BRBS Blue Ridge Bancshares Inc

Entry into a Material Definitive Agreement.

create a compliance committee composed of at least three of the Bank’s directors to monitor compliance with the Agreement and make quarterly progress reports to the Bank’s board of directors regarding actions the Bank has taken to comply with the Agreement and the results and status of such actions;

adopt, implement and adhere to a written program to effectively assess and manage the risks posed by the Bank’s third-party fintech relationships;

obtain an OCC non-objection prior to onboarding or signing a contract with a new third-party fintech partner, or offering new products or services or conducting new activities with or through existing third-party fintech partners;

adopt, implement and adhere to an effective written Bank Secrecy Act (“BSA”) risk assessment program to ensure BSA compliance risk assessments provide a comprehensive and accurate assessment of the Bank’s BSA compliance risk across all products, services, customers, entities, and geographies, including all activities provided by or through the Bank’s third-party fintech partners;

adopt a revised independent BSA audit program that includes an expanded scope and risk-based review of activities conducted through the Bank’s third-party fintech partners;

ensure that the Bank’s BSA department is appropriately staffed with personnel that have requisite expertise, training, skills and authority;

adopt, implement and adhere to revised and expanded risk-based policies, procedures, and processes (including specific requirements for the Bank’s fintech businesses) to obtain and analyze appropriate customer due diligence, enhanced due diligence, and beneficial ownership information for bank customers at the time of account opening and on an ongoing basis, and to effectively use this information to monitor and investigate suspicious or unusual activity;

develop, implement and adhere to an enhanced written risk-based program to ensure the timely identification, analysis, and suspicious activity monitoring and reporting for all lines of business, including activities provided by and through the Bank’s third-party fintech relationship accounts and sub-accounts;

submit to the OCC an action plan to conduct a review and provide a written report of the Bank’s suspicious activity monitoring, including with respect to high risk customer activity involving the Bank’s third-party fintech partners, and thereafter conduct such review and provide the written report to the OCC; and

implement and adhere to an acceptable written program to effectively assess and manage the Bank’s information technology activities, including those activities conducted through and by the Bank’s third-party fintech partners.