Contract analysis

Section 1.1 — Definitions. As used in this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Addendum shall have the meanings ascribed to them in the Program Agreement. "Addendum Effective Date" means the date of execution of this Addendum by both Parties, as set forth on the signature page hereof. "Applicable Law" means all federal and state laws, r

Section 1.2 — Interpretation. In this Addendum, unless the context otherwise requires: (a) the singular includes the plural and vice versa; (b) references to "Articles," "Sections," and "Exhibits" are to Articles, Sections, and Exhibits of this Addendum; (c) the words "include," "includes," and "including" are deemed to be followed by the phrase "without limitation"; (d) the words "herein," "hereof," "hereby," "hereu

ARTICLE II — BSA/AML COMPLIANCE OBLIGATIONS

Section 2.1 — General Compliance Obligation. The Partner acknowledges and agrees that the Bank, as the chartered national banking association, bears ultimate regulatory responsibility for compliance with the Bank Secrecy Act, its implementing regulations, OFAC sanctions requirements, and all other Applicable Law with respect to all End Users and all Partner Channel Transactions. The Partner's activities under the Pro

Section 2.2 — Partner BSA/AML Policies and Procedures. (a) The Partner shall develop, maintain, implement, and enforce its own written BSA/AML and OFAC compliance policies and procedures that are, in all material respects, no less stringent than the Bank's corresponding policies and procedures as provided to the Partner by the Bank and updated from time to time. The Bank shall make its current BSA/AML and OFAC polici

Section 2.3 — Partner Compliance Personnel. (a) The Partner shall designate a qualified compliance officer who shall be responsible for overseeing the Partner's BSA/AML and OFAC compliance obligations under this Addendum and the Program Agreement (the "Partner Compliance Officer"). The Partner Compliance Officer shall possess education, training, and experience commensurate with the complexity, volume, and risk profi

Section 2.4 — Partner Training. (a) The Partner shall ensure that all Partner personnel who are involved in, or who have responsibility for, End User onboarding, transaction processing, customer service, complaint handling, fraud prevention, and compliance functions receive initial and ongoing BSA/AML and OFAC training that is consistent with the Bank's enterprise-wide training standards as communicated to the Partne

ARTICLE III — CUSTOMER DUE DILIGENCE AND ENHANCED DUE DILIGENCE

Section 3.1 — CDD Obligations. (a) The Bank retains ultimate responsibility for performing and ensuring the adequacy of Customer Due Diligence on all End Users, including compliance with the Customer Identification Program ("CIP") requirements under 31 C.F.R. § 1020.220 and the beneficial ownership requirements for legal entity customers under 31 C.F.R. § 1010.230 (the "Beneficial Ownership Rule"). Nothing in this Ad

Section 3.2 — Enhanced Due Diligence for High-Risk End Users. (a) The Partner shall cooperate fully with the Bank in identifying and flagging End Users who meet the Bank's criteria for Enhanced Due Diligence, as set forth in the Bank's EDD policies and procedures and as communicated to the Partner from time to time. Categories of End Users that may be subject to EDD include, without limitation: (i) politically expose

Section 3.3 — Ongoing Monitoring of End User Information. (a) The Partner shall implement and maintain procedures to ensure that End User information is kept current and accurate throughout the life of the End User's account or relationship. Such procedures shall include periodic refresh of CDD and EDD documentation at intervals specified by the Bank, which intervals may vary based on the End User's risk rating. (b)

Section 3.4 — Risk Rating Cooperation. (a) The Partner shall cooperate with the Bank in assigning and maintaining risk ratings for all End Users, using the Bank's risk rating methodology as provided to the Partner from time to time. The Bank shall retain sole discretion and authority over the assignment and modification of End User risk ratings. (b) The Partner shall provide to the Bank all data and information reaso

ARTICLE IV — OFAC SANCTIONS SCREENING

Section 4.1 — Bank's OFAC Screening Obligation. (a) The Bank shall screen one hundred percent (100%) of Partner Channel Transactions and all End Users and their associated parties (including beneficial owners, originators, and beneficiaries) against the OFAC Sanctions Lists. The Bank shall maintain and operate sanctions screening systems and processes reasonably designed to ensure that no Partner Channel Transaction

Section 4.2 — Partner Data Obligations for OFAC Screening. (a) The Partner shall transmit to the Bank, in the data format and through the technical interfaces specified by the Bank in Exhibit B, all transaction data and End User identifying information necessary for the Bank to perform complete, accurate, and timely OFAC screening of all Partner Channel Transactions and End Users. Such data shall include, at a minimu

Section 4.3 — OFAC Hit Disposition and blocking. (a) If the Bank identifies a potential OFAC match (a "true positive") involving a Partner Channel Transaction or an End User, the Bank shall block, reject, or freeze the relevant transaction or account in accordance with OFAC regulations, including the requirement to file a blocked property report with OFAC within ten (10) business days of blocking. (b) The Partner sha

Section 4.4 — OFAC Screening Remediation Cooperation. (a) The Partner acknowledges the Bank's obligation under the Consent Order and the Remediation Action Plan to achieve full OFAC screening operationalization for all BaaS channels by November 1, 2025. (b) The Partner shall cooperate fully with the Bank in implementing any system changes, data format modifications, API integrations, process adjustments, or other tec

ARTICLE V — TRANSACTION MONITORING AND SUSPICIOUS ACTIVITY REPORTING

Section 5.1 — Bank's Transaction Monitoring. (a) The Bank shall maintain and operate a Transaction Monitoring System to monitor all Partner Channel Transactions for potentially suspicious activity, in accordance with the Bank's BSA/AML Program and Applicable Law. The Bank's TMS is currently being upgraded to Veridian TMS version 10.0, with user acceptance testing completion targeted for August 1, 2025, and full produ

Section 5.2 — Partner Data Transmission for Transaction Monitoring. (a) The Partner shall transmit to the Bank complete, accurate, and timely transaction data for all Partner Channel Transactions in the format and at the frequency specified in Exhibit B. Data transmissions shall be made through the secure interfaces and using the protocols designated by the Bank, and shall include all data fields required by the Bank

Section 5.3 — SAR Cooperation. (a) The Bank is solely responsible for determining whether to file a Suspicious Activity Report with FinCEN in connection with any End User or Partner Channel Transaction. The decision to file, or to decline to file, a SAR rests exclusively with the Bank and may not be delegated to the Partner or any other third party. (b) Notwithstanding the Bank's sole responsibility for SAR filing de

Section 5.4 — SAR Backlog Remediation Cooperation. (a) The Partner shall provide prioritized support to the Bank in connection with the Bank's clearance of a backlog of approximately 2,400 unreviewed suspicious activity alerts that were outstanding as of September 2024, as identified in the Consent Order. The Bank's target clearance date for the alert backlog is June 30, 2025. (b) Such support shall include expedited

Section 5.5 — Suspicious Activity Escalation by Partner. (a) The Partner shall promptly escalate to the Bank's BSA Officer any activity, transaction, pattern, or circumstance that the Partner identifies or suspects may constitute money laundering, terrorist financing, fraud, structuring, sanctions evasion, or other financial crime involving an End User or Partner Channel Transaction. (b) Such escalation shall occur w

ARTICLE VI — DATA SHARING AND INFORMATION REQUIREMENTS

Section 6.1 — General Data Sharing Obligation. (a) The Partner shall provide the Bank with access to all data, records, documents, and information in the Partner's possession or control that is reasonably necessary for the Bank to fulfill its obligations under the BSA/AML Program, OFAC sanctions compliance requirements, CDD/EDD policies, SAR filing obligations, Currency Transaction Report ("CTR") filing obligations,

Section 6.2 — Real-Time and Periodic Reporting. The Partner shall provide the Bank with the following data and reports: (a) Real-Time Transaction Data Feeds. Real-time data feeds for all Partner Channel Transactions, transmitted through the secure interfaces and in the data formats specified in Exhibit B, sufficient to enable the Bank to perform OFAC screening and transaction monitoring on a real-time or near-real-ti

Section 6.3 — Data Quality Standards. (a) The Partner represents and warrants that all data provided to the Bank pursuant to this Addendum shall be complete, accurate, and timely. "Complete" means that all required data fields are populated with the specified information. "Accurate" means that the data is correct, corresponds to the underlying records, and has been validated through appropriate quality controls. "Tim

Section 6.4 — Record Retention. (a) The Partner shall retain all records related to End Users and Partner Channel Transactions, including without limitation onboarding records, CDD/EDD documentation, transaction records, communications, compliance records, and audit logs, for a minimum of five (5) years from the date of the transaction or the date the End User's account is closed, whichever is later, or such longer p

ARTICLE VII — AUDIT, EXAMINATION, AND INSPECTION RIGHTS

Section 7.1 — Bank Audit Rights. (a) The Bank and its authorized agents, including Calderwood & Harkness LLP as outside regulatory counsel, Caldera & Pope LLP as external auditor and independent BSA/AML testing firm, the Bank's internal audit department, and any successor or replacement audit, testing, or advisory firms engaged by the Bank, shall have the right to audit, examine, and inspect the Partner's books, reco

Section 7.2 — Independent Consultant Access. (a) The Partner shall provide full cooperation and access to Thornfield Consulting Group LLC, the OCC-mandated independent consultant (engagement reference TCG-BRB-2025-001), as reasonably necessary for Thornfield to fulfill its assessment, validation, and reporting functions under the Consent Order. (b) Such cooperation and access shall include, without limitation: (i) ac

Section 7.3 — Regulatory Examination Access. (a) The Partner acknowledges and agrees that the OCC, FinCEN, OFAC, the FDIC, and other federal and state regulatory authorities have the right, pursuant to Applicable Law and the Bank's charter, to examine the Partner's books, records, systems, and activities to the extent related to the Program Agreement, this Addendum, and the Bank's compliance obligations. Such examina

Section 7.4 — Internal Audit Cooperation. The Partner shall cooperate fully with the Bank's Head of Internal Audit, Derek Ballard, and the Bank's internal audit department in connection with any internal audit of the BaaS program, the Bank's BSA/AML compliance functions, or the Partner's compliance with this Addendum. Such cooperation shall include, without limitation, providing access to Partner records, systems, an

ARTICLE VIII — REMEDIATION COOPERATION

Section 8.1 — General Remediation Obligation. (a) The Partner acknowledges the existence and requirements of the Consent Order and the Bank's Comprehensive Remediation Action Plan, and the Partner understands that the Bank's compliance with the Consent Order is a matter of the highest priority and regulatory urgency. (b) The Partner shall cooperate fully, promptly, and in good faith with the Bank, Calderwood & Harkne

Section 8.2 — Specific Remediation Cooperation Obligations. The Partner shall undertake the following specific remediation cooperation obligations: (a) Technical and Operational Changes. The Partner shall implement all technical and operational changes to its systems and processes as directed by the Bank to support the Bank's remediation, including without limitation modifications to data feeds, data formats, API int

Section 8.3 — Remediation Milestones. The Partner shall comply with the following remediation deadlines, as they apply to the Partner's End Users and Partner Channel Transactions: The Bank may modify the foregoing milestones upon written notice to the Partner if such modifications are required by the OCC, the Independent Consultant, or changes in the Remediation Action Plan.

Section 8.4 — Cost Allocation. (a) Unless otherwise agreed by the Parties in a separate written agreement, the Partner shall bear all costs and expenses associated with any modifications, upgrades, changes, or enhancements to the Partner's own systems, processes, staffing, and operations required to comply with this Addendum, including the remediation cooperation obligations set forth in this Article VIII. (b) The Ba

ARTICLE IX — REPRESENTATIONS AND WARRANTIES

Section 9.1 — Partner Representations and Warranties. The Partner represents and warrants to the Bank, as of the Addendum Effective Date, as follows: (a) Organization and Good Standing. The Partner is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization, and has the legal capacity and authority to conduct its business as presently conducted and as contemplated unde

Section 9.2 — Ongoing Representations. The representations and warranties set forth in Section 9.1 shall be deemed repeated and reaffirmed by the Partner: (a) as of the date of each Partner Channel Transaction; (b) as of each quarterly compliance certification date pursuant to Section 10.2; and (c) as of any other date on which the Bank reasonably requests confirmation of such representations and warranties. If at an

ARTICLE X — REPORTING AND CERTIFICATION

Section 10.1 — Monthly Compliance Reporting. On a monthly basis, no later than the fifteenth (15th) calendar day following the end of each calendar month, the Partner shall provide the Bank with a monthly compliance report, in a format prescribed by the Bank, covering the following: (a) End User onboarding volumes for the reporting month, including new accounts opened, accounts closed, and accounts suspended or restr

Section 10.2 — Quarterly Compliance Certification. On a quarterly basis, no