Consent Order against Community Federal Savings Bank, Woodhaven, NY

UNITED STATES OF AMERICA DEPARTMENT OF THE TREASURY OFFICE OF THE COMPTROLLER OF THE CURRENCY ) In the Matter of: ) ) AA-ENF-2025-21 Community Federal Savings Bank ) Woodhaven, New York ) CONSENT ORDER WHEREAS, the Office of the Comptroller of the Currency (“OCC”) has supervisory authority over Community Federal Savings Bank, Woodhaven, New York (“Bank”); WHEREAS, the OCC intends to initiate cease and desist proceedings against the Bank pursuant to 12 U.S.C. § 1818(b), through the issuance of a Notice of Charges, for deficiencies in its Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) compliance program which resulted in violations of law or regulation, including 12 C.F.R. § 21.21 (BSA/AML program violation), 12 C.F.R. § 163.180(d) (suspicious activity reporting violation), and 31 C.F.R. § 1010.520(b)(3) (violation of information sharing requirement under 314(a) of the USA PATRIOT Act) (see also 31 U.S.C. § 5318(h)(1) and 31 C.F.R. § 1020.210(a); 31 U.S.C. § 5318(g) and 31 C.F.R. § 1020.320; 31 U.S.C. § 5311 note); WHEREAS, the Bank has begun taking some corrective actions and has articulated commitments to remedy the deficiencies identified by the OCC; WHEREAS, the findings in this Consent Order (“Order”) are based on examination of the Bank’s BSA/AML compliance program as a whole, and are based on concerns largely unrelated to customers involved in digital assets activities; WHEREAS, in the interest of cooperation and to avoid additional costs associated with administrative and judicial proceedings with respect to the above matter, the Bank, by and 1 through its duly elected and acting Board of Directors (“Board”), consents to the issuance of this Order, by the OCC through the duly authorized representative of the Comptroller of the Currency (“Comptroller”); and NOW, THEREFORE, pursuant to the authority vested in the OCC by Section 8(b) of the Federal Deposit Insurance Act, as amended, 12 U.S.C. § 1818(b), the OCC hereby orders that: ARTICLE I JURISDICTION (1) The Bank is an “insured depository institution” as that term is defined in 12 U.S.C. § 1813(c)(2). (2) The Bank is a Federal savings association within the meaning of 12 U.S.C. § 1813(q)(1)(C), and is chartered and examined by the OCC. See 12 U.S.C. §§ 1461 et seq., 5412(b)(2)(B). (3) The OCC is the “appropriate Federal banking agency” as that term is defined in 12 U.S.C. § 1813(q) and is therefore authorized to initiate and maintain this cease and desist action against the Bank pursuant to 12 U.S.C. § 1818(b). ARTICLE II COMPTROLLER’S FINDINGS The Comptroller finds, and the Bank neither admits nor denies, the following: (1) Since 2020, the Bank has significantly grown its payment processing line, relative to its size, resulting in significant annual wire and ACH activity, including cross-border activity involving foreign financial institutions. (2) Despite the growing volume of transactions flowing through its payment processing line and the attendant risks, the Bank has failed to develop and maintain controls and risk management processes commensurate with its risk and growth. 2 (3) The Bank’s suspicious activity monitoring processes are deficient for identifying, investigating, and reporting potentially suspicious activity. The Bank’s automated suspicious activity alerting system’s filtering criteria and thresholds had not been adequately tuned to the risk profile of the Bank’s payment processing line, the significant increases in higher risk products and services, and international exposures. The Bank utilized an automated alert triage system, but several deficiencies in its logic, data, and methodology resulted in the system auto-closing alerts that should have been escalated for further review. As a result, the system auto-closed a very high percentage of all ingested alerts. (4) The Bank’s customer due diligence program (“CDD”) is ineffective. As a result, the Bank does not understand the nature of certain of its customers’ businesses and the purpose of the transactions in the payment processing line, including risks related to foreign financial institutions. The Bank failed to effectively consider risks related to payment processing line customers, including the volume of cross-border transactions. Additionally, in various instances, the Bank failed to determine whether it had correspondent accounts for foreign financial institutions to ensure compliance with due diligence requirements under section 312 of the USA PATRIOT Act. (5) The Bank also had weak independent testing for BSA/AML. For example, the Bank’s internal auditor failed to identify BSA/AML program weaknesses. The Bank’s internal auditor also failed to scope in its audit work and effectively test high-risk areas of the Bank’s BSA/AML program. (6) As a result, the Bank has not established and maintained a reasonably designed BSA/AML compliance program (“BSA/AML Program”) that adequately covers the required BSA/AML Program components. Deficiencies include: (i) systemic internal controls breakdowns, (ii) weak independent testing, and (iii) weak BSA staffing. These deficiencies 3 resulted in a BSA/AML Program violation under 12 C.F.R. § 21.21 (see also 31 U.S.C. §§ 5318(h)(1), 31 C.F.R. § 1020.210(a)) and additional violations of regulations, including 31 C.F.R. § 1010.520(b)(3) (see also 31 U.S.C. § 5311 note) and 12 C.F.R. § 163.180(d) (see also 31 U.S.C. § 5318(g), 31 C.F.R. § 1020.320). ARTICLE III COMPLIANCE COMMITTEE (1) Within fifteen (15) days of the date of this Order, the Board shall appoint a Compliance Committee of at least three (3) members, of which a majority shall be directors who are not employees or officers of the Bank or any of its subsidiaries or affiliates. The Board shall submit in writing to the Assistant Deputy Comptroller the names of the members of the Compliance Committee within ten (10) days of their appointment. In the event of a change of the membership, the Board shall submit in writing to the Assistant Deputy Comptroller within ten (10) days the name of any new or resigning committee member. The Compliance Committee shall monitor and oversee the Bank’s compliance with the provisions of this Order. The Compliance Committee shall meet at least quarterly, maintain detailed minutes of its meetings, and make those minutes available to the OCC. ARTICLE IV ACTION PLAN (1) Within ninety (90) days of this Order, the Bank shall submit to the Assistant Deputy Comptroller for review and prior written determination of no supervisory objection an acceptable written plan that details the remedial actions necessary to achieve and maintain 4 compliance with the BSA1 and that incorporates the substantive requirements of Articles V through X of this Order (“Action Plan”). (2) The Action Plan shall include, at a minimum: (a) a description of the corrective actions needed to achieve compliance with Articles V through X of this Order; (b) the specific Article(s) and associated paragraph(s) (and, if applicable, subparagraph(s)) that each corrective action will address; (c) reasonable and well-supported timelines that identify the completion dates for all corrective actions required by Articles V through X of this Order; and (d) the person(s) responsible for the completion of the corrective actions required by Articles V through X of this Order. (3) Upon receipt of the Assistant Deputy Comptroller’s written determination of no supervisory objection to the Action Plan the Board shall adopt, and Bank management shall immediately implement and thereafter ensure adherence to the Action Plan, including the timelines set forth within the Action Plan. The Board shall review the effectiveness of the Action Plan at least annually, and more frequently if necessary, or if required by the OCC in writing, and shall amend the Action Plan as needed or as directed by the OCC. (4) Where the Bank considers modifications to the Action Plan as appropriate, the Bank shall submit a revised Action Plan containing the proposed modifications to the Assistant Deputy Comptroller for prior written determination of no supervisory objection. Upon receipt of a written 1 The BSA, codified at 12 U.S.C. §§ 1829b, 12 U.S.C. 1951-1960, 31 U.S.C. 5311-5314, 5316-5336, establishes program, recordkeeping and reporting requirements for national banks, federal savings associations, federal branches and agencies of foreign banks. References to the “BSA” within this Order include references to the relevant statutes as well as 12 C.F.R. §§ 21.11 and 21.21 and 31 C.F.R. Chapter X. 5 determination of no supervisory objection from the Assistant Deputy Comptroller, the Board shall timely adopt the revised Action Plan. Bank management, shall immediately implement and thereafter ensure adherence to the revised Action Plan, including the timelines set forth within the revised Action Plan. ARTICLE V BSA PROGRAM ASSESSMENT (1) Within the time periods specified in the Action Plan for which the Assistant Deputy Comptroller has provided no supervisory objection, the Bank shall submit to the Assistant Deputy Comptroller the engagement contracts with and work plans of the third-party consultant(s) (“Program Consultant”) conducting a comprehensive, end-to-end review and assessment of the Bank’s BSA/AML Program (“BSA Program Assessment”). (2) The BSA Program Assessment must include a comprehensive, end-to-end review and assessment of the Bank’s BSA Program, including all components of the program, to identify any deficiencies that the Bank needs to address in order to achieve and maintain compliance with the BSA and to determine whether the Bank’s BSA Program is commensurate with the Bank’s size, complexity, and risk profile. (3) Any subsequent amendments to the BSA Program Assessment shall be provided to the Assistant Deputy Comptroller. (4) The Program Consultant shall provide the Board with a written report that includes the Program Consultant’s conclusions about the effectiveness of each component of the BSA Program. The written report shall identify any deficiencies the Bank needs to address in order to achieve and maintain compliance with the BSA and shall include the Program Consultant’s assessment of whether the Bank’s BSA Program is commensurate with the Bank’s size, complexity, and risk profile. 6 (5) When providing its written report to the Bank, the Program Consultant shall promptly provide a copy of the report to the Assistant Deputy Comptroller. Any presentations made to the Bank regarding the report, or any preliminary or final findings or recommendations contained therein, shall promptly be made to the Assistant Deputy Comptroller, and a copy of any presentation materials shall promptly be provided to the Assistant Deputy Comptroller. All supporting materials and work papers associated with the BSA Program Assessment, as well as personnel of the Program Consultant, shall be made available to the OCC upon written request. ARTICLE VI BSA/AML INTERNAL CONTROLS (1) Within the time periods specified in the Action Plan for which the Assistant Deputy Comptroller has provided no supervisory objection, the Bank shall develop, implement, and maintain an acceptable system of internal controls to identify and control the risks associated with money laundering, terrorist financing, and other illicit financial activity and to achieve and maintain ongoing compliance with the BSA, including all recordkeeping and reporting requirements such as those in 12 C.F.R. § 163.180(d) and 31 C.F.R. § 1010.520 (“BSA/AML Internal Controls Program”). (2) The BSA/AML Internal Controls Program shall include a written institution-wide, ongoing BSA/AML Risk Assessment that reflects a comprehensive analysis of the Bank’s money laundering, terrorist financing, and other illicit financial activity risk, strategies to control those risks, and methods to limit any identified vulnerabilities. The Board shall ensure that management updates the BSA/AML Risk Assessment on a periodic basis, commensurate with the Bank’s BSA/AML risk profile, or whenever there is a significant change in BSA/AML risk within the Bank or its lines of businesses. The BSA/AML Risk Assessment shall: 7 (a) assess the impact of Bank activities, product lines, and third-party relationships on the Bank’s BSA/AML risk profile based on appropriate data and information, including the Bank’s current, or subsequently proposed, products, services, customer types, customer risk ratings, transaction types and volumes, and geographies served; and (b) identify and evaluate the adequacy of internal controls and assess the Bank’s residual BSA/AML risk profile, including whether it aligns with the Bank’s Board-approved BSA/AML risk appetite. (3) The BSA/AML Internal Controls Program shall include a written CDD program that ensures the Bank complies with all applicable CDD requirements and that is commensurate with the Bank’s money laundering, terrorist financing, and other illicit financial activity risk (“CDD Program”). The CDD Program shall: (a) include clear definitions of customer risk categories and an effective methodology for assigning a customer’s risk category; (b) ensure ongoing monitoring is conducted to maintain and update customer information and to identify and report suspicious activity, including periodically reviewing all customers and accounts that exhibit higher-risk characteristics for money laundering, terrorist financing, or other illicit activity with documented analysis of transaction activity and all other significant information in the file; (c) ensure the timely identification of correspondent accounts for foreign financial institutions and the Bank’s compliance with requirements of 12 C.F.R. § 1010.610 and section 312 of the USA PATRIOT Act; 8 (d) ensure that management’s and staff’s respective responsibilities for establishing and revising customer risk profiles are clearly defined; and (e) ensure that missing or inaccurate CDD information is timely identified and remediated. (4) The BSA/AML Internal Controls Program shall include a written program to ensure that the Bank timely screen Bank files, records, and data sources to identify and report accounts or transactions in compliance with section 314(a) of the USA PATRIOT Act and 31 C.F.R. § 1010.520 (“Section 314(a) Program”). (5) The Board shall review the effectiveness of the Bank’s BSA/AML Internal Controls Program, including the BSA/AML Risk Assessment, CDD Program, and 314(a) Program at least annually, or more frequently as warranted, and amend the Bank’s BSA/AML Internal Controls Program as needed. ARTICLE VII SUSPICIOUS ACTIVITY IDENTIFICATION, EVALUATION, AND REPORTING (1) Within the time periods specified in the Action Plan for which the Assistant Deputy Comptroller has provided no supervisory objection, Bank management shall develop, implement, and adhere to a risk-based suspicious activity identification, evaluation, and reporting program consistent with 12 C.F.R. § 163.180(d) (“Suspicious Activity Review Program”). (2) The Bank’s Suspicious Activity Review Program shall ensure that the Bank identifies, evaluates, and reports suspicious activity, including known or suspected violations of Federal law, violations of the BSA, or suspicious transactions related to potential money laundering, terrorist financing, or other illicit financial activity across all lines of business. Accordingly, the Suspicious Activity Review Program shall ensure that the Bank: 9 (a) has monitoring systems that effectively identify potentially suspicious activity, including by applying appropriate rules, thresholds, and filters commensurate with the Bank’s money laundering, terrorist financing, and other illicit financial activity risk profile that include: (i) effective controls, as appropriate, to ensure the Suspicious Activity Report Program is functioning as intended including when the Bank establishes a new product or service or enters into a new line of business; and (ii) prompt reporting and remediation of deficiencies. (b) effectively and timely dispositions alerts, including appropriate consideration of CDD information when conducting alert reviews and suspicious activity investigations; (c) files Suspicious Activity Reports (SARs) timely, completely, and accurately, with a sufficient description of the suspicious activity and the basis for filing; and (d) promptly remediates any backlogs in the Suspicious Activity Review Program, including appropriate reporting to the Board and management. (3) The Board shall review the effectiveness of the Bank’s Suspicious Activity Review Program at least annually, and more frequently if necessary, and amend the Bank’s Suspicious Activity Review Program as needed. ARTICLE VIII SUSPICIOUS ACTIVITY REVIEW LOOK-BACK (1) Within the time periods specified in the Action Plan for which the Assistant Deputy Comptroller has provided no supervisory objection, the Bank shall submit to the 10 Assistant Deputy Comptroller, for review and prior written determination of no supervisory objection, the name, qualifications, and engagement terms of a proposed independent, third- party consultant (“SAR Look-Back Consultant”) to conduct a review and provide a written report on the Bank’s suspicious activity monitoring, investigation, decisioning, and reporting (“SAR Look-Back”). The Bank’s submission shall address the due diligence that the Bank engaged in to identify and select the SAR Look-Back Consultant. The submission shall include a methodology, scope and timeline for completing the SAR Look-Back. (2) The SAR Look-Back shall determine whether SARs should be filed for any previously unreported suspicious activity and to review the quality and accuracy of previous SAR filings to determine whether corrections or amendments are necessary to ensure that the suspicious activity identified was comprehensively and accurately reported in accordance with 12 C.F.R. § 163.180(d). (3) Following receipt of the Assistant Deputy Comptroller’s written determinations of no supervisory objection to the proposed SAR Look-Back Consultant and to the methodology, scope and timeline for completing the consultant’s review, the Board shall enter into a written agreement with the SAR Look-Back Consultant, consistent with the requirements of this Article, to conduct the SAR Look-Back. (4) Within sixty (60) days of completing the SAR Look-Back, the SAR Look- Back Consultant shall provide the Board with a written report that addresses: (a) the number and types of customers, accounts, and transactions that the SAR Look-Back Consultant reviewed; (b) a list of the customers, accounts, and transactions that the SAR Look-Back Consultant concluded require additional investigation; 11 (c) a list of any SARs that the SAR Look-Back Consultant has recommended that the Bank should file for any previously unreported suspicious activity; (d) a list of existing SARs that the SAR Look-Back Consultant has recommended the Bank should correct or amend; and (e) a list of customers, accounts, and transactions where, contrary to the SAR Look-Back Consultant’s recommendation, the Bank determined not to file a SAR or to correct or amend existing SAR filings, and the reasons provided for that decision. (5) Upon receiving the written report, the Board shall also ensure that a copy of the written report of the findings and recommendations from the SAR Look-Back is promptly provided to the Assistant Deputy Comptroller. All supporting materials and work papers associated with the SAR Look-Back, as well as personnel of the SAR Look-Back Consultant, shall be made available to the OCC upon written request. (6) Based upon the results of the SAR Look-Back or the BSA Program Assessment, the OCC, at its sole discretion, may expand the scope of the SAR Look-Back, either in terms of the subjects to be addressed, the time period(s) to be covered, or both (“Supplemental SAR Look-Back”). A Supplemental SAR Look-Back shall be carried out in a manner consistent with other requirements of this Article. ARTICLE IX BSA/AML INDEPENDENT TESTING (1) Within the time periods specified in the Action Plan for which the Assistant Deputy Comptroller has provided no supervisory objection, Bank management shall develop, implement, and adhere to an acceptable BSA/AML independent testing program (“BSA/AML 12 Audit Program”) that complies with the requirements of 12 C.F.R. 21.21(d)(2). The BSA/AML Audit Program shall test the Bank’s compliance with the BSA and the overall adequacy of the Bank’s BSA/AML Program to ensure it is commensurate with the Bank’s money laundering, terrorist financing, and other illicit financial activity risk. (2) The Board shall adopt and Bank management shall implement and thereafter ensure adherence to the Bank’s BSA/AML Audit Program. The Board shall review the effectiveness of the Bank’s BSA/AML Audit Program at least annually, and more frequently if necessary, and amend the Bank’s BSA/AML Audit Program as needed. (3) All deficiencies in BSA/AML processes and controls identified through the BSA/AML Audit Program shall be promptly reported to the Bank’s Board or Audit Committee, and to senior management. The Board or Audit Committee shall ensure that Bank management takes prompt action to remedy deficiencies cited in audit reports and that the BSA/AML Audit function reviews and validates corrective action promptly. ARTICLE X BSA/AML OFFICER AND STAFFING (1) In the event that the Bank’s BSA Officer position is vacated, the Board shall ensure that the Bank promptly retains a new BSA Officer who is qualified and vested with sufficient independence, authority, and resources to fulfill the duties and responsibilities of the position and ensure compliance with the BSA. The BSA Officer shall provide timely and accurate periodic reporting to the Board about the status of the Bank’s BSA/AML Program, including compliance with the BSA, this Order, and the Action Plan. (2) The Bank shall employ sufficient staff with appropriate training, skills and expertise needed to support the BSA Officer and the Bank’s BSA/AML Program and that such 13 staff is vested with sufficient authority and resources to fulfill their respective duties and responsibilities. (3) Prior to appointing a new BSA Officer, the Board shall submit to the Assistant Deputy Comptroller the following information for a prior written determination of no supervisory objection to appoint the individual as BSA Officer: (a) the information sought in the “Changes in Directors and Senior Executive Officers” and “Background Investigations” booklets of the Comptroller’s Licensing Manual, together with a legible fingerprint card for the proposed BSA Officer; and (b) a written statement of the Board’s reasons for selecting the proposed BSA Officer. (4) A prior written determination of no supervisory objection to the proposed individual shall not constitute an approval or endorsement of the proposed individual. In addition, the requirement to submit information and the prior written no supervisory objection provisions of this paragraph are based on the authority of 12 U.S.C. § 1818(b)(6)(E) and do not require the Assistant Deputy Comptroller to complete the review and act on any such information within sixty (60) days. ARTICLE XI GENERAL BOARD RESPONSIBILITIES (1) The Board, directly or through one of its committees, shall ensure that the Bank has timely adopted and implemented all corrective actions required by this Order, and shall verify that the Bank adheres to the corrective actions and they are effective in addressing the Bank’s violations that resulted in this Order. The Board shall hold Bank management and 14 personnel accountable for executing their duties and responsibilities pertaining to or resulting from this Order. ARTICLE XII WAIVERS (1) The Bank, by executing and consenting to this Order, waives: (a) any and all rights to the issuance of a Notice of Charges pursuant to 12 U.S.C. § 1818; (b) any and all procedural rights available in connection with the issuance of this Order; (c) any and all rights to a hearing and a final agency decision pursuant to 12 U.S.C. § 1818 and 12 C.F.R. Part 19; (d) any and all rights to seek any type of administrative or judicial review of this Order; (e) any and all claims for fees, costs, or expenses against the OCC, or any of its officers, employees, or agents related in any way to this enforcement matter or this Order, whether arising under common law or under the terms of any statute, including, but not limited to, the Equal Access to Justice Act, 5 U.S.C. § 504 and 28 U.S.C. § 2412; (f) any and all rights to assert these proceedings, the consent to and/or the issuance of this Order, as the basis for a claim of double jeopardy in any pending or future proceedings brought by the United States Department of Justice or any other governmental entity; and (g) any and all rights to challenge or contest the validity of this Order. 15 ARTICLE XIII OTHER PROVISIONS (1) As a result of this Order, the Bank is not: (a) precluded from being treated as an “eligible savings association” for the purposes of 12 C.F.R. Part 5, unless the Bank fails to meet any of the requirements contained in subparagraphs (1)-(4) of 12 C.F.R. § 5.3, Definitions, eligible savings association, or is otherwise informed in writing by the OCC; and (b) subject to the restrictions in 12 C.F.R. § 5.51 or the limitations on golden parachute payments set forth in 12 C.F.R. Part 359, unless the Bank is otherwise subject to such requirements pursuant to 12 C.F.R. § 5.51(c)(7)(i) and (iii). (2) This Order supersedes all prior OCC communications issued pursuant to 12 C.F.R. §§ 5.3 and 5.51(c)(7)(ii). ARTICLE XIV CLOSING (1) This Order is a settlement of the cease and desist proceedings against the Bank contemplated by the OCC, based on the violations of law described in the Comptroller’s Findings set forth in Article II of this Order. The OCC releases and discharges the Bank from all potential liability for a cease and desist order that has been or might have been asserted by the OCC based on the violations described in Article II of this Order, to the extent known to the OCC as of the effective date of this Order. The OCC expressly reserves its right to assess civil money penalties or take other enforcement actions if the OCC determines that the Bank has 16 continued, or failed to correct, the violations described in Article II of this Order or that the Bank otherwise is violating or has violated this Order. (2) Nothing in this Order shall prevent the OCC from: (a) instituting enforcement actions other than a cease and desist order against the Bank based on the Comptroller’s Findings set forth in Article II of this Order; (b) instituting enforcement actions against the Bank based on any other findings, including if the OCC determines that the Bank has continued, or failed to correct, the violations described in Article II of this Order or that the Bank otherwise is violating or has violated this Order; (c) instituting enforcement actions against institution-affiliated parties (as defined by 12 U.S.C. § 1813(u)) based on the Comptroller’s Findings set forth in Article II of this Order, or any other findings; or (d) utilizing the Comptroller’s Findings set forth in Article II of this Order in future enforcement actions against the Bank or its institution-affiliated parties to establish a pattern or the continuation of a pattern. (3) Nothing in this Order is a release, discharge, compromise, settlement, dismissal, or resolution of any actions, or in any way affects any actions that may be or have been brought by any other representative of the United States or an agency thereof, including, without limitation, the United States Department of Justice. (4) This Order is: (a) a “cease-and-desist order issued upon consent” within the meaning of 12 U.S.C. § 1818(b); 17 (b) a “cease-and-desist order which has become final” within the meaning of 12 U.S.C. § 1818(e); (c) an “order issued with the consent of the depository institution” within the meaning of 12 U.S.C. § 1818(h)(2); (d) an “effective and outstanding . . . order” within the meaning of 12 U.S.C. § 1818(i)(1); and (e) a “final order” within the meaning of 12 U.S.C. § 1818(i)(2) and (u). (5) This Order is effective upon its issuance by the OCC, through the Comptroller’s duly authorized representative. Except as otherwise expressly provided herein, all references to “days” in this Order shall mean calendar days and the computation of any period of time imposed by this Order shall not include the date of the act or event that commences the period of time. (6) The provisions of this Order shall remain effective except to the extent that, and until such time as, such provisions are amended, suspended, waived, or terminated in writing by the OCC, through the Comptroller’s duly authorized representative. If the Bank seeks an extension, amendment, suspension, waiver, or termination of any provision of this Order, the Board or a Board-designee shall submit a written request to the Assistant Deputy Comptroller asking for the desired relief. Any request submitted pursuant to this paragraph shall include a statement setting forth in detail the circumstances that warrant the desired relief or prevent the Bank from complying with the relevant provision(s) of the Order and shall be accompanied by relevant supporting documentation. The OCC’s decision concerning a request submitted pursuant to this paragraph, which will be communicated to the Board in writing, is final and not subject to further review. 18 (7) The Bank will not be deemed to be in compliance with this Order until it has adopted, implemented, and adhered to all of the corrective actions set forth in each Article of this Order. (8) This Order is not a contract binding on the United States, the United States Treasury Department, the OCC, or any officer, employee, or agent of the OCC and neither the Bank nor the OCC intends this Order to be a contract. (9) Each citation, issuance, or guidance referenced in this Order includes any subsequent citation, issuance, or guidance that replaces, supersedes, amends, or revises the referenced cited citation, issuance, or guidance. (10) No separate promise or inducement of any kind has been made by the OCC, or by its officers, employees, or agents, to cause or induce the Bank to consent to the issuance of this Order. (11) All reports, plans, or programs submitted to the OCC pursuant to this Order shall be forwarded, by overnight mail or via email, to the following: Assistant Deputy Comptroller with a copy to: the Examiner-in-Charge (12) The terms of this Order, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements, or prior arrangements between the parties, whether oral or written. 19 IN TESTIMONY WHEREOF, the undersigned, authorized by the Comptroller as his duly authorized representative, has hereunto set his signature on behalf of the Comptroller. //s/ Digitally Signed, Dated: 2026.04.24 Aaron Liechenstein Date Assistant Deputy Comptroller Novel Bank Supervision IN TESTIMONY WHEREOF, the undersigned, as the duly elected and acting Board of Directors of Community Federal Savings Bank have hereunto set their signatures on behalf of the Bank. //s// Digitally Signed 4/24/2026 Charles Crawford Date //s// Digitally Signed 4/24/2026 Elsa De La Garza Date //s// Digitally Signed 4/24/2026 Syd Ghermezian Date /s/ 4/24/2026 Martin Hyman Date /s/ 4/24/2026 Samson Lim Date //s// Digitally Signed 4/24/2026 Ira Perlmuter Date //s// Digitally Signed 4/24/2026 Pete Chiccino Date 20