MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
From: Colette Whitman, Partner, and Brendan Walsh, Associate Calderwood & Harkness LLP 425 Park Avenue, 28th Floor New York, NY 10065
To: Board of Directors of Belmont Ridge Bank NA
Attention: Margaret R. Ellsworth, Chair of the Board and Chair, Governance & Nominating Committee James W. Prescott, General Counsel & Corporate Secretary
Date: July 18, 2025
Re: Board Governance Gap Analysis and Regulatory Benchmarking — Belmont Ridge Bank NA
Matter No.: 1045-00003
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP ("C&H") has been retained by Belmont Ridge Bank NA ("BRB" or the "Bank") to serve as board governance advisory counsel in connection with certain regulatory findings and to provide a comprehensive assessment of the Bank's current board governance practices. This memorandum constitutes the initial comprehensive assessment deliverable under our engagement. Its purpose is to identify and analyze gaps between BRB's current board governance practices and three critical benchmarks: (a) the heightened expectations of the Office of the Comptroller of the Currency ("OCC") as expressed in Matters Requiring Attention ("MRA") Letter SA-2024-0315, dated November 15, 2024; (b) the parallel Federal Reserve supervisory letter SR-BHC-2024-1107, issued December 3, 2024, to Belmont Ridge Financial Group, Inc. ("BRFG"), BRB's Delaware-incorporated bank holding company parent; and (c) evolving best practices among peer national banks of comparable size and complexity.
BRB is a nationally chartered commercial bank (OCC Charter No. 24-0738) with approximately $38.7 billion in total consolidated assets as of the first quarter of 2025. The Bank is headquartered at 600 Lexington Avenue, 34th Floor, New York, NY 10022. BRB's common stock is publicly traded on the Nasdaq Stock Market under the ticker symbol "BRBK," and the Bank's market capitalization was approximately $4.2 billion as of June 30, 2025. BRFG, the holding company parent, is incorporated in Delaware and is subject to Federal Reserve supervision as a bank holding company.
The OCC's MRA Letter identified four discrete findings requiring remediation by December 31, 2025. These findings address: (1) the Risk Committee's lack of a formalized escalation protocol for enterprise risk matters; (2) the Audit Committee's over-reliance on management-prepared materials without independent verification; (3) insufficient board-level information flow regarding compliance and Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") matters; and (4) the Governance & Nominating Committee charter's failure to address director skill-matrix requirements or succession planning for committee chairs. In parallel, the Federal Reserve's supervisory letter raised substantively similar governance concerns at the holding company level, with a remediation timeline aligned with the OCC's expectations.
BRB submitted an initial remediation plan to the OCC on February 28, 2025. The OCC acknowledged receipt of the plan and provided comments on April 4, 2025. Those comments underscored the OCC's expectation that remediation efforts would include comprehensive governance document revisions, formalized protocols, and demonstrable structural changes — not merely procedural adjustments.
C&H was retained effective July 1, 2025. This memorandum has been prepared in coordination with Ashford Pike Advisory LLC ("Ashford Pike"), a regulatory consulting firm retained by BRB in January 2025 and led by Managing Director Kenneth R. Stoltz, which is developing operational remediation elements. We have also coordinated with Meridian Cobalt LLP ("Meridian Cobalt"), BRB's existing general corporate and securities-disclosure counsel, through Harold F. Dunleavy, Partner, Corporate Practice Group, with respect to matters touching upon SEC disclosure obligations and proxy statement content.
Our key findings are as follows:
• BRB's governance documents are materially out of date relative to current regulatory expectations and peer practices. Several key charters have not been amended in over three years, and none incorporate post-2023 OCC heightened expectations for boards of banks with assets exceeding $10 billion.
• Specific deficiencies correspond directly to each of the four MRA findings. Each deficiency is concrete and identifiable, resulting from the absence of formalized protocols, policies, and charter provisions that are now standard among peer institutions and expected by regulators.
• Beyond the four MRA findings, we have identified additional governance gaps in the Corporate Governance Guidelines, the Director Independence Standards, the Board Code of Conduct, the Technology & Innovation Committee Charter, and the board self-evaluation process, as well as a recommended review of the Bank's directors' and officers' insurance coverage.
• Remediation is achievable within the December 31, 2025 deadline with prompt board action, provided the timeline set forth in Section X of this memorandum is adhered to.
We recommend the following deliverables as the core governance remediation work product:
1. Revised Risk Committee Charter (addressing MRA Finding 1)
2. Revised Audit Committee Charter (addressing MRA Finding 2)
3. Revised Governance & Nominating Committee Charter (addressing MRA Finding 4)
4. New Board Information Flow Policy (addressing MRA Finding 3)
5. Amended and Restated Corporate Governance Guidelines
6. Enhanced Board and Committee Self-Evaluation Framework
7. Updated Director Independence Standards
8. Initial Director Skills Matrix
9. Director Independence Assessment Memorandum (separate deliverable)
Each of these deliverables is discussed in detail below, together with the underlying gap analysis, regulatory expectations, and peer benchmarking that support our recommendations.
II. Background and Regulatory Context
A. BRB Board Composition and Structure
BRB's Board of Directors currently consists of thirteen (13) members. Of these, ten (10) are independent directors under applicable Nasdaq listing standards and OCC guidance, and three (3) are non-independent by virtue of their management roles at the Bank:
• Richard A. Montague, President and Chief Executive Officer
• Franklin D. Reeves, Chief Operating Officer
• Alma G. Brashear, Executive Vice President and Head of Digital Banking
The Board is chaired by Margaret R. Ellsworth, an independent director who has served on the Board since 2018. Ms. Ellsworth, age 64, previously served as Chief Financial Officer of Hargrove Mutual Bancshares and brings extensive financial services and governance experience to her role. She also chairs the Governance & Nominating Committee.
The Board's Lead Independent Director is David K. Sorrento, who has served as a director since 2016. Mr. Sorrento, age 69, is a retired managing partner of Clearpoint Consulting Group, a management consulting firm. As Lead Independent Director, Mr. Sorrento presides at executive sessions of independent directors and serves as a liaison between the independent directors and the Board Chair.
The Board maintains five standing committees, each of which is described below:
Audit Committee. The Audit Committee consists of five (5) members, all of whom are independent directors. The Committee is chaired by Thomas J. Callahan, who has served as a director since 2019. Mr. Callahan, age 62, is a CPA (inactive) and a former audit partner at Ridgewell & Haines LLP, BRB's current independent auditor. The Audit Committee meets eight (8) times per year in regularly scheduled meetings and holds additional meetings as circumstances require.
Risk Committee. The Risk Committee consists of five (5) members, all of whom are independent directors. The Committee is chaired by Priya Venkataraman, who has served as a director since 2020. Ms. Venkataraman, age 57, formerly served as Chief Risk Officer of Lakemont Financial Corporation, a regional banking organization. The Risk Committee meets eight (8) times per year in regularly scheduled meetings.
Compensation & Human Capital Committee. The Compensation & Human Capital Committee consists of four (4) members, all of whom are independent directors. The Committee is chaired by Sandra M. Okafor, who has served as a director since 2021. Ms. Okafor, age 55, formerly served as Chief Human Resources Officer of Marlowe Asset Management Atlantic Industries, Inc. The Committee meets at least four (4) times per year.
Governance & Nominating Committee. The Governance & Nominating Committee consists of four (4) members, all of whom are independent directors. The Committee is chaired by Margaret R. Ellsworth, the Board Chair. The Committee meets at least four (4) times per year.
Technology & Innovation Committee. The Technology & Innovation Committee consists of three (3) members, all of whom are independent directors. The Committee is chaired by Lawrence B. Huang, who has served as a director since 2021. Mr. Huang, age 60, brings technology industry experience to the role. The Committee meets at least four (4) times per year.
The Board holds eight (8) regularly scheduled meetings per year and convenes additional special meetings as needed. We note that there is substantial overlap in board composition between BRB and its holding company parent, BRFG: eleven (11) of BRB's thirteen (13) directors also serve on the BRFG board. This dual-service arrangement, while common among bank holding company structures, raises governance considerations that are discussed further in Section VIII.A below.
B. Financial Profile
BRB's financial profile as of the most recently available data is summarized as follows:
Regulatory identification numbers are as follows: FDIC Certificate Number 19842; RSSD ID 1048273; BRFG Employer Identification Number (EIN) 83-4127560.
BRB's capital ratios are well above the regulatory minimums for well-capitalized institutions, and its financial performance metrics are generally in line with peer institutions. The Bank's asset size, however, places it squarely within the range where the OCC has increasingly applied heightened supervisory expectations — a point of significant relevance to this governance assessment.
C. OCC MRA Letter — SA-2024-0315 (November 15, 2024)
On November 15, 2024, the OCC issued MRA Letter SA-2024-0315 to BRB following the completion of a targeted supervisory examination of the Bank's corporate governance and board oversight practices. The letter identified four discrete findings requiring remediation. Each finding is summarized below; detailed analysis of each finding, including gap assessment, regulatory expectations, peer benchmarking, and recommendations, is set forth in Sections IV through VII of this memorandum.
Finding 1: Risk Committee Escalation Protocol. The OCC found that BRB's Risk Committee lacks a formalized escalation protocol for enterprise risk matters. Specifically, the OCC noted the absence of defined triggers, timelines, or procedures for escalating enterprise risk matters from the Risk Committee to the full Board. The OCC observed that the current informal, discretionary approach is inconsistent with supervisory expectations for an institution of BRB's size and complexity.
Finding 2: Audit Committee Independent Verification. The OCC found that BRB's Audit Committee demonstrates an over-reliance on management-prepared materials without independent verification. The OCC cited specific instances in which management-prepared reports were accepted by the Committee without independent corroboration or meaningful challenge, and noted that the Audit Committee Charter does not establish structural mechanisms for independent verification.
Finding 3: Board Information Flow — Compliance and BSA/AML. The OCC found that the Board receives insufficient information regarding compliance and BSA/AML matters. The OCC noted that no standalone information flow policy governs reporting on these topics, that reporting cadences are irregular, and that the Chief Compliance Officer ("CCO") and BSA Officer do not have defined roles in the board reporting framework.
Finding 4: Director Skill-Matrix and Chair Succession Planning. The OCC found that the Governance & Nominating Committee Charter does not address director skill-matrix requirements or succession planning for committee chairs. The OCC noted that the absence of a formalized competency framework and succession process is inconsistent with supervisory expectations for effective board composition and continuity.
The OCC established a remediation deadline of December 31, 2025 for all four findings.
D. Federal Reserve Supervisory Letter — SR-BHC-2024-1107 (December 3, 2024)
On December 3, 2024, the Federal Reserve Board issued Supervisory Letter SR-BHC-2024-1107 to BRFG at the holding company level. The letter raised governance concerns that parallel the OCC's MRA findings, reflecting the Federal Reserve's separate but coordinated supervisory perspective on the governance practices of the consolidated organization. While the Federal Reserve's letter addresses holding company governance, the substantial overlap in board composition between BRFG and BRB (11 of 13 directors serve on both boards) means that governance remediation at the bank level will necessarily address many of the Federal Reserve's concerns as well. The Federal Reserve's remediation timeline is aligned with the OCC's December 31, 2025 deadline.
E. Remediation Plan Status
BRB submitted its initial remediation plan to the OCC on February 28, 2025, within the timeframe requested by the OCC. The plan outlined the Bank's proposed approach to addressing each of the four MRA findings, including engagement of external advisors, a governance document revision timeline, and operational remediation steps.
On April 4, 2025, the OCC acknowledged receipt of the remediation plan and provided written comments. The OCC's comments were substantive and directive, emphasizing several themes:
• The need for a "comprehensive, written escalation framework with objective triggers" (Finding 1);
• The expectation of "systematic independent verification procedures, not solely reliance on the independent auditor" (Finding 2);
• The direction to "establish a comprehensive, board-approved information flow policy that ensures timely, unfiltered reporting on compliance and BSA/AML matters to the full board" (Finding 3); and
• The instruction that the remediation plan should include "a formalized director competency matrix and a documented committee chair succession plan" (Finding 4).
Ashford Pike Advisory LLC, led by Managing Director Kenneth R. Stoltz, is responsible for developing operational remediation steps, including enhancements to risk-management processes, compliance monitoring systems, and management reporting infrastructure. C&H is responsible for all governance-specific remediation elements, including charter revisions, policy drafting, and governance framework design.
The remaining remediation timeline is approximately five and one-half (5.5) months from the date of this memorandum. As discussed in Section X, we believe this timeline is achievable provided the Board acts promptly on the recommendations set forth herein.
F. Current State of Governance Documents
A review of BRB's existing governance documents reveals that several key documents are materially out of date. The following table summarizes the current governance document inventory and amendment history:
Several critical observations emerge from this review. First, the Risk Committee Charter — the document most directly implicated by MRA Finding 1 — has not been amended in over four years. This predates the OCC's 2024 supervisory review cycle, the publication of significant OCC and Federal Reserve guidance on risk committee expectations, and multiple developments in peer practice. Second, the Board Code of Conduct has not been updated in over five years and does not address issues that have become standard governance concerns in the intervening period. Third, none of the governance documents incorporate the OCC's post-2023 heightened expectations for boards of banks with assets exceeding $10 billion, expectations that the OCC has increasingly applied to institutions in BRB's asset-size range. Fourth, the Technology & Innovation Committee Charter, adopted in September 2021, has never been amended despite the rapidly evolving cybersecurity and technology risk landscape.
A complete governance document inventory with detailed amendment history is set forth in Appendix E (to be prepared separately).
III. Peer-Institution Benchmarking Methodology
To provide the Board with an objective, data-driven assessment of BRB's governance practices relative to comparable institutions, C&H conducted a structured peer benchmarking analysis. This section describes the methodology employed, the composition of the peer group, the data sources utilized, and the dimensions of governance benchmarked.
Selection Criteria. Peer institutions were selected based on the following criteria: (a) nationally chartered commercial banks or bank holding companies; (b) total consolidated assets between $25 billion and $50 billion; (c) publicly traded on a U.S. national securities exchange; and (d) subject to OCC or Federal Reserve supervision. These criteria were designed to identify institutions of comparable size, complexity, and regulatory profile to BRB.
Peer Group Composition. Based on the foregoing criteria, C&H identified eight (8) peer institutions. To preserve confidentiality and avoid potential competitive sensitivities, the peer institutions are anonymized throughout this memorandum as Peers A through H. Each peer institution's governance documents were reviewed as of the most recent publicly available versions. The peer group includes institutions headquartered in the Northeast, Mid-Atlantic, Southeast, and Midwest regions, reflecting a geographic diversity that mitigates the risk of regional bias in governance practices.
Data Sources. The benchmarking analysis relied on the following publicly available data sources:
• SEC EDGAR filings, including definitive proxy statements (Form DEF 14A), annual reports (Form 10-K), and current reports (Form 8-K);
• Nasdaq and NYSE corporate governance standards and listing requirements;
• OCC and Federal Reserve publicly available enforcement actions, guidance, and bulletins;
• Committee charters, corporate governance guidelines, and related governance documents available on institutional websites;
• Proxy advisory firm published governance scoring methodologies, including those of Gramercy Proxy Services and Northgate Governance Advisors; and
• Published academic and industry research on bank governance best practices.
Benchmarking Dimensions. The peer benchmarking analysis assessed BRB's governance practices across eight principal dimensions:
1. Committee charter content and specificity — the degree to which committee charters contain detailed, actionable provisions addressing the committee's responsibilities, authority, and procedures;
2. Risk-escalation protocols — the presence and content of formalized protocols for escalating enterprise risk matters from the Risk Committee to the full board;
3. Audit committee independence practices and independent information access — the extent to which audit committees have structural mechanisms for independent verification of management-prepared information and access to independent advisors;
4. Board information-flow mechanisms — the existence and content of board-level policies governing the flow of information on compliance, BSA/AML, and regulatory matters;
5. Director skill-matrix practices — the use of formalized competency matrices to assess board composition and inform director recruitment;
6. Committee chair succession planning — the existence of documented plans for the orderly succession of committee leadership;
7. Board self-evaluation processes — the presence and rigor of annual board and committee self-evaluation frameworks; and
8. Governance document refresh frequency — the regularity with which governance documents are reviewed and updated.
Limitations. We note that peer benchmarking necessarily relies on publicly available information. Internal practices, informal procedures, and confidential regulatory guidance received by peer institutions are not captured in this analysis. Accordingly, the benchmarking results should be understood as reflecting a floor of peer practice — actual practices at peer institutions may be more robust than what is reflected in their public documents. Notwithstanding this limitation, publicly available governance documents and proxy disclosures provide a reliable basis for assessing the current standard of practice among institutions of BRB's size and profile, and these public documents are also the materials that regulators, proxy advisory firms, and institutional shareholders review when evaluating governance quality.
The results of the peer benchmarking analysis are integrated into the detailed gap analysis for each MRA finding in Sections IV through VII below. Anonymized summary data supporting the peer benchmarking analysis will be compiled in Appendix A (to be prepared separately).
IV. Detailed Gap Analysis — MRA Finding 1: Risk Committee Escalation Protocol
A. Current State Assessment
The Risk Committee Charter, last amended in January 2021, defines the Risk Committee's general oversight responsibilities for enterprise risk management. The Charter grants the Committee authority to "oversee the establishment, implementation, and maintenance of the Bank's enterprise risk management framework," to "review and approve the Bank's risk appetite statement," and to "receive reports from the Chief Risk Officer on the Bank's risk profile and risk management activities." These provisions, while directionally appropriate, are stated at a high level of generality and do not contain the specificity that regulators now expect.
Critically, the Charter does not contain any formalized escalation protocol. There are no defined triggers — whether quantitative or qualitative — that would require the Risk Committee to escalate an enterprise risk matter to the full Board. There are no specified timelines for board notification following the identification of a risk event or emerging risk concern. There are no documented procedures for how escalation decisions are to be made, recorded, or tracked. The Charter is silent on each of these points.
The current practice at BRB is informal and discretionary. Risk Committee Chair Priya Venkataraman exercises her judgment on when and how to bring risk matters to the full Board's attention. In practice, this typically occurs through verbal updates at regularly scheduled Board meetings. While Ms. Venkataraman's experience and judgment are considerable — she is a former Chief Risk Officer with deep expertise in enterprise risk management — the OCC has made clear that individual competence cannot substitute for structural governance requirements. An informal, personality-dependent process is inherently fragile and creates continuity risk in the event of a change in committee leadership.
Additionally, the Charter does not establish a defined mechanism for the Chief Risk Officer ("CRO") to report directly to the Risk Committee independent of management filtering. Under the current arrangement, CRO reports to the Risk Committee are coordinated through senior management channels, which creates the potential — whether or not realized in practice — for information filtering or delay. The OCC flagged this concern in its MRA findings.
Finally, the Risk Committee meets eight (8) times per year but does not maintain a standing agenda item dedicated to escalation review. The absence of such a standing item means that escalation considerations are not systematically addressed at each meeting and instead arise only when a committee member or management affirmatively raises a concern.
B. Regulatory Expectations
The OCC's heightened standards for risk governance of large national banks are set forth in 12 C.F.R. Part 30, Appendix D. These standards apply mandatorily to national banks with total consolidated assets of $50 billion or more. However, the OCC has made clear through supervisory practice, examination guidance, and institution-specific communications that it increasingly applies these principles on a supervisory best-practice basis to banks in the $25 billion to $50 billion asset range — the range in which BRB falls. BRB's MRA Letter is itself evidence of this trend: the OCC's expectations as expressed in the letter are substantively consistent with the Appendix D heightened standards.
Under these standards and related OCC guidance, risk committees of large banks are expected to maintain written escalation protocols that include:
• Quantitative triggers tied to the bank's risk appetite statement, such as breaches of established risk limits, unexpected loss events exceeding defined thresholds, or significant adverse movements in capital adequacy metrics;
• Qualitative triggers addressing matters such as significant regulatory findings, material cybersecurity incidents, significant litigation developments, adverse media coverage with reputational risk implications, and emerging risks identified through the bank's risk-sensing processes;
• Defined timelines for board notification following the identification of a triggering event, including immediate notification for the most severe events and notification within specified business-day windows for less severe but still material events; and
• Documented follow-up procedures requiring tracking of escalated matters, documentation of board-level deliberations, and confirmation that responsive actions have been taken and are being monitored.
Federal Reserve SR Letter 12-17 and related guidance reinforce these expectations at the holding company level, emphasizing that risk-management frameworks at large banking organizations should include clear escalation paths to the board. The Federal Reserve's supervisory letter to BRFG (SR-BHC-2024-1107) raised parallel concerns regarding the absence of a formalized escalation mechanism.
The OCC's April 4, 2025 comments on BRB's remediation plan were specific and emphatic on this point. The OCC stated that BRB should develop a "comprehensive, written escalation framework with objective triggers" and that an informal, discretionary approach would not satisfy the agency's supervisory expectations.
C. Peer Benchmarking
Our peer benchmarking analysis indicates that the adoption of formalized risk-escalation protocols is now a well-established practice among banks of BRB's size. Of the eight (8) peer institutions reviewed, seven (7) have adopted formalized risk-escalation protocols, either within their Risk Committee charters or as standalone board-approved policies. The one peer that has not adopted a formalized protocol (Peer E) has a significantly different risk profile and organizational structure, and we do not view Peer E's approach as a relevant comparator for BRB.
Among the seven peers with formalized protocols, the following best-practice elements were observed:
• Defined quantitative triggers: All seven peers include quantitative triggers, typically tied to the institution's risk appetite statement. Common triggers include breaches of established risk limits, single-event losses exceeding a specified dollar threshold, adverse capital adequacy movements exceeding a specified number of basis points, and significant increases in key risk indicators.
• Defined qualitative triggers: All seven peers include qualitative triggers. Common qualitative triggers include significant regulatory findings (MRAs, MOUs, consent orders), material cybersecurity incidents, significant litigation developments (new filings, adverse judgments, or settlements exceeding specified thresholds), adverse media coverage posing reputational risk, and identification of emerging risks not previously reflected in the risk appetite statement.
• Tiered escalation with specified timeframes: Six of seven peers employ a tiered escalation framework with differentiated timeframes. Typical tiers include: (i) immediate notification (within hours) for the most severe events (e.g., material cybersecurity breaches, imminent regulatory enforcement actions); (ii) notification within 24 hours for significant but not immediately critical events; and (iii) notification within one committee meeting cycle for matters that are material but not time-sensitive.
• Written documentation requirements: All seven peers require that escalation decisions be documented in writing, including the triggering event, the assessment of materiality, the escalation pathway followed, and any responsive actions directed by the Board or Risk Committee.
• Annual review and recalibration: Five of seven peers require annual review and recalibration of escalation triggers to ensure they remain aligned with the institution's evolving risk profile and risk appetite statement.
In addition to these charter-level provisions, five (5) of eight (8) peers require the CRO to have a direct, unfiltered reporting line to the Risk Committee chair, separate from the CRO's regular management reporting obligations. Four (4) of eight (8) peers require the Risk Committee to conduct periodic "escalation protocol effectiveness reviews" — structured assessments of whether the escalation framework is operating as designed and achieving its intended objectives.
D. Identified Gaps
Based on the foregoing current state assessment, regulatory expectations analysis, and peer benchmarking, C&H has identified the following specific gaps in BRB's governance framework with respect to MRA Finding 1:
Gap 1.1: No written escalation protocol exists in the Risk Committee Charter or as a standalone board-approved policy. The current approach is entirely informal and discretionary, dependent on the judgment of the Committee Chair.
Gap 1.2: No defined quantitative or qualitative escalation triggers have been established. There are no objective criteria that would require the Risk Committee to escalate a matter to the full Board; the decision to escalate is entirely a matter of individual judgment.
Gap 1.3: No requirement exists for the CRO to report directly to the Risk Committee independent of management filtering. The current reporting arrangement routes CRO communications to the Risk Committee through senior management channels, creating the potential for information delay or dilution.
Gap 1.4: No documented process exists for tracking and following up on escalated matters. When risk matters are brought to the Board's attention (informally), there is no systematic mechanism for ensuring that responsive actions are identified, assigned, implemented, and monitored.
Gap 1.5: No provision exists for periodic review and recalibration of the escalation framework. Because no framework exists, there is necessarily no process for evaluating its effectiveness or adjusting it in response to changes in the Bank's risk profile.
E. Recommendations
To address the gaps identified above and satisfy the OCC's expectations as expressed in MRA Finding 1 and the April 4, 2025 comments, C&H recommends the following actions:
1. Amend the Risk Committee Charter to incorporate a detailed escalation protocol section. The amended Charter should include:
(a) Defined quantitative triggers tied to BRB's risk appetite statement thresholds, including but not limited to: breaches of Board-approved risk limits in any material risk category (credit, market, liquidity, operational, compliance); single-event losses or aggregated losses within a rolling 30-day period exceeding defined dollar thresholds; adverse changes in capital adequacy ratios exceeding specified basis-point thresholds; and significant adverse changes in key risk indicators.
(b) Defined qualitative triggers, including but not limited to: receipt of MRAs, memoranda of understanding, consent orders, or other formal or informal regulatory actions; identification of material cybersecurity incidents as defined by the Bank's incident response plan; significant litigation filings, adverse judgments, or proposed settlements; identification of emerging risks not previously contemplated by the risk appetite statement; and significant adverse media coverage or reputational events.
(c) Tiered escalation timelines: immediate notification (within 4 hours) for the most severe events; notification within 24 hours for significant events; and notification within the next regularly scheduled Committee or Board meeting for matters that are material but not time-critical.
(d) Documentation and tracking requirements: all escalation decisions shall be documented in writing, including the triggering event, the materiality assessment, the escalation pathway followed, responsive actions directed by the Board or Committee, and follow-up status. The Risk Committee shall maintain an escalation log that is reviewed at each regularly scheduled meeting.
2. Establish a direct, unfiltered reporting line from the CRO to the Risk Committee chair (Ms. Venkataraman). The amended Charter should specify that the CRO shall have the right and responsibility to communicate directly with the Risk Committee chair on any enterprise risk matter, without prior management review or approval, and that the CRO shall attend all Risk Committee meetings and participate in executive sessions as requested by the Committee.
3. Add a charter provision requiring annual review and recalibration of escalation triggers. The Risk Committee should be required to review the escalation protocol at least annually, in conjunction with the annual review and approval of the Bank's risk appetite statement, and to recalibrate triggers as necessary to reflect changes in the Bank's risk profile, strategic direction, and regulatory environment.
4. Coordinate with Ashford Pike Advisory (Kenneth R. Stoltz) to ensure that the charter-level escalation protocol is aligned with the operational risk-management framework that Ashford Pike is developing as part of the broader MRA remediation. The escalation protocol should be integrated into the Bank's risk governance architecture, not isolated as a standalone document disconnected from operational risk processes.
5. Target completion: C&H will prepare a revised Risk Committee Charter incorporating these recommendations. The revised Charter (including a redline against the January 2021 version) will be completed by September 15, 2025, for Board review at the October regularly scheduled Board meeting.
V. Detailed Gap Analysis — MRA Finding 2: Audit Committee Independent Verification
A. Current State Assessment
The Audit Committee Charter, last amended in February 2023, is the most recently updated of BRB's committee charters. It grants the Audit Committee authority to "oversee the financial reporting process, including the integrity of the Bank's financial statements," and to "oversee the independent audit of the Bank's financial statements conducted by Ridgewell & Haines LLP" (current engagement partner: Lydia M. Chow). The Charter further provides that the Committee shall "review with management and the independent auditor the Bank's annual and quarterly financial statements and related disclosures."
Notwithstanding these provisions, the Charter does not specifically require the Audit Committee to independently verify management-prepared materials or to engage independent resources for such verification. The Charter's provisions contemplate a process in which management prepares materials, the independent auditor provides its observations, and the Committee reviews and discusses both — but there is no structural requirement for the Committee to go beyond these sources to independently corroborate or test management's assertions.
In current practice, the Audit Committee relies primarily on presentations and reports prepared by management. The principal management-level interface is CFO Catherine L. Ng, who prepares and presents financial reports, reserve analyses, and other materials for the Committee's consideration. These management presentations are supplemented by Ridgewell & Haines LLP's quarterly review comments and annual audit observations. While this process provides the Committee with multiple sources of information, both sources — management and the independent auditor — have limitations as mechanisms for independent verification.
The OCC's MRA finding specifically cited instances during the examination period in which management-prepared materials were accepted by the Audit Committee without independent corroboration or substantive challenge. The OCC noted that the Committee's reliance on the personal expertise of Chair Thomas J. Callahan — an inactive CPA and former audit partner at Ridgewell & Haines — while valuable, cannot substitute for structural requirements that ensure independent verification irrespective of the identity of the Committee Chair.
A significant structural gap is the absence of any provision in the current Charter for the Audit Committee to retain independent advisors or consultants at its own initiative without prior management approval. While the Charter generally references the Committee's "authority to oversee" various audit and financial reporting matters, it does not explicitly grant the Committee the independent authority and funding to engage outside resources — an authority that is not merely a best practice but is required by applicable law and listing standards.
B. Regulatory Expectations
Multiple regulatory and legal authorities establish expectations for audit committee independence and access to independent resources:
Nasdaq Listing Rule 5605(c)(3): Audit committees of Nasdaq-listed companies must have the "authority to engage independent counsel and other advisors, as it determines necessary to carry out its duties." This authority is to be exercised at the Committee's sole discretion, without the need for management pre-approval. BRB's Audit Committee Charter does not currently reflect this requirement with the specificity and clarity that the listing rule contemplates.
Sarbanes-Oxley Act of 2002, Section 301: Section 301, as implemented through SEC Rule 10A-3 and the Nasdaq listing standards, requires that the audit committee have "authority and funding" to engage independent counsel and other advisors. The statute and implementing rules make clear that the audit committee must have unilateral authority to retain advisors and that the company must provide "appropriate funding" for such engagements.
OCC Supervisory Expectations: The OCC, in MRA Finding 2 and its April 4, 2025 comments, expressed the expectation that audit committees of national banks should not be solely dependent on management for information. The OCC stated that audit committees should "have access to independent sources of financial and operational data" and should adopt "systematic independent verification procedures, not solely reliance on the independent auditor." This language reflects the OCC's view that the independent auditor, while an essential source of assurance, is not a substitute for the audit committee's own independent verification activities.
Federal Reserve Guidance: SR-BHC-2024-1107 directed that holding company audit committees should adopt procedures to independently verify key management assertions, with specific emphasis on asset quality, loan loss reserves, and compliance matters. The Federal Reserve's guidance reflects a growing supervisory consensus that audit committee independence requires structural mechanisms, not merely the absence of financial or personal conflicts of interest.
C. Peer Benchmarking
Our peer benchmarking analysis reveals that BRB's Audit Committee practices fall meaningfully below the current standard among peer institutions.
Independent advisor authority. All eight (8) peer institutions' Audit Committee charters include explicit, unconditional authority for the Audit Committee to retain independent counsel, advisors, and consultants without management approval. This is a universal feature of peer charters and is consistent with the legal requirements described above. BRB's Charter should have included this provision when it was last amended in February 2023; its absence is a clear gap.
Independent verification requirements. Six (6) of eight (8) peer institutions include specific provisions in their Audit Committee charters requiring the Committee to independently verify at least certain categories of management-prepared information. The categories most commonly specified are: (i) the allowance for loan and lease losses (ALLL) / current expected credit losses (CECL) reserves; (ii) fair value measurements of financial instruments; (iii) significant accounting estimates and judgments; and (iv) management's assessment of internal controls over financial reporting. Verification mechanisms include engagement of independent consultants, direct information requests to operational units bypassing management, and review of data from independent sources (e.g., third-party pricing services, regulatory reports).
Executive sessions with independent auditor. Five (5) of eight (8) peer institutions require the Audit Committee to hold private executive sessions with the independent auditor — without management present — at every regularly scheduled Committee meeting. The remaining three peers require executive sessions at least quarterly. BRB's current Charter does not include a specific requirement for such sessions, although they may occur informally at the Chair's discretion.
Dedicated budget. Four (4) of eight (8) peer institutions maintain a dedicated budget line for Audit Committee-directed independent reviews and consultants. The existence of a dedicated budget ensures that the Committee's authority to engage independent resources is not merely theoretical but is supported by practical funding mechanisms.
Internal audit function assessment. Three (3) of eight (8) peer institutions require the Audit Committee to commission an independent assessment of the effectiveness of the internal audit function at least every three years. This practice, recommended by the Institute of Internal Auditors (IIA) and increasingly expected by regulators, ensures that the Board's reliance on internal audit for independent assurance is itself subject to independent validation.
D. Identified Gaps
Based on the foregoing analysis, C&H has identified the following specific gaps:
Gap 2.1: The Audit Committee Charter lacks explicit, unconditional authority for the Committee to retain independent counsel, advisors, and consultants without management pre-approval. This gap is inconsistent with Nasdaq Listing Rule 5605(c)(3), Sarbanes-Oxley Act Section 301, and universal peer practice.
Gap 2.2: The Charter does not include any requirement for systematic independent verification of management-prepared materials. There is no specification of which categories of management information require independent verification, no defined methodology for such verification, and no documentation requirements.
Gap 2.3: The Charter does not require regular executive sessions with the independent auditor (Ridgewell & Haines LLP) without management present. While such sessions may occur informally, the absence of a charter requirement means they are discretionary and may not occur consistently.
Gap 2.4: There is no dedicated Audit Committee budget for independent reviews and consultants. Without a dedicated budget, the Committee's theoretical authority to engage independent resources may be constrained in practice by the need to secure management approval for funding.
Gap 2.5: The Charter does not include a provision for periodic independent assessment of the internal audit function. The Bank's reliance on internal audit as a source of independent assurance has not itself been subjected to independent validation.
Gap 2.6: Whistleblower complaint oversight procedures are referenced in the Charter but are not developed in sufficient detail. The Charter states that the Committee shall "oversee procedures for the receipt, retention, and treatment of complaints regarding accounting, internal controls, or auditing matters," but does not specify the procedures themselves, the Committee's role in directing investigations, or the tracking and reporting mechanisms for complaint resolution.
E. Recommendations
To address the gaps identified above and satisfy the OCC's expectations as expressed in MRA Finding 2 and the April 4, 2025 comments, C&H recommends the following actions:
1. Amend the Audit Committee Charter to include the following provisions:
(a) Explicit, unconditional authority to retain independent counsel, advisors, and consultants as the Committee determines necessary to carry out its duties, without the requirement of management pre-approval. The amended Charter should state that the Bank shall provide appropriate funding, as determined by the Committee, for the compensation of the independent auditor and any advisors retained by the Committee.
(b) A requirement for independent verification of specified categories of management-prepared materials. At a minimum, the Committee should be required to independently verify: (i) the CECL reserve and related credit quality assessments; (ii) significant accounting estimates and judgments exceeding a defined materiality threshold; (iii) management's compliance certifications; and (iv) fair value measurements for financial instruments where significant judgment is involved. The Charter should specify that independent verification may be accomplished through engagement of independent consultants, direct data requests to operational units, review of third-party data sources, or other appropriate means.
(c) Mandatory executive sessions with Ridgewell & Haines LLP at each regularly scheduled Committee meeting, without management present. The Charter should specify that these sessions are mandatory, not discretionary, and should include discussion of any concerns the auditor may have regarding management cooperation, accounting judgments, internal controls, or other matters.
(d) A dedicated annual budget for Audit Committee-directed independent reviews, consultants, and advisors. The budget amount should be established annually by the Committee in consultation with the CFO and should be adequate to fund the Committee's independent verification activities, external advisor engagements, and any special reviews the Committee may determine to be necessary.
2. Add a provision for independent assessment of the internal audit function at least triennially. The assessment should be conducted by a qualified, independent third party selected by the Audit Committee and should evaluate the internal audit function's effectiveness, independence, staffing adequacy, methodology, and compliance with IIA standards.
3. Expand whistleblower complaint oversight provisions. The amended Charter should include detailed procedures for the receipt, investigation, and tracking of complaints regarding accounting, internal controls, auditing matters, and financial reporting irregularities. These provisions should address: (i) the mechanisms by which complaints are received (including anonymous reporting channels); (ii) the Committee's role in directing or overseeing investigations; (iii) the standards for assessing the credibility and materiality of complaints; (iv) the documentation and record-keeping requirements; and (v) the periodic reporting of complaint activity and resolution status to the full Board.
4. Coordinate with Ridgewell & Haines LLP (Lydia M. Chow, engagement partner) to ensure that the independent auditor is aware of and prepared to support the enhanced Audit Committee procedures. In particular, the auditor should be prepared to participate actively in mandatory executive sessions and to respond to direct Committee inquiries regarding management cooperation, accounting judgments, and areas of elevated risk.
5. Target completion: September 15, 2025. The revised Audit Committee Charter (including a redline against the February 2023 version) will be prepared by C&H and delivered for Board review at the October 2025 Board meeting.
VI. Detailed Gap Analysis — MRA Finding 3: Board Information Flow (Compliance and BSA/AML)
A. Current State Assessment
BRB does not currently maintain a standalone Board Information Flow Policy. The flow of information to the Board on compliance and BSA/AML matters is governed entirely by informal management reporting practices rather than by a structured, board-approved framework. This absence of a formalized policy is one of the most significant governance gaps identified in our assessment, as it means that the Board's access to critical compliance and regulatory information is dependent on management's discretion regarding what to report, when to report it, and in what form.
In current practice, compliance and BSA/AML updates are provided to the Board and its committees at irregular intervals. These updates are typically included as components of broader management reports delivered to the Risk Committee or the full Board, rather than as dedicated, standalone reporting items. There is no defined reporting cadence — no requirement, for example, that the Board receive a comprehensive compliance and BSA/AML report on a quarterly basis. There are no materiality thresholds or escalation criteria that would trigger immediate or ad hoc reporting on compliance or BSA/AML developments.
The Chief Compliance Officer ("CCO") and BSA Officer do not have defined roles in the Board reporting framework. Their reports and observations are filtered through senior management — typically through the General Counsel, James W. Prescott, or the Chief Risk Officer — before reaching the Board or its committees. While Mr. Prescott and the CRO are well-qualified professionals, the filtering of CCO and BSA Officer reports through management channels creates a structural concern: the Board cannot be confident that it is receiving the full, unvarnished perspective of the compliance and BSA/AML functions.
Board members have reported, in the context of the OCC's supervisory examination, that they do not receive timely or complete information regarding regulatory examination findings, enforcement-related developments, or changes in the status of the Bank's BSA/AML program. This feedback from Board members is particularly significant because it confirms that the information-flow deficiency is not merely theoretical — it has been experienced by the directors themselves and has affected their ability to fulfill their oversight responsibilities.
The absence of a structured information-flow policy also means that there is no formal mechanism for ensuring that the Board is informed of regulatory examination findings within a specified timeframe. Currently, the timing and completeness of Board notification regarding regulatory matters depends on management's judgment and priorities.
B. Regulatory Expectations
The regulatory expectations regarding board-level information flow on compliance and BSA/AML matters are well-established and have been strengthening in recent years:
OCC Bulletin 2017-43 and related guidance on compliance management systems. The OCC expects that boards of national banks will receive regular, comprehensive reports on compliance risk and BSA/AML program effectiveness. The OCC's guidance contemplates that boards will have sufficient information to assess the adequacy of the bank's compliance management system, including its policies, procedures, training, monitoring, and corrective-action processes.
Bank Secrecy Act/Anti-Money Laundering Requirements (31 C.F.R. Chapter X). While the BSA and its implementing regulations do not mandate specific board reporting formats, the OCC's supervisory expectations — which are the operative standard for national banks — require board-level awareness and oversight of BSA/AML program effectiveness. The OCC has stated in examination guidance that "the board of directors is responsible for ensuring that the bank develops, implements, and maintains an effective BSA/AML program" and that this responsibility requires the board to receive "timely and comprehensive information" about program performance.
Federal Reserve SR 08-8 (Compliance Risk Management Programs and Oversight at Large Banking Organizations). The Federal Reserve expects that boards of large banking organizations will receive regular compliance reports and will ensure that compliance and BSA officers have direct access to the board when necessary. SR 08-8 emphasizes that effective compliance risk management requires "an organizational structure that supports independence of the compliance function" and that compliance officers should have the ability to bring matters directly to the board's attention.
OCC's April 4, 2025 Comments. The OCC's comments on BRB's remediation plan were direct and specific. The OCC instructed BRB to "establish a comprehensive, board-approved information flow policy that ensures timely, unfiltered reporting on compliance and BSA/AML matters to the full board." The use of the term "unfiltered" is significant — it reflects the OCC's concern that the current practice of routing compliance and BSA/AML reports through management channels may result in the filtering, summarization, or delay of information before it reaches the Board.
C. Peer Benchmarking
The adoption of formalized board information flow policies is now a majority practice among peer institutions.
Standalone policies. Six (6) of eight (8) peer institutions have adopted either standalone Board Information Flow Policies or substantially similar provisions embedded within their Corporate Governance Guidelines. These policies establish a structured framework for ensuring that boards receive timely, comprehensive, and unfiltered information on compliance, BSA/AML, and regulatory matters.
The following best-practice elements were observed among the peer group:
• Defined reporting cadence: All six peers with formal information flow provisions require at least quarterly comprehensive compliance and BSA/AML reporting to the full board. In addition to quarterly reports, these provisions require immediate (ad hoc) reporting when material events occur.
• Materiality thresholds for triggering immediate board notification: Five of six peers with formal provisions define specific materiality thresholds or categories of events that trigger immediate board notification. Common triggers include receipt of MRAs or formal enforcement actions, identification of material BSA/AML deficiencies or suspicious activity patterns, and notification by law enforcement of an ongoing investigation involving the bank.
• Defined roles for the CCO and BSA Officer: All six peers with formal provisions establish defined roles for the CCO and BSA Officer in the board reporting framework, including direct, unfiltered access to the board and relevant committees. These provisions typically specify that the CCO and BSA Officer may communicate directly with the board or committee chair without prior management review or approval.
• Specified timeline for reporting regulatory examination findings: Five of six peers require that regulatory examination findings, MRAs, and enforcement-related developments be reported to the full board within a specified timeframe. The most common timeframe is fifteen (15) business days of receipt. One peer institution requires reporting within ten (10) business days.
• Annual board review of the information flow policy: Four of six peers require the board to review and approve the information flow policy on an annual basis, ensuring that the policy remains current and effective.
CCO and BSA Officer attendance. Five (5) of eight (8) peer institutions require the CCO and BSA Officer to attend at least four (4) board or committee meetings per year for direct reporting. This requirement ensures that the board has regular, personal interaction with the compliance and BSA/AML leadership, separate from management presentations.
Annual board training. Four (4) of eight (8) peer institutions require annual board training on compliance and BSA/AML topics. Training is typically facilitated by the CCO, an external subject-matter expert, or a combination of both. Topics commonly covered include BSA/AML regulatory developments, sanctions compliance, consumer compliance risk, and fair lending.