CONFIDENTIAL — DRAFT — ATTORNEY-CLIENT PRIVILEGED
BOARD INFORMATION FLOW POLICY
OF
BELMONT RIDGE BANK NA
DRAFT — Prepared by Calderwood & Harkness LLP Matter Number: 1045-00003 July 2025
For Consideration and Adoption by the Board of Directors of Belmont Ridge Bank NA
This policy is presented for review by the Board of Directors at its next regularly scheduled meeting and, upon adoption, shall be effective immediately. This document has been prepared by Calderwood & Harkness LLP as outside counsel to Belmont Ridge Bank NA in connection with the Bank's ongoing regulatory remediation efforts and governance enhancements. This draft is subject to attorney-client privilege and work-product protection and should not be distributed outside the Board of Directors, senior management, and authorized advisors without the prior approval of the General Counsel.
Right-click to update Table of Contents
SECTION 1: PURPOSE AND BACKGROUND
1.1 Purpose. This Board Information Flow Policy (this "Policy") establishes the comprehensive framework governing the flow of information from management to the Board of Directors and its standing committees at Belmont Ridge Bank NA ("BRB" or the "Bank"), a nationally chartered bank operating under Office of the Comptroller of the Currency ("OCC") Charter Number 24-0738, with its principal office located at 600 Lexington Avenue, 34th Floor, New York, NY 10022.
The Board of Directors of a national bank bears fundamental responsibility for overseeing the safety, soundness, and legal compliance of the institution. That responsibility can be discharged effectively only when the Board receives timely, accurate, and complete information from management regarding the full spectrum of risks confronting the Bank. This Policy is designed to formalize and strengthen the channels through which such information is delivered, to establish clear expectations regarding the content, frequency, and quality of management reporting, and to ensure that no material information is withheld, delayed, filtered, or otherwise impeded in its transmission to the Board and its committees.
In particular, this Policy ensures that the Board receives timely, accurate, and complete information regarding: (a) compliance risk across the enterprise; (b) the status of the Bank's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") program; (c) findings arising from regulatory examinations conducted by the OCC, the Federal Reserve Board, and other supervisory agencies; (d) enforcement actions, whether formal or informal, taken or threatened by any regulatory authority; and (e) other material risk and compliance matters that may affect the Bank's condition, operations, reputation, or regulatory standing.
This Policy is further designed to enable the Board to fulfill its fiduciary duties of care and loyalty, its supervisory obligations under the National Bank Act, the regulations of the OCC (12 C.F.R. Parts 4, 21, and 30), the Federal Deposit Insurance Act, the Bank Secrecy Act, and all other applicable federal and state laws, regulations, and supervisory guidance, including the OCC's Heightened Standards for Large Financial Institutions (12 C.F.R. Part 30, Appendix D) and the interagency guidelines establishing standards for safety and soundness (12 C.F.R. Part 30, Appendix A).
1.2 Regulatory Background and Rationale
The development and adoption of this Policy is directly responsive to supervisory findings communicated to the Bank and its parent company during the 2024 examination cycle.
On November 15, 2024, the Office of the Comptroller of the Currency issued a Matters Requiring Attention ("MRA") letter to Belmont Ridge Bank NA, bearing reference number SA-2024-0315 (the "OCC MRA Letter"). The OCC MRA Letter identified multiple supervisory concerns, including, among other findings, insufficient board-level information flow regarding compliance and BSA/AML matters. This deficiency was designated as MRA Finding 3 in the OCC MRA Letter. Specifically, the OCC found that management's reporting to the Board lacked the depth, frequency, and independence necessary to enable the Board to exercise effective oversight of the Bank's compliance management system and BSA/AML program. The OCC further noted the absence of a formal, board-adopted policy governing the content, timing, and escalation of compliance-related information to the Board and its committees.
In parallel, the Board of Governors of the Federal Reserve System issued a supervisory letter to Belmont Ridge Financial Group, Inc. ("BRFG"), the Bank's parent bank holding company (a Delaware corporation, Employer Identification Number 83-4127560), dated December 3, 2024, bearing reference number SR-BHC-2024-1107 (the "Federal Reserve Supervisory Letter"). The Federal Reserve Supervisory Letter raised substantially similar concerns regarding information flow at the holding-company level, noting in particular the need for improved coordination of compliance and risk reporting between the Bank and BRFG given the substantially overlapping board composition of the two entities.
In response to these supervisory findings, BRB submitted its initial remediation plan to the OCC on February 28, 2025. The remediation plan addressed all MRA findings identified in the OCC MRA Letter, including MRA Finding 3 related to board information flow. The OCC acknowledged receipt of the remediation plan and provided comments thereon in a letter dated April 4, 2025. The OCC's comments were generally supportive of the proposed remediation approach but requested additional specificity regarding several governance-related deliverables, including the proposed Board Information Flow Policy.
The OCC has established a remediation deadline of December 31, 2025, for the satisfactory resolution of all MRA items identified in the OCC MRA Letter. The Bank's management and Board are committed to meeting this deadline.
This Policy constitutes a key governance-related remediation deliverable in response to MRA Finding 3. Its adoption and implementation will demonstrate to the OCC and the Federal Reserve that the Bank has established a formal, board-adopted framework governing the content, frequency, quality, and escalation of compliance, BSA/AML, and risk-related information to the Board and its committees. The Policy is designed to address the specific deficiencies identified by the OCC in the MRA Letter and to establish a durable governance framework that meets or exceeds supervisory expectations on an ongoing basis.
It should be noted that Ashford Pike Advisory LLC, an independent regulatory consulting firm retained by the Bank in January 2025, is coordinating with management on the operational remediation elements associated with the OCC MRA Letter and the Federal Reserve Supervisory Letter. Kenneth R. Stoltz, Managing Director of Ashford Pike Advisory LLC, is the lead consultant on the engagement. This Policy addresses the governance and board-reporting components of the remediation effort; the operational remediation elements — including enhancements to the Bank's BSA/AML transaction monitoring systems, staffing of the compliance function, and related operational improvements — are being addressed separately under the direction of management and Ashford Pike Advisory LLC, with oversight by the Risk Committee and the Audit Committee.
1.3 Scope. This Policy applies broadly to all information flow from management of BRB to the Board of Directors and its standing committees. For purposes of this Policy, the standing committees of the Board are: the Audit Committee, the Risk Committee, the Compensation & Human Capital Committee, the Governance & Nominating Committee, and the Technology & Innovation Committee.
This Policy applies to both regular (scheduled) reporting — that is, recurring reports delivered in connection with regularly scheduled Board and committee meetings — and ad hoc (event-driven) reporting — that is, reports and notifications triggered by the occurrence of specific events meeting the materiality thresholds defined in Section 5 of this Policy.
The substantive scope of this Policy covers information regarding: compliance risk across the enterprise; BSA/AML program matters, including Suspicious Activity Report ("SAR") filings, Currency Transaction Report ("CTR") activity, Office of Foreign Assets Control ("OFAC") screening, and related matters; findings arising from regulatory examinations conducted by the OCC, the Federal Reserve Board, the Federal Deposit Insurance Corporation ("FDIC"), the Financial Crimes Enforcement Network ("FinCEN"), state banking departments, and any other applicable regulatory authorities; supervisory actions, whether formal or informal; enforcement actions taken or threatened by any regulatory authority; findings of the Bank's internal audit function; and other material risk and compliance matters, including but not limited to cybersecurity incidents, data breaches, material litigation, and government investigations.
This Policy applies equally to information flow at the bank level (BRB) and, as relevant, at the holding-company level (BRFG). This dual application is appropriate and necessary given the substantially overlapping board composition between BRB and BRFG — eleven of the thirteen current BRB directors also serve on the BRFG board of directors — and the supervisory expectations of both the OCC and the Federal Reserve regarding coordinated governance and reporting at the bank and holding-company levels.
SECTION 2: DEFINITIONS
As used in this Policy, the following terms shall have the meanings set forth below:
"Bank" means Belmont Ridge Bank NA, a national banking association organized and existing under the laws of the United States, OCC Charter Number 24-0738.
"Board" means the Board of Directors of the Bank, currently consisting of thirteen (13) directors, of whom ten (10) are independent directors and three (3) are non-independent directors, as determined in accordance with the Bank's Corporate Governance Guidelines and applicable regulatory standards.
"BSA/AML" means the Bank Secrecy Act (31 U.S.C. §§ 5311–5332) and Anti-Money Laundering compliance, including all applicable regulations promulgated by FinCEN (31 C.F.R. Chapter X), the provisions of the USA PATRIOT Act (Pub. L. 107-56), the Anti-Money Laundering Act of 2020, and compliance with the sanctions programs administered by OFAC, as well as all related OCC and interagency guidance.
"BSA Officer" means the Bank's designated BSA/AML compliance officer responsible for the day-to-day administration, management, and oversight of the Bank's BSA/AML program, as required by 31 C.F.R. § 1020.210.
"Chief Compliance Officer" or "CCO" means the Bank's senior officer responsible for the enterprise compliance function, including oversight of the Bank's compliance management system, regulatory change management, and compliance risk assessment.
"Chief Risk Officer" or "CRO" means the Bank's senior officer responsible for enterprise risk management, including the identification, assessment, monitoring, and reporting of risks across all risk categories.
"Committees" means the standing committees of the Board, which are as follows:
(a) the Audit Committee (Chair: Thomas J. Callahan);
(b) the Risk Committee (Chair: Priya Venkataraman);
(c) the Compensation & Human Capital Committee (Chair: Sandra M. Okafor);
(d) the Governance & Nominating Committee (Chair: Margaret R. Ellsworth); and
(e) the Technology & Innovation Committee (Chair: Lawrence B. Huang).
"Enforcement Action" means any formal or informal enforcement action, consent order, cease-and-desist order, civil money penalty, memorandum of understanding, commitment letter, supervisory agreement, or similar supervisory or enforcement action taken or proposed by any federal or state regulatory agency, including the OCC, the Federal Reserve Board, the FDIC, FinCEN, the Consumer Financial Protection Bureau, or any state banking department or attorney general.
"General Counsel" means the Bank's General Counsel and Corporate Secretary, currently James W. Prescott.
"Management" means the Bank's executive officers and senior management, including:
(a) Richard A. Montague, Chief Executive Officer ("CEO");
(b) Franklin D. Reeves, Chief Operating Officer ("COO");
(c) Catherine L. Ng, Chief Financial Officer ("CFO");
(d) James W. Prescott, General Counsel and Corporate Secretary;
(e) the Chief Risk Officer;
(f) the Chief Compliance Officer; and
(g) the BSA Officer.
"Material Event" means an event meeting one or more of the materiality thresholds defined in Section 5.1 of this Policy that triggers immediate or accelerated reporting obligations to the Board Chair, Lead Independent Director, and relevant committee chairs.
"MRA" means Matters Requiring Attention, as defined by OCC supervisory guidance, including OCC Bulletin 2014-52 and subsequent updates thereto.
"Policy" means this Board Information Flow Policy of Belmont Ridge Bank NA, as adopted by the Board and as it may be amended from time to time.
"Regulatory Examination" means any examination, inspection, review, targeted assessment, horizontal review, or other supervisory activity conducted by the OCC, the Federal Reserve Board, the FDIC, FinCEN, a state banking department, or any other applicable regulatory authority with jurisdiction over the Bank or its activities.
SECTION 3: GOVERNANCE AND OVERSIGHT OF THIS POLICY
3.1 Adoption and Authority
This Policy shall be adopted by formal resolution of the Board of Directors of Belmont Ridge Bank NA. The Board resolution adopting this Policy shall be recorded in the minutes of the Board meeting at which adoption occurs and shall reference this Policy by title and date.
Authority for the interpretation and administration of this Policy rests with the General Counsel, in consultation with the Board Chair (Margaret R. Ellsworth) and the chairs of the Audit Committee (Thomas J. Callahan) and Risk Committee (Priya Venkataraman). Questions regarding the application of this Policy to specific circumstances — including the determination of whether a particular event constitutes a Material Event within the meaning of Section 5 — shall be resolved by the General Counsel, with the understanding that close questions shall be resolved in favor of reporting and escalation rather than non-reporting.
3.2 Annual Review
This Policy shall be reviewed by the Governance & Nominating Committee at least annually, and any recommended amendments shall be presented to the full Board of Directors for consideration and approval. The annual review shall consider, at a minimum: changes in applicable law, regulation, and supervisory guidance; the effectiveness of the information-flow practices established by this Policy during the preceding year; any feedback or findings from regulatory examinations conducted during the preceding year; and input from outside counsel, the independent auditor, and the regulatory consultant.
The first annual review of this Policy shall occur no later than the first regularly scheduled Board meeting following June 30, 2026, to ensure that at least one full year of experience under the Policy is available for assessment before the initial review.
The General Counsel shall coordinate the annual review process and shall consult with outside counsel (currently Calderwood & Harkness LLP) and the regulatory consultant (currently Ashford Pike Advisory LLC, Kenneth R. Stoltz, Managing Director) as appropriate in connection with the review.
3.3 Relationship to Other Governance Documents
This Policy supplements, and should be read in conjunction with, the following governance documents of the Bank:
(a) the Bank's Corporate Governance Guidelines (last amended March 2022, currently under revision in connection with the ongoing remediation effort);
(b) the Risk Committee Charter (last amended January 2021, currently under revision to address MRA Finding 1 regarding the CRO's direct reporting line to the Risk Committee);
(c) the Audit Committee Charter (last amended February 2023, currently under revision to address MRA Finding 2 regarding independent verification of management-prepared reports); and
(d) the Board Code of Conduct (last amended January 2020).
Each of the foregoing documents is being reviewed and, where necessary, revised as part of the Bank's comprehensive governance remediation program. Upon completion of those revisions, the General Counsel shall ensure that all governance documents are consistent with the requirements of this Policy and with each other.
In the event of any conflict or inconsistency between this Policy and any committee charter or other governance document of the Bank, the more rigorous information-flow requirement shall govern. That is, if a committee charter requires less frequent or less detailed reporting than this Policy, the requirements of this Policy shall prevail; conversely, if a committee charter imposes reporting obligations that exceed those specified herein, the committee charter requirements shall continue to apply in addition to the requirements of this Policy.
SECTION 4: REGULAR (SCHEDULED) REPORTING REQUIREMENTS
4.1 Reporting to the Full Board
The following reports shall be delivered to the full Board of Directors on a regular, scheduled basis, in connection with the Board's regularly scheduled meetings:
Quarterly Compliance Report. The Chief Compliance Officer shall prepare and deliver a written compliance report to the full Board at each regularly scheduled quarterly Board meeting. The Quarterly Compliance Report shall cover the following topics:
(a) the overall status of the Bank's compliance management system, including an assessment of the effectiveness of the compliance program and any significant changes to the program's structure, staffing, or coverage during the reporting period;
(b) a summary of compliance risk assessments conducted during the reporting period, including identification of areas of elevated compliance risk and any changes to the Bank's compliance risk profile;
(c) a description of material compliance issues identified during the reporting period, including the nature of the issue, the business line or function affected, the root cause analysis (where available), the remediation plan, and the current status of remediation;
(d) a summary of significant regulatory developments affecting the Bank's compliance obligations, including new laws, regulations, guidance, or enforcement trends that may require changes to the Bank's compliance program or business practices; and
(e) training and staffing updates for the compliance function, including completion rates for required compliance training, open positions within the compliance department, and any significant changes to the compliance organizational structure.
Quarterly BSA/AML Report. The BSA Officer shall prepare and deliver a written BSA/AML program report to the full Board at each regularly scheduled quarterly Board meeting. The Quarterly BSA/AML Report shall cover the following topics:
(a) Suspicious Activity Report ("SAR") filing activity and trends, including the number and dollar volume of SARs filed during the reporting period, categorized by type of suspicious activity and business line, together with a comparison to prior periods and identification of notable trends or patterns;
(b) Currency Transaction Report ("CTR") volume and exceptions, including the total number and dollar volume of CTRs filed, the number and nature of CTR exemptions granted, and any exceptions or errors identified during the reporting period;
(c) OFAC screening results and any blocked transactions, including the number of potential OFAC matches identified, the disposition of those matches, and details regarding any blocked or rejected transactions;
(d) updates to the BSA/AML risk assessment, including any changes to the Bank's customer risk profile, product risk profile, or geographic risk profile, and any changes to the Bank's BSA/AML risk rating;
(e) the status of any BSA/AML-related audit findings or regulatory recommendations, including findings from internal audit, external audit, or regulatory examinations, together with the remediation plan and current remediation status for each finding; and
(f) results of independent testing of the BSA/AML program, including the scope of testing conducted, significant findings, and management's response to those findings.
Quarterly Regulatory Examination Summary. The General Counsel or the General Counsel's designee shall prepare and deliver a written summary of ongoing and recently completed regulatory examinations to the full Board at each regularly scheduled quarterly Board meeting. The Quarterly Regulatory Examination Summary shall include:
(a) a listing of all regulatory examinations commenced, ongoing, or completed during the reporting period, including the examining agency, the scope of the examination, and the current status;
(b) a summary of findings communicated by examiners, whether in the form of MRAs, Matters Requiring Immediate Attention ("MRIAs"), supervisory recommendations, or informal comments;
(c) the status of all open MRAs, MRIAs, and supervisory recommendations, including the originally assigned due date, the current remediation status, and any extensions or modifications granted by the examining agency; and
(d) specific tracking of the items identified in the OCC MRA Letter SA-2024-0315 and the Federal Reserve Supervisory Letter SR-BHC-2024-1107, which shall be individually tracked and reported on until all items are formally closed by the respective supervisory agency.
Semi-Annual Enforcement and Legal Proceedings Report. The General Counsel shall prepare and deliver a written report to the full Board on a semi-annual basis regarding any pending or threatened enforcement actions, material litigation, and government investigations involving the Bank or any of its affiliates. The Semi-Annual Enforcement and Legal Proceedings Report shall include:
(a) a description of any pending or threatened enforcement actions by any regulatory agency, including the nature of the action, the allegations, the potential exposure, and the Bank's response strategy;
(b) a summary of material litigation involving the Bank or its affiliates, including cases with potential exposure exceeding $500,000 individually or $2,000,000 in the aggregate, together with litigation reserves and the status of settlement negotiations, if applicable;
(c) a description of any pending or known government investigations involving the Bank or its affiliates, including subpoenas, civil investigative demands, and requests for information from regulatory or law enforcement agencies; and
(d) an assessment of any potential financial, operational, or reputational impact of pending enforcement actions, litigation, or investigations.
Annual Enterprise Risk Report. The Chief Risk Officer shall prepare and deliver an annual comprehensive enterprise risk report to the full Board at a regularly scheduled Board meeting. The Annual Enterprise Risk Report shall provide a holistic summary of the Bank's overall risk profile, encompassing the following risk categories: credit risk, market risk, operational risk, liquidity risk, compliance risk, strategic risk, and reputational risk. The report shall include an assessment of risk trends, the adequacy of risk management frameworks and controls, the results of stress testing and scenario analysis, and recommendations for risk management enhancements. The Annual Enterprise Risk Report shall be delivered no later than the first regularly scheduled Board meeting following the close of the Bank's fiscal year.
4.2 Reporting to the Audit Committee
The Audit Committee, consisting of five (5) independent directors and chaired by Thomas J. Callahan, meets no fewer than eight (8) times per year. At each regularly scheduled meeting of the Audit Committee, the committee shall receive the following information:
(a) an update from the Chief Compliance Officer on compliance matters relevant to financial reporting and internal controls over financial reporting, including any compliance issues that may have an impact on the accuracy or reliability of the Bank's financial statements or disclosures;
(b) a report from the Bank's internal audit function on completed and planned audits relating to compliance and BSA/AML, including a summary of findings, the risk ratings assigned to those findings, management's responses, and the status of remediation for any open audit findings;
(c) updates from the Bank's independent auditor, Ridgewell & Haines LLP (engagement partner Lydia M. Chow), on any compliance-related findings arising from the annual audit or quarterly reviews, including observations regarding the effectiveness of internal controls and any matters that the independent auditor believes should be brought to the attention of the Audit Committee; and
(d) a summary of whistleblower complaints received through the Bank's ethics hotline and other reporting channels during the reporting period, including the number and nature of complaints received, the status of investigations, and the disposition of completed investigations.
Consistent with the remediation of MRA Finding 2 identified in the OCC MRA Letter, the Audit Committee shall receive independently prepared or independently verified materials, and shall not rely solely on management-prepared materials without verification from internal audit, external audit, or other independent sources. The Audit Committee Chair (Thomas J. Callahan) shall be responsible for ensuring that this independent verification requirement is satisfied and shall raise any concerns with the Board Chair and the Lead Independent Director.
4.3 Reporting to the Risk Committee
The Risk Committee, consisting of five (5) independent directors and chaired by Priya Venkataraman, meets no fewer than eight (8) times per year. At each regularly scheduled meeting of the Risk Committee, the committee shall receive the following information:
(a) a report from the Chief Risk Officer on enterprise risk matters, including compliance risk, with particular emphasis on changes to the Bank's risk profile, emerging risks, and the adequacy of risk management frameworks and controls;
(b) BSA/AML program updates from the BSA Officer, to the extent such updates provide additional detail or perspective beyond the Quarterly BSA/AML Report delivered to the full Board, including deep-dive analyses of specific BSA/AML risk areas, customer segments, or products as directed by the Risk Committee;
(c) status updates on regulatory remediation milestones, including progress against the remediation plan submitted to the OCC on February 28, 2025, with specific attention to the December 31, 2025 deadline for resolution of all MRA items; and
(d) information on emerging risks, including cybersecurity threats and vulnerabilities, operational resilience concerns, third-party risk management, and any other risks identified through the Bank's enterprise risk management framework that may warrant attention by the Risk Committee.
Consistent with the formalized escalation protocol addressing MRA Finding 1 identified in the OCC MRA Letter and the revised Risk Committee Charter currently under development, the Chief Risk Officer shall have a direct reporting line to the Risk Committee that is independent of management filtering. The CRO's reports to the Risk Committee shall be prepared by the CRO and delivered directly to the committee without prior management review, editing, or approval. This direct reporting relationship is intended to ensure that the Risk Committee receives candid and unfiltered assessments of the Bank's risk profile.
Following each meeting of the Risk Committee, the Risk Committee Chair (Priya Venkataraman) shall provide a summary report to the full Board at the next regularly scheduled Board meeting. This summary shall highlight significant matters discussed by the Risk Committee, any actions taken or recommended, and any matters requiring the attention or action of the full Board.
4.4 Reporting to Other Committees
In addition to the reports provided to the Audit Committee and the Risk Committee as described above, the following standing committees of the Board shall receive reports as set forth below:
Compensation & Human Capital Committee (Chair: Sandra M. Okafor). The Compensation & Human Capital Committee shall receive at least quarterly updates from the Chief Compliance Officer or the General Counsel on any compliance or regulatory issues relating to incentive compensation, including clawback provisions, risk-taking incentives, and the alignment of compensation practices with safety and soundness requirements. These updates shall also address human-capital compliance matters, including fair lending compliance, equal employment opportunity compliance, and any regulatory findings or litigation relating to the Bank's employment practices.
Governance & Nominating Committee (Chair: Margaret R. Ellsworth). The Governance & Nominating Committee shall receive reports on governance-related regulatory developments on at least a semi-annual basis, or more frequently as warranted by developments. These reports shall cover changes to OCC or Federal Reserve expectations for board governance, director qualification requirements, board self-assessment practices, and any governance-related supervisory findings. In addition, the Governance & Nominating Committee is responsible for the annual review of this Policy, as described in Section 3.2, and for the review of the annual assessment of Policy compliance, as described in Section 10.1.
Technology & Innovation Committee (Chair: Lawrence B. Huang). The Technology & Innovation Committee shall receive reports on technology-related compliance risks at each regularly scheduled committee meeting. These reports shall address cybersecurity incident reporting and response, data privacy compliance (including compliance with applicable state and federal data privacy laws), and technology-related BSA/AML controls, including the performance and adequacy of transaction monitoring systems, automated screening tools, and other technology platforms that support the Bank's compliance and BSA/AML program.
4.5 Board Meeting Cadence and Information Delivery
The Board of Directors holds eight (8) regularly scheduled meetings per year, in addition to special meetings convened as needed. Each standing committee of the Board meets on a schedule established by its respective charter.
To ensure that directors have adequate time to review and prepare for meetings, management shall adhere to the following delivery schedules for meeting materials:
(a) Board materials for regularly scheduled meetings of the full Board shall be distributed to all directors no fewer than five (5) business days in advance of the scheduled meeting date. This five-day advance delivery requirement shall apply to all materials described in Section 4.1 of this Policy, as well as to all other materials included in the Board meeting package.
(b) Committee materials for regularly scheduled committee meetings shall be distributed to all members of the relevant committee no fewer than three (3) business days in advance of the scheduled committee meeting date. This three-day advance delivery requirement shall apply to all materials described in Sections 4.2, 4.3, and 4.4 of this Policy, as well as to all other materials included in the committee meeting package.
In the event that management is unable to meet the advance delivery deadlines specified above due to the timing of a Material Event or other extraordinary circumstance, the General Counsel shall notify the Board Chair or relevant committee chair, as applicable, and shall deliver the materials as soon as practicable. Supplemental materials may be distributed at the meeting itself, provided that directors are given adequate time during the meeting to review such materials before any action is taken.
Management shall ensure that all Board and committee materials are clear, concise, and presented in a format that enables directors to identify key risks, trends, and required actions. Reports shall include executive summaries, key takeaways, and recommended actions where appropriate. Data shall be presented in a manner that facilitates comparison to prior periods and identification of trends. The General Counsel shall work with the reporting officers (CCO, BSA Officer, CRO, and others) to develop standardized templates and formats for regular reports under this Policy.
The General Counsel shall maintain a "Board Reporting Calendar" setting forth all regular reporting obligations under this Policy and the applicable committee charters, including the responsible officer for each report, the recipient (Board or committee), the reporting frequency, and the delivery deadline. The Board Reporting Calendar is attached to this Policy as Appendix A in template form and shall be updated at least annually.
SECTION 5: AD HOC AND IMMEDIATE ESCALATION REPORTING
5.1 Materiality Thresholds for Immediate Escalation
The following events shall constitute Material Events requiring immediate escalation to the Board Chair (Margaret R. Ellsworth), the Lead Independent Director (David K. Sorrento), and the chair(s) of the relevant committee(s) within twenty-four (24) hours of discovery or notification:
(a) Receipt of any formal enforcement action, consent order, cease-and-desist order, or civil money penalty from any federal or state regulatory agency, including the OCC, the Federal Reserve Board, the FDIC, FinCEN, the Consumer Financial Protection Bureau, or any state banking department;
(b) Receipt of any Matter Requiring Immediate Attention ("MRIA") from the OCC, or any equivalent finding from another regulatory agency, regardless of the subject matter of the MRIA;
(c) Receipt of any new Matter Requiring Attention ("MRA") from the OCC, or any equivalent finding from another regulatory agency, that was not previously identified or anticipated by management in prior reports to the Board or relevant committee;
(d) Any SAR filing that involves, directly or indirectly, a director, executive officer, or significant shareholder (defined as any person or entity holding five percent (5%) or more of the outstanding common stock) of the Bank or its parent company, BRFG;
(e) Any BSA/AML compliance failure that, in the reasonable judgment of the BSA Officer or the General Counsel, could result in a regulatory enforcement action or civil money penalty exceeding five hundred thousand dollars ($500,000);
(f) Any cybersecurity incident or data breach involving unauthorized access to customer data that affects more than ten thousand (10,000) customers, or that involves the potential exposure of BSA/AML-sensitive information, including SAR data, CTR data, or customer due diligence records;
(g) Any material litigation or government investigation relating to compliance or BSA/AML matters, including the receipt of a grand jury subpoena, a civil investigative demand, or a formal order of investigation;
(h) Any whistleblower complaint, whether received through the Bank's ethics hotline, by direct communication to any officer or director, or through any other channel, alleging material violations of law, regulation, or Bank policy by any member of senior management at the level of Vice President or above;
(i) Any actual or suspected fraud involving aggregate amounts exceeding one million dollars ($1,000,000) or involving any executive officer of the Bank, regardless of the dollar amount; and
(j) Notification by the independent auditor, Ridgewell & Haines LLP, of a material weakness in the Bank's internal controls over financial reporting that is related to compliance processes, BSA/AML controls, or other matters within the scope of this Policy.
The foregoing list is not intended to be exhaustive. The General Counsel, in consultation with the CCO, BSA Officer, and CRO, shall use reasonable judgment to determine whether events not specifically enumerated above nonetheless constitute Material Events warranting immediate escalation. In cases of doubt, the General Counsel shall err on the side of escalation.
5.2 Escalation Procedures
Upon identification of a Material Event as defined in Section 5.1, the responsible officer — that is, the CCO, BSA Officer, CRO, or General Counsel, as applicable based on the nature of the event — shall immediately notify the General Counsel. If the General Counsel is already the responsible officer, the notification requirement shall be deemed satisfied. If the Material Event involves allegations concerning the General Counsel, the responsible officer shall notify the Board Chair directly, with a copy to outside counsel (Calderwood & Harkness LLP, Attn: Colette Whitman).
Upon receiving notification of a Material Event, the General Counsel shall promptly notify the following individuals:
(i) the Board Chair, Margaret R. Ellsworth;
(ii) the Lead Independent Director, David K. Sorrento; and
(iii) the chair of the relevant committee — for risk-related events, the Risk Committee Chair, Priya Venkataraman; for audit, financial-reporting, or internal-control-related events, the Audit Committee Chair, Thomas J. Callahan; for technology or cybersecurity-related events, the Technology & Innovation Committee Chair, Lawrence B. Huang; and, where applicable, more than one committee chair if the event implicates the responsibilities of multiple committees.
This notification shall be made within twenty-four (24) hours of the General Counsel's receipt of the initial report from the responsible officer.
The Chief Executive Officer (Richard A. Montague) shall also be notified of the Material Event, except where the Material Event involves allegations against the CEO personally, in which case the CEO shall not be notified until the Board Chair and Lead Independent Director have had the opportunity to consult and determine the appropriate course of action.
Within forty-eight (48) hours of the initial notification to directors, the General Counsel shall provide a written summary of the Material Event to all notified directors. The written summary shall include: a description of the event; the date and circumstances of discovery or notification; an initial assessment of the potential impact on the Bank; a description of any immediate actions taken or proposed; and a recommended course of action, including whether a special meeting of the Board or relevant committee is warranted.
The Board Chair, in consultation with the Lead Independent Director and the relevant committee chair(s), shall determine whether to convene a special meeting of the Board or the relevant committee to address the Material Event. In making this determination, the Board Chair and Lead Independent Director shall consider the severity and urgency of the event, the potential impact on the Bank's safety and soundness, regulatory standing, or reputation, and whether the event requires Board-level action or decision.
5.3 Escalation to BRFG Board
Given the substantially overlapping board composition between BRB and BRFG — eleven of the thirteen BRB directors also serve on the BRFG board — Material Events escalated to the BRB Board pursuant to this Section 5 shall simultaneously be communicated to the BRFG Board, as relevant. This parallel communication is necessary to ensure compliance with Federal Reserve supervisory expectations at the holding-company level, as articulated in the Federal Reserve Supervisory Letter SR-BHC-2024-1107.
The General Counsel shall coordinate with the corporate secretary of BRFG to ensure that the simultaneous communication to the BRFG Board is effected in a timely manner and that appropriate records are maintained at both the bank and holding-company levels.
SECTION 6: ROLES AND RESPONSIBILITIES
6.1 Chief Compliance Officer (CCO)
The Chief Compliance Officer bears primary responsibility for the preparation and delivery of regular compliance reports to the Board and its committees as specified in Section 4 of this Policy, including the Quarterly Compliance Report to the full Board and the updates to the Audit Committee regarding compliance matters relevant to financial reporting and internal controls.
The CCO has the obligation to immediately escalate Material Events related to compliance matters to the General Counsel, and thereafter to the Board Chair, Lead Independent Director, and relevant committee chairs, in accordance with the escalation procedures set forth in Section 5 of this Policy.
The CCO shall be responsible for maintaining a comprehensive log of all compliance-related reports and escalations made to the Board and its committees, including the date of each report or escalation, the subject matter covered, the recipients, and any actions taken by the Board or committee in response. This log shall be available for review by the Audit Committee, the Risk Committee, and the Bank's regulators.
The CCO shall have direct, unfiltered access to the Board Chair, the Lead Independent Director, and the chairs of the Audit Committee and the Risk Committee. This access right exists independent of the management chain of command, and the CCO shall not be required to obtain the approval or authorization of the CEO or any other member of management before communicating with these directors.
The CCO shall attend Board meetings and relevant committee meetings — specifically, Audit Committee meetings and Risk Committee meetings — as a standing invitee, and shall be prepared to provide reports and respond to questions from directors at each such meeting.
6.2 BSA Officer
The BSA Officer bears primary responsibility for the preparation and delivery of regular BSA/AML program reports to the Board and its committees as specified in Section 4 of this Policy, including the Quarterly BSA/AML Report to the full Board and the BSA/AML program updates to the Risk Committee.
The BSA Officer has the obligation to immediately escalate BSA/AML-related Material Events to the General Counsel, and thereafter to the Board Chair, Lead Independent Director, and relevant committee chairs, in accordance with the escalation procedures set forth in Section 5 of this Policy.
The BSA Officer shall have direct, unfiltered access to the Board Chair, the Lead Independent Director, and the chairs of the Audit Committee and the Risk Committee. This access right exists independent of the management chain of command.
Critically, the BSA Officer shall report directly to the Board on BSA/AML matters and shall not be subject to management filtering or revision of BSA/AML reports prior to Board delivery. Management shall not direct, edit, redact, or otherwise alter the content of the BSA Officer's reports to the Board or its committees. The BSA Officer's reports shall reflect the BSA Officer's own professional judgment regarding the status of the Bank's BSA/AML program and any deficiencies or concerns identified. This requirement is fundamental to the independence of the BSA/AML compliance function and is consistent with the expectations of the OCC, FinCEN, and interagency guidance.
The BSA Officer shall attend Risk Committee meetings and Audit Committee meetings as a standing invitee for BSA/AML-related agenda items and shall be prepared to provide reports and respond to questions from committee members at each such meeting.
6.3 Chief Risk Officer (CRO)
The Chief Risk Officer is responsible for enterprise risk reporting to the Board and the Risk Committee as specified in Section 4 of this Policy, including the Annual Enterprise Risk Report to the full Board and the enterprise risk reports to the Risk Committee at each of its regularly scheduled meetings.
Consistent with the revised Risk Committee Charter currently under development as part of the remediation of MRA Finding 1, the CRO shall have a direct reporting line to the Risk Committee that is independent of management. The CRO's reports to the Risk Committee shall be prepared by the CRO and delivered directly to the committee without prior management review, editing, or approval. The CRO shall also have direct, unfiltered access to the Board Chair, the Lead Independent Director, and the Risk Committee Chair.
The CRO has the obligation to escalate risk-related Material Events under Section 5 of this Policy to the General Counsel, and thereafter to the Board Chair, Lead Independent Director, and relevant committee chairs, in accordance with the escalation procedures set forth therein.
6.4 General Counsel and Corporate Secretary
James W. Prescott, as General Counsel and Corporate Secretary of the Bank, bears overall coordination responsibility for this Policy and for the Board Reporting Calendar described in Section 4.5 and Appendix A.
The General Counsel serves as the primary point of contact for outside counsel (currently Calderwood & Harkness LLP and Meridian Cobalt LLP) and the regulatory consultant (currently Ashford Pike Advisory LLC, Kenneth R. Stoltz, Managing Director) on governance-related information-flow matters, including matters arising under this Policy and matters related to the remediation of MRA Finding 3.
The General Counsel is responsible for the preparation and delivery of the Quarterly Regulatory Examination Summary and the Semi-Annual Enforcement and Legal Proceedings Report, as described in Section 4.1 of this Policy.
The General Counsel plays a central role in the escalation process described in Section 5: the General Counsel receives all Material Event notifications from the responsible officers (CCO, BSA Officer, CRO) and is responsible for coordinating the prompt notification of the Board Chair, the Lead Independent Director, and the relevant committee chairs. The General Counsel is also responsible for preparing the written summary of Material Events required to be delivered within forty-eight (48) hours of the initial notification.
The General Counsel is further responsible for documenting Board and committee actions taken in response to Material Events, including any resolutions adopted, directives issued, or follow-up actions requested by the Board or its committees. Such documentation shall be maintained in the escalation log described in Section 9.2 and shall be available for regulatory review.
The General Counsel shall coordinate with the Chief Financial Officer (Catherine L. Ng) regarding any financial reporting or disclosure implications of Material Events, including the potential need for disclosure in the Bank's or BRFG's public filings, regulatory reports, or financial statements.
6.5 Chief Executive Officer
Richard A. Montague, as Chief Executive Officer of the Bank, is ultimately accountable for ensuring management's compliance with this Policy. The CEO shall set the appropriate tone at the top and shall communicate to all members of management the importance of timely, accurate, and complete information flow to the Board and its committees.
The CEO shall ensure that adequate resources and staffing are provided to the CCO, BSA Officer, CRO, and other management functions responsible for Board reporting under this Policy. Budgetary constraints shall not be used as a justification for non-compliance with the reporting requirements of this Policy.
The CEO shall not direct, filter, suppress, delay, or otherwise impede information required to be reported to the Board or its committees under this Policy. This prohibition extends to any instruction, suggestion, or request made to any officer or employee of the Bank to withhold, modify, minimize, or delay the communication of information to the Board or its committees.
6.6 Board Chair and Lead Independent Director
Margaret R. Ellsworth, as Board Chair, and David K. Sorrento, as Lead Independent Director, bear shared responsibility for ensuring that the Board's agenda includes adequate time for thorough discussion of compliance, BSA/AML, and risk-related reports delivered under this Policy. The agenda for each regularly scheduled Board meeting shall allocate sufficient time for presentation and discussion of the Quarterly Compliance Report, the Quarterly BSA/AML Report, the Quarterly Regulatory Examination Summary, and other reports required under this Policy.
The Board Chair and Lead Independent Director serve as the primary Board-level recipients of Material Event escalations under Section 5. Upon receipt of a Material Event notification, the Board Chair and Lead Independent Director shall consult and determine the appropriate course of action, including whether to convene a special meeting of the Board or the relevant committee.
The Board Chair and Lead Independent Director may, individually or jointly, direct management to provide supplemental information, reports, or briefings on any compliance, BSA/AML, or risk matter at any time, whether or not such information is otherwise required by this Policy. Management shall respond to such requests promptly and completely.
The Board Chair and Lead Independent Director may request executive sessions with the CCO, BSA Officer, CRO, or General Counsel without other members of management present. Such executive sessions may be held as part of a regularly scheduled Board meeting or at any other time at the discretion of the Board Chair or Lead Independent Director.
6.7 Committee Chairs
Each committee chair is responsible for ensuring that his or her committee receives the information required under this Policy and the applicable committee charter. Committee chairs shall work with the General Counsel and the relevant reporting officers to ensure that committee meeting agendas and materials are sufficient to enable the committee to discharge its oversight responsibilities.
Committee chairs shall report to the full Board on significant information received by the committee, including Material Events escalated to the committee under Section 5, at the next regularly scheduled Board meeting or sooner if the significance of the matter warrants earlier communication. Committee chair reports to the full Board shall include a summary of the matters discussed, any actions taken or recommended by the committee, and any matters requiring the attention or action of the full Board.
SECTION 7: INDEPENDENCE AND QUALITY OF BOARD INFORMATION
7.1 Independent Verification
Consistent with the remediation of MRA Finding 2 identified in the OCC MRA Letter SA-2024-0315, management-prepared reports delivered to the Board or its committees under this Policy shall, where practicable, include independent verification or corroboration from one or more of the following sources: the Bank's internal audit function; the Bank's independent auditor, Ridgewell & Haines LLP; the regulatory consultant, Ashford Pike Advisory LLC; or other qualified independent sources.
Independent verification may take the form of independent testing of data and conclusions presented in management reports, independent review of compliance processes and controls, attestations from internal audit regarding the accuracy of management representations, or other verification methods appropriate to the subject matter.
The Audit Committee shall periodically assess whether the information provided to the Board and its committees under this Policy is accurate, complete, and independently verified, and shall report its findings to the full Board. The Audit Committee may direct internal audit or the independent auditor to conduct targeted reviews of specific management reports or reporting processes as part of this assessment.
7.2 Direct Access to External Advisors
The Board and its committees shall have direct access to external advisors, including outside counsel (currently Calderwood & Harkness LLP and Meridian Cobalt LLP), the independent auditor (Ridgewell & Haines LLP, engagement partner Lydia M. Chow), and the regulatory consultant (Ashford Pike Advisory LLC, Kenneth R. Stoltz, Managing Director), for purposes of independently verifying information received from management, obtaining independent advice, or otherwise supporting the Board's oversight responsibilities.
The Board Chair and committee chairs may engage such advisors directly, without management approval, subject to applicable budget and engagement protocols established by the Board. Management shall cooperate fully with external advisors engaged by the Board or its committees and shall provide such advisors with access to the Bank's records, personnel, and facilities as may be necessary.
7.3 Non-Retaliation. No director, officer, or employee of the Bank shall be subject to retaliation, in any form, for providing information to the Board or its committees in good faith pursuant to this Policy. Retaliation includes, without limitation, termination of employment, demotion, suspension, reduction in compensation, reassignment to a less desirable position, harassment, or any other adverse action taken because of the individual's communication of information to the Board or its committees.
This non-retaliation provision supplements the Bank's existing whistleblower policy, ethics reporting policy, and any protections afforded by applicable federal and state law, including the Sarbanes-Oxley Act, the Dodd-Frank Act, and the whistleblower protections under the Bank Secrecy Act. Any allegation of retaliation under this section shall be reported to the General Counsel and the Audit Committee Chair and shall be investigated promptly.
SECTION 8: CONFIDENTIALITY AND PRIVILEGE
8.1 Confidential Treatment
All reports, materials, and communications provided to the Board and its committees under this Policy shall be treated as confidential and shall be subject to the Bank's information security policies, records management policies, and applicable confidentiality obligations. Directors and management personnel receiving such materials shall take appropriate steps to safeguard the confidentiality of the information, including secure storage, limited distribution, and compliance with the Bank's policies regarding the use of personal devices and external email for the transmission of confidential information.