CALDERWOOD & HARKNESS LLP

CALDERWOOD & HARKNESS LLP
1285 Avenue of the Americas, 40th Floor New York, New York 10019
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WORKSTREAM 5
BSA/AML PROGRAM GOVERNANCE & TRAINING ENHANCEMENT PLAN
Remediation Action Plan — Belmont Ridge Bank National Association
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reference: Consent Order No. OCC-2025-003 (Effective January 15, 2025)
Submission: For inclusion in the Comprehensive Remediation Action Plan due to the Office of the Comptroller of the Currency by May 15, 2025
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022 OCC Charter No. 48271 | FDIC Certificate No. 31845
Prepared by:
Calderwood & Harkness LLP C&H Matter No. 1045-00002
Philip Hartmann, Responsible Partner ($1,450/hr) Yuki Nakamura, Lead Associate ($895/hr) Carlos Espinoza, Working Associate ($725/hr)
Date: May 2025
ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
This document has been prepared by Calderwood & Harkness LLP in its capacity as outside counsel to Belmont Ridge Bank National Association for the purpose of rendering legal advice in connection with Consent Order No. OCC-2025-003 and related regulatory matters. This document is protected by the attorney-client privilege and the work-product doctrine and shall not be disclosed to any third party, other than authorized regulators pursuant to Section 12 hereof, without the prior written consent of the Bank's General Counsel and C&H.
1. Executive Summary
This Workstream 5 Governance and Training Enhancement Plan (the "Plan") has been prepared by Calderwood & Harkness LLP ("C&H") in coordination with the senior management of Belmont Ridge Bank National Association ("BRB" or the "Bank") and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG"). The Plan is one of five interlocking workstreams that together comprise the Bank's Comprehensive Remediation Action Plan responsive to Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025.
Workstream 5 is directed specifically at Deficiency Category (v) of the Consent Order — board-level oversight deficiencies in the Bank's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program. In its findings, the OCC concluded that the BRFG Board of Directors had not maintained a dedicated Compliance Committee; that BSA/AML reporting to the Board was delivered only on a quarterly basis; and that such reporting was materially deficient in scope, omitting foundational program metrics including Suspicious Activity Report ("SAR") volumes and filing timeliness, Office of Foreign Assets Control ("OFAC") screening hit rates, transaction monitoring alert dispositions, and risk ratings for the Bank's Banking-as-a-Service ("BaaS") partners. The Consent Order additionally identified enterprise-wide training gaps — encompassing baseline awareness training, role-specific advanced training for BSA/AML personnel, and specialized training for the Board and executive management — that were documented during the OCC's targeted BSA/AML examination conducted from March 2024 through September 2024.
The governance-oriented findings in the Consent Order substantially parallel the conclusions of the independent BSA/AML testing performed by Caldera & Pope LLP in September 2024 (engagement partner Franklin Dorsey), and reflect a pattern of prior escalation. The OCC previously issued a Matter Requiring Attention ("MRA") in June 2022 concerning transaction monitoring deficiencies and a Matter Requiring Immediate Attention ("MRIA") in November 2023 concerning OFAC screening gaps, notably including the failure to screen approximately 3.8 million of 31.7 million NovaPay transactions during calendar year 2023 (a coverage gap of approximately 12%). The Consent Order expressly cites the Bank's failure to remediate these prior supervisory findings as evidence of governance and oversight breakdown.
The total budget dedicated to Workstream 5 as scoped in this Plan is $2,300,000, comprising $500,000 for board and governance restructuring and $1,800,000 for training and policy development. In addition, the BSA/AML department will be restructured and expanded from its current permanent headcount of 62 full-time equivalents ("FTEs") to a target permanent headcount of 77 FTEs, an incremental 15 permanent hires at an estimated fully loaded annual cost of $2,250,000. During the 12-month intensive remediation period, permanent staff will be supplemented by 30 temporary FTEs deployed under a managed-services arrangement with Pinnacle Compliance Solutions LLC at a contract value of $3,600,000. These staffing costs are shared across multiple workstreams; Workstream 5 provides the organizational and governance framework within which these resources will operate.
Thornfield Consulting Group LLC ("Thornfield"), the independent consultant retained pursuant to the Consent Order (engagement reference TCG-BRB-2025-001, led by Dr. Vivian Castellano), will validate the governance and training enhancements described herein as part of its comprehensive assessment of the Bank's remediation efforts. Thornfield's preliminary gap assessment is due April 15, 2025, and its final validation report — which will support the Bank's self-certification of compliance — is due February 15, 2026.
The key deadlines governing Workstream 5 are the adoption of a Board Resolution establishing the Compliance Committee by February 28, 2025 (the 45-day mark from the Consent Order's effective date); the operationalization of the Compliance Committee with monthly meetings throughout the remediation period; the submission of this Plan as a component of the Comprehensive Remediation Action Plan on May 15, 2025; and full implementation of the governance and training framework by February 15, 2026, coinciding with the Bank's compliance self-certification obligation.
2. Consent Order Requirements — Governance and Training Provisions
2.1 Specific Consent Order Mandates
The Consent Order contains several discrete provisions bearing directly on the scope of Workstream 5. In summary form, and on an article-by-article basis, the following mandates apply:
•  Article III (Board Oversight). The Board is required to establish and maintain a dedicated Compliance Committee comprised principally of independent directors, with defined authority to oversee the Bank's BSA/AML compliance program, its remediation, and its interaction with the independent consultant retained under Article X.
•  Article IV (Reporting). The Board must receive, on no less than a monthly basis during the remediation period, comprehensive BSA/AML program metrics including, but not limited to, SAR filing volumes and timeliness; OFAC screening hit rates and true-match statistics; Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") remediation status; transaction monitoring alert volumes and disposition; and risk ratings for each BaaS partner.
•  Article V (BSA Officer and Staffing). The Bank shall maintain a qualified BSA Officer, vested with sufficient authority, independence, and resources, and shall ensure that the BSA/AML department is adequately staffed relative to the size, complexity, and risk profile of the Bank's operations — with specific reference to the Bank's BaaS activities.
•  Article VII (Training). The Bank shall implement an enterprise-wide BSA/AML and OFAC training program covering all personnel, with role-specific curricula and documented completion tracking maintained for a minimum of five years.
•  Article X (Independent Consultant). The Board, through the Compliance Committee, shall actively oversee remediation progress and shall engage constructively with the independent consultant.
2.2 Prior Supervisory History and Governance Failures
The governance mandates in the Consent Order are best understood against the Bank's supervisory history of the past three years, which reflects a pattern of escalation driven in significant part by insufficient Board engagement:
•  June 2022 MRA — Transaction Monitoring. In connection with the 2022 continuous examination cycle, the OCC issued an MRA identifying deficiencies in the Bank's transaction monitoring program, including insufficient tuning of the Veridian Transaction Monitoring System ("Veridian TMS") and inadequate alert disposition documentation. The Board received only generalized quarterly reports concerning the MRA; there was no dedicated committee tasked with tracking remediation progress against defined milestones.
•  November 2023 MRIA — OFAC Screening. The escalation from MRA to MRIA in November 2023 reflected continued governance failures. The MRIA concerned material OFAC screening gaps affecting BaaS channels, including the failure to screen approximately 3.8 million of 31.7 million NovaPay transactions (approximately 12%) during calendar year 2023. Available records indicate the Board was not specifically informed of the magnitude of the NovaPay screening gap, notwithstanding its supervisory significance.
•  Prior Outside Counsel. During the period from 2019 through January 2025, the Bank was represented by Drayton Mercer LLP (Helen Frazier, lead partner; 55 East 52nd Street, Suite 3100, New York, NY 10055) on BSA/AML supervisory matters. That engagement was terminated by the Bank in January 2025 following issuance of the Consent Order. C&H was retained as replacement outside counsel effective January 20, 2025.
•  September 2024 Independent Testing. Caldera & Pope LLP's independent BSA/AML test (fee: $1,100,000; engagement partner Franklin Dorsey) identified governance and reporting deficiencies substantially aligned with those subsequently articulated by the OCC. Available records suggest these findings were not adequately escalated to the Board level.
2.3 Remediation Deadlines Applicable to Workstream 5
The Consent Order establishes the following firm deadlines pertinent to this Workstream:
3. Board-Level Governance Restructuring
3.1 Establishment of the Compliance Committee
Consistent with Article III of the Consent Order, the BRFG Board of Directors will adopt, on or before February 28, 2025, a Board Resolution acknowledging the Consent Order and establishing a standing Compliance Committee of the Board (the "Compliance Committee"). The draft Resolution and accompanying Compliance Committee Charter have been prepared by C&H and are attached hereto as Appendix A.
The Compliance Committee will initially consist of three independent directors:
•  James Rutherford — Independent Director, designated as Chair of the Compliance Committee. Mr. Rutherford has more than 25 years of experience in financial services regulatory matters and previously served as General Counsel at a peer institution.
•  Sandra Villarreal — Independent Director, with prior experience as a state banking commissioner.
•  Keith Yamamoto — Independent Director, with a background in fintech and payments compliance.
The Compliance Committee shall consist of no fewer than three independent directors at all times. Additional members may be appointed by the Board upon recommendation of the Nominating and Governance Committee.
To ensure clear delineation of responsibilities and avoid duplication with other standing Board committees, the following boundaries are memorialized in the Charter:
•  The Audit Committee (chaired by Margaret Dao) retains oversight of financial reporting, internal controls over financial reporting, and the Bank's external auditor relationship with Caldera & Pope LLP (whose engagement includes both external audit and BSA/AML independent testing services).
•  The Risk Committee (chaired by Arthur Connelly, Lead Independent Director) retains oversight of enterprise risk management, credit risk, market risk, and regulatory capital adequacy, including monitoring of the Bank's Tier 1 capital ratio of 11.2% as of December 31, 2024.
•  The Compliance Committee will exercise oversight of the BSA/AML compliance program, OFAC sanctions compliance, consumer compliance, and remediation of the Consent Order. The Compliance Committee will coordinate with the Audit Committee on independent testing matters and with the Risk Committee on enterprise risk implications of BSA/AML matters.
The Compliance Committee is expressly authorized under its Charter to retain independent legal counsel, consultants, and other advisors as it deems necessary, and shall have direct and unrestricted access to Philip Hartmann of Calderwood & Harkness LLP and to Dr. Vivian Castellano of Thornfield Consulting Group LLC.
3.2 Compliance Committee Meeting Cadence and Agenda Framework
The Compliance Committee will meet monthly throughout the remediation period from February 2025 through February 2026, and may meet more frequently on the call of the Chair or upon request of the CCO, the General Counsel, or C&H. Following completion of the remediation period and receipt of Thornfield's final validation report, the Committee's meeting cadence may transition to quarterly, subject to the discretion of the Board and any continued expectations articulated by the OCC.
Each Compliance Committee meeting will follow a standing agenda that includes, at minimum, the following items:
1.  Report of the BSA Officer (Thomas Ikeda) on the operational status of the BSA/AML program;
2.  Report of the CCO (Patricia Langston) on cross-workstream remediation progress;
3.  SAR filing metrics — including monthly, year-to-date, and trailing 12-month volumes, and average filing timeliness (CY 2024 baseline: 3,847 SARs filed; 78-day average filing time against the Bank's target of 30 days);
4.  OFAC screening hit rates and true-match statistics (CY 2024 baseline: 14,320 hits generated; 12 true matches; false-positive rate of approximately 99.9%);
5.  CDD/EDD remediation progress against the population of 47,000 accounts subject to remediation, tracked to interim milestone of 23,500 accounts by July 15, 2025 and completion by January 15, 2026;
6.  Transaction monitoring alert volumes and SAR conversion rates (CY 2024 baseline: 41,500 alerts; 9.3% SAR conversion rate);
7.  BaaS partner risk ratings and compliance status across the Bank's 14 active BaaS partners, with particular focus on the three largest by volume: NovaPay (41% of BaaS volume), FairLend Digital (28%), and VaultEdge (18%);
8.  Status of the SAR backlog (2,400 unreviewed alerts at baseline) against the June 30, 2025 clearance target;
9.  Status updates from the independent consultant, Thornfield Consulting Group;
10.  Engagement updates from Calderwood & Harkness LLP, including regulatory strategy and privilege matters;
11.  Budget and resource utilization against the $42,500,000 remediation budget (exclusive of the $14,500,000 civil money penalty);
12.  Regulatory correspondence update, including all communications with the OCC and, as applicable, FinCEN.
3.3 Reporting Metrics and Dashboard
A Board-level BSA/AML compliance dashboard will be developed and deployed to enable the Compliance Committee and full Board to receive standardized, quantitative reporting on the health of the BSA/AML program. The dashboard will be updated on a monthly basis and will include, at minimum, the following key performance indicators ("KPIs"):
•  SAR filing count (monthly, year-to-date, trailing 12-month);
•  SAR filing timeliness — average days from alert generation to SAR filing, against a target of ≤30 days;
•  OFAC screening coverage rate across all channels including BaaS, against a target of 100%;
•  OFAC true-match rate and blocking/rejection actions;
•  CDD/EDD remediation completion percentage against the 47,000-account population;
•  Transaction monitoring alert volume and disposition rates by disposition category;
•  SAR conversion rate (SARs filed as a percentage of alerts generated);
•  Currency Transaction Report ("CTR") filing volumes (CY 2024 baseline: 28,612 CTRs);
•  BaaS-related SAR volume as a percentage of total SARs (CY 2024 baseline: 2,108 of 3,847, or 54.8%);
•  Staffing levels — permanent FTEs against the plan of 77, and Pinnacle temporary FTEs against the plan of 30;
•  Training completion rates by audience segment (see Section 6);
•  Remediation milestone tracker, cross-referenced to every Consent Order deadline.
Dashboard specifications, data source mapping, and technical implementation will be developed in coordination with CIO/CTO Linda Petrosian and BSA Officer Thomas Ikeda. Target date for initial dashboard deployment is April 2025.
3.4 Corporate Bylaws Amendment
To formalize the Compliance Committee as a standing committee of the Board, the corporate bylaws of Belmont Ridge Financial Group, Inc. (a Delaware corporation) will be amended to incorporate provisions concerning the composition, qualifications, authority, meeting requirements, and reporting obligations of the Compliance Committee. Redlined and clean copies of the amended bylaws have been prepared by C&H for consideration by the Nominating and Governance Committee and adoption by the full Board.
The bylaw amendments provide, among other things, that each member of the Compliance Committee must qualify as an "independent director" under applicable listing standards and applicable federal banking regulations, and that at least one member of the Committee shall possess documented BSA/AML experience or a comparable financial services regulatory background.
3.5 Board Oversight Accountability Standards
Directors' obligations under the Consent Order are substantive and personal. Each director is required to actively oversee the BSA/AML program, to receive and critically review monthly reporting materials, and to engage directly with the independent consultant retained under Article X. These obligations are not delegable to management.
Individual directors and executive officers should be aware of the potential exposure to civil money penalties, prohibition orders, and other enforcement actions available to federal banking regulators under 12 U.S.C. § 1818, including institution-affiliated party removal proceedings. Nothing in this Plan is intended to constitute a comprehensive analysis of individual liability exposure; C&H is prepared to provide individualized briefings to any director or officer upon request through the General Counsel.
The Bank's Directors' and Officers' liability insurance coverage has been reviewed by C&H and outside brokers in light of the Consent Order and the total remediation outlay of approximately $57,000,000 ($42,500,000 remediation budget plus the $14,500,000 civil money penalty). A separate coverage assessment memorandum has been provided to the General Counsel.
All members of the Board are required to complete the Tier 1 training curriculum described in Section 6.3.4 hereof.
4. Senior Management Governance Enhancements
4.1 BSA/AML Program Governance Structure — Current State
As of the date hereof, the Bank's BSA/AML governance structure at the management level is as follows:
•  Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), reports to the Chief Compliance Officer.
•  Patricia Langston, Chief Compliance Officer (appointed January 2024; her predecessor was terminated in connection with the OCC's targeted examination findings), reports to the General Counsel.
•  Gregory Nardone, General Counsel and Corporate Secretary, reports to the CEO and to the Board.
•  Melissa Chu, Chief Risk Officer, maintains an independent enterprise risk oversight function reporting to the Risk Committee.
•  Warren Ashby, Head of Fintech Partnerships and BaaS Division, has direct business ownership of the Bank's 14 BaaS partner relationships.
•  Derek Ballard, Head of Internal Audit, provides independent testing and audit reporting to the Audit Committee.
The BSA/AML department currently has a headcount of 62 FTEs and an FY 2024 operating budget of $18,200,000.
4.2 Recommended Governance Enhancements
The following governance enhancements are recommended to align the Bank's structure with Article V of the Consent Order and with regulatory expectations regarding BSA Officer independence:
(a) Elevated BSA Officer reporting. Effective upon Board adoption of the amended organizational structure, Thomas Ikeda, as BSA Officer, will have a direct reporting line to the Compliance Committee, with a dotted line to the CCO (Patricia Langston) for day-to-day supervisory coordination. This structural change is designed to ensure the BSA Officer's independence from business-line influence and to guarantee unfiltered access to the Board.
(b) Management-Level BSA/AML Steering Committee. A Management-Level BSA/AML Steering Committee (the "Steering Committee") will be constituted with the following membership:
•  Patricia Langston (CCO), Chair
•  Thomas Ikeda (BSA Officer)
•  Melissa Chu (CRO)
•  Warren Ashby (Head of BaaS)
•  Linda Petrosian (CIO/CTO)
•  Derek Ballard (Head of Internal Audit), Observer
The Steering Committee will meet on a bi-weekly basis during the remediation period and monthly thereafter. Its charter provides for operational oversight of all five remediation workstreams, review of workstream deliverables prior to submission to the Compliance Committee, and escalation of material issues to the Compliance Committee and the Board.
(c) BaaS Compliance Accountability. Warren Ashby is expressly designated as the management-level owner of BaaS partner compliance, with enhanced reporting obligations to the BSA Officer and the Compliance Committee. Mr. Ashby is accountable for the execution of compliance addenda with all 14 BaaS partners and for implementation of the CDD/EDD responsibility matrix defined in Workstream 3.
(d) Escalation Protocols. Formal escalation protocols will be documented and disseminated, providing that: (i) the BSA Officer escalates material issues to the CCO; (ii) the CCO escalates material issues to the General Counsel; and (iii) the General Counsel escalates material issues to the Chair of the Compliance Committee and, as appropriate, to the full Board. Criteria for what constitutes a "material issue" — such as an OFAC true match, a BaaS partner termination consideration, or a variance from a Consent Order milestone — are set forth in the BSA/AML Reporting and Escalation Policy referenced in Section 7.1.
4.3 Key Executive Responsibilities Under the Remediation Plan
The following table summarizes the individual accountabilities of executive officers under the Comprehensive Remediation Action Plan, with specific reference to Workstream 5:
•  Diane Whitford (CEO and Board Chair): Ultimate accountability for the Bank's remediation; primary regulatory engagement lead alongside outside counsel; principal signatory on OCC correspondence.
•  Raymond Okoye (President and COO): Operational execution oversight across all workstreams; resource allocation authority within the approved remediation budget.
•  Samantha Reeves (CFO): Budget management for the $42,500,000 remediation spend (exclusive of the civil money penalty); financial reporting of remediation costs in accordance with GAAP and, as applicable, disclosure obligations; coordination of the $14,500,000 civil money penalty payment due to the OCC on March 16, 2025.
•  Gregory Nardone (General Counsel): Primary liaison with Calderwood & Harkness LLP; privilege gatekeeper; coordinator of all regulatory correspondence.
•  Patricia Langston (CCO): Day-to-day remediation program lead; Compliance Committee liaison; point of contact (jointly with C&H) for the Thornfield engagement.
•  Thomas Ikeda (BSA Officer): Operational lead for the SAR, OFAC, and CDD/EDD workstreams; oversight of Pinnacle temporary staff; coordination of transaction monitoring and model validation activities.
•  Warren Ashby (Head of BaaS): BaaS partner compliance remediation lead; responsible for fintech partner communications, execution of compliance addenda, and implementation of the CDD/EDD responsibility matrix across all 14 BaaS partners (including NovaPay, FairLend Digital, VaultEdge, and 11 others).
•  Linda Petrosian (CIO/CTO): Technology remediation lead; owner of the Veridian TMS v.10.0 upgrade (user acceptance testing target: August 1, 2025); OFAC screening system integration; coordinator of the Ridgeline Data Systems LLC evaluation.
•  Derek Ballard (Head of Internal Audit): Independent testing of remediated controls; support of Thornfield's validation activities; ongoing BSA/AML audit program.
5. Organizational Restructuring of the BSA/AML Department
5.1 Current State Staffing Assessment
The BSA/AML department, as of January 2025, comprises 62 FTEs distributed across the following functional areas: transaction monitoring analysts, SAR investigators, OFAC screening analysts, KYC/CDD specialists, quality assurance reviewers, compliance officers, and administrative support.
C&H's staffing assessment, informed by interviews with Thomas Ikeda, Patricia Langston, and functional team leads, and cross-referenced against comparable peer institutions engaged in BaaS activities, identifies the following gaps in the current staffing model:
•  Insufficient dedicated resources for BaaS-channel monitoring, given that the Bank's 14 active fintech partners generated $74.3 billion in transaction volume during calendar year 2024 and $127.4 million in BaaS-related revenue;
•  Inadequate OFAC screening analyst staffing, evidenced by the 3.8 million unscreened NovaPay transactions in 2023;
•  The absence of a dedicated model validation function, contributing to the failure to conduct independent validation of Veridian TMS since March 2021 — a gap of more than three years at the time of the OCC's examination;
•  Insufficient quality assurance capacity, contributing to disposition documentation deficiencies identified by the OCC and by Caldera & Pope.
These structural staffing deficiencies are directly implicated in the operational failures documented in the Consent Order, including the SAR backlog of 2,400 unreviewed alerts and the 78-day average SAR filing time.
5.2 Target State Organizational Structure
The target permanent headcount of the BSA/AML department is 77 FTEs, representing the current 62 FTEs plus 15 new permanent positions. The 15 new positions will be added at an estimated average fully loaded cost of $150,000 per FTE, for an incremental annual run-rate cost of $2,250,000.
The composition of the 15 new positions is as follows:
Full position descriptions, including qualifications, responsibilities, and reporting lines, are provided in Appendix F.
5.3 Hiring Timeline
Hiring will proceed in two phases in order to prioritize resources supporting the SAR backlog clearance and OFAC remediation objectives:
•  Phase 1 (February – April 2025): Recruit and onboard 8 positions — the 4 Senior SAR Investigators, 2 OFAC Sanctions Screening Analysts, 1 BaaS Compliance Specialist, and 1 Quality Assurance Manager.
•  Phase 2 (May – August 2025): Recruit and onboard the remaining 7 positions — 1 OFAC Sanctions Screening Analyst, 1 BaaS Compliance Specialist, 2 CDD/EDD Analysts, 1 Model Validation Specialist, 1 BSA/AML Training Manager, and 1 Regulatory Reporting Coordinator.
All 15 positions shall be filled no later than August 2025. Qualification requirements for the roles include relevant certifications (CAMS, CFE, or ACAMS preferred), a minimum of three years of BSA/AML experience for senior roles, and — for the BaaS Compliance Specialists — demonstrable fintech and payments compliance experience.
5.4 Temporary Staffing — Pinnacle Compliance Solutions LLC
To bridge the gap between the identification of staffing deficiencies and the completion of permanent hiring, the Bank has engaged Pinnacle Compliance Solutions LLC to deploy 30 temporary FTEs under a managed-services statement of work (SOW Ref: PCS-BRB-2025-0012; key contact Andrea Solis, Director of Managed Services, 90 Broad Street, 20th Floor, New York, NY 10004).
The contract value of the Pinnacle engagement is $3,600,000, calculated as 30 FTEs at $10,000 per FTE per month over 12 months ($300,000 per month × 12 months). Pinnacle personnel will be deployed principally as SAR investigators, KYC/CDD analysts, and transaction monitoring reviewers. All Pinnacle personnel will be under the supervision of Thomas Ikeda as BSA Officer, and will be subject to the Bank's quality-control protocols, including QA sampling, error-tracking, and mandatory training (see Section 6).
Full deployment of the Pinnacle personnel is targeted for March 2025, coincident with the SAR backlog clearance ramp-up. The Pinnacle engagement will be wound down over the course of the remediation period as permanent hires onboard and as backlog and remediation projects reach completion, with full transition to the permanent workforce contemplated by February 2026.
5.5 Updated Organizational Chart
The revised BSA/AML department organizational chart is included as Appendix B. In summary form, the reporting structure is as follows:
•  Compliance Committee (Board level) → CCO (Patricia Langston) → BSA Officer (Thomas Ikeda) — with a dotted line from the BSA Officer directly to the Compliance Committee.
•  From the BSA Officer, functional teams: Transaction Monitoring; SAR Investigations; OFAC Screening; CDD/EDD; BaaS Compliance; Quality Assurance; Model Validation; Training; and Regulatory Reporting.
•  Cross-functional coordination lines connect the BSA Officer to the CRO (Melissa Chu), the Head of BaaS (Warren Ashby), the CIO/CTO (Linda Petrosian), and the Head of Internal Audit (Derek Ballard).
6. Enterprise-Wide BSA/AML and OFAC Training Program
6.1 Training Program Objectives
The Consent Order specifically found that the Bank's BSA/AML training program was insufficient in scope, depth, and coverage, and that it did not adequately address OFAC obligations, fintech/BaaS-specific risks, or Board-level responsibilities. To remediate these findings, the Bank will implement an enterprise-wide training program with the following objectives:
•  Ensure that all approximately 5,800 BRB employees receive baseline BSA/AML awareness training;
•  Provide role-specific advanced training for compliance personnel, BaaS relationship managers, and customer-facing staff;
•  Deliver specialized training for the Board and C-suite on governance obligations, personal liability exposure, and Consent Order requirements;
•  Establish documented, verifiable completion tracking maintained for a minimum of five years.
The budget allocation for training and policy development within Workstream 5 is $1,800,000.
6.2 Audience Segmentation
Training will be delivered on a tiered basis to five audience segments, with content differentiated by role, seniority, and risk exposure:
•  Tier 1 — Board of Directors and C-Suite. Diane Whitford (CEO), Raymond Okoye (COO), Samantha Reeves (CFO), Gregory Nardone (GC), Patricia Langston (CCO), Thomas Ikeda (BSA Officer), Melissa Chu (CRO), Warren Ashby (Head of BaaS), Linda Petrosian (CIO/CTO), Derek Ballard (Internal Audit), together with all BRFG directors — Arthur Connelly, Margaret Dao, James Rutherford, Sandra Villarreal, and Keith Yamamoto.
•  Tier 2 — BSA/AML and Compliance Department. All 77 FTEs (post-hiring) plus the 30 Pinnacle temporary staff.
•  Tier 3 — BaaS Division and Fintech Relationship Managers. Warren Ashby's team responsible for the 14 BaaS partner relationships.
•  Tier 4 — Front-Line and Customer-Facing Staff. Retail banking, commercial lending, and wealth management personnel.
•  Tier 5 — All Other Employees. General BSA/AML awareness training.
6.3 Curriculum Content
6.3.1 General BSA/AML Awareness (Tiers 1–5, All Employees).  The baseline curriculum, required of all employees regardless of role, will cover:
•  The BSA/AML regulatory framework, including the Bank Secrecy Act, USA PATRIOT Act, and FinCEN regulations;
•  OFAC sanctions compliance fundamentals — the SDN list, blocked persons, and prohibited transactions;
•  Customer identification and CDD/EDD fundamentals;
•  Red flags for suspicious activity;
•  The obligation to report suspicious activity internally, and the "no tipping off" rule;
•  Consequences of non-compliance, including institutional penalties and personal liability;
•  An overview of Consent Order No. OCC-2025-003 and the Bank's remediation commitments.
6.3.2 Advanced BSA/AML Compliance Training (Tier 2).  The advanced curriculum for the BSA/AML department will include:
•  SAR investigation techniques and narrative drafting standards, with a specific focus on the ≤30-day filing timeliness target;
•  Transaction monitoring alert review and disposition, including Veridian TMS v.10.0 functionality;
•  OFAC screening operations, including real-time and batch processing, hit review and disposition procedures, and false-positive management (given the 99.9% false-positive rate on 14,320 CY 2024 hits);
•  CDD/EDD procedures — customer risk rating, beneficial ownership requirements, ongoing monitoring, and periodic review;
•  CTR filing requirements (28,612 CTRs filed in CY 2024);
•  Quality assurance standards and error tracking;
•  BaaS-specific compliance considerations.
6.3.3 BaaS/Fintech-Specific Compliance Training (Tier 3).  The BaaS-focused curriculum will include:
•  The BaaS partner compliance oversight framework;
•  The CDD/EDD responsibility matrix delineating BRB and fintech partner obligations;
•  Monitoring of BaaS transaction flows (CY 2024 BaaS volume of $74.3 billion; NovaPay at $30.5 billion; FairLend Digital at 28% of BaaS volume; VaultEdge at 18%);
•  OFAC screening requirements applicable to BaaS channels, with express reference to remediation of the NovaPay screening gap;
•  BaaS partner risk assessment and tiering methodology;
•  Escalation and termination triggers for non-compliant partners;
•  SAR filing obligations related to BaaS customer activity (2,108 BaaS-related SARs in CY 2024, or 54.8% of total).
6.3.4 Board and Senior Management Training (Tier 1).  The Board and C-suite curriculum — which will be delivered principally by C&H attorneys — will cover:
•  Directors' and officers' BSA/AML oversight obligations under federal banking law;
•  Personal liability exposure under 12 U.S.C. § 1818, including civil money penalties and removal proceedings;
•  Consent Order requirements and timeline, with emphasis on milestones from February 28, 2025 through February 15, 2026;
•  Interpretation of BSA/AML metrics and dashboards (SAR volumes, OFAC hit rates, CDD/EDD progress, BaaS partner risk ratings);
•  The role and authority of the Compliance Committee (chaired by James Rutherford);
•  Engagement with the independent consultant, Thornfield Consulting Group;
•  Fiduciary obligations in the context of the $42,500,000 remediation budget (and the additional $14,500,000 civil money penalty);
•  Shareholder communication considerations — including engagement with Brindoval Capital Partners LP (8.3% holder; principal contact Julian Whitmore; represented by Amberly Knox LLP, Steven Briggs);
•  D&O insurance coverage implications.
6.3.5 Front-Line Staff Training (Tier 4).  The front-line curriculum will focus on:
•  Recognition of suspicious activity at the customer touchpoint;
•  Customer identification and verification procedures;
•  Escalation procedures for potential sanctions matches or suspicious transactions;
•  CDD/EDD documentation requirements for both in-person and digital onboarding;
•  Recordkeeping obligations.
6.4 Delivery Methods
Training will be delivered through a combination of the following methods:
•  In-person, instructor-led training for Tiers 1, 2, and 3. Tier 1 sessions will be facilitated by C&H attorneys. Tier 2 and Tier 3 sessions will be delivered by the BSA/AML Training Manager (post-hiring) and by external subject-matter experts;
•  E-learning modules for Tiers 4 and 5, developed in coordination with Linda Petrosian's IT team and delivered through the Bank's learning management system;
•  Scenario-based exercises and case studies drawn from actual BRB remediation issues (appropriately anonymized), embedded across all tiers;
•  Annual refresher training required for all tiers;
•  Ad hoc training for new hires — including the 15 new permanent FTEs and the Pinnacle temporary staff — within 30 days of start date.
6.5 Training Schedule
6.6 Completion Tracking and Accountability
A centralized training management system will be used to track enrollment, completion, assessment scores, and certification status for every employee. The following standards will apply:
•  A minimum passing score of 80% on all assessments;
•  Employees who fail to complete assigned training within 30 days of deadline will be subject to progressive discipline, with managers held accountable for team completion rates;
•  Training completion rates will be reported monthly to the BSA Officer, the CCO, and the Compliance Committee;
•  Training completion metrics will be integrated into the Board-level compliance dashboard described in Section 3.3;
•  All training records will be retained for a minimum of five years and shall be available for review by the OCC and by Thornfield.
7. Policy Development and Revision
7.1 Policy Suite Overview
Workstream 5 encompasses a comprehensive revision of the Bank's BSA/AML and sanctions-related governance policies. Every revised policy will be cross-referenced to the specific articles of Consent Order No. OCC-2025-003 that it is designed to address, and a consolidated master policy index will be maintained by the Compliance function. The policies within the scope of Workstream 5 (as distinct from operational policies addressed in Workstreams 1 through 4) include:
•  BSA/AML Program Policy (enterprise-wide);
•  Compliance Committee Charter;
•  BSA Officer Authority and Independence Policy;
•  BSA/AML Reporting and Escalation Policy;
•  BSA/AML Training Policy;
•  BaaS Partner Compliance Oversight Policy.
OFAC-specific policies, SAR policies, CDD/EDD policies, and transaction monitoring policies are addressed within Workstreams 1 through 4, but will be coordinated with the Workstream 5 governance framework to ensure consistency.
7.2 Policy Development Process
Each policy revision will follow a defined process:
1.  C&H drafts initial policy revisions with substantive input from Patricia Langston, Thomas Ikeda, and the relevant functional heads;
2.  Thornfield Consulting Group reviews drafts as part of its independent assessment and provides feedback;
3.  Policies are reviewed and approved by the Management-Level BSA/AML Steering Committee and then presented to the Compliance Committee for Board-level approval;
4.  Final policies become effective upon Compliance Committee approval and are distributed to all relevant personnel;
5.  Policy revision history and version control are maintained by the Compliance function.
7.3 Policy Implementation and Communication
All revised policies will be communicated to affected personnel within 15 business days of adoption. Policy acknowledgment will be required from all employees in scope, tracked through the training management system. Changes to policies will be integrated into the training curriculum described in Section 6, including the delivery of refresher training upon material updates.
The Bank will conduct an annual review of all BSA/AML policies. Interim revisions will be triggered by regulatory changes, examination findings, or material events (such as changes in BaaS partner composition).
8. Accountability Framework
8.1 Roles and Responsibilities Matrix (RACI)
Workstream 5 deliverables have been mapped across the Board, the Compliance Committee, the C-suite, the BSA Officer, the CCO, line-of-business heads, and support functions (IT, Legal, Audit) through a formal RACI matrix. The full RACI is provided in Appendix E. In summary:
•  The Compliance Committee is Accountable for Board-level oversight and is Informed on all workstream progress;
•  The CCO (Patricia Langston) is Accountable for overall program coordination and regulatory reporting;
•  The BSA Officer (Thomas Ikeda) is Responsible for operational execution of governance enhancements, staffing, and training delivery;
•  The General Counsel (Gregory Nardone) is Consulted on legal and privilege matters and is Responsible for oversight of the C&H engagement, including fee-collar monitoring (fee overruns above $9,200,000 require written General Counsel approval);
•  The Head of BaaS (Warren Ashby) is Responsible for BaaS-specific governance and training implementation;
•  The CIO/CTO (Linda Petrosian) is Responsible for training technology infrastructure and compliance dashboard development;
•  The Head of Internal Audit (Derek Ballard) is Responsible for independent testing of governance controls.
8.2 Performance Metrics and Success Criteria
Success of Workstream 5 will be measured against the following criteria:
•  Compliance Committee established and operational by February 28, 2025;
•  Monthly Compliance Committee meetings held throughout the remediation period, with documented minutes and action items;
•  Board-level compliance dashboard operational by April 2025;
•  All 15 permanent FTE positions filled by August 2025;
•  30 Pinnacle temporary FTEs deployed by March 2025;
•  Training completion rates:
•  Tier 1 (Board/C-Suite): 100% by April 30, 2025;
•  Tier 2 (BSA/AML Department): 100% by May 31, 2025;
•  Tier 3 (BaaS Division): 100% by June 30, 2025;
•  Tier 4 (Front-Line Staff): 100% by August 31, 2025;
•  Tier 5 (All Other Employees): 100% by September 30, 2025;
•  Revised governance policies adopted by the Board by June 2025;
•  Management-Level BSA/AML Steering Committee operational by March 2025;
•  Thornfield validation of governance and training enhancements reflected in the preliminary gap assessment (April 15, 2025) and the final validation report (February 15, 2026).
8.3 Escalation and Issue Resolution
Issues identified during governance implementation will be escalated through the following chain: BSA Officer → CCO → General Counsel → Compliance Committee → full Board. Material issues — including any inability to meet hiring targets, training completion shortfalls, or fundamental disagreements regarding the governance framework — will additionally be escalated to Philip Hartmann at C&H for regulatory risk assessment and potential proactive communication with Jonathan Frey, the OCC's Examiner-in-Charge.
Governance enhancements will also be reported to FinCEN as part of overall remediation progress, given FinCEN's continuing interest in the SAR filing remediation. Angela Drummond, Associate Director of FinCEN's Enforcement Division, will be the Bank's principal FinCEN point of contact through this remediation.
9. Budget Summary for Workstream 5
The budget for Workstream 5 is structured as follows:
The staffing components (both permanent at $2,250,000 and temporary at $3,600,000) are shared across multiple workstreams; Workstream 5 captures the organizational restructuring and governance framework within which those resources will operate. All costs are captured within the Board-approved $42,500,000 remediation budget, exclusive of the $14,500,000 civil money penalty. The Bank's total outlay in connection with the Consent Order (remediation plus civil money penalty) is therefore approximately $57,000,000.
10. Integration with Other Workstreams
The governance and training framework established in Workstream 5 provides the operating structure within which the four operational workstreams will be executed. Specific integration points are as follows:
•  Workstream 1 — OFAC Sanctions Screening Remediation. Governance reporting to the Compliance Committee includes OFAC screening metrics. OFAC training is embedded across the training curriculum. OFAC screening is targeted to be fully operational for all BaaS channels by November 1, 2025.
•  Workstream 2 — SAR Backlog Clearance and Process Improvement. Governance reporting includes SAR volumes and timeliness metrics. SAR-specific training is embedded within the Tier 2 curriculum. The Workstream 5 staffing plan — including both permanent and Pinnacle resources — supports the June 30, 2025 backlog clearance target.
•  Workstream 3 — CDD/EDD Remediation. Governance reporting includes CDD/EDD remediation progress against the 47,000-account population. CDD/EDD-specific training is embedded across relevant tiers. The CDD/EDD responsibility matrix for BaaS partners (including NovaPay, FairLend Digital, and VaultEdge) is integrated with the governance framework, with interim milestones at July 15, 2025 (50%) and completion at January 15, 2026 (100%).
•  Workstream 4 — Transaction Monitoring Model Validation and Tuning. Governance reporting includes transaction monitoring alert volumes and SAR conversion rates. Model validation training will be delivered to the new Model Validation Specialist and to relevant existing staff. The Veridian TMS v.10.0 upgrade (UAT by August 1, 2025) and independent validation (by October 1, 2025) will be reported through the governance structure. The evaluation of Ridgeline Data Systems LLC as a contingency vendor will similarly be reported.
All workstreams will report through the governance structure defined in Workstream 5: BSA Officer → CCO → Management Steering Committee → Compliance Committee → Board.
11. Independent Consultant Validation — Workstream 5
Thornfield Consulting Group LLC will assess Workstream 5 deliverables as part of its comprehensive review of the Bank's remediation efforts pursuant to Article X of the Consent Order. The Thornfield engagement (reference TCG-BRB-2025-001) is structured as a fixed fee of $6,500,000 plus reimbursable expenses not to exceed $400,000.
The Thornfield engagement team responsible for the governance assessment is led by Dr. Vivian Castellano (Managing Director), supported by Nathaniel Burgess (Director, Fintech & Payments Compliance) on BaaS governance matters.
Thornfield will issue two formal deliverables bearing on Workstream 5:
•  The preliminary gap assessment (due April 15, 2025), which will include an initial evaluation of governance restructuring progress and training program design;
•  The final validation report (due February 15, 2026), which will certify whether the Bank's governance and training enhancements satisfy the requirements of the Consent Order.
C&H will oversee the Thornfield engagement pursuant to the Oversight and Communication Protocol previously agreed among the parties, including bi-weekly status calls involving Philip Hartmann, Patricia Langston, and Dr. Vivian Castellano. Pursuant to the Access and Cooperation Protocol, Thornfield will have access to Board minutes, Compliance Committee records, training records, policy documents, and organizational charts, subject to appropriate privilege and confidentiality protections.
12. OCC Reporting Requirements — Workstream 5
Workstream 5 deliverables will be reflected in the Bank's periodic reporting to the OCC as follows:
•  First quarterly progress report (September 15, 2025): Report on Compliance Committee establishment and operations; staffing progress (permanent and temporary); training completion rates across Tiers 1–5; policy adoption status; and management governance enhancements.
•  Second quarterly progress report (December 15, 2025): Report on ongoing governance operations; verification of full training completion; remaining policy finalizations; and readiness for the February 2026 self-certification.
•  Compliance self-certification (February 15, 2026): Certification that Board oversight, organizational structure, staffing, training, and policy framework satisfy all Consent Order requirements, supported by Thornfield's final validation report.
All OCC correspondence will be tracked in C&H's OCC Correspondence Log. The Bank's Examiner-in-Charge is Jonathan Frey, based at the OCC's Northeastern District Office, 340 Madison Avenue, New York, NY 10017.
13. Risk Factors and Contingencies
The following risk factors have been identified as potentially impacting successful execution of Workstream 5, together with mitigation strategies:
Hiring delays. Competition for qualified BSA/AML professionals — particularly those with BaaS/fintech experience — may delay filling of the 15 permanent positions. Mitigation: Pinnacle temporary staff bridge the interim gap; expanded recruiting channels including specialty compliance recruiters; competitive compensation calibrated within the $150,000 fully loaded budget per FTE; and, if necessary, phased revision of scope through the Compliance Committee.
Training completion resistance. Operational demands, particularly at the front-line, may lead to training completion delays for the approximately 5,800 employees in Tiers 4 and 5. Mitigation: Phased rollout aligned with operating rhythms; mandatory completion deadlines enforced through management accountability; escalation to Compliance Committee for departments falling below completion thresholds.
Board engagement. There is a risk that individual Board members may not fully engage with the enhanced oversight responsibilities contemplated by the Compliance Committee framework. Mitigation: Tailored Tier 1 training; dedicated Compliance Committee resources including direct access to C&H and Thornfield; individual director briefings by C&H on personal liability exposure available upon request.
Scope creep. The governance restructuring may reveal additional organizational deficiencies requiring further changes, particularly as Thornfield's assessment matures. Mitigation: Contingency reserve within the overall $42,500,000 remediation budget; prompt escalation of scope changes to C&H and the Compliance Committee.
Evolving regulatory expectations. The OCC or FinCEN may impose additional governance requirements beyond the Consent Order during follow-up examination or in connection with sector-wide guidance on BaaS. Mitigation: Proactive regulator communication; Thornfield's early-warning function; C&H examination preparedness guidance for management and the Board.
14. Appendices
The following appendices are incorporated herein by reference and are filed under separate cover with the Comprehensive Remediation Action Plan.
Appendix A — Compliance Committee Charter (Draft)
Full text of the Compliance Committee Charter as prepared by Calderwood & Harkness LLP, including provisions concerning composition, qualifications, authority, meeting frequency, reporting obligations, retention of independent advisors, and interaction with the independent consultant.
Appendix B — Revised BSA/AML Department Organizational Chart
Visual organizational chart depicting the target state (77 permanent FTEs plus 30 Pinnacle temporary FTEs), primary and dotted-line reporting relationships, and the nine functional teams within the BSA/AML department.
Appendix C — Training Curriculum Matrix
Table mapping training topics to audience tiers, delivery methods, scheduled delivery dates, assessment requirements, and refresher cadence.
Appendix D — Key Remediation Milestone Dates (Workstream 5)
Calendar of all governance and training milestones from February 2025 through February 2026, cross-referenced to the applicable articles of Consent Order No. OCC-2025-003.
Appendix E — RACI Matrix for Workstream 5 Deliverables
Detailed Responsible/Accountable/Consulted/Informed assignments for each governance and training deliverable within Workstream 5.
Appendix F — New Position Descriptions (15 Permanent FTEs)
Position titles, qualifications, essential functions, reporting relationships, and target start dates for all 15 new BSA/AML department positions.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
END OF WORKSTREAM 5
BSA/AML PROGRAM GOVERNANCE & TRAINING ENHANCEMENT PLAN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Philip Hartmann Partner Responsible Partner, C&H Matter No. 1045-00002
Date: ________
Acknowledged and Approved for Inclusion in the Comprehensive Remediation Action Plan:
BELMONT RIDGE BANK NATIONAL ASSOCIATION
By: ________
Gregory Nardone General Counsel and Corporate Secretary
Date: ________
By: ________
Patricia Langston Chief Compliance Officer
Date: ________
ATTORNEY-CLIENT PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT C&H Matter No. 1045-00002 | Not for further distribution without General Counsel approval.
Date | Milestone
February 28, 2025 | Board Resolution acknowledging Consent Order and establishing the Compliance Committee (45 days from effective date)
May 15, 2025 | Governance and training enhancement plan included in Comprehensive Remediation Action Plan filed with OCC
September 15, 2025 | First quarterly progress report to OCC demonstrating governance improvements
December 15, 2025 | Second quarterly progress report to OCC
February 15, 2026 | Full compliance program implementation; self-certification due; Thornfield final validation report
# | Position | Rationale
4 | Senior SAR Investigators | Reduce SAR filing time to ≤30 days; absorb elevated BaaS-related SAR volume (2,108 of 3,847 CY 2024 SARs, or 54.8%)
3 | OFAC Sanctions Screening Analysts | Support 100% screening coverage across all BaaS channels; remediate NovaPay-type screening gaps
2 | BaaS Compliance Specialists | Dedicated fintech partner oversight; embedded coordination with Warren Ashby's BaaS Division
2 | CDD/EDD Analysts | Ongoing high-risk customer review and periodic re-verification
1 | Model Validation Specialist | Ongoing validation of Veridian TMS v.10.0; prevent recurrence of stale validation
1 | BSA/AML Training Manager | Enterprise-wide training program administration
1 | Quality Assurance Manager | Post-remediation QA program leadership
1 | Regulatory Reporting Coordinator | SAR/CTR filing quality and timeliness; FinCEN coordination
Period | Audience | Notes
March – April 2025 | Tier 1 (Board and C-Suite) | Coincident with early remediation phase; delivered by C&H
March – May 2025 | Tier 2 (BSA/AML Department) | Includes Pinnacle onboarding; aligned with SAR backlog ramp-up
April – June 2025 | Tier 3 (BaaS Division) | Aligned with BaaS compliance framework rollout and addendum execution
May – August 2025 | Tier 4 (Front-Line Staff) | Phased across retail, commercial, and wealth lines
June – September 2025 | Tier 5 (All Other Employees) | E-learning deployment
Ongoing | All | New-hire training within 30 days; annual recertification; refreshers upon material policy updates (e.g., Veridian TMS v.10.0 deployment 8/1/2025; OFAC screening full operationalization 11/1/2025)
Category | Amount
Board and governance restructuring | $500,000
— Compliance Committee establishment, bylaws amendment, charter development
— Board-level reporting dashboard design and implementation
— Governance consulting and advisory
Training and policy development | $1,800,000
— Curriculum development (all tiers)
— E-learning platform development and licensing
— Instructor-led delivery (including C&H-delivered Tier 1 sessions)
— Training management system implementation
— Policy drafting, revision, and implementation
Internal headcount additions — 15 permanent FTEs (annual fully loaded) | $2,250,000
Temporary staffing — Pinnacle Compliance Solutions (30 FTEs × $10,000/mo × 12 mos) | $3,600,000
Total Workstream 5 cost (governance + training + staffing) | $8,150,000