WORKSTREAM 4
TRANSACTION MONITORING MODEL VALIDATION & TUNING PLAN
Remediation Action Plan — Consent Order No. OCC-2025-003
ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
May 2025
Prepared for:
Belmont Ridge Bank National Association OCC Charter No. 48271; FDIC Certificate No. 31845 680 Lexington Avenue, 22nd Floor New York, NY 10022
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No.: 1045-00002
For Inclusion in Comprehensive Remediation Action Plan Due to the Office of the Comptroller of the Currency by May 15, 2025
Privilege Designation: This document is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This document and its contents are strictly confidential and may not be disclosed, copied, or distributed without the express written consent of Calderwood & Harkness LLP and Belmont Ridge Bank National Association.
Authorized Distribution:
• Gregory Nardone, General Counsel, Belmont Ridge Bank National Association
• Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
• Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
• Linda Petrosian, Chief Information Officer / Chief Technology Officer, Belmont Ridge Bank National Association
• Melissa Chu, Chief Risk Officer, Belmont Ridge Bank National Association
• Compliance Committee Members (James Rutherford, Chair), Belmont Ridge Financial Group, Inc.
• Authorized Members of the BRFG Board of Directors
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum sets forth a detailed remediation plan addressing Deficiency Category (iv) of Consent Order No. OCC-2025-003 ("Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank"). Deficiency Category (iv) pertains specifically to BRB's failure to independently validate and adequately tune its transaction monitoring system ("TMS"), a critical component of the Bank's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program.
BRB currently operates the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3" or the "Current System"), pursuant to Contract No. VA-BRB-2023-0044, with a current annual contract value ("ACV") of $4,100,000 per year under a three-year term ending December 2026. The Veridian TMS v.8.3 platform provides rules-based and behavioral transaction monitoring across BRB's retail banking, commercial lending, and Banking-as-a-Service ("BaaS") partner channels, including integrated sanctions screening capabilities.
Core Deficiency. The OCC's examination findings, which were developed during the targeted BSA/AML examination conducted from March 2024 through September 2024, established that Veridian TMS v.8.3 has not been independently validated since March 2021—more than three years prior to the commencement of the OCC's targeted examination. Furthermore, tuning parameters within the system were last updated in October 2022—more than two years prior to the examination—and that update was limited in scope, covering only three of the system's active detection scenarios. The OCC further found that BRB lacked an ongoing model risk management governance framework for the TMS and had failed to adequately document model assumptions, limitations, and performance metrics.
Supervisory History. The deficiencies identified in the Consent Order are not newly discovered concerns. In June 2022, the OCC issued a Matter Requiring Attention ("MRA") that specifically cited BSA/AML transaction monitoring deficiencies, including the need for model validation and tuning updates. BRB's former outside counsel, Drayton Mercer LLP (Helen Frazier, lead partner), advised on the MRA response, but the MRA was not adequately remediated. The failure to remediate the June 2022 MRA contributed directly to the escalation to the Consent Order. Additionally, in November 2023, the OCC issued a Matter Requiring Immediate Attention ("MRIA") regarding OFAC screening gaps, further evidencing systemic deficiencies in BRB's monitoring and screening infrastructure.
Remediation Approach. This Workstream 4 plan proposes a comprehensive remediation strategy consisting of the following principal components:
1. Technology Upgrade: Upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including an enhanced OFAC screening module, providing expanded machine-learning-assisted behavioral analytics, improved peer-group analysis, BaaS-specific monitoring rules, and enhanced structuring detection capabilities.
2. Comprehensive Model Tuning: Full recalibration of all active detection scenarios and thresholds using statistical analysis, historical data review, and below-the-line testing, with particular attention to BaaS-specific tuning requirements.
3. Independent Model Validation: Engagement of a qualified third-party validator to perform a comprehensive independent model validation of the upgraded TMS v.10.0, including conceptual soundness review, outcomes analysis, and process verification.
4. Ongoing Governance Framework: Establishment of a permanent model risk management governance framework with defined roles and responsibilities, periodic validation cadences, quarterly tuning reviews, formal change management processes, and Board-level reporting.
Key Milestones. The remediation plan targets the following critical deadlines, each of which aligns with the Consent Order's remediation timeline:
• August 1, 2025: User Acceptance Testing ("UAT") completion and production deployment of Veridian TMS v.10.0.
• October 1, 2025: Independent model validation completed, with final validation report delivered.
• November 1, 2025: OFAC screening module fully operational for all BaaS channels (in coordination with Workstream 1).
• February 15, 2026: Compliance Self-Certification submitted to the OCC; Thornfield Consulting Group LLC final validation report due.
Budget. The Veridian TMS v.10.0 upgrade carries a one-time implementation cost of $2,800,000 plus incremental annual licensing of $1,900,000 per year, bringing BRB's total Veridian ACV from $4,100,000 to $6,000,000 per year. The Year 1 total Veridian cost attributable to this workstream is $4,700,000. These costs are included within the Board-approved total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty imposed under the Consent Order).
Contingency Vendor. Ridgeline Data Systems LLC ("Ridgeline") is under active evaluation as a backup vendor in the event that the Veridian upgrade proves insufficient or cannot be delivered on schedule. Ridgeline has proposed terms of $7,200,000 per year for a five-year term, representing a total contract value of $36,000,000. A mutual non-disclosure agreement has been executed for evaluation purposes, and Calderwood & Harkness LLP ("C&H") has prepared both a Veridian vs. Ridgeline Vendor Comparison Memorandum and a Ridgeline Term Sheet Review Memorandum.
Interdependencies. This Workstream 4 plan is closely interdependent with several other components of BRB's Comprehensive Remediation Action Plan:
• Workstream 1 (OFAC Sanctions Screening Remediation): The enhanced OFAC screening module within TMS v.10.0 is a shared deliverable; OFAC module specifications and BaaS channel integration details are addressed in Workstream 1.
• Workstream 2 (SAR Backlog Clearance & Process Improvement): TMS tuning directly affects alert quality and volume, which in turn impacts SAR investigator workload and filing timelines.
• Workstream 3 (CDD/EDD Remediation): Customer risk ratings from the CDD/EDD remediation of approximately 47,000 accounts feed directly into TMS scenario calibration and peer-group analysis.
• Workstream 5 (BSA/AML Program Governance & Training): Board-level and Compliance Committee reporting on TMS model performance, training on model governance for BSA/AML staff, and governance framework alignment are addressed in Workstream 5.
II. BACKGROUND AND CURRENT STATE ASSESSMENT
II.A. Consent Order Findings — Deficiency Category (iv): Model Validation
Consent Order No. OCC-2025-003, issued by the OCC on January 15, 2025, identifies multiple categories of deficiency in BRB's BSA/AML compliance program. Deficiency Category (iv) addresses the Bank's failure to independently validate and adequately tune its transaction monitoring system in accordance with applicable supervisory expectations. The Consent Order's findings in this category are based upon the OCC's targeted BSA/AML examination, which was conducted from March 2024 through September 2024 under the direction of Jonathan Frey, Examiner-in-Charge.
The OCC's specific findings under Deficiency Category (iv) include the following:
(a) No Independent Validation Since March 2021. The Bank's transaction monitoring system had not been independently validated since March 2021—a period exceeding three years prior to the OCC's examination. OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management), which adopts the framework set forth in the Board of Governors' SR 11-7, establishes the expectation that models used in compliance functions, including BSA/AML transaction monitoring models, should be subject to periodic independent validation. The absence of validation for more than three years represents a significant departure from these supervisory expectations and created material model risk that the OCC determined was unacceptable.
(b) Tuning Parameters Last Updated October 2022. The tuning parameters within the Veridian TMS v.8.3 were last updated in October 2022. Moreover, that update was limited in scope, consisting of threshold adjustments applied to only three of the system's active detection scenarios. The remaining scenarios had not been recalibrated since the system's initial implementation. This failure to comprehensively tune the TMS meant that detection thresholds and scenario configurations were not aligned with BRB's evolving risk profile, particularly given the significant growth in the Bank's BaaS operations during calendar years 2023 and 2024.
(c) Absence of Ongoing Model Risk Management Governance. The OCC found that BRB lacked a formal, documented model risk management governance framework specific to the transaction monitoring system. There was no established cadence for periodic validation, no formal process for threshold change approval, and no defined roles and responsibilities for model oversight within the Bank's three lines of defense structure.
(d) Inadequate Documentation of Model Assumptions, Limitations, and Performance Metrics. The Bank failed to maintain adequate documentation of the model's underlying assumptions, known limitations, and ongoing performance metrics. The absence of such documentation hindered both internal oversight and external examination of the system's effectiveness.
These findings were among those contributing to the issuance of the Consent Order, which requires BRB to submit a Comprehensive Remediation Action Plan to the OCC by May 15, 2025. The Consent Order also requires quarterly progress reports to the OCC (due September 15, 2025 and December 15, 2025) and a Compliance Self-Certification by February 15, 2026, supported by an independent assessment from the OCC-mandated independent consultant, Thornfield Consulting Group LLC.
In addition to the OCC's examination findings, Caldera & Pope LLP ("C&P"), BRB's external auditor and BSA/AML independent testing firm (engagement partner Franklin Dorsey), completed its most recent BSA/AML independent test in September 2024. The C&P report identified multiple deficiencies that echoed and corroborated the OCC's findings, including the absence of a current independent model validation, the staleness of tuning parameters, and gaps in model documentation. The C&P independent testing findings further underscore the urgency and necessity of the remediation actions outlined in this plan.
II.B. Transaction Monitoring System — Current Configuration
BRB's transaction monitoring operations are currently supported by the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"). The following describes the current configuration and operational parameters of the system.
Vendor Information. Veridian Analytics Inc. is a Delaware corporation headquartered at 1900 Embarcadero Road, Suite 400, Palo Alto, California 94303. Veridian provides transaction monitoring, sanctions screening, and compliance analytics solutions to financial institutions. BRB's primary point of contact at Veridian is Priya Subramanian, Vice President of Client Solutions, who oversees the BRB account relationship and will serve as the lead Veridian representative for the TMS v.10.0 upgrade.
Contractual Framework. BRB's engagement with Veridian is governed by Contract No. VA-BRB-2023-0044, a Master Services Agreement with an annual contract value of $4,100,000 per year under a three-year term expiring in December 2026. The MSA encompasses the TMS platform license, integrated sanctions screening functionality, standard technical support, and periodic software updates within the v.8.x release line. The upgrade to TMS v.10.0 requires an amendment to the MSA, which C&H has drafted and which is addressed in Section V.B of this plan.
Current Capabilities. The Veridian TMS v.8.3 platform provides rules-based and behavioral transaction monitoring capabilities. The system is configured to process transactions across BRB's core business lines—retail banking, commercial lending, and wealth management—as well as all BaaS partner transaction channels. The system includes integrated sanctions screening functionality, although, as noted in the OCC's examination findings and addressed in Workstream 1, the sanctions screening module has been inadequately configured for certain BaaS transaction flows, most notably those associated with NovaPay Technologies.
Scenario Inventory. As of the date of this plan, BRB's Veridian TMS v.8.3 instance includes a portfolio of active detection scenarios covering the principal typologies of suspicious activity relevant to BRB's business profile and customer base. These scenarios include, but are not limited to:
• Structuring detection (cash and monetary instrument deposits segmented to evade CTR filing requirements);
• Rapid movement of funds (funds-in/funds-out patterns indicative of pass-through or layering activity);
• High-risk geography monitoring (transactions involving jurisdictions identified by FATF, FinCEN, or BRB's internal risk assessment as presenting elevated BSA/AML risk);
• Unusual wire activity (outbound and inbound wire transfers exceeding defined parameters or exhibiting anomalous patterns);
• Peer-group analysis (comparison of individual customer transaction behavior against expected activity for the customer's risk segment and account profile);
• BaaS partner-specific monitoring (rules designed to address the unique risks of BaaS-originated transactions, including P2P payments, digital wallet transfers, and fintech-originated ACH activity);
• Cash-intensive business monitoring (scenarios targeting customers classified as operating cash-intensive businesses);
• Third-party payment processor monitoring; and
• Additional scenarios covering shell company indicators, trade finance anomalies (where applicable to the commercial lending portfolio), and correspondent banking risk factors.
A complete inventory of all active detection scenarios, together with current threshold settings, is maintained within the Veridian TMS v.8.3 administration console and will be extracted and documented as part of the tuning activities described in Section VII of this plan. Appendix D provides the template that will be used for this documentation.
Transaction Coverage. The Veridian TMS v.8.3 is currently configured to monitor the following transaction types across all BRB business lines and BaaS partner channels:
• All deposit account transactions (including cash deposits, check deposits, and internal transfers);
• All wire transfers (both domestic and international, inbound and outbound);
• All Automated Clearing House ("ACH") transactions;
• All card transactions (debit card, credit card, and prepaid card activity); and
• All BaaS partner transaction flows, encompassing transactions originated through each of BRB's 14 active BaaS partners.
It is important to note, however, that while the system is configured to ingest and process BaaS partner transaction data, the OCC's examination identified material gaps in the actual screening and monitoring of certain BaaS flows, particularly those associated with NovaPay Technologies. These gaps are addressed in both this plan (as they relate to model tuning) and in Workstream 1 (as they relate to OFAC sanctions screening).
II.C. Performance Metrics (CY 2024 Baseline)
Understanding the current performance of the Veridian TMS v.8.3 is essential to defining the scope of remediation required and establishing meaningful optimization targets for the upgraded system. The following metrics represent the CY 2024 baseline against which remediation progress will be measured.
Transaction Monitoring Alert Volume. During CY 2024, the Veridian TMS v.8.3 generated a total of 41,500 transaction monitoring alerts across all business lines and BaaS partner channels. This alert volume reflects the output of all active detection scenarios and represents the total population of alerts requiring disposition by BRB's BSA/AML investigation team.
SAR Filing Volume and Conversion Rate. Of the 41,500 alerts generated in CY 2024, BRB's investigation team filed a total of 3,847 Suspicious Activity Reports ("SARs") to FinCEN. This yields a SAR conversion rate (i.e., the ratio of SARs filed to total alerts generated) of approximately 9.3% (3,847 ÷ 41,500 ≈ 9.27%). While the appropriate SAR conversion rate varies by institution and risk profile, the current rate, when considered alongside the absolute alert volume, indicates significant over-alerting and a high proportion of false-positive alerts that consume investigator resources without resulting in regulatory filings.
BaaS-Related SARs. BaaS-related transactions accounted for a disproportionate share of SAR filings. Of the 3,847 total SARs filed in CY 2024, 2,108 (approximately 54.8%) were attributable to BaaS partner transaction activity. This concentration reflects both the inherent risk profile of BaaS-originated transactions and the inadequacy of BaaS-specific monitoring configurations within the current system.
SAR Filing Timeliness. The average elapsed time from alert generation to SAR filing was 78 days in CY 2024. This significantly exceeds the regulatory expectation that SARs be filed within 30 days of the initial detection of suspicious activity (or within 60 days if no suspect has been identified at the time of initial detection). The extended filing timeline is attributable to multiple factors, including the high alert volume straining investigator capacity, an accumulating backlog of unreviewed alerts, and inefficiencies in the case management workflow within the current Veridian v.8.3 platform.
OFAC Screening Hit Volume and False-Positive Rate. In CY 2024, the Veridian TMS v.8.3's integrated OFAC screening module generated 14,320 potential hits against OFAC sanctions lists. Of these, only 12 were confirmed as true matches, yielding a false-positive rate of approximately 99.9% ((14,320 − 12) ÷ 14,320 ≈ 99.92%). This extraordinarily high false-positive rate places an enormous operational burden on the OFAC compliance team and indicates that the screening module's fuzzy matching algorithms, list management configurations, and filtering rules require substantial recalibration.
Year-Over-Year SAR Volume Trend. Total SARs filed in CY 2023 were 2,914. The CY 2024 total of 3,847 represents a year-over-year increase of approximately 32%. This increase is driven in part by the growth in BaaS-related activity, the expansion of BRB's BaaS partner portfolio, and potential changes in customer behavior patterns, though it may also reflect the impact of stale tuning parameters that failed to keep pace with evolving transaction patterns.
Currency Transaction Report Volume. BRB filed a total of 28,612 Currency Transaction Reports ("CTRs") in CY 2024, reflecting the volume of cash transactions exceeding $10,000 processed through BRB's branch network and commercial banking operations.
Alert Backlog. As of September 2024—the conclusion of the OCC's examination fieldwork—BRB had approximately 2,400 unreviewed transaction monitoring alerts in its investigation queue. This backlog represents alerts that had been generated by the TMS but had not yet been assigned to or reviewed by an investigator. The existence of this backlog was cited in the Consent Order and is the subject of dedicated remediation efforts under Workstream 2 (SAR Backlog Clearance & Process Improvement).
Assessment. Taken together, these baseline metrics present a picture of a transaction monitoring system that is simultaneously over-alerting (generating a high volume of alerts, the vast majority of which are false positives, particularly in the OFAC screening function) and under-covering (failing to adequately screen certain BaaS transaction flows, most notably NovaPay, and operating with stale detection parameters that may not capture emerging typologies). The combination of these factors has degraded the effectiveness of BRB's BSA/AML compliance program and contributed directly to the deficiencies identified in the Consent Order. Comprehensive model tuning of the upgraded TMS v.10.0 must address both dimensions of this problem—reducing false positives while ensuring adequate detection coverage.
II.D. Prior Validation and Tuning History
A review of the historical record of model validation and tuning activities for BRB's Veridian TMS reveals a pattern of infrequent and incomplete attention to these critical model risk management functions. The following chronology summarizes the relevant history:
March 2021 — Last Independent Model Validation. The most recent independent model validation of the Veridian TMS v.8.3 was completed in March 2021. This validation was performed by a prior firm that is no longer engaged by BRB. The March 2021 validation report identified several recommendations for threshold adjustments and scenario enhancements. However, BRB's management response to these recommendations was incomplete: only a subset of the identified threshold adjustments were implemented, and several recommended scenario enhancements were deferred indefinitely without documented justification. The partial implementation of the March 2021 validation recommendations represents an additional governance failure that contributed to the deterioration of the TMS's effectiveness over the subsequent years.
October 2022 — Last Tuning of TMS Parameters. The tuning parameters within the Veridian TMS v.8.3 were last updated in October 2022. Critically, this update did not constitute a comprehensive tuning exercise. Rather, it was limited to threshold adjustments on only three of the system's active detection scenarios. The remaining scenarios—including those governing structuring detection, high-risk geography monitoring, and BaaS-specific activity—were not recalibrated. No above-the-line/below-the-line ("ATL/BTL") threshold analysis was performed as part of this update, nor was the update accompanied by formal documentation of the statistical or risk-based rationale for the threshold changes that were made.
June 2022 — OCC MRA on BSA/AML Transaction Monitoring. In June 2022, the OCC issued a Matter Requiring Attention specifically citing deficiencies in BRB's BSA/AML transaction monitoring program. The MRA identified the need for updated model validation and tuning, as well as improvements to the documentation of the TMS's operational parameters and performance. BRB's then-outside counsel, Drayton Mercer LLP (Helen Frazier, lead partner), advised on the Bank's response to the MRA. Despite this engagement, the MRA was not adequately remediated. The limited October 2022 tuning update, discussed above, was the primary responsive action taken, and it was insufficient to address the breadth of the MRA's requirements. The failure to fully remediate the June 2022 MRA was a significant factor in the OCC's decision to escalate its supervisory action from an MRA to the Consent Order issued in January 2025.
November 2023 — OCC MRIA on OFAC Screening Gaps. In November 2023, the OCC issued a Matter Requiring Immediate Attention regarding gaps in BRB's OFAC sanctions screening processes. The MRIA focused on the inadequacy of sanctions screening for certain BaaS partner transaction flows, providing further evidence that the deficiencies in BRB's monitoring and screening infrastructure extended beyond transaction monitoring to encompass sanctions compliance as well. The MRIA is addressed primarily in Workstream 1 but is noted here because it reflects the same underlying failure to maintain and validate the Veridian TMS platform.
No Comprehensive ATL/BTL Analysis. At no point since the Veridian TMS v.8.3's initial implementation has BRB conducted a comprehensive above-the-line/below-the-line threshold analysis across all active detection scenarios. An ATL/BTL analysis is a fundamental component of model tuning, designed to assess whether the system's detection thresholds are set at appropriate levels to capture suspicious activity (above-the-line testing) while also examining whether potentially suspicious activity may be occurring below current thresholds and therefore escaping detection (below-the-line testing). The absence of any such analysis was specifically cited in the Consent Order's findings.
Termination of Prior Outside Counsel. Drayton Mercer LLP, which had served as BRB's primary outside counsel for BSA/AML regulatory matters during the period of the June 2022 MRA and the November 2023 MRIA, was terminated in January 2025 following the issuance of the Consent Order. Calderwood & Harkness LLP was engaged as successor counsel to lead the remediation effort, including the preparation of this Comprehensive Remediation Action Plan.
II.E. BSA/AML Department Staffing Context
The successful execution of the remediation plan outlined in this document depends in significant part on the adequacy of BRB's BSA/AML department staffing. The current and planned staffing levels are as follows:
Current Headcount. As of January 2025, BRB's BSA/AML department comprises 62 full-time equivalent employees ("FTEs"). These employees include investigators, analysts, quality assurance reviewers, sanctions screening analysts, and management personnel. The department is led by Thomas Ikeda, who was appointed BSA Officer and AML Program Director in March 2023.
Planned Permanent Additions. The remediation plan calls for the addition of 15 permanent FTEs to the BSA/AML department, bringing the total permanent headcount from 62 to 77 FTEs. The fully loaded annual cost of these 15 additional positions is estimated at $2,250,000. Certain of these positions will be specifically allocated to model governance and tuning functions, including dedicated resources for ongoing scenario management, threshold monitoring, and model inventory maintenance. The recruitment process for these positions is underway, with targeted completion of hiring by Q3 2025.
Temporary Staffing Augmentation. To bridge the staffing gap during the 12-month remediation period, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide 30 temporary FTE analysts under Statement of Work Reference No. PCS-BRB-2025-0012. The total contract value for the Pinnacle engagement is $3,600,000 for the 12-month period. Pinnacle's temporary staff will be deployed across multiple remediation workstreams, with a portion allocated to support tuning data analysis, historical data extraction, and alert-level review during the parallel-run and post-deployment stabilization periods associated with the TMS v.10.0 upgrade.
Resource Requirements for Workstream 4. Model validation and tuning activities under this Workstream 4 will require dedicated resources from both the BSA/AML team and the Bank's technology team under Linda Petrosian, CIO/CTO. Specific resource allocations are detailed in Section XI (Resource Requirements and Budget) of this plan.
III. REMEDIATION OBJECTIVES
III.A. Consent Order Compliance Objectives
The remediation plan for Workstream 4 is designed to achieve full compliance with the requirements of Consent Order No. OCC-2025-003, Deficiency Category (iv), within the timeframes mandated by the Consent Order. The specific compliance objectives are as follows:
Independent Model Validation. BRB will achieve independent model validation of the upgraded Veridian TMS v.10.0 by October 1, 2025. This validation will be performed by a qualified third party that is independent of both Veridian Analytics (the model vendor) and BRB's internal model development and tuning teams. The validation will encompass conceptual soundness review, outcomes analysis, and process verification, consistent with the expectations set forth in OCC Bulletin 2011-12 and the Board of Governors' SR 11-7 (Supervisory Guidance on Model Risk Management).
Comprehensive Model Tuning. BRB will implement comprehensive tuning of all transaction monitoring scenarios and thresholds within the upgraded TMS v.10.0. This tuning will cover all active detection scenarios—not merely a subset, as was the case with the limited October 2022 tuning update—and will include formal above-the-line and below-the-line threshold analysis with documented statistical justification for each threshold setting.
Ongoing Periodic Validation Governance Framework. BRB will establish a permanent governance framework for model risk management of the TMS that meets OCC supervisory expectations. This framework will include: defined roles and responsibilities within BRB's three lines of defense structure; a formal model inventory with comprehensive documentation of model assumptions, limitations, and performance metrics; a periodic validation cadence (minimum annual independent validation); a periodic tuning cadence (quarterly reviews); formal model change management processes; and Board-level and Compliance Committee reporting on model performance and governance activities.
Full Business Line Coverage. The upgraded TMS v.10.0 will be configured to adequately cover all of BRB's business lines, including retail banking, commercial lending, wealth management, and all 14 active BaaS partner channels. The system must be capable of processing the full volume of BaaS-originated transactions—approximately $74.3 billion in CY 2024—with appropriate monitoring rules and detection scenarios tailored to the risk profiles of each BaaS partner and product type.
Cross-Workstream Alignment. Model validation and tuning findings will be aligned with the OFAC sanctions screening remediation addressed in Workstream 1 and the SAR process improvements addressed in Workstream 2. Specifically, the independent model validation will encompass the OFAC screening module configuration and performance, and the tuning exercise will account for the relationship between alert quality, alert volume, and SAR investigator capacity.
III.B. Operational Objectives
Beyond achieving compliance with the Consent Order's specific requirements, the remediation plan for Workstream 4 pursues the following operational objectives, which are intended to enhance the long-term effectiveness and sustainability of BRB's transaction monitoring program:
False-Positive Rate Reduction. BRB will reduce false-positive alert rates to improve investigator efficiency and ensure that BSA/AML resources are directed toward genuinely suspicious activity. The current CY 2024 baseline of 41,500 total alerts, of which only 3,847 (9.3%) resulted in SAR filings, indicates substantial opportunity for improvement. The tuning exercise will target a reduction in total alert volume to a more manageable level while maintaining or improving the SAR conversion rate above the current 9.3% baseline. The OFAC screening false-positive rate of 99.9% (14,320 hits, 12 true matches) represents an extreme case requiring particular attention through improved fuzzy matching algorithms and enhanced list management within the TMS v.10.0 OFAC module.
Complete BaaS Coverage. BRB will ensure that 100% of BaaS partner transaction flows are covered by the upgraded TMS v.10.0 and OFAC screening module. This objective directly addresses the gaps identified in the OCC examination, particularly the NovaPay screening deficiency (approximately 3,800,000 unscreened transactions in CY 2023), and will be coordinated with the BaaS-specific remediation measures in Workstream 1.
Automated Threshold Monitoring. BRB will implement automated ATL/BTL threshold monitoring capabilities within the TMS v.10.0, together with a periodic recalibration schedule. This will replace the current ad hoc approach to threshold management with a systematic, data-driven process that enables the Bank to identify and respond to threshold drift and changing transaction patterns on an ongoing basis.
Comprehensive Documentation. BRB will ensure full documentation of all model assumptions, limitations, performance benchmarks, and governance controls, addressing the documentation deficiency cited in the Consent Order and establishing a documentation standard that will support future validations, examinations, and internal audits.
IV. TECHNOLOGY UPGRADE PLAN — VERIDIAN TMS v.10.0
IV.A. Scope of Upgrade
The cornerstone of the technology component of this remediation plan is the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0. The v.10.0 release represents a major platform upgrade that addresses many of the architectural and functional limitations of the current v.8.3 system. The scope of the upgrade encompasses the following principal areas:
Enhanced Detection Scenarios. Veridian TMS v.10.0 includes an expanded library of detection scenarios that incorporate machine-learning-assisted behavioral analytics alongside the existing rules-based detection framework. Key enhancements include:
• Improved Peer-Group Analysis: Advanced statistical models for defining and comparing customer peer groups, enabling more precise identification of anomalous transaction behavior relative to expected activity patterns for customers of similar type, geography, and account profile.
• BaaS-Specific Monitoring Rules: Purpose-built detection scenarios designed to address the unique risk characteristics of BaaS-originated transactions, including peer-to-peer payment flows, digital wallet transfers, rapid account funding and defunding patterns, and fintech-originated ACH activity.
• Enhanced Structuring Detection: Improved algorithms for identifying structuring activity, including multi-day and multi-branch structuring patterns, and structuring involving mixed transaction types (e.g., combinations of cash deposits and monetary instrument purchases).
• Machine-Learning-Assisted Behavioral Analytics: Supervised and unsupervised machine learning models that complement rules-based detection by identifying emerging patterns of suspicious behavior that may not be captured by predefined rules.
Enhanced OFAC Screening Module. The TMS v.10.0 upgrade includes an enhanced OFAC screening module that provides both real-time and batch screening capabilities integrated with all 14 BaaS partner transaction flows. The enhanced OFAC module features improved fuzzy matching algorithms, more granular list management controls, and configurable screening sensitivity parameters designed to reduce the current 99.9% false-positive rate while maintaining or improving true-match detection sensitivity. Detailed specifications for the OFAC module are set forth in Workstream 1 (OFAC Sanctions Screening Remediation Plan), and the implementation of the OFAC module is coordinated across both workstreams.
Improved Case Management and Workflow. Veridian TMS v.10.0 includes a significantly upgraded case management and workflow module that addresses several of the operational inefficiencies contributing to BRB's 78-day average SAR filing time. Key improvements include:
• Automated Alert Assignment: Rules-based and capacity-aware automated routing of alerts to investigators, replacing manual queue management and ensuring equitable workload distribution.
• SAR Narrative Generation Assistance: AI-assisted narrative drafting tools that pre-populate SAR narratives based on alert data, transaction details, and customer information, reducing the time required for investigators to prepare filings.
• Quality Review Functionality: Built-in quality review workflows that enable supervisory review and sign-off within the case management system, streamlining the review process and creating a complete audit trail of all review activities.
Enhanced Reporting and Dashboards. The v.10.0 platform includes enhanced reporting and dashboard capabilities designed to support Compliance Committee-level oversight of key transaction monitoring and sanctions screening metrics. Pre-built dashboards will provide real-time and trending views of the following metrics, among others:
• SAR filing volumes and trends (by business line, BaaS partner, and scenario);
• SAR conversion rates (overall and by scenario);
• OFAC hit rates and true-match/false-positive ratios;
• Alert aging and backlog metrics;
• Scenario-level performance indicators;
• Model performance benchmarks and threshold drift indicators.
These dashboards will support the Compliance Committee reporting obligations described in Section IX of this plan and in Workstream 5 (BSA/AML Program Governance & Training).
Architecture. Veridian TMS v.10.0 employs an API-based integration architecture for BaaS partner data feeds, replacing the batch file transfer mechanism used in the current v.8.3 configuration. This architectural improvement enables more timely ingestion and processing of BaaS transaction data and provides greater flexibility for onboarding new BaaS partners. The v.10.0 platform is designed to scale to accommodate BRB's current BaaS total transaction volume of approximately $74.3 billion (CY 2024), with headroom for projected growth in BaaS volumes over the remaining term of the Veridian contract.
IV.B. Commercial Terms
The upgrade from Veridian TMS v.8.3 to TMS v.10.0 has been negotiated with Veridian Analytics on the following commercial terms, which are subject to final documentation in an amendment to the existing Master Services Agreement:
• One-Time Implementation Fee: $2,800,000, covering the platform upgrade, scenario configuration, data migration, integration development, professional services, UAT support, and post-deployment stabilization assistance.
• Incremental Annual Licensing: $1,900,000 per year, covering the TMS v.10.0 platform license increment (over the existing v.8.3 license fee), the enhanced OFAC screening module, and expanded support and maintenance services.
• New Total Annual Contract Value: $4,100,000 (existing ACV under the current contract) + $1,900,000 (incremental licensing) = $6,000,000 per year.
The commercial terms will be documented in an amendment to the Master Services Agreement (Contract No. VA-BRB-2023-0044). The MSA amendment has been drafted by Calderwood & Harkness LLP and includes, among other provisions, detailed performance service level agreements ("SLAs"), implementation milestone requirements with associated remedies, data security and confidentiality protections, and provisions addressing BRB's right to transition to an alternative vendor in the event of Veridian's material breach or failure to meet specified performance benchmarks. The MSA amendment is the subject of a separate document prepared by C&H and is not reproduced in this plan.
The key contact at Veridian Analytics for all commercial and implementation matters is Priya Subramanian, Vice President of Client Solutions, who will serve as the senior Veridian relationship manager for the duration of the upgrade project.
IV.C. Implementation Timeline
The implementation of the Veridian TMS v.10.0 upgrade will follow the timeline set forth below. This timeline has been developed in coordination with Veridian Analytics and BRB's technology team under Linda Petrosian (CIO/CTO), and is designed to achieve the Consent Order's remediation milestones while allowing adequate time for thorough testing and validation.
IV.D. Implementation Risk Factors and Mitigation
The implementation of a major platform upgrade on the timeline required by the Consent Order carries inherent execution risks. BRB has identified the following principal risk factors and corresponding mitigation strategies:
Risk: Delay in Data Migration or BaaS Partner Feed Integration. The upgrade requires integration with data feeds from all 14 active BaaS partners, each of which has its own technical architecture, data formats, and connectivity requirements. Delays in establishing or testing these data feeds could impact the overall implementation timeline.
Mitigation: BRB will undertake early engagement with all 14 BaaS partners, commencing in March 2025, to communicate integration requirements and timelines. Priority will be given to the top three BaaS partners by transaction volume: NovaPay Technologies (41% of BaaS volume), FairLend Digital (28% of BaaS volume), and VaultEdge (18% of BaaS volume). These three partners collectively account for approximately 87% of BaaS transaction volume and will be the focus of the initial integration testing phase. Warren Ashby, Head of the Fintech/BaaS Division, will be responsible for coordinating BaaS partner engagement and ensuring partner cooperation. Where necessary, compliance remediation letters will be issued to BaaS partners demanding timely cooperation with integration requirements pursuant to the terms of their respective program agreements with BRB.
Risk: Insufficient BRB IT Resources. The TMS v.10.0 upgrade requires substantial involvement from BRB's technology team for data migration, integration development, environment management, and testing support. BRB's IT department has competing priorities that could constrain resource availability.
Mitigation: Linda Petrosian (CIO/CTO) has committed to allocating a dedicated project team for the TMS v.10.0 implementation. Additionally, the $2,800,000 implementation fee includes supplemental professional services from Veridian Analytics, including dedicated integration engineers and project management resources, to supplement BRB's internal capabilities.
Risk: Veridian Fails to Meet Performance Benchmarks. There is a risk that the upgraded TMS v.10.0 platform may not perform as expected in the production environment, whether due to software defects, performance degradation under production transaction volumes, or other technical issues.
Mitigation: The MSA amendment includes detailed performance SLAs covering system availability, transaction processing throughput, alert generation latency, and screening response times. The amendment also includes defined escalation procedures for performance issues, with escalation paths to Veridian senior management. Additionally, BRB is maintaining Ridgeline Data Systems LLC as a contingency alternative vendor (see Section VI) in the event that Veridian is unable to meet its performance obligations.
Risk: UAT Reveals Critical Defects Requiring Extended Remediation. The UAT phase may identify critical defects in the TMS v.10.0 configuration that require extended remediation effort, potentially jeopardizing the August 1, 2025 production deployment target.
Mitigation: The implementation timeline includes a built-in buffer between the planned commencement of UAT in July 2025 and the August 1, 2025 deployment target. Additionally, BRB will maintain parallel-run capability to continue operating TMS v.8.3 as a fallback system during the transition period. In the event that critical defects are identified during UAT that cannot be resolved by August 1, 2025, the parallel-run of v.8.3 will ensure continuity of transaction monitoring operations while v.10.0 defects are remediated. Any material delay to the deployment timeline will be communicated to the OCC through C&H.
C&H has prepared a separate Technology Implementation Timeline & Risk Assessment Memorandum that provides additional detail on implementation risks, mitigation strategies, and contingency planning. That memorandum should be read in conjunction with this plan.
V. CONTINGENCY — RIDGELINE DATA SYSTEMS LLC
BRB's primary remediation strategy under this Workstream 4 is the upgrade to Veridian TMS v.10.0 as described in Section IV above. However, recognizing the critical importance of the transaction monitoring system to BSA/AML compliance and the significant consequences of a failed implementation, BRB has undertaken a parallel evaluation of an alternative TMS/sanctions screening vendor: Ridgeline Data Systems LLC ("Ridgeline").
Vendor Information. Ridgeline Data Systems LLC is a Delaware limited liability company headquartered at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661. Ridgeline offers an enterprise-grade transaction monitoring and sanctions screening platform that serves a number of large U.S. financial institutions, including several with significant BaaS operations. BRB's primary point of contact at Ridgeline is David Marchetti, Chief Revenue Officer.
Proposed Commercial Terms. Ridgeline has proposed the following terms for its platform:
• Annual license and services fee: $7,200,000 per year
• Contract term: 5 years
• Total contract value: $36,000,000
These terms are preliminary and subject to further negotiation in the event that BRB determines it is necessary to proceed with Ridgeline. The proposed annual cost of $7,200,000 represents a 20% premium over the anticipated $6,000,000 annual Veridian ACV under the TMS v.10.0 upgrade, though the Ridgeline platform may offer certain capabilities (including native AI-driven analytics and a more mature BaaS integration framework) that partially offset this cost differential.
Evaluation Status. A mutual non-disclosure agreement has been executed between BRB and Ridgeline to facilitate the evaluation process. C&H has prepared two memoranda in connection with the Ridgeline evaluation:
1. Veridian vs. Ridgeline Vendor Comparison Memorandum: A comprehensive comparison of the two platforms across dimensions including functionality, scalability, BaaS integration capabilities, regulatory compliance features, implementation timelines, and total cost of ownership.
2. Ridgeline Term Sheet Review Memorandum: A detailed analysis of the proposed commercial terms, including identification of key negotiation points and risk provisions that would need to be addressed in any definitive agreement.
Contingency Trigger. BRB will initiate a formal procurement process with Ridgeline if either of the following conditions is met:
(a) Veridian TMS v.10.0 fails to meet specified performance benchmarks during UAT or post-deployment stabilization, as measured against the SLAs defined in the MSA amendment; or
(b) Veridian is unable to meet the August 1, 2025 production deployment deadline, and BRB determines that the delay is material and cannot be remediated within a reasonable timeframe.
Timeline Impact. It is critical to acknowledge that a decision to replace Veridian with Ridgeline would carry significant timeline implications. Based on Ridgeline's estimated implementation schedule and the additional procurement, contracting, and data migration activities that would be required, a Ridgeline replacement would add approximately six to nine months to the full deployment timeline. This could extend the completion of Workstream 4 remediation beyond the February 15, 2026 Consent Order deadline, necessitating discussions with the OCC regarding a revised remediation timeline. This risk underscores the paramount importance of the Veridian TMS v.10.0 upgrade succeeding on schedule.
OCC Notification. Any engagement of Ridgeline as a replacement vendor would require separate notification to the OCC and potentially revised remediation timeline discussions with Jonathan Frey, OCC Examiner-in-Charge. C&H would coordinate any such notification and discussions on BRB's behalf. Additionally, Thornfield Consulting Group would need to be informed, as a vendor transition would materially affect the scope and timeline of Thornfield's independent assessment.
VI. COMPREHENSIVE MODEL TUNING PLAN
VI.A. Tuning Objectives
The comprehensive model tuning exercise represents one of the most critical components of the Workstream 4 remediation plan. The tuning objectives are designed to address the specific deficiencies cited in the Consent Order while establishing a framework for ongoing, data-driven calibration of the TMS.
Full Recalibration. BRB will perform a full recalibration of all active detection scenarios in the upgraded TMS v.10.0. Unlike the limited October 2022 tuning update, which addressed only three scenarios, this exercise will encompass every active scenario in the system, including structuring detection, rapid movement of funds, high-risk geography monitoring, unusual wire activity, peer-group analysis, BaaS-specific scenarios, and all other detection rules.
ATL Threshold Optimization. Above-the-line thresholds will be optimized to ensure adequate detection of suspicious activity while managing alert volumes to a level that is operationally sustainable given BRB's current and planned investigator resources. Each threshold setting will be supported by documented statistical analysis, risk-based rationale, and regulatory alignment considerations.
BTL Threshold Establishment and Monitoring. Below-the-line thresholds will be established for each detection scenario, together with an ongoing BTL monitoring framework. BTL testing will be conducted to identify whether potentially suspicious activity is occurring below current detection thresholds and therefore escaping the system's surveillance. This directly addresses the Consent Order's finding regarding the absence of a formal ATL/BTL framework.
BaaS-Specific Tuning. Given that BaaS-related SARs constituted 54.8% of all SARs in CY 2024 (2,108 of 3,847 total), BaaS-specific tuning considerations are a central focus of the tuning exercise. The unique risk profiles of BaaS-originated transactions—including the prevalence of peer-to-peer payment flows, the velocity of digital transaction activity, and the challenges of customer due diligence for fintech-onboarded customers—require differentiated monitoring parameters that cannot be adequately addressed by the Bank's general retail banking scenarios alone.
VI.B. Tuning Methodology
The comprehensive tuning exercise will employ the following methodological framework, which incorporates quantitative analysis, qualitative risk assessment, and regulatory alignment considerations:
Historical Data Analysis. The tuning team will conduct a thorough review of 24 months of transaction data across all business lines and BaaS partner channels (CY 2023 and CY 2024). This analysis will examine transaction volumes, value distributions, customer segmentation patterns, alert generation patterns, SAR filing outcomes, and known suspicious activity typologies observed during the review period. Historical data analysis provides the empirical foundation for threshold calibration by establishing the statistical characteristics of the transaction populations monitored by each detection scenario.
Statistical Threshold Analysis. Tuning recommendations will be informed by rigorous statistical analysis, including:
• Distribution Analysis: Examination of the statistical distributions of relevant transaction characteristics (e.g., transaction values, frequencies, geographic concentrations) for each scenario's target population.
• Percentile-Based Calibration: Use of percentile thresholds to set detection parameters at levels that capture the targeted proportion of the transaction population.
• Peer Benchmarking: Comparison of BRB's threshold settings against anonymized industry benchmarks for institutions of comparable size, business mix, and risk profile. Veridian Analytics will provide peer benchmarking data from its client base (subject to appropriate anonymization and data sharing provisions), and BRB will supplement this with publicly available industry data where appropriate.
Below-the-Line Analysis. A critical component of the tuning methodology is sample-based testing below current thresholds to identify potentially suspicious activity that is not captured by current detection rules. BTL testing will involve the selection of statistically significant samples of transactions that fall below current thresholds and the manual review of those samples for indicators of suspicious activity. The results of BTL testing will inform threshold adjustment decisions and provide documentation of the Bank's assessment that current thresholds are not resulting in material under-reporting.
Scenario-Specific Tuning. Each detection scenario will be individually tuned with documented rationale specific to the scenario's purpose, target population, and historical performance. This includes, but is not limited to, the following scenarios:
• Structuring detection scenarios (multiple sub-scenarios addressing cash structuring, monetary instrument structuring, and multi-branch structuring patterns);
• Rapid movement of funds scenarios (funds-in/funds-out analysis with configurable look-back periods and velocity thresholds);
• High-risk geography scenarios (both OFAC-specific and general high-risk country/jurisdiction monitoring);
• Unusual wire activity scenarios (domestic and international wire scenarios with value, frequency, and counterparty-based thresholds);
• Peer-group analysis scenarios (customer-level behavioral analytics compared against peer-group norms);
• BaaS-specific scenarios (P2P payment monitoring, digital wallet activity, fintech-originated ACH monitoring, rapid account funding/defunding);
• Cash-intensive business scenarios;
• Third-party payment processor scenarios; and
• Additional scenarios as warranted by BRB's risk assessment and typology analysis.
BaaS Partner Segmentation. The tuning methodology will incorporate BaaS partner segmentation to account for the materially different risk profiles and transaction characteristics of different BaaS partners. Separate tuning parameters will be developed for each of the top three BaaS partners by transaction volume:
• NovaPay Technologies: NovaPay processes approximately 41% of BRB's BaaS transaction volume, representing approximately $30.5 billion in transaction value in CY 2024. NovaPay's product suite is heavily oriented toward peer-to-peer payment flows, which present unique monitoring challenges including high transaction velocity, small transaction values, and difficulty in distinguishing legitimate P2P activity from structuring or layering activity. Additionally, approximately 3,800,000 NovaPay transactions (representing 12% of the 31.7 million total NovaPay transactions in CY 2023) were unscreened for OFAC compliance, a finding that underscores the need for particularly rigorous tuning of NovaPay-specific monitoring parameters.
• FairLend Digital: FairLend Digital accounts for approximately 28% of BaaS transaction volume. FairLend's product suite includes digital lending and deposit products that present different risk characteristics than NovaPay's P2P platform.