1045-00003 · Client 1045 · Transaction Documents/Committee Charters

revised-risk-committee-charter-draft.docx DOCUMENT Litigation

9 / 12 ← → ✕

Contract analysis Extract to table

BELMONT RIDGE BANK NA

CHARTER OF THE RISK COMMITTEE OF THE BOARD OF DIRECTORS

DRAFT — Redline Against January 2021 Version

Prepared by:

Calderwood & Harkness LLP 425 Park Avenue, 28th Floor New York, NY 10065

Matter Number: 1045-00003

July 2025

Additions shown in underline; deletions shown in strikethrough. Draft for discussion purposes — subject to Board approval.

This redline has been prepared against the existing Risk Committee Charter of Belmont Ridge Bank NA, as last amended in January 2021 (the "January 2021 Charter"). The revisions set forth herein incorporate changes responsive to (i) OCC MRA Letter SA-2024-0315 dated November 15, 2024, and (ii) Federal Reserve Supervisory Letter SR-BHC-2024-1107 dated December 3, 2024, as well as recommendations developed by Calderwood & Harkness LLP as part of the governance remediation engagement undertaken at the direction of the Board of Directors. All proposed changes remain subject to review, discussion, and approval by the Board of Directors of Belmont Ridge Bank NA.

Right-click to update Table of Contents

ARTICLE I — PURPOSE

The Risk Committee (the "Committee") is a standing committee of the Board of Directors (the "Board") of Belmont Ridge Bank NA (the "Bank"), a national bank chartered under the laws of the United States (OCC Charter Number 24-0738), with its principal office and headquarters located at 600 Lexington Avenue, 34th Floor, New York, NY 10022.

The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities with respect to the enterprise-wide risk management framework of the Bank. In furtherance of this purpose, the Committee shall exercise the duties and responsibilities set forth in this Charter and such other duties and responsibilities as the Board may assign to the Committee from time to time.

The Bank is a wholly owned subsidiary of Belmont Ridge Financial Group, Inc., a Delaware corporation and registered bank holding company (Nasdaq: BRBK) (the "Parent Company"). In carrying out its responsibilities, the Committee shall be mindful of the need for coordination with the Parent Company's board of directors and its risk governance structures, while at all times maintaining the independent exercise of its fiduciary duties to the Bank and its stakeholders. The Committee shall ensure that the Bank's risk governance framework appropriately addresses the risks arising from the Bank's relationship with the Parent Company and its affiliates, including intercompany transactions, shared services arrangements, and consolidated risk exposures.

ARTICLE II — COMPOSITION AND MEMBERSHIP

Section 2.1 — Number of Members

The Committee shall consist of no fewer than members of the Board, each of whom shall be an independent director as defined in Section 2.2 of this Charter. The current composition of the Committee consists of five (5) independent directors. The Board shall appoint members of the Committee annually, at or promptly following the annual meeting of the Board, or more frequently as needed to fill vacancies or respond to changed circumstances, upon the recommendation of the Governance & Nominating Committee of the Board (currently chaired by Margaret R. Ellsworth).

Section 2.2 — Independence Requirements

Each member of the Committee shall satisfy the independence requirements of:

(a) the applicable rules and listing standards of the Nasdaq Stock Market applicable to risk committee members of listed companies;

(b) applicable regulations and supervisory guidance of the Office of the Comptroller of the Currency, including the heightened standards applicable to national banks with total consolidated assets exceeding $10 billion;

(c) applicable regulations of the Board of Governors of the Federal Reserve System applicable to bank holding companies and their subsidiary depository institutions; and

(d) the Bank's own Director Independence Standards, as adopted and amended by the Board from time to time (last amended March 2022, currently under review as part of the governance remediation engagement).

The three non-independent directors currently serving on the Board — the Chief Executive Officer and President, the Chief Operating Officer, and the Executive Vice President and Head of Digital Banking — are not eligible for membership on the Committee.

Section 2.3 — Qualifications

Section 2.4 — Chair

The Board shall designate a Chair of the Committee (the "Committee Chair") from among the independent members of the Committee. The current Committee Chair is Priya Venkataraman, who has served as an independent director of the Bank since 2020 and who previously served as Chief Risk Officer of Lakemont Financial Corporation, a bank holding company with approximately $52 billion in total consolidated assets.

Section 2.5 — Removal and Vacancies

Members of the Committee may be removed by the Board at any time, with or without cause, by resolution adopted by a majority of the full Board. Any vacancy on the Committee, whether arising from removal, resignation, retirement, or any other cause, shall be filled by the Board upon the recommendation of the Governance & Nominating Committee. A member appointed to fill a vacancy shall serve for the remainder of the unexpired term of the departing member and until his or her successor is duly appointed.

ARTICLE III — MEETINGS

Section 3.1 — Frequency

Section 3.2 — Quorum

A majority of the members of the Committee then in office shall constitute a quorum for the transaction of business at any meeting of the Committee. All actions of the Committee shall be taken by a majority vote of the members present at a meeting at which a quorum is present. The Committee may act by unanimous written consent in lieu of a meeting, in accordance with applicable law and the Bank's Bylaws. Any action taken by unanimous written consent shall have the same force and effect as an action taken at a duly convened meeting, and the written consent shall be filed with the minutes of the Committee.

Section 3.3 — Attendance by Non-Members

The Committee may invite to any meeting such members of management, officers, employees, and advisors as the Committee deems appropriate, including without limitation the Chief Risk Officer, the Chief Compliance Officer, the BSA Officer, the Chief Financial Officer (Catherine L. Ng), members of the internal audit department, the Bank's external auditors (Ridgewell & Haines LLP, current engagement partner Lydia M. Chow), outside legal counsel, and other advisors or consultants.

Section 3.4 — Agendas and Materials

Section 3.5 — Minutes and Reporting

The Committee shall maintain written minutes of its meetings, which shall be prepared by the Corporate Secretary or his or her designee and shall be filed with the corporate records of the Bank. Minutes shall be approved by the Committee at its next regularly scheduled meeting or by such other process as the Committee Chair may direct.

The Committee Chair shall report to the full Board on the Committee's activities, findings, and recommendations at the next regularly scheduled Board meeting following each Committee meeting. Such reports shall be sufficiently detailed to enable the Board to understand the matters considered by the Committee, the actions taken or recommended, and any matters requiring Board attention or action.

ARTICLE IV — DUTIES AND RESPONSIBILITIES

The Committee shall have the following duties and responsibilities, subject to the overriding authority of the full Board. The enumeration of specific duties and responsibilities in this Article IV is not intended to limit the scope of the Committee's authority, and the Committee may take such other actions and exercise such other powers as it deems necessary or appropriate to fulfill its purpose as set forth in Article I.

Section 4.1 — Enterprise Risk Oversight

The Committee shall oversee the Bank's enterprise risk management framework, including the policies, procedures, systems, and practices for identifying, measuring, monitoring, and managing material risks across the organization. The Committee's oversight shall extend to all business lines, legal entities, and functions of the Bank, and shall encompass both on-balance-sheet and off-balance-sheet exposures.

The material risk categories subject to Committee oversight include, but are not limited to: credit risk, market risk, interest rate risk, liquidity risk, operational risk, compliance risk, strategic risk, reputational risk, model risk, and technology and cyber risk. The Committee shall ensure that the Bank maintains appropriate policies, limits, and controls for each material risk category, and that management has implemented effective processes for aggregating and reporting risk exposures across the organization.

Section 4.2 — Risk Appetite and Tolerance

The Committee shall review and recommend to the Board for approval the Bank's Risk Appetite Statement and enterprise-wide risk limits. The Risk Appetite Statement shall articulate the aggregate level and types of risk that the Bank is willing to accept in pursuit of its strategic objectives, and shall be expressed through both qualitative statements and quantitative metrics.

Section 4.3 — Chief Risk Officer Oversight

Section 4.4 — Risk Management Staffing and Resources

Section 4.5 — Regulatory and Compliance Risk

The Committee shall oversee the Bank's compliance risk management framework, including oversight of the compliance function, the Bank Secrecy Act and Anti-Money Laundering ("BSA/AML") program, and the Bank's adherence to applicable laws, regulations, and supervisory guidance. The Committee shall receive regular reports from the Chief Compliance Officer and the BSA Officer regarding the status of the Bank's compliance programs, identified compliance risks, and remedial actions taken or recommended.

Section 4.6 — Coordination with Other Committees

The Committee shall coordinate with the Audit Committee on matters involving internal controls over financial reporting, internal audit activities, and financial reporting risk, in order to ensure comprehensive and non-duplicative oversight of the Bank's control environment.

Section 4.7 — Stress Testing and Capital Adequacy

Section 4.8 — Escalation Protocol for Enterprise Risk Matters

Section 4.8(a) — Escalation Triggers

Section 4.8(b) — Escalation Timelines

Section 4.8(c) — Escalation Reporting and Documentation

Section 4.8(d) — Independent Risk-Assessment Resources for Escalation Events

Section 4.8(e) — Coordination with Regulatory Authorities

Section 4.9 — Risk-Related Policies

The Committee shall review and approve, or recommend to the Board for approval, all material risk-related policies of the Bank, including but not limited to the following:

(a) Enterprise Risk Management Policy;

(b) Credit Risk Policy;

(d) Liquidity Risk Policy;

(e) Operational Risk Policy;

(f) Compliance Risk Policy;

(g) Bank Secrecy Act and Anti-Money Laundering Policy;

(h) Model Risk Management Policy;

(i) Third-Party Risk Management Policy;

(j) Information Security Policy; and

(k) Business Continuity and Disaster Recovery Policy.

Section 4.10 — Emerging Risks

ARTICLE V — DIRECT REPORTING LINE OF THE CHIEF RISK OFFICER

ARTICLE VI — AUTHORITY AND RESOURCES

Section 6.1 — Authority

The Committee shall have full authority to investigate any matter within the scope of its responsibilities under this Charter, the Bank's Bylaws, and any applicable resolution of the Board. In carrying out any such investigation, the Committee shall have direct and unrestricted access to any officer, employee, or agent of the Bank and of Belmont Ridge Financial Group, Inc., and each such person shall be directed to cooperate fully with the Committee and to provide any information, documents, or records requested by the Committee.

Section 6.2 — Funding

The Bank shall provide the Committee with appropriate funding, as determined by the Committee in its sole discretion, for:

(a) compensation to any independent consultants, legal counsel, and other advisors retained by the Committee;

(b) ordinary administrative expenses of the Committee, including meeting expenses, travel, and materials; and

(c) any other purposes the Committee deems necessary or appropriate to carry out its responsibilities under this Charter.

ARTICLE VII — ANNUAL ASSESSMENT

The Committee shall conduct an annual self-assessment of its performance and effectiveness. The results of the self-assessment shall be reported to the Governance & Nominating Committee (currently chaired by Margaret R. Ellsworth) and to the full Board.

ARTICLE VIII — REVIEW AND AMENDMENT OF CHARTER

This Charter shall be reviewed at least annually by the Committee, and any proposed amendments shall be recommended to the full Board for approval. The Committee shall ensure that the Charter remains current and responsive to changes in applicable law, regulation, supervisory guidance, and best practices in risk governance.

ARTICLE IX — EFFECTIVE DATE AND APPROVAL

This Amended and Restated Charter of the Risk Committee of the Board of Directors of Belmont Ridge Bank NA shall become effective upon approval by the Board of Directors. The target date for Board consideration and approval of this Charter is the October 2025 regularly scheduled meeting of the Board, consistent with the Calderwood & Harkness engagement timeline, which targets completion of all draft charters, policies, and governance documents by September 15, 2025, for Board review at the October Board meeting.

Upon adoption by the Board, this Amended and Restated Charter shall supersede in its entirety the prior Risk Committee Charter, as last amended in January 2021, and all prior versions thereof.

APPENDIX A — ESCALATION PROTOCOL FLOWCHART

Step 1 — Triggering Event Identification A mandatory escalation trigger (as defined in Section 4.8(a)) occurs or is identified by any officer, employee, or agent of the Bank.

↓

Step 2 — Initial Notification to CRO / Relevant Senior Officer The officer or employee identifying the event notifies the Chief Risk Officer (or the relevant senior officer, such as the Chief Compliance Officer, BSA Officer, or General Counsel, depending on the nature of the event) promptly upon identification.

↓

Step 3 — Notification to Committee Chair (Within 24 Hours) The Chief Risk Officer (or relevant senior officer) notifies the Committee Chair, Priya Venkataraman, within twenty-four (24) hours of becoming aware of the event, providing a preliminary description of the event, affected risk category, estimated magnitude, and any immediate actions taken.

↓

Step 4 — Committee Chair Determination (Within 48 Hours) The Committee Chair determines, within forty-eight (48) hours of receiving notification, the appropriate response, which may include:

(a) Convening a special meeting of the Committee;

(b) Immediate notification to the full Board of Directors;

(d) Engagement of external advisors (e.g., Calderwood & Harkness LLP, Meridian Cobalt LLP, Ashford Pike Advisory LLC).

↓

Step 5 — Imminent Safety & Soundness Threats (Accelerated Timeline) For events constituting an imminent threat to the safety and soundness of the Bank, the Committee Chair notifies the Board Chair, Margaret R. Ellsworth, and the Lead Independent Director within twenty-four (24) hours, and a special Board meeting is convened within seventy-two (72) hours.

↓

Step 6 — Special Committee Meeting and/or Board Notification The Committee considers the escalation event, directs management action, engages advisors as needed, and determines whether the matter requires referral to the full Board.

↓

Step 7 — Resolution, Remediation, and Documentation Actions taken are documented in the Escalation Log maintained by the Chief Risk Officer. The Escalation Log tracks: date and nature of event, date of notification, actions taken, resolution status, and remedial measures. The Committee reviews the Escalation Log at each regularly scheduled meeting.

↓

Step 8 — Reporting to the Board The Committee Chair provides a written summary of the escalation event to the full Board at the next regularly scheduled Board meeting, or sooner if warranted.

Key Contacts:

APPENDIX B — COMMITTEE MEETING CALENDAR (ILLUSTRATIVE)

Additional special meetings may be called at any time in accordance with Section 3.1 of this Charter. Actual dates for each meeting shall be set by the Committee Chair in coordination with the Corporate Secretary (James W. Prescott) and shall be published to Committee members and regular attendees no later than December of the preceding calendar year.

ADOPTION AND APPROVAL RECORD

Board Approval:

This Amended and Restated Charter of the Risk Committee of the Board of Directors of Belmont Ridge Bank NA was considered, approved, and adopted by the Board of Directors on the following date:

Date of Board Approval: ________

Attestation by the Corporate Secretary:

I, James W. Prescott, General Counsel and Corporate Secretary of Belmont Ridge Bank NA, hereby attest that the foregoing Amended and Restated Charter of the Risk Committee of the Board of Directors was duly approved and adopted by the Board of Directors of Belmont Ridge Bank NA by resolution duly adopted at a meeting of the Board held on the date set forth above, at which a quorum was present and acting throughout.