DESCRIPTION OF SERVICES AVAILABLE 1. Loan Compliance … · 3 LCR-15 MD Choice of Settlement Agent, and other MD Disclosures (MD loans only, as applicable), if applicable LCR-16 Appraisal

DESCRIPTION OF SERVICES AVAILABLE

1. Loan Compliance File Review Training

Oversee the review of a random sample of approved, declined and withdrawn applications from each major loan category. Examine applicable marketing materials submitted, and origination disclosures. Randomly test the APR, finance charge, TIP, Cash to Close, In 5 Years, Total of Payments, and Amount Financed from each consumer residential loan category. The testing will involve utilizing the OCC’s APR software. This review will test regulatory compliance with the regulations as follows:

LCR-1 Truth in Lending, Regulation Z Proper determination of coverage Completion and Timing Requirements of Loan Estimate and Closing Disclosure Proper determination and disclosure related to Changed Circumstance TRID Rules and revisions to the TRID rules; Completion and accuracy of TIL Higher Priced Mortgage Loan testing documentation in file

If applicable – no exceptions to Debt to Income Ratio

Verification of income

Documentation of ability to repay

Escrow per RESPA if 1st lien

No prepayment penalty Proper identification of prepaid finance charges, tolerance violations, calculation of APR,

Finance Charge, payment schedule, TIP, as applicable, etc. Right of Rescission signing, dating, # of copies, if applicable Properly documented Release of Right of Rescission, if institution requires this, date of

disbursement of funds, if RofR applies, waiver of RofR, if applicable Section 32 testing documentation and compliance ARM disclosures, if applicable Home Equity Open End Line of Credit Early Disclosure timing, contents Home Equity Open End Line of Credit Agreement contents, signing HELOCs approaching End of Draw Period notifications and procedures HELOC and non-real-estate secured open-end statement contents HELOC Postponement of Closing Costs Lender paid Closing Cost disclosure and handling for open-end and closed-end products Mortgage Servicing Requirements Ability to Repay/Qualified Mortgage

LCR-2 RESPA, Regulation X Affiliated Business Arrangement timing and completion, if applicable Escrow calculation, cushion, payment frequency, if applicable Broker Relationships Homeowner Counseling Force-Placed Hazard Insurance Timely crediting of payments, Cut-off timing Recent Mortgage Servicing Requirement Changes

2

LCR-3 Equal Credit Opportunity Act, Regulation B This review is not a fair lending review. It will cover timing, notification, and disclosure

requirements of Reg B, including the valuation notice and copy requirements.

Home Mortgage Disclosure Act, Regulation C Review of sampling of files on HMDA LAR to determine

proper determination of coverage

accurate completion of each field

Data in loan files will be also be compared to the data reported on the Financial Institution's HMDA LAR (if applicable), if the Financial Institution is a HMDA reporter. Upon completion of the Loan Review a report will be prepared describing the deficiencies and recommendations will be made to improve the Financial Institution’s compliance program.

Sampling of other files to determine if coverage was accurately determined (this is optional and at the request of the Institution)

LCR-4 Fair Housing Act Notices posted properly

LCR-5 Flood Disaster Protection Act Determination properly dated Review of all open files identified as being in SFHA by Flood Co. for notification, coverage, etc. Force-Placement Escrow

LCR-6 Fair Credit Reporting Act and Fair and Accurate Credit Transaction Act (FACT Act)

Permissible purpose for obtaining credit reports, timing Credit Score Disclosure Address Alerts Fraud Alerts, Active Duty Alerts Risk Based Pricing Notice Adverse Action Notice

LCR-7 Unfair or Deceptive Acts or Practices – general observations LCR-8 Gramm Leach Bliley Act, Regulation P, Title12 Chapter III, Part 332

Privacy Notice content and documentation of disclosures in files Annual mailing, if required General Observations of adherence to Notice

LCR-9 Home Ownership and Equity Protection Act (HOEPA) LCR-10 USA PATRIOT Act, Customer Identification Procedures

unless this is done as part of the annual Independent AML/BSA Audit

LCR-11 Office of Foreign Assets Control (Verification with OFAC’s SDN List) unless this is done as part of the annual Independent AML/BSA Audit

LCR-12 Maryland Mortgage Disclosure if no escrow on 1st lien, any balloon payment, or mandatory arbitration, if applicable

LCR-13 Maryland Deed of Trust Affidavit completion for settled loans, if applicable

LCR-14 MD Counseling Disclosure, if applicable

3

LCR-15 MD Choice of Settlement Agent, and other MD Disclosures (MD loans only, as applicable), if applicable

LCR-16 Appraisal Guidance LCR-17 Small Creditor QM and ATR Requirements, Small Servicer

Requirements LCR-18 SAFE Act LCR-19 Military Lending Act – Determination of products subject to the MLA,

documentation in file of verification of data base, disclosure requirements

4

2. Identity Theft Red Flag Audit Training

This annual audit reviews the institution’s adopted Identity Theft Red Flag Program. Samplings of loan files, new deposit accounts, wires, safe deposit activity, targeted identified files will be reviewed for:

Review of adequacy of Risk Assessment compliance with address change procedures compliance with address discrepancy procedures review of service provider contracts and relationships logging of identity theft attempts and occurrences senior officer involvement compliance with procedures established for each of the 23+ ID theft red flags for each applicable product Board adoption of the Program and approval of the officer/committee Annual review, analysis, and report to the Board Training Modifications to the Program due to product/service changes, ID theft incidents, etc.; Board approval of any modifications

3. Community Reinvestment Act Review Training

Review the Financial Institution's CRA program to ensure compliance with CRA's Performance Standards for the Intermediate Small Bank or Large Bank. This review will include an examination of the 's public file and public notice. A review of the Financial Institution's geographic loan distribution reports or analysis will also be conducted to ensure proper delineation of the assessment area. Recommendations will be made to improve the Financial Institution's overall CRA program. If the Financial Institution has chosen to be reviewed as a Large Financial Institution, loan files will be sampled to ensure proper reporting.

Frequency of Review - Review will be conducted once within a 12 month cycle.

5

4. Fair Lending Review Training

Perform file comparisons of HMDA files or other identified file sampling regarding timing, action taken, pricing, documentation on the basis of race, sex, ethnicity, age, income, appraised value (At least 5 denied applications from any prohibited group and 20 approved applications from any control group will be sampled for a comparison of any approval/denial decisions. At least 5 approved applications from the prohibited basis group and 20 control group approvals will be sampled for a comparison of pricing, terms, and underwriting conditions.) Note: No single audit/review can be expected to evaluate every prohibited basis, every product, or every underwriting center. The Financial Institution will review these issues and a risk based scope will be mutually agreed upon.

Review of all posters, advertisement file Review of Loan Policy Review of how loan personnel are compensated (Pricing Policies, etc.) Complaint File Documentation of any Fair Lending Training Overview and Analysis of HMDA data Color-coded maps depicting HMDA applications, and funded loans vs. Assessment Area

Demographics and Income Level Review of appraisers, mortgage brokers used – contracts, agreements Review of purchased loans as compared to similar loans originated Review of Examiner Questionnaire Review of most recent Fair Lending/Compliance/CRA Audit by Federal Examiner

5. Deposit Operations Review Training

Review a random sample of each deposit product including: personal checking and savings, certificate of deposits, and club accounts. Examine advertisements, disclosures, statements, computer system generated notices and marketing materials to ensure regulatory compliance with the following regulations:

1. Truth in Savings, Regulation DD

2. Electronic Funds Transfer, Regulation E and Error Resolution Compliance

3. Expedited Funds Availability, Regulation CC

4. Reserve Requirements, Regulation D

5. Gramm Leach Bliley Act, Regulation P, Title12 Chapter III, Part 332

6. NOW account ownership requirements and limitations

7. Overdraft Program Guidance

A report will be prepared outlining the deficiencies noted during the review and recommendations will be made to improve regulatory compliance.

Frequency of Review - Review will be conducted once within a 12 month cycle.

6

6. Anti-Money Laundering/Bank Secrecy Act Program Independent Audit*

*This audit is required annually. Conduct a review of the Financial Institution's compliance with the Bank Secrecy Act and Anti-Money Laundering Program. Review the Financial Institution’s written policies and procedures. Perform an audit of CTRs, large currency transaction reporting, monetary instrument logs, suspicious activity reporting, and exemption procedures. The review will also cover record retention, internal controls, risk assessment and risk rating processes. Review will also include an examination of the Financial Institution’s compliance with applicable sections of USA PATRIOT Act and OFAC. The review will include the following:

1. Testing the overall integrity and effectiveness of management system and internal controls, and AML/BSA technical compliance.

2. Test and review the Financial Institution’s systems and procedures for identifying and reporting suspicious activity in high risk areas.

3. Test record retention requirements

4. Sample and review cash reports and CTRs filed

5. Assess employees’ knowledge of the BSA and Anti-money laundering regulations and procedures.

6. Assess adequacy, accuracy, and completeness of training programs.

7. Test compliance with the USA PATRIOT Act Section 326, Customer Identification Program including a review of account opening procedures and verification of customer’s identification for personal and business accounts. Review risk rating of customer base. Review proper identification and monitoring of high risk customers

8. Assess adequacy of compliance with the USA PATRIOT Act, Section 314 Special Information-Sharing.

9. Test OFAC compliance for new and existing deposit and loan accounts, check cashing for non-customers, Financial Institution check payees, and wire transfers incoming and outgoing.

10. Evaluate readiness and compliance with the 5th Pillar requirements relating to Customer Due Diligence, Knowing Your Customer, Beneficial Owner, etc.

11. Review Financial Institution’s Risk Assessment for proper coverage and due diligence

12. Hemp and Marijuana Banking risk identification

The Financial Institution is referred to the AML/BSA/OFAC Work Program provided by Cliber Compliance, LLC. A report will be prepared identifying all deficiencies and recommendations will be made to improve regulatory compliance.

Frequency of Review - Review will be conducted once within a 12 month cycle.

7

7. Anti-Money Laundering/Bank Secrecy Act/Customer Identification Program/OFAC Risk Assessment Evaluation/Preparation

Cliber Compliance, LLC will review the Institutional Risk Assessment for AML, BSA, CIP, OFAC, and related risks. The assigned risk ratings, mitigating factors, and exposure will be evaluated. The process for risk assessment and addressing of any risks prior to product or service change or implementation will be reviewed.

Frequency of Review - Review will be conducted once within a 12 month cycle.

8

8. Internet Compliance Review Training

Review the Financial Institution’s Internet Site to ensure compliance with the consumer protection laws and regulations. The review will ensure that the services and products advertised on the Financial Institution’s Web site comply with:

1. Electronic Funds Transfer, Regulation E

2. Truth in Savings, Regulation DD

3. Expedited Funds Availability, CC

4. Truth in Lending, Regulation Z

5. RESPA, Regulation X

6. ECOA, Regulation B

7. HMDA, Regulation C

8. Fair Housing Act

9. FDIC Advertisement Rules

10. Gramm Leach Bliley Act, Regulation P, Title12 Chapter III, Part 332

11. Interagency Guidance on Web Linking

12. Interagency Guidance on Non-Deposit Investment Products

13. Electronic Signature Act 14. UDAAP

Cliber Compliance, LLC will review disclosures, notices, statements, applications, and other supporting documentation made available to the consumers via the Internet Site. A report will be prepared identifying the deficiencies and recommendations will be made to improve the Financial Institution’s Internet Compliance Program. This review helps ensure that the Financial Institution’s Web Site complies with the advertisement and disclosure requirements of the above stated regulations. This review does not measure or evaluate the Financial Institution’s security systems or standards to safeguard customer records or information on the Web Site. Furthermore, this review does not evaluate or measure risk resulting from third party arrangements or links established through the Financial Institution’s Internet Site.

Frequency of Review - Review will be conducted once within a 12 month cycle.

9

9. Loan Compliance Training Loan Compliance Training will include a review of the following regulations:

1. Truth in Lending, Regulation Z and TRID requirements and the finalized amendments to TRID

2. RESPA, Regulation X

3. Mortgage Servicing Requirements

4. Flood Disaster Protection Act

5. Regulation O: Loans to Insiders

6. Small Creditor QM and ATR Requirements

7. Reg B Appraisal Notice and Copy Requirements, Notification Timing Requirements, monitoring information collection, application vs. inquiry

8. FCRA permissible purpose to obtain a credit report, Timely delivery of Risk Based Pricing Notice

9. HMDA

10. UDAAP Policy Requirements

11. CRA Requirements

12. Military Lending Act Requirements

The Loan Compliance training will be presented to all lending employees. Each employee will receive training materials which may be used as on-the-job instructional tools. Training will be documented for the Financial Institution's compliance file.

Frequency - Training will be conducted once within a 12 month cycle.

10. Fair Lending Training Fair Lending Training will include a review of the following regulations:

1. Equal Credit Opportunity Act, Regulation B

2. Home Mortgage Disclosure Act, Regulation C, if applicable to institution*

3. Fair Housing Act

4. Fair Credit Reporting Act and Fair and Accurate Credit Transaction Act (FACT Act)

5. Community Reinvestment Act (CRA)

6. Unfair or Deceptive Acts or Practices *HMDA training may be provided as a separate session in order to cover it in sufficient depth.

The Fair Lending training will be presented to all lending employees. Each employee will receive training materials which may be used as on-the-job instructional tools. Training will be documented for the Financial Institution's compliance file.

Frequency - Training will be conducted once within a 12 month cycle.

10

11. Deposit Compliance Training

The Deposit Compliance Training will include a review of the following regulations: 1. Truth in Savings, Regulation DD

2. Funds Availability, Regulation CC

3. Electronic Funds Transfer, Regulation E

4. Reserve Requirements, Regulation D

5. Fair Credit Reporting Act

6. NOW Account Ownership requirements and limitations

7. Overdraft Program Requirements

The Deposit Compliance training will be presented to all retail and operations employees. Each employee will receive training materials which may be used as on-the-job instructional tools. Training will be documented for the Financial Institution's compliance file.

Frequency - Training will be conducted once within a 12 month cycle.

11

12. BSA/AML/USA PATRIOT ACT/OFAC Training This training is required for new employees and for all associates annually.

This mandatory training will include the following topics:** 1. The Financial Institution’s written policies and procedures

2. The Financial Institution’s written CIP Program and CIP requirements

3. CTR filing requirements, exemption procedures, monetary instrument logs, funds transfer recordkeeping requirements

4. All other record retention requirements

5. The need for internal controls, risk assessment and risk rating processes.

6. SAR filing, SAR process, No SAR Needed file, reviewing and identifying suspicious activity and what to do with it

7. USA Patriot Act Section 314A requirements

8. Optional portions of the USA Patriot Act

9. Identification and monitoring requirements of high risk customers

10. OFAC compliance for new and existing deposit and loan accounts, check cashing for non-customers, Financial Institution check payees, and wire transfers incoming and outgoing.

11. The requirements of the 5th Pillar: CDD and Beneficial Ownership

12. Hemp and Marijuana Banking and identifying customers with this potential risk

The AML/BSA/USAP Patriot Act/OFAC training will be presented to all employees. Each employee will receive training materials which may be used as on-the-job instructional tools. Training will be documented for the Financial Institution's compliance file.

Frequency - Training will be conducted once within a 12 month cycle.

13. Privacy Review Training Privacy Training will cover the requirements of Gramm Leach Bliley Act, Regulation P,

Title12 Chapter III, Part 332 and the Financial Institution’s privacy policy.

14. Telephone and Compliance Support Provide the Financial Institution with support for compliance issues that may arise on a

day-to-day basis. Support for this service will be billed at the contract hourly rate. (Calls are billed in ½ hour intervals).

12

15. Advertisement and Web Site Review Training

Cliber Compliance, LLC will review the Financial Institution’s advertisements for the Financial Institution on an on-going basis. The advertisements may be provided in a hard copy format, faxed or emailed. Cliber Compliance, LLC will review the advertisement, advise the Financial Institution of changes in order to ensure regulatory compliance. A response will be given to the Financial Institution within a 24 hour period. (Reviews of advertisements are billed at the hourly rate.)

16. Meetings and Conferences

Occasionally the Financial Institution may request the services of Cliber Compliance, LLC to attend meetings. These meeting may be with Financial Institution regulators, audit committee members, Board of Directors or other managerial or support groups. These meetings will be billed at the hourly rate including travel time.

17. Newsletters

Periodic newsletters will be provided with new interpretations, hot topics, useful resources and other compliance information.

18. Tailored Audit, Review, Training , Policy Drafting, Compliance Consulting

Audits, Reviews, and Training can be tailored to fit specific requests and needs. Financial Institution-specific forms and procedures (existing or developed as part of the training or audit) can be incorporated. One half-day training session on TRID Compliance, completion of the Loan Estimate and the Closing Disclosure, the Service Provider Disclosure, the Acknowledgement of Intent to Proceed, a Chance of Circumstance and how it is justified and documented, etc.

19. Review and Implementation of Compliance Aspects of Software

13

Review of the compliance implications of software setup; Assistance in the initial setup of software and review of documents.

20. Cliber Compliance Connection

Email/call with compliance questions and receive a response within 24 hours

Unlimited 10 per month 3 per month

21. Integrated Disclosure Rule and Revisions/TRID and TRID Revisions Training/Testing/Policy Writing

Provide hands-on, practical training on the Integrated Disclosure requirements and the changes made to TRID. Perform testing on your loan software. Sample letters, lists, instructions will be provided.

22. Military Lending Act Training/Testing/Policy Writing

Provide hands-on, practical training on the new Military Lending Act requirements. Perform testing on your loan software. Sample checklists, instructions, and policy/procedures will be provided.

23. HMDA: Workshops/Training/Testing/Policy Writing/LAR Testing

Provide hands-on, practical training on and review HMDA. Review software requirements to ensure all systems are in compliance. Sample data collection lists, instructions, policy/procedures will be tailored to reflect offered products, practices, etc. Board and Senior Management overview of requirements. Test LAR data and compare to files.

14

24. Board Training

Overview, high-level review of the requirements and resources needed to comply with

Fair Lending Regulation O: Loans to Insiders BSA, AML, and OFAC Privacy Regulatory changes Topics of choice