activity, making the absence of adequate CDD/EDD documentation particularly concerning.

6. Account Age and Activity Status. Active accounts with high levels of ongoing transaction activity will be prioritized over dormant or low-activity accounts. While dormant accounts are not exempt from CDD/EDD requirements, the immediate risk of ongoing illicit activity is higher for accounts that are actively transacting. Dormant accounts will be remediated in Tier 3, with the additional step of assessing whether the account should be closed due to inactivity.

5.2 Tier Classification

Based on the application of the prioritization criteria described above, the 47,000 accounts will be classified into three tiers:

Tier 1 (Highest Priority): Approximately 15,000 Accounts. Tier 1 consists of accounts that meet two or more of the high-risk criteria described above. These accounts represent the most concentrated BSA/AML risk within the remediation population and will be addressed first. The target for Tier 1 remediation is completion by May 31, 2025, providing a buffer ahead of the July 15, 2025 interim milestone. Tier 1 accounts are expected to include the majority of accounts with SAR history, accounts with connections to OFAC-sanctioned or FATF grey-listed jurisdictions, accounts with the highest transaction volumes, and accounts from NovaPay and FairLend Digital with the most acute documentation gaps.

Tier 2 (Elevated Priority): Approximately 16,000 Accounts. Tier 2 consists of accounts that meet one high-risk criterion. These accounts present elevated but not the highest risk and will be remediated second. The cumulative target for Tier 1 and Tier 2 remediation is 23,500 accounts — representing the 50% interim milestone — by July 15, 2025. This means that approximately 8,500 Tier 2 accounts must be remediated between June 1 and July 15, 2025, following the completion of Tier 1. The remaining Tier 2 accounts (approximately 7,500) will be remediated in Phase B alongside Tier 3 accounts.

Tier 3 (Standard Priority): Approximately 16,000 Accounts. Tier 3 consists of the remaining accounts that do not meet any of the high-risk criteria but nonetheless have CDD/EDD documentation deficiencies requiring remediation. These accounts present lower relative risk and will be remediated in Phase B, with a target completion date of January 15, 2026. Tier 3 remediation will proceed concurrently with the completion of remaining Tier 2 accounts and with the ongoing periodic review activities required under the Revised CDD/EDD Policy.

5.3 Data-Driven Triage Process

The prioritization scoring model will be populated using account-level data extracted from BRB's core banking systems and from data feeds provided by each BaaS partner. Linda Petrosian (CIO/CTO) will lead the data extraction effort, working with BRB's IT team and with the technical contacts at each BaaS partner. The data extraction will encompass:

• Customer identification and CIP data (name, address, date of birth, SSN/TIN, identification document records);

• Beneficial ownership information (entity customers);

• Current customer risk rating (where assigned);

• Transaction history (volume, value, type, counterparty jurisdictions);

• SAR filing history and pending TMS alerts;

• Account opening date, BaaS partner of record, and product type;

• Account activity status (active, dormant, restricted);

• Geographic indicators (customer address, country of residence/citizenship, counterparty jurisdictions); and

• Existing CDD/EDD documentation on file (completeness indicators).

The extracted data will be organized into a unified remediation inventory — a single, consolidated database of all 47,000 accounts with their associated data elements. This inventory will serve as the foundation for the scoring model and for the remediation tracking system described in Section 12.

The scoring model will assign a numeric priority score to each account based on the weighted application of the prioritization criteria described in Section 5.1. The specific criteria weights and tier thresholds will be documented in Appendix B (Prioritization Scoring Model) and will be reviewed and approved by Melissa Chu (Chief Risk Officer) and Thomas Ikeda (BSA Officer) prior to application.

Critically, the prioritization methodology must be independently validated by Thornfield Consulting Group before full-scale remediation commences. Nathaniel Burgess (Director, Fintech & Payments Compliance) will lead Thornfield's review of the scoring model, which is targeted for completion by March 31, 2025. Thornfield's review will assess whether the criteria are appropriate, the weights are reasonable, and the resulting tier classifications effectively direct remediation resources toward the highest-risk accounts. Any deficiencies identified by Thornfield will be addressed before the prioritization model is finalized.

6. Remediation Process and Procedures

6.1 CDD Remediation Steps

The remediation of each deficient account will follow a structured, documented process designed to identify all CDD/EDD gaps, collect the required information and documentation, update the account's risk profile, and confirm that the remediated file meets all applicable regulatory and policy requirements. For each deficient account, the remediation team will execute the following steps:

Step 1: Retrieve and Review Existing Documentation. The remediation analyst will compile all CDD records currently on file for the account, including CIP verification records, copies of identification documents, beneficial ownership certification forms (FinCEN Form 4506 or equivalent), account opening documentation, customer questionnaires, and onboarding records sourced from the applicable BaaS partner. The analyst will review all available documentation to establish a baseline understanding of what information is currently available and what is missing. For BaaS partner-sourced accounts, this step will require coordination with the BaaS partner to obtain copies of any documentation held by the partner but not previously transmitted to BRB.

Step 2: Identify Documentation Gaps. The analyst will compare the existing documentation against the requirements set forth in BRB's Revised CDD/EDD Policy (currently in development by C&H, as described in Section 11) and the applicable regulatory standards. The gap analysis will assess compliance with the CIP requirements of 31 CFR § 1020.220 (customer identification and verification), the beneficial ownership requirements of 31 CFR § 1010.230 (the FinCEN CDD Rule), BRB's internal risk-rating methodology, EDD requirements for high-risk accounts, and periodic review requirements. Each identified gap will be documented in the account's remediation record using the standardized Remediation Checklist (Appendix C).

Step 3: Request Missing Information. For each identified gap, the remediation team will initiate outreach to the customer to collect the missing CIP elements, identification documents, beneficial ownership information, source-of-funds documentation, source-of-wealth documentation, and any other information required to complete the CDD or EDD file. Customer outreach may be conducted directly by BRB or through the applicable BaaS partner, in accordance with the allocation of customer-facing responsibilities set forth in the BaaS Partner CDD/EDD Responsibility Matrix (companion document, referenced in Appendix F). Outreach will be conducted using standardized templates (Appendix D) and through multiple channels, including mail, email, and, for accounts on digital platforms, in-app notifications. Where applicable, outreach materials will be provided in multiple languages to accommodate the Bank's diverse customer base. Outreach will be documented in the account's remediation record, including the date, method, and content of each communication.

Step 4: Assign or Update Customer Risk Rating. For each account, the remediation analyst will apply or re-apply BRB's risk-rating methodology, taking into account all available information — including the customer's identification profile, geographic connections, product usage, transaction patterns, business type (for entity customers), beneficial ownership structure, and any adverse media or other risk indicators. Accounts that previously lacked a risk rating will be assigned a rating for the first time. Accounts with existing risk ratings will have their ratings reviewed and updated to reflect current information. The risk-rating determination will be documented and supported by the analyst's written rationale.

Step 5: Document EDD Where Required. For all accounts that are risk-rated high or very high following the risk-rating assignment or update in Step 4, the remediation analyst will complete a full EDD review. The EDD review will encompass the requirements described in Section 6.2 below, including enhanced identification verification, corroborated source-of-funds analysis, source-of-wealth documentation, purpose-of-account documentation, and the development of an ongoing monitoring plan with a defined review cycle. The EDD file will be reviewed and approved by a senior compliance officer (at the level of Assistant BSA Officer or above) before the remediation record can be closed.

Step 6: Validate and Close Remediation Record. Upon completion of all remediation steps, the account's remediation file will undergo the quality review process described in Section 10. A compliance analyst will review the completed file to confirm that all identified gaps have been addressed, that the documentation is complete and accurate, that the risk rating is supported, and that EDD has been performed where required. Upon successful quality review, the account will be marked as "remediated" in the tracking system, with a timestamped completion record.

6.2 EDD-Specific Requirements

Enhanced Due Diligence is required for all accounts that are risk-rated high or very high following the CDD remediation process described above. In addition, EDD is mandatory for the following customer categories, regardless of risk-rating outcome:

• Politically Exposed Persons ("PEPs"), including foreign PEPs, domestic PEPs (senior government officials), and international organization PEPs, as well as their family members and close associates;

• Customers with residence, citizenship, or significant business operations in OFAC-sanctioned jurisdictions, FATF grey list or black list countries, or other jurisdictions identified as high-risk in BRB's country risk assessment;

• Customers who have been the subject of prior Suspicious Activity Report filings by BRB or, to the extent known, by other financial institutions;

• Entity customers with complex beneficial ownership structures, including those involving multiple layers of holding companies, trusts, nominee arrangements, or bearer shares;

• Customers exhibiting high-value or unusual transaction patterns that are inconsistent with the stated purpose of the account or the customer's known business profile; and

• Any other customers identified through the risk-rating process or through transaction monitoring as warranting enhanced scrutiny.

For each account requiring EDD, the following documentation must be completed and maintained in the account file:

• Corroborated Source of Funds: Documentation and verification of the origin of the funds flowing into and through the account, including bank statements, employment records, business financial statements, tax returns, or other supporting documentation sufficient to establish a reasonable understanding of the legitimate source of the customer's funds.

• Source of Wealth: Documentation of the customer's overall wealth profile, including the source of the customer's accumulated wealth (as distinguished from the source of specific funds), to the extent that such information is reasonably obtainable and relevant to the risk profile.

• Expected Account Activity Profile: A documented description of the expected nature, volume, and frequency of account activity, based on the customer's stated purpose for the account, business profile, and income level, which will serve as a baseline for ongoing monitoring.

• Senior Management Approval: Written approval of the customer relationship by a senior compliance officer at the level of Assistant BSA Officer or above, documenting the rationale for maintaining the relationship notwithstanding the elevated risk profile.

• Ongoing Monitoring Plan: A defined monitoring plan specifying the frequency of periodic reviews (at minimum annually for high-risk accounts), the scope of each review, and the triggers that would require an interim review outside the regular cycle.

6.3 BaaS Partner Coordination

The CDD/EDD remediation effort will require extensive coordination with BRB's BaaS partners, as the partners serve as the primary customer-facing entities and hold significant customer data and documentation. BRB's obligations as the chartered national bank require it to retain ultimate responsibility for CDD/EDD, regardless of the extent to which specific CDD/EDD functions have been delegated to BaaS partners through contractual arrangements. The Consent Order's findings make clear that BRB cannot rely on BaaS partner assurances regarding CDD/EDD compliance without robust verification and oversight.

Remediation will require the following types of cooperation from BaaS partners:

• Provision of customer identification and CIP documentation collected at onboarding;

• Provision of beneficial ownership information collected from entity customers;

• Facilitation of customer outreach to collect missing or updated information, including delivery of outreach communications through partner platforms (e.g., in-app notifications for NovaPay and VaultEdge customers);

• Sharing of transaction data and account activity information necessary for risk-rating and EDD analysis;

• Participation in account-level discussions regarding complex or high-risk customers; and

• Compliance with deadlines established by BRB for data delivery and customer response facilitation.

Warren Ashby (Head of Fintech Partnerships) will serve as the primary liaison with BaaS partner contacts: Ethan Garrison (CEO, NovaPay Technologies), Aisha Okonkwo (CEO, FairLend Digital), Marcus Tan (CEO, VaultEdge), and the relevant contacts at each of the remaining eleven BaaS partners. Mr. Ashby will communicate remediation requirements, timelines, and expectations to each partner and will track partner responsiveness and cooperation.

Where BaaS partners fail to provide timely cooperation with remediation requirements — defined as failure to respond to data requests within the timelines specified in the BaaS Partner CDD/EDD Responsibility Matrix — BRB will escalate through the following sequence of actions:

1. Initial escalation by Warren Ashby to the partner's designated compliance contact;

2. Escalation by Warren Ashby to the partner's CEO with a formal written demand for cooperation;

3. Issuance of a formal compliance remediation letter, prepared by Calderwood & Harkness LLP, to the partner CEO, citing the partner's contractual obligations and the potential consequences of continued non-cooperation (see companion documents: NovaPay Compliance Remediation Letter, FairLend Compliance Remediation Letter);

4. As a measure of last resort, consideration of suspension of new account onboarding through the non-cooperating partner, or termination of the BaaS partnership agreement, subject to the approval of the CCO, CEO, General Counsel, and outside counsel, and with notification to the Compliance Committee.

The BaaS Partner CDD/EDD Responsibility Matrix (Appendix F, companion document) provides a detailed delineation of which CDD/EDD elements are BRB's direct responsibility versus delegated (but supervised) partner obligations. This matrix is being updated concurrently with the Revised CDD/EDD Policy and will serve as the definitive reference for allocating remediation tasks between BRB and each partner.

6.4 Account Closure Considerations

A foreseeable outcome of the remediation process is that some customer accounts will be subject to closure. Account closure may be appropriate in the following circumstances:

• The customer fails to respond to repeated outreach requests within sixty (60) days of the initial outreach communication, despite multiple attempts through multiple channels;

• The information provided by the customer during the remediation process raises new concerns regarding the legitimacy of the account or the customer's identity;

• The EDD review reveals that the customer presents unacceptable risk that cannot be adequately mitigated through enhanced monitoring; or

• Other factors, including adverse media, law enforcement inquiries, or SAR filing, support a determination that the customer relationship should be terminated.

Account closure decisions will be made by Patricia Langston (CCO) in consultation with Warren Ashby (Head of Fintech Partnerships) and the applicable BaaS partner, following BRB's account closure policy. Where the account closure is prompted by suspicious activity indicators, BRB will file a SAR prior to or concurrent with the closure, in accordance with FinCEN's SAR filing requirements. Account closures will be tracked separately in the remediation tracking system and reported as a distinct category within the overall remediation metrics. The Consent Order does not permit BRB to treat account closure as a substitute for remediation — closure addresses the ongoing risk but does not cure the historical CDD/EDD deficiency. Accordingly, accounts that are closed during the remediation period will be documented to record the deficiency, the outreach attempts, and the basis for closure.

7. Staffing and Resource Allocation

7.1 Temporary Staffing — Pinnacle Compliance Solutions LLC

The scale of the CDD/EDD remediation effort — 47,000 accounts to be remediated within approximately twelve months — exceeds the capacity of BRB's existing BSA/AML department. To ensure that BRB has sufficient analyst capacity to execute this Plan within the mandated timeframes, BRB has contracted with Pinnacle Compliance Solutions LLC ("Pinnacle") to provide temporary BSA/AML analyst support.

Pinnacle (SOW Ref: PCS-BRB-2025-0012; key contact: Andrea Solis, Director of Managed Services; 90 Broad Street, 20th Floor, New York, NY 10004) has been contracted to provide thirty (30) full-time-equivalent ("FTE") BSA/AML analysts for a period of twelve (12) months. The contract rate is $10,000 per month per FTE, resulting in a monthly cost of $300,000 and a total contract value of $3,600,000 for the twelve-month engagement period. The Pinnacle engagement encompasses analyst support for multiple remediation workstreams, with the allocation of FTEs across workstreams determined by BRB based on priority and capacity needs.

A portion of the thirty Pinnacle FTEs will be dedicated to the CDD/EDD remediation workstream. The estimated allocation is twelve to fifteen (12–15) FTEs, with the precise number subject to adjustment based on remediation pace and the relative demands of other workstreams. The remainder of the Pinnacle FTEs will be allocated to SAR backlog clearance (Workstream 2) and other remediation tasks as determined by the Workstream Leads in coordination with the CCO.

All Pinnacle analysts assigned to the CDD/EDD remediation workstream must meet the qualification standards outlined in the Pinnacle Statement of Work and Staffing Plan, which require a minimum of two (2) years of BSA/AML experience, familiarity with CDD/EDD requirements and the FinCEN CDD Rule, and proficiency in reviewing customer identification and beneficial ownership documentation. Pinnacle analysts will operate under the direct day-to-day supervision of Thomas Ikeda (BSA Officer) and will be subject to the Temporary Staff Supervision & Quality Control Protocols memorandum, which establishes procedures for onboarding, training, work assignment, quality review, and performance management of temporary staff.

7.2 Internal BRB Staff

BRB's BSA/AML department has a current headcount of sixty-two (62) FTEs as of January 2025. This headcount is insufficient for the department's ongoing compliance responsibilities and the additional demands of the remediation effort. As part of the overall remediation plan, BRB is adding fifteen (15) permanent FTE compliance staff positions, bringing the planned post-remediation headcount to seventy-seven (77) FTEs. The average fully loaded cost per new FTE (including salary, benefits, and overhead) is $150,000, resulting in a total annual cost of $2,250,000 for the fifteen new positions.

A subset of the new hires — estimated at five to seven (5–7) FTEs — will be specifically focused on CDD/EDD remediation and ongoing periodic review functions. These positions include CDD/EDD remediation analysts, a CDD/EDD quality assurance specialist, and a BaaS CDD/EDD coordination manager. The hiring timeline has been structured to prioritize CDD/EDD-focused roles, with offers extended and start dates targeted to support Phase A remediation. Specifically, the CDD/EDD-focused positions will be filled by no later than April 15, 2025, to ensure that internal BRB staff are available to supplement Pinnacle analysts during the critical Phase A period.

The remaining new hires will support other functions within the BSA/AML department, including SAR analysis, transaction monitoring, OFAC screening, and quality assurance, and will contribute to the department's long-term sustainability beyond the remediation period.

7.3 C&H Advisory Resources

Calderwood & Harkness LLP will provide ongoing advisory support for the CDD/EDD workstream throughout the remediation period. C&H's role encompasses guidance on remediation strategy and methodology, drafting and review of the Revised CDD/EDD Policy and associated procedures, preparation of BaaS partner compliance remediation letters, advice on regulatory reporting and OCC interface, and coordination with the Thornfield independent consultant. The C&H advisory team for this workstream consists of:

• Yuki Nakamura ($895 per hour) — Ms. Nakamura serves as the primary C&H contact for CDD/EDD remediation oversight and policy drafting, including the Revised CDD/EDD Policy, the BaaS Partner CDD/EDD Responsibility Matrix, and remediation process documentation. Ms. Nakamura participates in weekly status calls with the Workstream Lead and provides ongoing guidance on remediation methodology and regulatory compliance.

• Carlos Espinoza ($725 per hour) — Mr. Espinoza supports analyst coordination and BaaS partner engagement, including drafting formal compliance remediation letters to NovaPay and FairLend Digital, and contributes to workstream documentation and OCC reporting.

• Philip Hartmann ($1,450 per hour) — Mr. Hartmann provides escalation support and OCC/regulatory interface as needed, including participation in meetings with the Compliance Committee and the OCC Examiner-in-Charge, and exercises overall supervisory responsibility for C&H's work on this workstream as part of the broader BRB engagement.

C&H's fees for the CDD/EDD workstream are budgeted within the overall C&H engagement and are not charged as a separate line item to this workstream's budget, although the estimated allocation to Workstream 3 is $400,000 to $600,000 over the engagement period, as discussed in Section 8 below.

8. Budget

8.1 Total Workstream Budget: $4,300,000

The total budget allocated to Workstream 3 (CDD/EDD Remediation) is $4,300,000. This budget encompasses the following categories of expenditure:

Temporary Staffing (CDD/EDD-Allocated Pinnacle FTEs): Approximately $1,440,000–$1,800,000. This represents the CDD/EDD workstream's share of the broader Pinnacle Compliance Solutions contract ($3,600,000 total for 30 FTEs over 12 months). Based on an estimated allocation of 12–15 FTEs to CDD/EDD remediation at $10,000 per month per FTE, the Workstream 3 allocation ranges from $1,440,000 (12 FTEs × $10,000/month × 12 months) to $1,800,000 (15 FTEs × $10,000/month × 12 months). The precise allocation will fluctuate over the remediation period based on operational needs and the relative progress of each workstream.

Internal Headcount (CDD/EDD-Focused New Hires): Approximately $750,000–$1,050,000. This represents the CDD/EDD workstream's share of the broader internal hiring budget ($2,250,000 total for 15 new FTEs). Based on an estimated 5–7 FTEs dedicated to CDD/EDD functions at $150,000 per FTE (fully loaded annual cost), the Workstream 3 allocation ranges from $750,000 to $1,050,000. The budget includes recruitment costs, onboarding expenses, and compensation for the first twelve months of employment.

Technology and Data Extraction: Estimated $350,000. This budget covers the costs associated with data extraction from BRB's core banking systems and BaaS partner data feeds, data cleansing and reconciliation activities, development and deployment of the CDD/EDD Progress Tracking Dashboard, and system configuration to support the remediation workflow. Technology costs will be coo

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT Subject to final review before OCC submission; privilege designation to be removed from version filed with OCC as appropriate per the Privilege Protocol Memorandum.
WORKSTREAM 3
CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE REMEDIATION PLAN
Prepared in Response to OCC Consent Order No. OCC-2025-003
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No.: 1045-00002
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
DRAFT — For Inclusion in Comprehensive Remediation Action Plan to be Submitted to the Office of the Comptroller of the Currency by May 15, 2025
ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
Right-click to update Table of Contents
1. Executive Summary
This document constitutes the Workstream 3 remediation plan (the "Plan") and addresses Deficiency Category (iii) as identified in Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order identified, among other matters, BRB's failure to maintain adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") documentation for a substantial population of high-risk customer accounts, the preponderance of which were onboarded through the Bank's fintech Banking-as-a-Service ("BaaS") partnership channel. This Plan has been developed by Calderwood & Harkness LLP ("C&H") in close consultation with BRB management and sets forth the detailed framework, procedures, governance, staffing, budget, and timeline required to achieve full remediation of the identified deficiencies within the timeframes mandated by the Consent Order.
Based upon the findings of the OCC's targeted BSA/AML examination, which concluded in September 2024, approximately 47,000 high-risk customer accounts have been identified as lacking adequate CDD or EDD documentation as of the examination conclusion date. These deficient accounts are overwhelmingly concentrated in the BaaS channel, which encompasses fourteen (14) active fintech sponsor partners operating under BRB's national bank charter. The deficiencies span a range of documentation failures, including incomplete Customer Identification Program ("CIP") records, absent or stale beneficial ownership information, missing customer risk ratings, insufficient EDD for accounts warranting heightened scrutiny, and overdue periodic reviews. The magnitude and systemic nature of these deficiencies reflect structural weaknesses in the allocation and supervision of CDD/EDD responsibilities between BRB and its fintech sponsor partners — weaknesses that this Plan is designed to address both through retrospective remediation and through the adoption of a comprehensive Revised CDD/EDD Policy on a going-forward basis.
This Plan establishes a risk-based prioritization methodology and a phased remediation approach that will proceed in two phases:
Phase A (Priority Remediation): Fifty percent (50%) of the affected account population — 23,500 accounts — will be fully remediated by July 15, 2025, consistent with the interim milestone set forth in the Consent Order.
Phase B (Full Remediation): One hundred percent (100%) of the affected account population — all 47,000 accounts — will be fully remediated by January 15, 2026, consistent with the final remediation deadline set forth in the Consent Order.
The total budget allocated to Workstream 3 is $4,300,000, which encompasses temporary staffing costs, internal headcount additions dedicated to CDD/EDD functions, technology and data management expenditures, BaaS partner outreach and customer communication costs, and related operational expenses. This budget has been approved by the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG"), BRB's parent holding company, as part of the $42,500,000 total remediation budget authorized by the Board Resolution dated February 28, 2025.
This Plan is a component of the Comprehensive Remediation Action Plan ("RAP") required under Article VII of the Consent Order, which mandates submission to the OCC by May 15, 2025. The RAP is to be submitted to Jonathan Frey, National Bank Examiner, Examiner-in-Charge, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. The successful execution and completion of this Plan will be subject to independent validation by the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield") (Engagement Ref: TCG-BRB-2025-001), under the leadership of Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with support from Nathaniel Burgess, Director, Fintech & Payments Compliance. Thornfield's validation will encompass review of the prioritization methodology, interim assessment at the 50% milestone, and final validation at the 100% remediation milestone, with findings to be incorporated into Thornfield's final validation report due to the OCC on February 15, 2026.
The remainder of this Plan details the regulatory background and context for the CDD/EDD deficiencies, the precise scope of the remediation effort, the governance and accountability framework, the risk-based prioritization methodology, the step-by-step remediation process, staffing and resource allocation, the budget, the master timeline, quality assurance protocols, the Revised CDD/EDD Policy, technology and data management infrastructure, BaaS partner-specific remediation considerations, regulatory reporting obligations, risk mitigation strategies, and interdependencies with the other four workstreams of the Comprehensive RAP.
2. Background and Regulatory Context
2.1 Consent Order Findings — CDD/EDD Deficiencies
The OCC's targeted BSA/AML examination of BRB commenced in March 2024 and concluded in September 2024. The examination was conducted by the OCC Northeastern District Office under the direction of Jonathan Frey, National Bank Examiner, Examiner-in-Charge, and was prompted in part by the Bank's failure to satisfactorily remediate prior supervisory actions (as discussed in Section 2.2 below), as well as by the rapid growth and increasing complexity of BRB's BaaS business line. The examination was comprehensive in scope, encompassing BRB's BSA/AML program governance, CIP and CDD practices, EDD processes, OFAC sanctions screening infrastructure, suspicious activity monitoring and reporting, and Board-level oversight.
Among the examination's central findings was the determination that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation as of the examination conclusion date. The OCC's examination team identified pervasive deficiencies across multiple dimensions of CDD/EDD compliance, including but not limited to: accounts lacking completed CIP records meeting the requirements of 31 CFR § 1020.220; accounts for which required beneficial ownership information under 31 CFR § 1010.230 had not been collected, verified, or updated; accounts for which no customer risk rating had been assigned; accounts that had been rated as high risk but for which no documented EDD had been performed; and accounts that had not undergone periodic review within the cycles prescribed by BRB's own policies.
The vast majority of the 47,000 deficient accounts were onboarded through BRB's fintech BaaS partner channels. The OCC concluded that these deficiencies reflected systemic weaknesses in the division of CDD/EDD responsibilities between BRB and its fintech sponsors — specifically, BRB's failure to ensure that its BaaS partners were collecting, maintaining, and transmitting to BRB the CDD/EDD documentation required to meet the Bank's regulatory obligations as the chartered institution of record. The OCC further found that BRB lacked adequate policies, procedures, and internal controls to supervise BaaS partners' CDD/EDD functions, to validate the completeness and accuracy of partner-sourced CDD/EDD data, and to identify and remediate gaps in a timely manner.
The Consent Order issued on January 15, 2025, identifies CDD/EDD deficiencies as one of five core deficiency categories requiring remediation. The five categories are:
(i) OFAC sanctions screening failures, including the approximately 3,800,000 unscreened transactions in the NovaPay channel in CY 2023;
(ii) SAR filing deficiencies, including a backlog of approximately 2,400 unreviewed suspicious activity alerts and late-filed SARs;
(iii) CDD/EDD documentation failures for approximately 47,000 high-risk customer accounts;
(iv) Transaction monitoring model validation gaps, including the absence of independent model validation for BRB's Veridian TMS v.8.3 transaction monitoring system; and
(v) Board-level oversight deficiencies, including the absence of a dedicated Compliance Committee and inadequate BSA/AML reporting to the Board of Directors.
The severity of the CDD/EDD deficiency category is underscored by its intersection with other deficiency categories. The same customer population affected by CDD/EDD gaps is also the population subject to OFAC screening failures and SAR filing deficiencies, reflecting the concentration of risk in the BaaS channel. BaaS-related Suspicious Activity Reports constituted 2,108 of the 3,847 total SARs filed by BRB in calendar year 2024, representing approximately 54.8% of all SAR filings. This disproportionate SAR activity within the BaaS customer population underscores the elevated risk profile of BaaS-onboarded customers and the critical importance of maintaining robust CDD/EDD documentation for this segment.
2.2 Prior Supervisory History
The Consent Order did not arise in a vacuum. BRB has been the subject of escalating supervisory concern over the past three years, with prior OCC supervisory actions that the Bank failed to remediate in a timely and satisfactory manner.
In June 2022, BRB received a Matter Requiring Attention ("MRA") from the OCC regarding deficiencies in the Bank's BSA/AML transaction monitoring program. The MRA identified inadequacies in the calibration and validation of BRB's transaction monitoring scenarios, as well as insufficient documentation of the Bank's transaction monitoring methodology. BRB submitted a remediation plan in response to the MRA, but the OCC's subsequent supervisory review found that the remediation efforts were incomplete and did not fully address the identified concerns.
In November 2023, the OCC issued a Matter Requiring Immediate Attention ("MRIA") — a more serious supervisory action indicating an elevated level of concern — regarding gaps in BRB's OFAC sanctions screening program. The MRIA identified specific instances in which BaaS partner-originated transactions were not being screened against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") in a manner consistent with BRB's regulatory obligations. The MRIA demanded immediate corrective action and enhanced Board reporting on OFAC screening controls.
The Consent Order issued in January 2025 explicitly references BRB's failure to remediate these prior supervisory actions as a material consideration in the OCC's decision to escalate to formal enforcement. The Consent Order describes a "pattern of escalating deficiency" in which BRB repeatedly failed to marshal the resources, governance, and institutional commitment necessary to address identified compliance weaknesses before they compounded into systemic failures. This history of escalating supervisory concern establishes the backdrop against which the current remediation effort must be understood and underscores the importance of demonstrating to the OCC that BRB is now committed to comprehensive, timely, and sustainable compliance remediation.
BRB's prior outside regulatory counsel, Drayton Mercer LLP (lead partner: Helen Frazier), represented the Bank during the 2023–2024 OCC examination cycle, including during the period in which the MRA and MRIA were outstanding. The Drayton Mercer engagement was terminated in January 2025, following the issuance of the Consent Order, and BRB retained Calderwood & Harkness LLP as successor regulatory counsel effective February 10, 2025. C&H has conducted a thorough review of the Drayton Mercer file and the prior supervisory correspondence to ensure continuity and to identify lessons from the prior remediation efforts that inform the design of this Plan.
2.3 Independent Testing Findings
Caldera & Pope LLP ("C&P") serves as BRB's external auditor and has also been engaged as the Bank's contracted BSA/AML independent testing firm. Franklin Dorsey is the C&P Engagement Partner responsible for both the external audit and the BSA/AML independent test.
C&P completed its most recent BSA/AML independent test in September 2024, contemporaneous with the conclusion of the OCC's targeted examination. The C&P independent test identified multiple CDD/EDD deficiencies that are directly echoed in the OCC Consent Order findings. Specifically, C&P reported that a statistically significant sample of BaaS-onboarded accounts exhibited deficiencies in CIP documentation, beneficial ownership records, and risk-rating assignments. C&P also noted that periodic review cycles for high-risk accounts were not being adhered to consistently and that EDD files for a material number of high-risk accounts were either incomplete or absent. These findings corroborate the scope and severity of the CDD/EDD deficiency and provide an independent data point supporting the 47,000-account remediation population identified by the OCC.
The C&P independent test findings have been shared with Thornfield Consulting Group as part of the independent consultant's baseline assessment, and C&P's work papers and testing methodology are available for Thornfield's review.
2.4 BaaS Channel Profile
BRB operates one of the larger BaaS programs among national banks, maintaining fourteen (14) active BaaS partnerships through which fintech companies offer consumer and small-business financial products under BRB's national bank charter. The BaaS program is overseen by Warren Ashby, Head of Fintech Partnerships and BaaS Division, and generated total transaction volume of approximately $74.3 billion in calendar year 2024.
The three largest BaaS partners by transaction volume are:
NovaPay Technologies Inc. NovaPay (CEO: Ethan Garrison; principal offices at 450 Mission Street, Suite 1200, San Francisco, CA 94105) is BRB's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume — approximately $30.5 billion in CY 2024. NovaPay operates a consumer payments and peer-to-peer transfer platform serving approximately 2.1 million end-user accounts under BRB's charter. NovaPay was onboarded as a BaaS partner in 2021 and has grown rapidly, becoming the dominant contributor to BRB's BaaS revenue and the source of the largest concentration of CDD/EDD-deficient accounts.
FairLend Digital LLC. FairLend (CEO: Aisha Okonkwo; principal offices at 100 Summer Street, Suite 800, Boston, MA 02110) is BRB's second-largest BaaS partner, accounting for approximately 28% of total BaaS transaction volume. FairLend operates a digital lending platform through which BRB originated approximately $1.4 billion in consumer and small-business loans in fiscal year 2024. FairLend was onboarded in 2022 and presents unique CDD/EDD challenges due to the additional documentation requirements associated with lending products, including source-of-funds verification and business-entity due diligence for small-business borrowers.
VaultEdge Inc. VaultEdge (CEO: Marcus Tan; principal offices at 2200 Ross Avenue, Suite 3600, Dallas, TX 75201) is BRB's third-largest BaaS partner, accounting for approximately 18% of total BaaS transaction volume. VaultEdge operates a digital savings and neobanking platform with approximately 870,000 deposit accounts under BRB's charter. VaultEdge was onboarded most recently among the top three partners, in 2023, and the recency of its onboarding raises particular concerns about the adequacy of onboarding controls at inception.
The remaining eleven (11) BaaS partners collectively represent approximately 13% of total BaaS transaction volume. While individually smaller than the top three partners, these partners contribute to the overall CDD/EDD deficiency population and will be assessed and remediated on a risk-prioritized basis as described in this Plan.
Total BaaS revenue to BRB in CY 2024 was $127.4 million, comprised of interchange fees, program fees, and interest income. The BaaS business line thus represents a material revenue contributor to the Bank, which must be balanced against the compliance risks that the channel presents.
Importantly, as the chartered national bank, BRB retains ultimate regulatory responsibility for all BSA/AML and CDD/EDD compliance with respect to customers onboarded through its BaaS partners. This principle — codified in OCC guidance, including OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), OCC Bulletin 2020-10 (Third-Party Relationships: Frequently Asked Questions), and the Interagency Guidance on Third-Party Relationships — is a foundational premise of this Plan. BRB may delegate certain CDD/EDD functions to its BaaS partners through contractual arrangements and operational protocols, but the Bank may not delegate its compliance responsibility. The CDD/EDD deficiencies identified by the OCC are ultimately BRB's deficiencies, regardless of whether the proximate cause was a BaaS partner's failure to collect or transmit documentation.
3. Scope Definition
3.1 In-Scope Account Population
The total in-scope account population for Workstream 3 consists of 47,000 high-risk customer accounts that have been identified as lacking adequate CDD or EDD documentation as of the OCC examination conclusion date in September 2024. This figure was determined through the OCC examination team's review of BRB's account records, BaaS partner data feeds, and compliance files, and has been corroborated by the independent testing findings of Caldera & Pope LLP and by BRB's own preliminary internal analysis.
The 47,000 accounts span a range of product types offered through BRB's BaaS channels, including:
• Consumer deposit accounts (checking, savings, and money market accounts offered through BaaS partner digital platforms);
• Small-business lending accounts (term loans, lines of credit, and other lending products originated through FairLend Digital and other lending-focused BaaS partners);
• Savings and neobanking accounts (high-yield savings and hybrid deposit-investment products offered through VaultEdge and similar partners);
• Peer-to-peer ("P2P") payment accounts (payment and transfer accounts offered through NovaPay and similar payments-focused partners); and
• Other products offered through BaaS channels, including prepaid card programs and payment facilitation accounts.
An account has been classified as having "inadequate CDD/EDD" for purposes of this Plan if the account meets one or more of the following criteria:
(a) The account lacks a completed Customer Identification Program ("CIP") record meeting the requirements of 31 CFR § 1020.220, including verification of the customer's identity through documentary or non-documentary means;
(b) The account lacks beneficial ownership information where required under the FinCEN CDD Rule (31 CFR § 1010.230), including identification and verification of each individual who owns 25% or more of the legal entity customer, and identification of a single individual with significant responsibility to control, manage, or direct the legal entity;
(c) The account lacks a current customer risk rating assigned in accordance with BRB's risk-rating methodology;
(d) The account has been rated as high risk or very high risk but lacks documented EDD, including source-of-funds or source-of-wealth analysis, enhanced identification verification, purpose-of-account documentation, or an ongoing monitoring plan; or
(e) The account has not undergone periodic review within the review cycle prescribed by BRB's applicable policies (i.e., the account's most recent periodic review is overdue).
Many of the 47,000 accounts exhibit multiple deficiency criteria simultaneously. The remediation process will address all identified deficiencies for each account, not merely the most prominent or easily remediable gap.
3.2 Channel Distribution
Preliminary data analysis, conducted jointly by BRB's BSA/AML department and IT team, has produced the following estimated breakdown of the 47,000 deficient accounts by BaaS partner:
These figures are estimates based on preliminary data extraction and are subject to refinement as the data extraction and reconciliation process described in Section 12.1 is completed. The final account-by-account inventory, broken down by BaaS partner, product type, and risk tier, will be documented in Appendix A upon completion of the data analysis phase.
A smaller number of deficient accounts may originate from BRB's direct retail banking and wealth management channels, which are not part of the BaaS program. These direct-channel accounts are included within the 47,000 total and will be remediated through the same process described in this Plan, albeit without the BaaS partner coordination complexities.
3.3 Exclusions. The following categories of accounts are excluded from, or subject to modified treatment within, the scope of this Plan:
Closed or Closing Accounts. Accounts that have been formally closed, or that are in the process of closure, prior to the remediation commencement date of April 1, 2025, will be logged in the remediation tracking system and documented with a notation of the CDD/EDD deficiency, but will not be subject to full remediation. For these accounts, the deficiency will be recorded in the account closing documentation, and any remaining regulatory obligations (such as SAR filing where suspicious activity indicators are present) will be fulfilled. The number of accounts falling into this category will be tracked and reported as part of the overall remediation metrics.
Accounts Subject to Active Law Enforcement Requests or Subpoenas. Accounts that are currently subject to active law enforcement requests, grand jury subpoenas, National Security Letters, Section 314(a) requests, or other legal process will be handled under separate coordination protocols established between C&H, BRB's General Counsel Gregory Nardone, and, where applicable, the relevant law enforcement agency. Remediation activities for these accounts will be conducted in a manner that does not interfere with pending legal process, and any customer outreach for these accounts will be reviewed by C&H and the General Counsel's office prior to initiation to ensure compliance with applicable legal constraints.
4. Governance and Accountability
4.1 Workstream Leadership
The effective execution of this Plan requires clear lines of authority, defined roles and responsibilities, and robust escalation protocols. The following individuals have been designated as the leadership team for Workstream 3:
Workstream Sponsor: Patricia Langston, Chief Compliance Officer, BRB. Ms. Langston serves as the executive sponsor for Workstream 3 and is ultimately accountable for the successful completion of CDD/EDD remediation within the timeframes mandated by the Consent Order. In her capacity as CCO, Ms. Langston has direct reporting authority to the Compliance Committee of the BRFG Board of Directors and serves as the Bank's principal liaison with the OCC on compliance matters. Ms. Langston is responsible for ensuring that the Workstream Lead has the resources, authority, and organizational support necessary to execute this Plan.
Workstream Lead (Day-to-Day): Thomas Ikeda, BSA Officer / AML Program Director, BRB. Mr. Ikeda is responsible for the day-to-day management and execution of the CDD/EDD remediation effort. This includes supervision of both internal BRB compliance staff and temporary Pinnacle Compliance Solutions analysts assigned to the workstream, management of the remediation workflow, oversight of quality assurance processes, coordination with BaaS partner contacts, and reporting on progress against milestones. Mr. Ikeda reports to Ms. Langston and, through the reporting structure described below, to the Compliance Committee and outside counsel.
BaaS Channel Coordination: Warren Ashby, Head of Fintech Partnerships / BaaS Division, BRB. Mr. Ashby is responsible for coordinating with BaaS partners to facilitate the data sharing, customer outreach, and documentation collection required for remediation. Mr. Ashby serves as the primary BRB point of contact for BaaS partner CEOs and compliance officers and will be instrumental in managing partner relationships throughout the remediation process, including, where necessary, communicating the consequences of partner non-cooperation.
Technology Support: Linda Petrosian, CIO/CTO, BRB. Ms. Petrosian is responsible for the technology infrastructure supporting the remediation effort, including data extraction from core banking systems and BaaS partner data feeds, development of the CDD/EDD Progress Tracking Dashboard, data cleansing and reconciliation, and integration of remediated customer data with BRB's transaction monitoring and screening systems.
Internal Audit Oversight: Derek Ballard, Head of Internal Audit, BRB. Mr. Ballard will provide independent assurance over the remediation process through periodic audit reviews, as described in Section 10.4 of this Plan.
Outside Counsel Oversight: Calderwood & Harkness LLP. C&H's advisory team for this workstream consists of:
• Philip Hartmann, Partner, C&H — responsible partner for the overall BRB engagement, providing strategic guidance, OCC/regulatory interface, and escalation support;
• Yuki Nakamura, Associate, C&H — primary C&H contact for CDD/EDD remediation oversight, policy drafting (including the Revised CDD/EDD Policy), and coordination with BRB's remediation team; and
• Carlos Espinoza, Associate, C&H — supporting analyst coordination, BaaS partner engagement (including drafting of formal compliance remediation letters), and workstream documentation.
Independent Consultant Validation: Thornfield Consulting Group LLC. As mandated by the Consent Order, Thornfield will perform independent validation of the CDD/EDD remediation effort. The Thornfield team is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, with support from Nathaniel Burgess, Director, Fintech & Payments Compliance. Thornfield operates under Engagement Ref: TCG-BRB-2025-001.
4.2 Reporting Structure
The governance framework for Workstream 3 is designed to ensure that remediation progress is visible, accountable, and subject to appropriate oversight at every level of the organization:
Weekly Reporting. Thomas Ikeda (Workstream Lead) will prepare and distribute a weekly status report to Patricia Langston (Workstream Sponsor) and Yuki Nakamura (C&H). The weekly report will include: accounts remediated during the reporting period, cumulative accounts remediated to date, accounts in process, accounts pending customer response, accounts escalated for closure, quality review metrics, and any issues or impediments requiring escalation. Weekly remediation team meetings will be held to review progress, address operational issues, and coordinate BaaS partner engagement.
Bi-Weekly Reporting. Status reports will be provided on a bi-weekly basis to Thornfield Consulting Group (Nathaniel Burgess and Dr. Vivian Castellano) to ensure the independent consultant maintains current visibility into remediation progress and can plan periodic validation activities accordingly.
Monthly Reporting. A comprehensive monthly progress report, including the CDD/EDD Progress Tracking Dashboard, will be submitted to the Compliance Committee of the BRFG Board of Directors, chaired by James Rutherford. The monthly report will include all key metrics, trend analysis, and narrative discussion of progress, challenges, and mitigation actions. This reporting obligation is part of the Compliance Committee Reporting Framework established under Workstream 5 (Governance & Training).
Quarterly Reporting. Progress against CDD/EDD remediation milestones will be included in the quarterly progress reports submitted to the OCC pursuant to the Consent Order. The first quarterly progress report is due September 15, 2025; the second is due December 15, 2025. These reports will quantify accounts remediated, percentage completion, remaining accounts, and any deviations from the remediation timeline, and will be reviewed by C&H prior to submission.
4.3 Escalation Protocols
The following escalation protocols have been established to ensure that risks to milestone achievement are identified and addressed promptly:
Milestone Risk Escalation. Any risk of missing the July 15, 2025 (50% remediation) or January 15, 2026 (100% remediation) milestones must be escalated immediately by the Workstream Lead (Ikeda) to the Workstream Sponsor (Langston) and the C&H responsible partner (Hartmann). Upon escalation, Langston and Hartmann will assess the nature and severity of the risk and determine appropriate corrective action, which may include reallocation of resources, acceleration of staffing, modification of the prioritization approach, or other measures.
Board-Level Escalation. If remediation falls more than 10% behind the planned pace at any point during the remediation period — i.e., if the cumulative number of accounts remediated is more than 10% below the target for the applicable reporting period — the Workstream Sponsor (Langston) shall escalate the matter to the Compliance Committee (James Rutherford, Chair) and the Risk Committee (Arthur Connelly, Lead Independent Director and Risk Committee Chair) of the BRFG Board of Directors. Board-level escalation will trigger enhanced oversight, including more frequent reporting and, if necessary, emergency resource allocation.
BaaS Partner Non-Cooperation Escalation. Issues requiring BaaS partner cooperation that are not resolved through routine channels will be escalated by Warren Ashby (Head of Fintech Partnerships) to the relevant partner CEO (Ethan Garrison at NovaPay, Aisha Okonkwo at FairLend, Marcus Tan at VaultEdge, or the relevant contact at other partners). If partner non-cooperation persists, C&H will prepare and issue formal compliance remediation letters (see companion documents: NovaPay Compliance Remediation Letter, FairLend Compliance Remediation Letter) demanding cooperation and outlining potential consequences, including suspension of new account onboarding or program termination. Decisions regarding program suspension or termination will be made by the CCO (Langston) in consultation with the CEO, General Counsel (Nardone), and outside counsel (Hartmann) and will require Compliance Committee notification.
5. Risk-Based Prioritization Methodology
5.1 Prioritization Criteria
Given the magnitude of the remediation population — 47,000 accounts — a risk-based prioritization methodology is essential to ensure that the accounts presenting the greatest risk to BRB, its customers, and the integrity of the financial system are remediated first. This approach is consistent with regulatory expectations for risk-based BSA/AML compliance and ensures that BRB allocates its finite remediation resources to maximum risk-reduction effect.
Accounts will be triaged into three priority tiers based on the following risk factors, each of which has been selected for its relevance to the likelihood and potential severity of BSA/AML risk associated with the account:
1. Customer Risk Rating. Accounts that are currently rated "high" or "very high" risk under BRB's existing risk-rating methodology will receive the highest priority for remediation. Accounts for which no risk rating has been assigned — a deficiency that is itself one of the CDD gaps to be remediated — will be presumed to be high risk pending the assignment of a risk rating during the remediation process. This presumption reflects the conservative principle that accounts whose risk profiles are unknown should be treated as potentially elevated risk until affirmatively assessed.
2. Transaction Volume and Value. Accounts with higher aggregate transaction volumes, and particularly accounts with significant wire transfer and Automated Clearing House ("ACH") transaction activity, will be prioritized. These transaction types are subject to OFAC screening requirements and are commonly associated with higher BSA/AML risk due to their speed, volume, and cross-border capabilities. Accounts with aggregate transaction values exceeding specified thresholds (to be defined in the scoring model in coordination with the CRO) will receive elevated priority scores.
3. BaaS Partner Risk Profile. Accounts onboarded through the BaaS partners assessed as presenting the highest risk will be prioritized. Specifically, accounts from NovaPay Technologies are elevated in priority due to the OFAC sanctions screening gap affecting approximately 3.8 million transactions in CY 2023, which compounds the CDD/EDD deficiency for the NovaPay customer population. Accounts from FairLend Digital are elevated due to the complexity of lending-related CDD/EDD requirements. Accounts from VaultEdge are elevated due to the recency of VaultEdge's onboarding and concerns about onboarding controls at inception. Accounts from lower-risk partners receive correspondingly lower priority scores.
4. Geographic Risk. Accounts with connections to high-risk jurisdictions — including countries on the Financial Action Task Force ("FATF") grey list or black list, jurisdictions subject to OFAC comprehensive or sectoral sanctions, and jurisdictions identified by BRB's own country risk assessment as presenting elevated money laundering or terrorist financing risk — will be elevated in priority. Geographic connections include the customer's country of residence, country of citizenship, country of incorporation (for entity customers), and counterparty jurisdictions for significant transactions.
5. SAR History. Accounts that have been the subject of prior Suspicious Activity Report filings, or that are currently associated with pending transaction monitoring alerts in BRB's Veridian TMS, will be prioritized. The existence of a SAR filing or pending alert indicates that the account has already been identified as presenting potential suspicious activity, making the absence of adequate CDD/EDD documentation particularly concerning.
6. Account Age and Activity Status. Active accounts with high levels of ongoing transaction activity will be prioritized over dormant or low-activity accounts. While dormant accounts are not exempt from CDD/EDD requirements, the immediate risk of ongoing illicit activity is higher for accounts that are actively transacting. Dormant accounts will be remediated in Tier 3, with the additional step of assessing whether the account should be closed due to inactivity.
5.2 Tier Classification
Based on the application of the prioritization criteria described above, the 47,000 accounts will be classified into three tiers:
Tier 1 (Highest Priority): Approximately 15,000 Accounts. Tier 1 consists of accounts that meet two or more of the high-risk criteria described above. These accounts represent the most concentrated BSA/AML risk within the remediation population and will be addressed first. The target for Tier 1 remediation is completion by May 31, 2025, providing a buffer ahead of the July 15, 2025 interim milestone. Tier 1 accounts are expected to include the majority of accounts with SAR history, accounts with connections to OFAC-sanctioned or FATF grey-listed jurisdictions, accounts with the highest transaction volumes, and accounts from NovaPay and FairLend Digital with the most acute documentation gaps.
Tier 2 (Elevated Priority): Approximately 16,000 Accounts. Tier 2 consists of accounts that meet one high-risk criterion. These accounts present elevated but not the highest risk and will be remediated second. The cumulative target for Tier 1 and Tier 2 remediation is 23,500 accounts — representing the 50% interim milestone — by July 15, 2025. This means that approximately 8,500 Tier 2 accounts must be remediated between June 1 and July 15, 2025, following the completion of Tier 1. The remaining Tier 2 accounts (approximately 7,500) will be remediated in Phase B alongside Tier 3 accounts.
Tier 3 (Standard Priority): Approximately 16,000 Accounts. Tier 3 consists of the remaining accounts that do not meet any of the high-risk criteria but nonetheless have CDD/EDD documentation deficiencies requiring remediation. These accounts present lower relative risk and will be remediated in Phase B, with a target completion date of January 15, 2026. Tier 3 remediation will proceed concurrently with the completion of remaining Tier 2 accounts and with the ongoing periodic review activities required under the Revised CDD/EDD Policy.
5.3 Data-Driven Triage Process
The prioritization scoring model will be populated using account-level data extracted from BRB's core banking systems and from data feeds provided by each BaaS partner. Linda Petrosian (CIO/CTO) will lead the data extraction effort, working with BRB's IT team and with the technical contacts at each BaaS partner. The data extraction will encompass:
• Customer identification and CIP data (name, address, date of birth, SSN/TIN, identification document records);
• Beneficial ownership information (entity customers);
• Current customer risk rating (where assigned);
• Transaction history (volume, value, type, counterparty jurisdictions);
• SAR filing history and pending TMS alerts;
• Account opening date, BaaS partner of record, and product type;
• Account activity status (active, dormant, restricted);
• Geographic indicators (customer address, country of residence/citizenship, counterparty jurisdictions); and
• Existing CDD/EDD documentation on file (completeness indicators).
The extracted data will be organized into a unified remediation inventory — a single, consolidated database of all 47,000 accounts with their associated data elements. This inventory will serve as the foundation for the scoring model and for the remediation tracking system described in Section 12.
The scoring model will assign a numeric priority score to each account based on the weighted application of the prioritization criteria described in Section 5.1. The specific criteria weights and tier thresholds will be documented in Appendix B (Prioritization Scoring Model) and will be reviewed and approved by Melissa Chu (Chief Risk Officer) and Thomas Ikeda (BSA Officer) prior to application.
Critically, the prioritization methodology must be independently validated by Thornfield Consulting Group before full-scale remediation commences. Nathaniel Burgess (Director, Fintech & Payments Compliance) will lead Thornfield's review of the scoring model, which is targeted for completion by March 31, 2025. Thornfield's review will assess whether the criteria are appropriate, the weights are reasonable, and the resulting tier classifications effectively direct remediation resources toward the highest-risk accounts. Any deficiencies identified by Thornfield will be addressed before the prioritization model is finalized.
6. Remediation Process and Procedures
6.1 CDD Remediation Steps
The remediation of each deficient account will follow a structured, documented process designed to identify all CDD/EDD gaps, collect the required information and documentation, update the account's risk profile, and confirm that the remediated file meets all applicable regulatory and policy requirements. For each deficient account, the remediation team will execute the following steps:
Step 1: Retrieve and Review Existing Documentation. The remediation analyst will compile all CDD records currently on file for the account, including CIP verification records, copies of identification documents, beneficial ownership certification forms (FinCEN Form 4506 or equivalent), account opening documentation, customer questionnaires, and onboarding records sourced from the applicable BaaS partner. The analyst will review all available documentation to establish a baseline understanding of what information is currently available and what is missing. For BaaS partner-sourced accounts, this step will require coordination with the BaaS partner to obtain copies of any documentation held by the partner but not previously transmitted to BRB.
Step 2: Identify Documentation Gaps. The analyst will compare the existing documentation against the requirements set forth in BRB's Revised CDD/EDD Policy (currently in development by C&H, as described in Section 11) and the applicable regulatory standards. The gap analysis will assess compliance with the CIP requirements of 31 CFR § 1020.220 (customer identification and verification), the beneficial ownership requirements of 31 CFR § 1010.230 (the FinCEN CDD Rule), BRB's internal risk-rating methodology, EDD requirements for high-risk accounts, and periodic review requirements. Each identified gap will be documented in the account's remediation record using the standardized Remediation Checklist (Appendix C).
Step 3: Request Missing Information. For each identified gap, the remediation team will initiate outreach to the customer to collect the missing CIP elements, identification documents, beneficial ownership information, source-of-funds documentation, source-of-wealth documentation, and any other information required to complete the CDD or EDD file. Customer outreach may be conducted directly by BRB or through the applicable BaaS partner, in accordance with the allocation of customer-facing responsibilities set forth in the BaaS Partner CDD/EDD Responsibility Matrix (companion document, referenced in Appendix F). Outreach will be conducted using standardized templates (Appendix D) and through multiple channels, including mail, email, and, for accounts on digital platforms, in-app notifications. Where applicable, outreach materials will be provided in multiple languages to accommodate the Bank's diverse customer base. Outreach will be documented in the account's remediation record, including the date, method, and content of each communication.
Step 4: Assign or Update Customer Risk Rating. For each account, the remediation analyst will apply or re-apply BRB's risk-rating methodology, taking into account all available information — including the customer's identification profile, geographic connections, product usage, transaction patterns, business type (for entity customers), beneficial ownership structure, and any adverse media or other risk indicators. Accounts that previously lacked a risk rating will be assigned a rating for the first time. Accounts with existing risk ratings will have their ratings reviewed and updated to reflect current information. The risk-rating determination will be documented and supported by the analyst's written rationale.
Step 5: Document EDD Where Required. For all accounts that are risk-rated high or very high following the risk-rating assignment or update in Step 4, the remediation analyst will complete a full EDD review. The EDD review will encompass the requirements described in Section 6.2 below, including enhanced identification verification, corroborated source-of-funds analysis, source-of-wealth documentation, purpose-of-account documentation, and the development of an ongoing monitoring plan with a defined review cycle. The EDD file will be reviewed and approved by a senior compliance officer (at the level of Assistant BSA Officer or above) before the remediation record can be closed.
Step 6: Validate and Close Remediation Record. Upon completion of all remediation steps, the account's remediation file will undergo the quality review process described in Section 10. A compliance analyst will review the completed file to confirm that all identified gaps have been addressed, that the documentation is complete and accurate, that the risk rating is supported, and that EDD has been performed where required. Upon successful quality review, the account will be marked as "remediated" in the tracking system, with a timestamped completion record.
6.2 EDD-Specific Requirements
Enhanced Due Diligence is required for all accounts that are risk-rated high or very high following the CDD remediation process described above. In addition, EDD is mandatory for the following customer categories, regardless of risk-rating outcome:
• Politically Exposed Persons ("PEPs"), including foreign PEPs, domestic PEPs (senior government officials), and international organization PEPs, as well as their family members and close associates;
• Customers with residence, citizenship, or significant business operations in OFAC-sanctioned jurisdictions, FATF grey list or black list countries, or other jurisdictions identified as high-risk in BRB's country risk assessment;
• Customers who have been the subject of prior Suspicious Activity Report filings by BRB or, to the extent known, by other financial institutions;
• Entity customers with complex beneficial ownership structures, including those involving multiple layers of holding companies, trusts, nominee arrangements, or bearer shares;
• Customers exhibiting high-value or unusual transaction patterns that are inconsistent with the stated purpose of the account or the customer's known business profile; and
• Any other customers identified through the risk-rating process or through transaction monitoring as warranting enhanced scrutiny.
For each account requiring EDD, the following documentation must be completed and maintained in the account file:
• Corroborated Source of Funds: Documentation and verification of the origin of the funds flowing into and through the account, including bank statements, employment records, business financial statements, tax returns, or other supporting documentation sufficient to establish a reasonable understanding of the legitimate source of the customer's funds.
• Source of Wealth: Documentation of the customer's overall wealth profile, including the source of the customer's accumulated wealth (as distinguished from the source of specific funds), to the extent that such information is reasonably obtainable and relevant to the risk profile.
• Expected Account Activity Profile: A documented description of the expected nature, volume, and frequency of account activity, based on the customer's stated purpose for the account, business profile, and income level, which will serve as a baseline for ongoing monitoring.
• Senior Management Approval: Written approval of the customer relationship by a senior compliance officer at the level of Assistant BSA Officer or above, documenting the rationale for maintaining the relationship notwithstanding the elevated risk profile.
• Ongoing Monitoring Plan: A defined monitoring plan specifying the frequency of periodic reviews (at minimum annually for high-risk accounts), the scope of each review, and the triggers that would require an interim review outside the regular cycle.
6.3 BaaS Partner Coordination
The CDD/EDD remediation effort will require extensive coordination with BRB's BaaS partners, as the partners serve as the primary customer-facing entities and hold significant customer data and documentation. BRB's obligations as the chartered national bank require it to retain ultimate responsibility for CDD/EDD, regardless of the extent to which specific CDD/EDD functions have been delegated to BaaS partners through contractual arrangements. The Consent Order's findings make clear that BRB cannot rely on BaaS partner assurances regarding CDD/EDD compliance without robust verification and oversight.
Remediation will require the following types of cooperation from BaaS partners:
• Provision of customer identification and CIP documentation collected at onboarding;
• Provision of beneficial ownership information collected from entity customers;
• Facilitation of customer outreach to collect missing or updated information, including delivery of outreach communications through partner platforms (e.g., in-app notifications for NovaPay and VaultEdge customers);
• Sharing of transaction data and account activity information necessary for risk-rating and EDD analysis;
• Participation in account-level discussions regarding complex or high-risk customers; and
• Compliance with deadlines established by BRB for data delivery and customer response facilitation.
Warren Ashby (Head of Fintech Partnerships) will serve as the primary liaison with BaaS partner contacts: Ethan Garrison (CEO, NovaPay Technologies), Aisha Okonkwo (CEO, FairLend Digital), Marcus Tan (CEO, VaultEdge), and the relevant contacts at each of the remaining eleven BaaS partners. Mr. Ashby will communicate remediation requirements, timelines, and expectations to each partner and will track partner responsiveness and cooperation.
Where BaaS partners fail to provide timely cooperation with remediation requirements — defined as failure to respond to data requests within the timelines specified in the BaaS Partner CDD/EDD Responsibility Matrix — BRB will escalate through the following sequence of actions:
1. Initial escalation by Warren Ashby to the partner's designated compliance contact;
2. Escalation by Warren Ashby to the partner's CEO with a formal written demand for cooperation;
3. Issuance of a formal compliance remediation letter, prepared by Calderwood & Harkness LLP, to the partner CEO, citing the partner's contractual obligations and the potential consequences of continued non-cooperation (see companion documents: NovaPay Compliance Remediation Letter, FairLend Compliance Remediation Letter);
4. As a measure of last resort, consideration of suspension of new account onboarding through the non-cooperating partner, or termination of the BaaS partnership agreement, subject to the approval of the CCO, CEO, General Counsel, and outside counsel, and with notification to the Compliance Committee.
The BaaS Partner CDD/EDD Responsibility Matrix (Appendix F, companion document) provides a detailed delineation of which CDD/EDD elements are BRB's direct responsibility versus delegated (but supervised) partner obligations. This matrix is being updated concurrently with the Revised CDD/EDD Policy and will serve as the definitive reference for allocating remediation tasks between BRB and each partner.
6.4 Account Closure Considerations
A foreseeable outcome of the remediation process is that some customer accounts will be subject to closure. Account closure may be appropriate in the following circumstances:
• The customer fails to respond to repeated outreach requests within sixty (60) days of the initial outreach communication, despite multiple attempts through multiple channels;
• The information provided by the customer during the remediation process raises new concerns regarding the legitimacy of the account or the customer's identity;
• The EDD review reveals that the customer presents unacceptable risk that cannot be adequately mitigated through enhanced monitoring; or
• Other factors, including adverse media, law enforcement inquiries, or SAR filing, support a determination that the customer relationship should be terminated.
Account closure decisions will be made by Patricia Langston (CCO) in consultation with Warren Ashby (Head of Fintech Partnerships) and the applicable BaaS partner, following BRB's account closure policy. Where the account closure is prompted by suspicious activity indicators, BRB will file a SAR prior to or concurrent with the closure, in accordance with FinCEN's SAR filing requirements. Account closures will be tracked separately in the remediation tracking system and reported as a distinct category within the overall remediation metrics. The Consent Order does not permit BRB to treat account closure as a substitute for remediation — closure addresses the ongoing risk but does not cure the historical CDD/EDD deficiency. Accordingly, accounts that are closed during the remediation period will be documented to record the deficiency, the outreach attempts, and the basis for closure.
7. Staffing and Resource Allocation
7.1 Temporary Staffing — Pinnacle Compliance Solutions LLC
The scale of the CDD/EDD remediation effort — 47,000 accounts to be remediated within approximately twelve months — exceeds the capacity of BRB's existing BSA/AML department. To ensure that BRB has sufficient analyst capacity to execute this Plan within the mandated timeframes, BRB has contracted with Pinnacle Compliance Solutions LLC ("Pinnacle") to provide temporary BSA/AML analyst support.
Pinnacle (SOW Ref: PCS-BRB-2025-0012; key contact: Andrea Solis, Director of Managed Services; 90 Broad Street, 20th Floor, New York, NY 10004) has been contracted to provide thirty (30) full-time-equivalent ("FTE") BSA/AML analysts for a period of twelve (12) months. The contract rate is $10,000 per month per FTE, resulting in a monthly cost of $300,000 and a total contract value of $3,600,000 for the twelve-month engagement period. The Pinnacle engagement encompasses analyst support for multiple remediation workstreams, with the allocation of FTEs across workstreams determined by BRB based on priority and capacity needs.
A portion of the thirty Pinnacle FTEs will be dedicated to the CDD/EDD remediation workstream. The estimated allocation is twelve to fifteen (12–15) FTEs, with the precise number subject to adjustment based on remediation pace and the relative demands of other workstreams. The remainder of the Pinnacle FTEs will be allocated to SAR backlog clearance (Workstream 2) and other remediation tasks as determined by the Workstream Leads in coordination with the CCO.
All Pinnacle analysts assigned to the CDD/EDD remediation workstream must meet the qualification standards outlined in the Pinnacle Statement of Work and Staffing Plan, which require a minimum of two (2) years of BSA/AML experience, familiarity with CDD/EDD requirements and the FinCEN CDD Rule, and proficiency in reviewing customer identification and beneficial ownership documentation. Pinnacle analysts will operate under the direct day-to-day supervision of Thomas Ikeda (BSA Officer) and will be subject to the Temporary Staff Supervision & Quality Control Protocols memorandum, which establishes procedures for onboarding, training, work assignment, quality review, and performance management of temporary staff.
7.2 Internal BRB Staff
BRB's BSA/AML department has a current headcount of sixty-two (62) FTEs as of January 2025. This headcount is insufficient for the department's ongoing compliance responsibilities and the additional demands of the remediation effort. As part of the overall remediation plan, BRB is adding fifteen (15) permanent FTE compliance staff positions, bringing the planned post-remediation headcount to seventy-seven (77) FTEs. The average fully loaded cost per new FTE (including salary, benefits, and overhead) is $150,000, resulting in a total annual cost of $2,250,000 for the fifteen new positions.
A subset of the new hires — estimated at five to seven (5–7) FTEs — will be specifically focused on CDD/EDD remediation and ongoing periodic review functions. These positions include CDD/EDD remediation analysts, a CDD/EDD quality assurance specialist, and a BaaS CDD/EDD coordination manager. The hiring timeline has been structured to prioritize CDD/EDD-focused roles, with offers extended and start dates targeted to support Phase A remediation. Specifically, the CDD/EDD-focused positions will be filled by no later than April 15, 2025, to ensure that internal BRB staff are available to supplement Pinnacle analysts during the critical Phase A period.
The remaining new hires will support other functions within the BSA/AML department, including SAR analysis, transaction monitoring, OFAC screening, and quality assurance, and will contribute to the department's long-term sustainability beyond the remediation period.
7.3 C&H Advisory Resources
Calderwood & Harkness LLP will provide ongoing advisory support for the CDD/EDD workstream throughout the remediation period. C&H's role encompasses guidance on remediation strategy and methodology, drafting and review of the Revised CDD/EDD Policy and associated procedures, preparation of BaaS partner compliance remediation letters, advice on regulatory reporting and OCC interface, and coordination with the Thornfield independent consultant. The C&H advisory team for this workstream consists of:
• Yuki Nakamura ($895 per hour) — Ms. Nakamura serves as the primary C&H contact for CDD/EDD remediation oversight and policy drafting, including the Revised CDD/EDD Policy, the BaaS Partner CDD/EDD Responsibility Matrix, and remediation process documentation. Ms. Nakamura participates in weekly status calls with the Workstream Lead and provides ongoing guidance on remediation methodology and regulatory compliance.
• Carlos Espinoza ($725 per hour) — Mr. Espinoza supports analyst coordination and BaaS partner engagement, including drafting formal compliance remediation letters to NovaPay and FairLend Digital, and contributes to workstream documentation and OCC reporting.
• Philip Hartmann ($1,450 per hour) — Mr. Hartmann provides escalation support and OCC/regulatory interface as needed, including participation in meetings with the Compliance Committee and the OCC Examiner-in-Charge, and exercises overall supervisory responsibility for C&H's work on this workstream as part of the broader BRB engagement.
C&H's fees for the CDD/EDD workstream are budgeted within the overall C&H engagement and are not charged as a separate line item to this workstream's budget, although the estimated allocation to Workstream 3 is $400,000 to $600,000 over the engagement period, as discussed in Section 8 below.
8. Budget
8.1 Total Workstream Budget: $4,300,000
The total budget allocated to Workstream 3 (CDD/EDD Remediation) is $4,300,000. This budget encompasses the following categories of expenditure:
Temporary Staffing (CDD/EDD-Allocated Pinnacle FTEs): Approximately $1,440,000–$1,800,000. This represents the CDD/EDD workstream's share of the broader Pinnacle Compliance Solutions contract ($3,600,000 total for 30 FTEs over 12 months). Based on an estimated allocation of 12–15 FTEs to CDD/EDD remediation at $10,000 per month per FTE, the Workstream 3 allocation ranges from $1,440,000 (12 FTEs × $10,000/month × 12 months) to $1,800,000 (15 FTEs × $10,000/month × 12 months). The precise allocation will fluctuate over the remediation period based on operational needs and the relative progress of each workstream.
Internal Headcount (CDD/EDD-Focused New Hires): Approximately $750,000–$1,050,000. This represents the CDD/EDD workstream's share of the broader internal hiring budget ($2,250,000 total for 15 new FTEs). Based on an estimated 5–7 FTEs dedicated to CDD/EDD functions at $150,000 per FTE (fully loaded annual cost), the Workstream 3 allocation ranges from $750,000 to $1,050,000. The budget includes recruitment costs, onboarding expenses, and compensation for the first twelve months of employment.
Technology and Data Extraction: Estimated $350,000. This budget covers the costs associated with data extraction from BRB's core banking systems and BaaS partner data feeds, data cleansing and reconciliation activities, development and deployment of the CDD/EDD Progress Tracking Dashboard, and system configuration to support the remediation workflow. Technology costs will be coo

WORKSTREAM 3

CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE REMEDIATION PLAN

Record

Parties

Dates

Amounts