Consent Order issued by the Office of the Comptroller of the Currency, dated February 9, 2023

(1) The Bank is an “insured depository institution” as that term is defined in 12 U.S.C. § 1813(c)(2).

(2) The Bank is a Federal savings association within the meaning of 12 U.S.C. § 1813(q)(1)(C), and is chartered and examined by the OCC. See 12 U.S.C. §§ 1461 et seq., 5412(b)(2)(B).

(3) The OCC is the “appropriate Federal banking agency” as that term is defined in 12 U.S.C. § 1813(q) and is therefore authorized to initiate and maintain this cease and desist action against the Bank pursuant to 12 U.S.C. § 1818(b).

(1) The Board shall maintain a Compliance Committee of at least three (3) members of which a majority shall be directors who are not employees or officers of the Bank or any of its subsidiaries or affiliates. The Board shall confirm in writing to the Assistant Deputy Comptroller the names of the members of the Compliance Committee within ten (10) days of the effective date of this Order. In the event of a change of the membership, the Board shall submit in writing to the Assistant Deputy Comptroller within ten (10) days the name of any new or resigning

(2) By March 31, 2023, and thereafter within ten (10) days after the end of each calendar month, the Compliance Committee shall submit to the Board a written progress report setting forth in detail:

(a) a detailed and complete description of the corrective actions needed to achieve compliance with each Article of this Order;

(b) the specific corrective actions undertaken to comply with each Article of this Order; and

(3) Upon receiving each written progress report, the Board shall forward a copy of the report, with any additional comments by the Board, to the Assistant Deputy Comptroller within ten (10) days of the first Board meeting following the Board’s receipt of such report.

(1) Within thirty (30) days of the effective date of this Order, the Board shall develop, adopt, implement, and thereafter ensure the Bank’s adherence to a program for corporate governance and Board oversight of the Bank’s operation and structure.  The Board shall submit a copy of this program to the Assistant Deputy Comptroller within ten (10) days of its adoption.  At a minimum, the Board shall ensure that the program addresses the following:

(a) an education program designed to ensure that the officer has skills and abilities necessary to supervise effectively;

(c) objectives by which the officer's effectiveness will be measured; and

(d) a performance appraisal program and projected timeline for evaluating performance according to the position's description and responsibilities and for measuring performance against the Bank's goals and objectives.

(1) Within sixty (60) days of the effective date of this Order, the Board shall submit to the Assistant Deputy Comptroller for review and prior written determination of no supervisory objection an acceptable a written strategic plan for the Bank, covering at least a three-year period (“Strategic Plan”). The Strategic Plan shall establish objectives for the Bank’s overall risk profile, earnings performance, growth, balance sheet mix, off-balance sheet activities, liability structure, and capital and liquidity adequacy, together with strategies to achieve those objectives, and shall, at a minimum, include:

(a) a mission statement that forms the framework for the establishment of strategic goals and objectives;

(b) the strategic goals and objectives to be accomplished, including key financial indicators and risk tolerances;

(c) an assessment of the Bank’s strengths, weaknesses, opportunities and threats that impact its strategic goals and objectives;

(d) an evaluation of the Bank's internal operations, staffing requirements, board and management information systems, policies, and procedures for their adequacy and contribution to the accomplishment of the strategic goals and objectives developed under paragraph (1)(b) of this Article;

(e) a management employment and succession plan designed to promote adequate staffing and continuity of capable management;

(f) a realistic and comprehensive budget that corresponds to the Strategic Plan’s goals and objectives;

(g) a financial forecast to include projections for major balance sheet and income statement accounts and desired financial ratios over the period covered by the Strategic Plan;

(h) an identification and prioritization of initiatives and opportunities, including timeframes that comply with the requirements of this Order;

(i) a description of the Bank’s target market(s) and competitive factors in its identified target market(s), and a description of controls systems to mitigate risks in the Bank’s target market(s);

(j) an identification and assessment of the present and planned product lines (assets and liabilities) and the identification of appropriate risk management systems to identify, measure, monitor, and control risks within the product lines; 

(k) concentration limits commensurate with the Bank’s strategic goals and objectives and risk profile;

(l) assigned roles, responsibilities, and accountability for the strategic planning; and

(m) a description of systems and metrics designed to monitor the Bank’s progress in meeting the Strategic Plan’s goals and objectives.

(2) Within thirty (30) days following receipt of the Assistant Deputy Comptroller’s written determination of no supervisory objection to the Strategic Plan or to any subsequent amendment to the Strategic Plan, the Board shall adopt and Bank management, subject to Board review and ongoing monitoring, shall immediately implement and thereafter ensure adherence to the Strategic Plan.  The Board shall review the effectiveness of the Strategic Plan at least annually, no later than December 31 each year, and more frequently if necessary or if required by the OCC in writing, and amend the Strategic Plan as needed or directed by the OCC.  Any amendment to the Strategic Plan must be submitted to the Assistant Deputy Comptroller for review and prior written determination of no supervisory objection.

(3) Until the Strategic Plan required under this Article has been submitted by the Bank for the Assistant Deputy Comptroller’s review, has received a written determination of no supervisory objection from the Assistant Deputy Comptroller and has been adopted by the Board, the Bank shall not significantly deviate from the products, services, asset composition and size, funding sources, structure, operations, policies, procedures, and markets of the Bank that existed immediately before the effective date of this Order without first obtaining the Assistant Deputy Comptroller’s prior written determination of no supervisory objection to such significant deviation. 

(4) The Bank may not initiate any action that significantly deviates from a Strategic Plan (that has received written determination of no supervisory objection from the Assistant Deputy Comptroller and has been adopted by the Board) without a prior written determination of no supervisory objection from the Assistant Deputy Comptroller.  

(5) Any request by the Bank for prior written determination of no supervisory objection to a significant deviation described in paragraphs (3) or (4) of this Article shall be submitted in writing to the Assistant Deputy Comptroller at least thirty (30) days in advance of the proposed significant deviation. Such written request by the Bank shall include an assessment of the effects of such proposed change on the Bank’s condition and risk profile, including a profitability analysis and an evaluation of the adequacy of the Bank’s organizational structure, staffing, management information systems, internal controls, and written policies and procedures to identify, measure, monitor, and control the risks associated with the proposed change.

(6) For the purposes of this Article, changes that may constitute a significant deviation include, but are not limited to, a change in the Bank’s marketing strategies, products and services, marketing partners, underwriting practices and standards, credit administration, account management, collection strategies or operations, fee structure or pricing, accounting processes and practices, or funding strategy, any of which, alone or in the aggregate, may have a material effect on the Bank’s operations or financial performance; or any other changes in personnel, operations, or external factors that may have a material effect on the Bank’s operations or financial performance.

(7) At least monthly, a written evaluation of the Bank’s performance against the Strategic Plan shall be prepared by Bank management and submitted to the Board. Within ten (10) days after submission of the evaluation, the Board shall review the evaluation and determine the corrective actions the Board will require Bank management to take to address any identified shortcomings. The Board’s review of the evaluation and discussion of any required corrective actions to address any identified shortcomings shall be documented in the Board’s meeting minutes. Upon completion of the Board’s review, the Board shall submit to the Assistant Deputy

(1) Within sixty (60) days of the effective date of this Order, the Bank shall submit to the Assistant Deputy Comptroller for review an acceptable, comprehensive, a written internal audit program that adequately assesses controls and operations to allow the Board and management to understand the sufficiency of  the Bank’s internal controls program (“Internal Audit Program”).                                                                                  

(2) Management shall ensure the Internal Audit Program’s compliance with the standards for internal audit systems set forth in Section II.B of the Interagency Guidelines Establishing Standards for Safety and Soundness, Appendix A to 12 C.F.R. Part 30.  Refer to the “Internal and External Audits” booklet of the Comptroller’s Handbook for related safe and sound principles.  The Internal Audit Program shall incorporate standards of safety and soundness that are commensurate with the Bank’s size, complexity, scope of activities, and risk profile and shall, at a minimum:

(a) require the development of an internal audit policy and plan that is risk-based and provides adequate audit scope, coverage, issue tracking, and frequency for all areas of the Bank, including an information technology (“IT”) audit, with

(b) address the use of third-parties to complete any internal audit activities, including documented Board approval of selection and termination of third-parties; refer to OCC Bulletin 2013-29, “Third-Party Relationships” for related safe and sound principles; 

(c) evaluate the reliability, adequacy, and effectiveness of the Bank’s internal controls system, whether operated by the Bank or a third-party;

(d) evaluate whether the Bank’s internal controls system results in prompt and accurate recording of transactions and proper safeguarding of assets;

(e) determine whether the Bank complies with laws and regulations and adheres to its established policies, procedures, and processes;

(1) Within thirty (30) days of the effective date of this Order, the Bank shall submit to the Assistant Deputy Comptroller for review and prior written determination of no supervisory objection an acceptable, written program to effectively assess and manage the Bank's information technology IT activities ("IT Governance Program"). Refer to Federal Financial Institutions Examination Council (“FFIEC”), IT Handbook, for related safe and sound principles. Although the Bank may outsource some or all of its IT functions, outsourcing does not change the Board's responsibility to ensure effective IT controls.

(2) The IT Governance Program shall be commensurate with the level of risk and complexity of the Bank's IT activities and shall, at a minimum, address the following:

(a) an effective IT risk governance program that establishes the roles, responsibilities, and accountability of the Board of directors and management; refer to the "Management" booklet of the FFIEC IT Examination Handbook;

(b) an effective IT Audit that is risk based and provides adequate IT audit scope, coverage, and frequency and includes a plan for the selection, due diligence, evaluation, and ongoing monitoring and Board and Audit Committee oversight of IT audit activities performed by third parties;

(c) an IT planning process with the following elements: long-term goals and the allocation of IT resources to achieve them; alignment of the IT strategic plan with the enterprise-wide business plan; identification and

(d) hiring and training practices governed by appropriate policies to maintain competent and trained staff to fulfill respective roles in the Bank's IT program, including in the Information Security Officer position; refer to the "Management" booklet of the FFIEC IT Examination Handbook;

(e) an effective IT risk management process that includes: identification and measurement of risks to information and technology assets, within the Bank or controlled by third-party providers; mitigation of risks to an acceptable residual risk level in conformance with the board's risk appetite; and monitoring risk levels with results reported to the board and senior management; refer to the "Management" booklet of the FFIEC IT Examination Handbook;

(f) an effective, written, system architecture program to identify, acquire, install, and maintain appropriate IT systems with project management standards, procedures, and controls commensurate with the characteristics and risks of the Bank's development, acquisition, and maintenance activities; refer to the "Development and Acquisition" booklet of the FFIEC IT Examination Handbook;

(g) an effective written program with standards and controls over data structure, usage, and storage; refer to the "Operations" and "Development and Acquisition" booklets of the FFIEC IT Examination Handbook;

(h) appropriate system security controls including documenting an inventory of information system assets including hardware, software, information and connections; classify the information system assets based on risk; implement user access and authentication controls based on the principle of least privilege, including proper segregation of duties; refer to the "Information Security" booklet of the FFIEC IT Examination Handbook;

(i) an effective incident identification and assessment process and effective written Incident Response Program; refer to OCC Bulletin 2005-13 "Response Programs for Unauthorized Access to Customer Information and Customer Notice - Final Guidance'';

(j) a written change management program that addresses controls over the introduction of changes, in a controlled manner, into the IT environment; implements effective patch management systems and software to ensure all network components (virtual machines, routers, switches, mobile devices, firewalls, etc.) and application software are appropriately updated; and use vulnerability scanners periodically to identify vulnerabilities in a timely manner; refer to the "Information Security" and "Operations" booklets of the FFIEC IT Examination Handbook;

(k) operational controls, procedures, standards, and processes, including, but not limited to, an environmental survey, network topologies and data

(l) an updated written, Board-approved, enterprise-wide business continuity management and resiliency process ("Business Continuity and Recovery Plan”) that includes a Business Impact Analysis that assesses and prioritizes potential threat and disruption scenarios, including cyber events, based upon their impact on operations and probability of occurrence; periodic enterprise-wide tests; independent assessment of the tests; and, updating the plan regularly as needed; refer to the "Business Continuity Planning" and "Information Security" booklets of the FFIEC IT Examination Handbook;

(m) an IT assurance and testing program that is risk-based, written, and well documented; identifies and addresses the areas of greatest IT and information security risk exposure; promotes sound IT and information security controls; evaluates the adequacy of planning, oversight, operating processes, internal controls, and compliance efforts; includes self-assessments, independent penetration tests, vulnerability assessments and audits in the assurance testing program; and promptly detects, reports, and tracks significant risks and deficiencies and corrective actions; refer to the

(n) an effective IT third-party risk management program to enable the Bank to effectively assess and manage the risks of IT services provided by third parties. At a minimum the program shall:  

(3) Within ten (10) days following receipt of the Assistant Deputy Comptroller's written determination of no supervisory objection to the IT Governance Program or to any subsequent amendment to the IT Governance Program, the Board shall adopt and Bank management, subject to Board review and ongoing monitoring, shall immediately implement and thereafter adhere to the IT Governance Program.

(4) The Board shall review the effectiveness of the IT Governance Program at least annually, no later than December 31, and more frequently if necessary or if required by the OCC in writing, and amend the IT Governance Program as needed or as directed by the

(2) The Information Security Program shall comply with 12 C.F.R. Part 30, Appendix B, and shall, at a minimum, address the following:

(a) the Board's approval, or the approval of an appropriate Board committee, of the Information Security Program;

(b) a risk assessment that identifies reasonably foreseeable threats that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer information systems; that assesses the likelihood and potential damage of these threats; that assesses the sufficiency

(c) measures to control identified risks, commensurate with the sensitivity of the information and the complexity and scope of the Bank's activities, including measures to address data loss prevention;

(d) dedicated Information Security Officer with sufficient authority to oversee and implement the Information Security Program;

(e) regular testing of key controls, systems, and procedures and independent testing or reviews of testing; including incident response testing and training;

(f) appropriate measures for the proper disposal of customer information and customer information systems; including measures to address data loss prevention;

(g) a process to monitor, evaluate and adjust, as appropriate, the program in response to changes in technology, the sensitivity of customer information, internal or external threats, changing business arrangements, changing outsourcing arrangements, and changing systems; and the annual receipt by the Board, or an appropriate committee thereof, of a report that describes the overall status of the Information Security Program and the Bank's compliance with 12 C.F.R. Part 30, Appendix B; and

(h) the annual receipt by the Board or appropriate committee thereof of a report that describes the overall status of the Information Security Program and the Bank’s compliance with 12 C.F.R. Part 30, Appendix B.

(3) Within ten (10) days following receipt of the Assistant Deputy Comptroller's written determination of no supervisory objection to the Information Security Program or to any subsequent amendment to the Information Security Program, the Board shall adopt and Bank management, subject to Board review and ongoing monitoring, shall immediately implement and thereafter adhere to the Information Security Program.

(4) The Board shall review the effectiveness of the Information Security Program at least annually, and more frequently if necessary or if required by the OCC in writing, and amend the Information Security Program as needed or as directed by the OCC. Any amendment to the Information Security Program must be submitted to the Assistant Deputy Comptroller for review and prior written determination of no supervisory objection.

(1) The Board shall immediately adopt and implement the written ACH Risk Management Program ("ACH Program") previously given no supervisory objection by the Assistant Deputy Comptroller.

(a) implementation of Board approved written risk-based policies, procedures, and processes for effective risk management of ACH activities appropriate for the size and complexity of the Bank, to include policies and 

(b) adequate staffing and defined resources at the Bank dedicated to the review and audit of ACH transactions to ensure ongoing compliance with ACH policies and procedures.

(3) The Board shall review the effectiveness of the ACH Program at least annually, and more frequently if necessary or if required by the OCC in writing, and amend the ACH Program as needed or directed by the OCC.

(1) Within thirty (30) days of the effective date of this Order, the Bank shall analyze the current BSA/AML risk profile and strategic direction to determine the skills, experience, and expertise required of the Bank’s BSA Officer.  Based on this analysis, the Board shall develop a comprehensive job description detailing all the requirements and responsibilities of the BSA Officer role.

(1) Within sixty (60) days of the effective date of this Order, the Bank shall develop, adopt, implement, ensure that the BSA Officer and any supporting staff receive training, and

(1) Within ninety (90) days of the effective date of this Order, the Board shall ensure that Bank management develops, implements, and thereafter maintains adherence to an enhanced written risk-based program of internal controls and processes to ensure compliance with the requirements to file SARs as set forth in 12 C.F.R. § 163.180.  At a minimum, this written program shall:

(1) Within sixty (60) days of the effective date of this Order, the Bank shall develop, adopt, implement, and thereafter ensure the Bank’s adherence to procedures for periodically reviewing, testing, and updating the Bank’s BSA/AML model risk assessments to cover risks associated with current, or subsequently proposed, Bank products, services, customers, entities, and geographies served, and including the dollar volume, number, and geographic markets associated with Bank products, services, customers and transactions.  The Bank’s procedures must include, at a minimum:

(1) The Board shall ensure that the Bank has timely adopted and implemented all corrective actions required by this Order, and shall verify that the Bank adheres to the corrective actions and they are effective in addressing the Bank’s deficiencies that resulted in this Order.

(2) In each instance in which this Order imposes responsibilities upon the Board, it is intended to mean that the Board shall:

(a) authorize, direct, and adopt corrective actions on behalf of the Bank as may be necessary to perform the obligations and undertakings imposed on the Board by this Order;

(b) ensure the Bank has sufficient processes, management, personnel, control systems, and corporate and risk governance to implement and adhere to all provisions of this Order;

(c) require that Bank management and personnel have sufficient training and authority to execute their duties and responsibilities pertaining to or resulting from this Order;

(d) hold Bank management and personnel accountable for executing their duties and responsibilities pertaining to or resulting from this Order;

(e) require appropriate, adequate, and timely reporting to the Board by Bank management of corrective actions directed by the Board to be taken under the terms of this Order; and

(f) address any noncompliance with corrective actions in a timely and appropriate manner.

(1) The Bank, by executing and consenting to this Order, waives:

(a) any and all rights to the issuance of a Notice of Charges pursuant to 12 U.S.C. § 1818;

(b) any and all procedural rights available in connection with the issuance of this Order;

(c) any and all rights to a hearing and a final agency decision pursuant to 12 U.S.C. § 1818 and 12 C.F.R. Part 109;

(d) any and all rights to seek any type of administrative or judicial review of this Order;

(e) any and all claims for fees, costs, or expenses against the OCC, or any of its officers, employees, or agents related in any way to this enforcement matter or this Order, whether arising under common law or under the terms of any statute, including, but not limited to, the Equal Access to Justice Act, 5 U.S.C. § 504 and 28 U.S.C. § 2412;

(f) any and all rights to assert these proceedings, the consent to and/or the issuance of this Order, as the basis for a claim of double jeopardy in any pending or future proceedings brought by the United States Department of Justice or any other governmental entity; and

(g) any and all rights to challenge or contest the validity of this Order.

(1) As a result of this Order, pursuant to 12 C.F.R. § 5.51(c)(7)(ii), the Bank is in “troubled condition,” and is not an “eligible bank/savings association” for purposes of 12 C.F.R. § 5.3, unless otherwise informed in writing by the OCC.

(2) The Bank is subject to the restrictions in 12 C.F.R. § 5.51 requiring prior notice to the OCC of changes in directors and senior executive officers or the limitations on golden parachute payments set forth in 12 C.F.R. Part 359.

(3) This Order supersedes all prior OCC communications issued pursuant to 12 C.F.R. §§ 5.3, and 5.51(c)(7)(ii)).

CLOSING



(1) This Order is a settlement of the cease and desist proceedings against the Bank contemplated by the OCC, based on the unsafe or unsound practices, noncompliance with the Formal Agreement, and/or violations of law described in the Comptroller’s Findings set forth in Article II of this Order. The OCC releases and discharges the Bank from all potential liability for a cease and desist order that has been or might have been asserted by the OCC based on the practices and/or violations described in Article II of this Order, to the extent known to the OCC as of the effective date of this Order. Nothing in this Order, however, shall prevent the OCC from:

(a) instituting enforcement actions other than a cease and desist order against the Bank based on the Comptroller’s Findings set forth in Article II of this Order;

(b) instituting enforcement actions against the Bank based on any other findings;

(c) instituting enforcement actions against institution-affiliated parties (as defined by 12 U.S.C. § 1813(u)) based on the Comptroller’s Findings set forth in Article II of this Order, or any other findings; or

(d) utilizing the Comptroller’s Findings set forth in Article II of this Order in future enforcement actions against the Bank or its institution-affiliated parties to establish a pattern or the continuation of a pattern.

(2) Nothing in this Order is a release, discharge, compromise, settlement, dismissal, or resolution of any actions, or in any way affects any actions that may be or have been brought by any other representative of the United States or an agency thereof, including, without limitation, the United States Department of Justice.

(3) This Order is:

(a) a “cease-and-desist order issued upon consent” within the meaning of 12 U.S.C. § 1818(b);

(b) a “cease-and-desist order which has become final” within the meaning of 12 U.S.C. § 1818(e);

(c) an “order issued with the consent of the depository institution” within the meaning of 12 U.S.C. § 1818(h)(2);

(d) an “effective and outstanding . . . order” within the meaning of 12 U.S.C. § 1818(i)(1); and

(e) a “final order” within the meaning of 12 U.S.C. § 1818(i)(2) and (u).

(4) This Order is effective upon its issuance by the OCC, through the Comptroller’s duly authorized representative. Except as otherwise expressly provided herein, all references to “days” in this Order shall mean calendar days and the computation of any period of time imposed by this Order shall not include the date of the act or event that commences the period of time.

(5) The provisions of this Order shall remain effective except to the extent that, and until such time as, such provisions are amended, suspended, waived, or terminated in writing by the OCC, through the Comptroller’s duly authorized representative. If the Bank seeks an extension, amendment, suspension, waiver, or termination of any provision of this Order, the Board or a Board-designee shall submit a written request to the signer’s title asking for the desired relief. Any request submitted pursuant to this paragraph shall include a statement setting forth in detail the circumstances that warrant the desired relief or prevent the Bank from complying with the relevant provision(s) of the Order, and shall be accompanied by relevant supporting documentation. The OCC’s decision concerning a request submitted pursuant to this paragraph, which will be communicated to the Board in writing, is final and not subject to further review.

(6) The Bank will not be deemed to be in compliance with this Order until it has adopted, implemented, and adhered to all of the corrective actions set forth in each Article of this Order; the corrective actions are effective in addressing the Bank’s deficiencies; and the OCC has verified and validated the corrective actions. An assessment of the effectiveness of the corrective actions requires sufficient passage of time for the Bank to demonstrate the sustained effectiveness of the corrective actions.

(7) This Order is not a contract binding on the United States, the United States Treasury Department, the OCC, or any officer, employee, or agent of the OCC and neither the Bank nor the OCC intends this Order to be a contract.

(8) Each citation, issuance, or guidance referenced in this Order includes any subsequent citation, issuance, or guidance that replaces, supersedes, amends, or revises the referenced cited citation, issuance, or guidance.

(9) This Order applies to the Bank and all its subsidiaries.

(10) No separate promise or inducement of any kind has been made by the OCC, or by its officers, employees, or agents, to cause or induce the Bank to consent to the issuance of this Order.

(11) All reports, plans, or programs submitted to the OCC pursuant to this Order shall be forwarded through the OCC’s secure portal with an e-mail notification to the Assistant Deputy Comptroller.

(12) The terms of this Order, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements, or prior arrangements between the parties, whether oral or written.