Search results

Money Movement Open Banking Services Agreement

Last Updated: October 12, 2026

This Money Movement Open Banking Services Agreement (the “Open Banking Services Agreement“) is a legally binding agreement between you, the person or entity (“Company“, “you“, or “your“) identified on the applicable proposal (“Proposal“), and Dwolla, Inc. (“NMI“, “us“, “our“, or “we“), an affiliate of Network Merchants, LLC. This Open Banking Services Agreement constitutes Service Terms under the NMI General Terms and Conditions, available at https://www.nmi.com/policy/platform-terms-conditions/ (the “General Terms and Conditions“), and is part of the Agreement (as defined in the General Terms and Conditions); NMI is the NMI Affiliate providing the Open Banking Services. If you have also accepted the Money Movement Service Terms, this Open Banking Services Agreement is one of the “Money Movement Agreements” thereunder. This Open Banking Services Agreement applies to your use of the Open Banking Services, as defined in Exhibit A below (also referred to in any Proposal as the “Money Movement Open Banking Services“), and to your access or use of related technology, software, and services that NMI or its Third-Party Service Providers make available to you. By accessing or using the Open Banking Services, you accept and agree to be bound by this Open Banking Services Agreement. In the event of a conflict between this Open Banking Services Agreement and the General Terms and Conditions or, if applicable, the Money Movement Service Terms, this Open Banking Services Agreement controls as to the Open Banking Services, solely to the extent of the conflict.

It is important that you read and understand this Open Banking Services Agreement as it governs your use of the Open Banking Services. You represent and warrant that you have the authority to accept this Open Banking Services Agreement on behalf of the legal entity you have registered and to provide any information that you share with NMI. By indicating your acceptance of this Open Banking Services Agreement or by executing a Proposal or other agreement that references this Open Banking Services Agreement, you agree to be bound by this Open Banking Services Agreement. If you do not accept this Open Banking Services Agreement, you must not access or use the Open Banking Services.

NMI offers software and services, as more fully described in this Open Banking Services Agreement, to facilitate the accessing of banking and financial data via NMI’s exchange session, which provides a Third-Party Service Provider’s link to a user interface the End User accesses to provide End User Data. You retrieve the End User Data from the user interface that the End User has authorized to be shared with you and NMI through NMI’s application programming interface (“NMI API“). You desire to use these services to help streamline and improve your onboarding process on your platform, website and/or application (each, an “Application“). You agree the terms herein govern your use of NMI’s software and services.

NMI may amend this Open Banking Services Agreement at any time by providing notice to you. The parties therefore agree as follows:

1. Open Banking Services

1.1 Description. The Open Banking Services are accessed through an API which will permit you to:

(A) Utilize NMI’s Third-Party Service Providers to perform the Open Banking Services, ordered by you through a Proposal;

(B) Upon successful authorization from End User, obtain specific details about End User and its financial institution account through the Third-Party Service Provider; and

2. Account and Open Banking Services Access Requirements

2.1 Authorization. As provided in Exhibit C below, incorporated herein by reference, you must obtain each End User’s agreement to the EULA prior to the use of or access to the Open Banking Services by the End User.

2.2 Credentials. You are solely responsible for maintaining the security of your NMI credentials, including passwords, security codes, and any key and secret issued to you to permit access to the API used for the Open Banking Services (the “Credentials“). Prior to the date NMI makes the Open Banking Services available to you (the “Open Banking Services Go Live Date“), you will be responsible for paying the Implementation Fee (as listed in the Proposal) as applicable. You may not sell, transfer, sublicense or disclose the Credentials to any third party, other than third party service providers who need such information to perform services for you. You are solely responsible for any activity using the Credentials, including any losses or liability that may arise from you sharing or failing to secure the Credentials.

2.3 User Permissions. You may permit your employees, your Affiliates, contractors, agents, or other third parties (each, an “Authorized User“) to access the Open Banking Services on your behalf. You will remain responsible for any actions taken by an Authorized User and for ensuring Authorized Users comply with the terms of this Open Banking Services Agreement. Authorized Users may only access or use the Open Banking Services for your internal business purposes and in accordance with this Open Banking Services Agreement. You are responsible for determining which Authorized Users may obtain access to certain features, functionality and data within the Open Banking Services. NMI is expressly permitted to rely on your creation of Authorized Users and user settings to release data or to initiate payments, if applicable, pursuant to instructions received through the Open Banking Services. Any third parties enabled as Authorized Users do not form any relationship with NMI and NMI will not be liable for any disputes, billing, or other matters between you and such Authorized User(s).

2.4 Third-Party Service Providers. NMI does not guarantee the availability of access to or reliability of services from Third-Party Service Providers.

3. Acceptable Use

3.1 Compliance. You represent and warrant that your use of the Open Banking Services will only be for lawful and legitimate purposes and will at all times comply with: (a) all applicable Laws (as defined in the General Terms and Conditions); (b) this Open Banking Services Agreement; and (c) the Integration Requirements.

3.2 Prohibitions. Without limiting the generality of Section 3.1, and in addition to any prohibitions and/or restrictions set out in Exhibit A, incorporated herein by reference, you agree you will not and will not permit your Authorized Users to:

(A) License, sublicense, sell, resell, transfer, assign or distribute Open Banking Services without express written permission from NMI;

(B) Reverse engineer, disassemble, decompile, disable, copy, modify, or translate the Open Banking Services or any of its features, components, or elements or otherwise attempt to discover the source code of the Open Banking Services;

(C) Replicate and/or resell the Open Banking Services or create a competitive product or any product built using the ideas, features, functions, and other components of the Open Banking Services;

(D) Use the Open Banking Services for any purpose other than your legitimate internal business purposes;

(E) Use the Open Banking Services for any fraudulent, unlawful, deceptive, or abusive purposes or in any manner intended to harm an End User, NMI, or any third party;

(F) Circumvent NMI’s intended limitations for any feature of the Open Banking Services;

(G) Use the Open Banking Services in a manner inconsistent with any developer documentation, integration guidance, or other technical, policy, or other requirements communicated by NMI or posted on NMI’s website, each as may be updated from time to time (the “Integration Requirements“); or

(H) Attempt any of the foregoing.

4. Security and Privacy

4.1 Personal Information. You represent and warrant that you have obtained express consent to provide NMI any identifying information of individuals processed using Open Banking Services (“Company PII“). NMI agrees not to sell or share, retain, use, or disclose Company PII for any purpose other than providing Open Banking Services as described in this Open Banking Services Agreement or meeting regulatory obligations.

4.2 Audit. NMI may audit, examine and otherwise monitor your compliance with this Open Banking Services Agreement and you agree to cooperate fully with any such audit. Within 30 days of notice from NMI, you will provide to NMI or its third party auditor (either, an “NMI Auditor“) access to and assistance with: documents, records, reports, or other data, information or materials compiled, maintained, or otherwise available to the extent related to your compliance with this Open Banking Services Agreement and not prohibited from disclosure by applicable Laws (as defined in the General Terms and Conditions). If an NMI Auditor determines that you are not in compliance with this Open Banking Services Agreement, you will take appropriate action to remedy the non-compliance and will provide NMI with evidence of the steps taken to achieve compliance within the time frame agreed upon by the parties.

5. Confidentiality

For purposes of this Open Banking Services Agreement, “Confidential Information” has the meaning given in the General Terms and Conditions. Confidential Information of a Third-Party Service Provider or Third-Party Data Provider disclosed to you in connection with the Open Banking Services will be subject to the same obligations that apply to NMI’s Confidential Information under the Agreement, and each such Third-Party Service Provider or Third-Party Data Provider retains all right, title, and interest in its own Confidential Information.

6. Intellectual Property

6.1 NMI API License. NMI grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access, use, and integrate the Open Banking Services into your services or payment technology in accordance with this Open Banking Services Agreement (“API License“). This API License may be immediately revoked or terminated by NMI if you share your Credentials in a manner not permitted by this Open Banking Services Agreement or that otherwise breaches this Open Banking Services Agreement. “Dwolla,” the Dwolla logo, and any other service marks, trademarks, logos or graphics used in Open Banking Services (“Dwolla Marks“) are trademarks, registered trademarks, or otherwise intellectual property of NMI and you do not obtain any right or license to the Dwolla Marks under this Open Banking Services Agreement. You may not remove or obscure any Dwolla Marks displayed or contained in Open Banking Services.

6.2 General.

(A) Marketing. You agree to participate in case studies upon written request by NMI. Further, you agree that NMI may include you in materials identifying you as a customer of NMI and a user of the Open Banking Services. You authorize NMI to use your name, website, logo, or other trademarks or service marks to identify you as a customer of NMI on NMI’s websites, marketing materials, and in public presentations. If you desire to opt out of being included in such communications and materials, please contact NMI. Upon receipt of and in accordance with such request, NMI will cease making references to you and make reasonable efforts to remove you from any already existing marketing materials.

(B) Customer Support for End Users. You are solely responsible for providing customer support for your services to End Users and, if applicable, for any goods or services that are sold via your Application. You must clearly disclose your support policy and publish your customer support contact information in an easily accessible manner within any Application through which you offer your services.

(C) Dispute Resolution for End Users. You are responsible for resolving all End User disputes related to your services (“Company Services End User Dispute“), including any Company Services End User Dispute communicated by an End User to NMI. NMI has no obligation nor any liability associated with a Company Services End User Dispute or your resolution policies and procedures. You agree to provide NMI with any requested information regarding the status and/or resolution of a Company Services End User Dispute. NMI has the right but no obligation to provide support to an End User that contacts NMI regarding a Company Services End User Dispute, and in such event, you must provide NMI with any information NMI reasonably requests for the purposes of assisting End User.

7. Term and Termination

7.1 Term. The term of this Open Banking Services Agreement begins on the service start date specified for the Open Banking Services in the applicable Proposal or, if no service start date is specified, on the Open Banking Services Go Live Date, and continues until terminated as provided in this Open Banking Services Agreement or the Agreement (the “Term“).

7.2 Termination. Either party may terminate this Open Banking Services Agreement at any time. NMI may suspend or terminate this Open Banking Services Agreement or your access to the Open Banking Services immediately upon written notice as provided in the General Terms and Conditions or Section 5 of Exhibit A, including if you materially breach this Open Banking Services Agreement, if required by a Third-Party Service Provider or Third-Party Data Provider, or if NMI’s relationship with the applicable Third-Party Service Provider or Third-Party Data Provider terminates or is suspended.

7.3 Effect of Termination; Survival. Upon termination or expiration, you will immediately stop using the Open Banking Services and the NMI API and remove all Dwolla Marks from your Application. Any fees accrued or due survive termination. Sections 4, 5, 6, this Section 7.3, and Section 8 of this Open Banking Services Agreement, and the provisions of Exhibits A, B, C, and D that by their nature extend beyond termination (including post-termination destruction, audit, and insurance obligations), survive termination or expiration.

8. Indemnification

In addition to your indemnification obligations under the General Terms and Conditions, you agree to defend, indemnify and hold harmless NMI, its Third-Party Service Providers and Third-Party Data Providers, and their respective officers, directors, employees, suppliers and agents from and against any and all third party claims, liabilities, damages, actions, proceedings, penalties, fines, costs, losses or expenses, including settlement amounts and reasonable attorneys’ fees and costs, arising out of or in any way connected with your: (i) access to or use of the Open Banking Services; (ii) negligence or willful misconduct; (iii) actual or alleged violation of any third party rights or any Laws; (iv) violation or breach of this Open Banking Services Agreement; or (v) infringement, or infringement by any of your Authorized Users, of any intellectual property or other right of anyone. Your obligations under this Section 8 are not subject to any limitation of liability in the Agreement.

Exhibit A
Money Movement Terms and Conditions for Third-Party Open Banking Services and Products

This Money Movement Terms and Conditions for Third-Party Open Banking Services and Products Exhibit (“Open Banking Services Exhibit“) applies to your use of the Open Banking Services provided to you through one of NMI’s Third-Party Service Providers (as defined below). Hereinafter “you”, “your”, or “Company” means the Company and “us”, “we”, “our” or “NMI” refers to NMI (protecting its third-party service provider).

1. DEFINITIONS

1.1 “Anonymous & Aggregated Data” means End User Data and information that is anonymized and aggregated with similar data and information to the extent that the original End User Data and information is no longer attributable to NMI, you, or to any specific End User, so it meets the prevailing standard of “De-identified” as set out in the applicable Laws. The parties to this Open Banking Services Agreement may use any Anonymous & Aggregated Data that is generated by the Open Banking Services or derived from your use of the Open Banking Services in accordance with the Privacy Laws and NMI’s privacy policy.

1.2 “Balance Check” means an Open Banking Service ordered by you that you can use to periodically gather account balances in an account without collecting transaction data. Account types accessed include depository accounts. You can retrieve these account balances using an API request to help ensure your End Users have the appropriate funds.

1.3 “Destroy” means to delete or destroy information using data destruction procedures that meet or exceed the NIST Special Publication 800-88 Guidelines for Media Sanitization.

1.4 “Documentation” means the Third-Party Service Provider Materials, Third-Party Service Provider User Guide and applicable Spec Sheet(s).

1.5 “End User” means (a) a natural person who is a resident of the United States and at least 18 years old, or (b) a business or other entity formed or registered in the United States, in each case who is authorized by you to use or access the Open Banking Services and who has (i) been supplied an identification and password by you or at your direction or (ii) for whom a unique user record is created by or authorized to be created by you within the Open Banking Services.

1.6 “End User Data” means End User’s login, password, transaction data, account number, any other authentication information required by Third-Party Service Provider or End User’s financial institution, and any other data, in each case received through the Open Banking Services. For the avoidance of doubt, End User Data includes Nonpublic Personal Information.

1.7 “End User Request” means any request by an individual (or by another person acting on behalf of an individual), including End Users (as defined in this Open Banking Services Agreement), to exercise a right under any Privacy Laws, or any other complaint or inquiry or similar communication about the use of services that are based on the Open Banking Services.

1.8 “Instant Account Verification (without identity check)” means an Open Banking Service ordered by you that accesses financial account information, including account and routing numbers, for direct deposit accounts such as checking, savings, and money market accounts.

1.9 “Marks” means the trademarks, marks, logos, trade names, and service marks owned or licensed by a party.

1.10 “Nonpublic Personal Information” means personally identifiable financial information as defined under Regulation P, 12 C.F.R. Part 1016, or the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., any End User Data that is protected as “personal data”, “personally identifiable information” or “personal information” under Privacy Laws, including any and all information that (alone or when used in combination with other information) is capable of being associated with, or could reasonably be associated with an individual, or information otherwise considered privileged, confidential, private, nonpublic or personal given protected status under applicable Laws.

1.11 “Open Banking Services” means Instant Account Verification, Balance Check, and the other products and services ordered by you through a Proposal to which these terms apply and are made available by Third-Party Service Provider through its online, web-based application or mobile components via designated websites, IP addresses, application programming interface(s), or other means.

1.12 “Privacy Laws” means any applicable law, regulation, rule or other mandatory legal obligation which regulates the Processing of Nonpublic Personal Information or that otherwise relates to data protection, data security or data breach notification obligations for Nonpublic Personal Information, including (without limitation and only as applicable between the parties) the U.S. Gramm-Leach-Bliley Act (GLBA); the GDPR, the UK GDPR, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; the California Consumer Privacy Act (CCPA) as amended, superseded or updated from time to time and similar law.

1.13 “Processing” means any operation or set of operations that is performed upon Nonpublic Personal Information or on sets of Nonpublic Personal Information, whether or not by automated means, such as collection, recording, structuring, storage, alteration, accessing, consultation, use, copying, disclosure, combination, de-identification, redaction, erasure or destruction. (“Process“, “Processes” and “Processed” are construed accordingly).

1.14 “Service Provider” means any third-party entity which provides End User Data or other data to a Third-Party Service Provider for use in the Open Banking Services pursuant to a contractual agreement.

1.15 “Spec Sheet” means a document provided by NMI or Third-Party Service Provider that describes the work by Third-Party Service Provider and you that is necessary to configure the Open Banking Services purchased by you in a Proposal.

1.16 “Third-Party Data Provider” means any third-party entity, including financial institutions, which provides End User Data or other data to NMI or NMI’s technology providers for use in the Open Banking Services.

1.17 “Third-Party Service Provider(s)” means a third-party entity that provides the Open Banking Services or professional services.

1.18 “Third-Party Service Provider Materials” means any materials that Third-Party Service Provider provides to you as part of, or in the course of providing, the Open Banking Services or professional services including implementation materials provided through Third-Party Service Provider’s developer portal or through NMI.

1.19 “Third-Party Service Provider Privacy Policy” means Third-Party Service Provider’s privacy policies describing Third-Party Service Providers’ processing of End User Data and Nonpublic Personal Information, as amended from time to time.

1.20 “Third-Party Service Provider Technology” means technology owned by Third-Party Service Provider or licensed to Third-Party Service Provider by a third party (including the Open Banking Services, professional services, software tools, algorithms, software (in source and object forms), user interface designs, architecture, toolkits, plug-ins, objects and Documentation, network designs, processes, know-how, methodologies, trade secrets, and any related intellectual property rights throughout the world) and feedback made to Third-Party Service Provider that are incorporated into any of the foregoing (which are hereby irrevocably assigned to Third-Party Service Provider), as well as any of the modifications or extensions of the above, whenever or wherever developed.

1.21 “Third-Party Service Provider User Guide” means the applicable user guides, frequently asked questions, help, and other documentation provided by Third-Party Service Provider to you including such documentation provided through NMI. For some Third-Party Service Provider products, additional guidance is accessible from within the Open Banking Services under the “help” menu.

2. LICENSE AND RESTRICTIONS

2.1 License Grant. Subject to, and except as explicitly set forth in, the terms of this Open Banking Services Exhibit, NMI grants you a non-exclusive and non-transferable right, solely during the Term and any implementation period preceding the Open Banking Services Go Live Date:

(A) to permit authorized End Users to access and use the Open Banking Services;

(B) to use the Open Banking Services in accordance with the Documentation and Integration Requirements and solely for your internal business purposes; and

(C) to use the Third-Party Service Provider Materials solely in conjunction with your authorized use of the Open Banking Services.

2.2 Restrictions. All rights not expressly granted to you hereunder are reserved by NMI and Third-Party Service Provider. You agree that you must not, and must not permit or authorize any third party (including but not limited to End Users) to:

(A) use the Open Banking Services in (i) violation of any applicable Laws or regulatory guideline or for fraudulent purposes, or (ii) a manner that would cause a material risk to the security or operations of NMI or any of its clients or partners, Third-Party Service Provider or any of its clients, or to the continued normal operation of other NMI or Third-Party Service Provider clients;

(B) copy, sublicense, sell, resell, rent, lease, transfer, assign, distribute, license, publish or publicly display, modify, duplicate, create derivative works from, translate, frame, scrape, mirror, republish, download, display, transmit, disassemble, decompile, reverse engineer all or any portion of the Open Banking Services, time share or otherwise commercially exploit or attempt to derive source code of the Open Banking Services or make the Open Banking Services available to any third party, other than to End Users or as otherwise contemplated by this Open Banking Services Agreement;

(C) attempt to gain unauthorized access to the Open Banking Services or their related systems or networks, or modify, create derivative works of, adapt, translate, reverse engineer (including monitoring or accessing inputs or output flowing through a system or an application), decompile, or otherwise attempt to discover within any Third-Party Service Provider Technology, the source code, data representations, or underlying algorithms, processes and methods. (This restriction will not apply to the extent it limits any non-waivable right you may enjoy under applicable Laws);

(D) access the Open Banking Services in order to build a competitive product or service, or copy any ideas, features, functions or graphics of the Open Banking Services;

(E) frame, scrape, link to, republish, download, display, transmit, or mirror any content forming part of the Open Banking Services, other than on your own intranets or otherwise for your own internal business purposes;

(F) remove, obscure, or alter any copyright, trademark or other proprietary notices associated with the Open Banking Services, Third-Party Service Provider Materials or SDKs;

(G) use End User Data obtained through the Open Banking Services in any way as, or as part of, a consumer report as that term is defined by the Fair Credit Reporting Act 15 U.S.C. §1681 (“FCRA“);

(H) process through Open Banking Services or share with Third-Party Service Provider any data that falls under the protections of the Health Insurance Portability and Accountability Act of 1996 or the Washington My Health My Data Act. You shall promptly notify NMI and/or Third-Party Service Provider, as applicable, if you inadvertently process or share data in breach of this provision;

(I) circumvent, disable, or stress test any security or other technological features of the Open Banking Services or the systems of any Third-Party Data Provider through which End User Data is sourced;

(J) re-identify or attempt to re-identify Anonymous & Aggregated Data or End User Data provided in a de-identified form;

(K) knowingly use the Open Banking Services to send or store infringing, obscene, threatening, libelous, or other unlawful or tortious material, including, without limitation, material harmful to or that causes damage to any property or violative of any person’s or third-party’s privacy rights or in any manner that encourages, supports or promotes illegal activities or unlawful gambling;

(L) use the Open Banking Services or any Third-Party Data Provider systems in any manner to provide service bureau, time sharing or other computer services to third parties, except where necessary to use the Open Banking Services, or in any manner that would cause a material risk to the security or operations of Third-Party Data Providers, or that would constitute excessive or abusive usage;

(M) intentionally or knowingly upload to the Open Banking Services or use the Open Banking Services to intentionally send or store viruses, worms, time bombs, trojan horses, or any other harmful or malicious code, files, scripts, agents or programs;

(N) conduct any platform or system level testing of the Open Banking Services, including, without limitation, load or security testing, without first obtaining Third-Party Service Provider’s written consent;

(O) sell, rent, lease, loan, license, distribute, publish or publicly display, copy, modify, duplicate, create derivate works from, translate, frame, scrape, mirror, republish, download, display, transmit, disassemble, decompile, reverse engineer all or any portion of, or otherwise attempt to derive source code of the Third-Party Data Provider services; or

(P) identify by name any Third-Party Service Provider or Third-Party Data Provider in: any press release, statements to the media, social media postings, or public disclosure except as otherwise expressly authorized or permitted in this Open Banking Services Agreement.

3. THIRD PARTIES

3.1 Third-Party Providers. You are responsible for complying with any applicable terms and conditions of any third-party products, services, and platforms you use in conjunction with the Open Banking Services, which are not provided by NMI or Third-Party Service Provider as part of the Open Banking Services.

3.2 Your Third-Party Access.

(A) Use by your Affiliates. Subject to their compliance with the terms of this Open Banking Services Exhibit, your Affiliates may use and access the Open Banking Services, Documentation or End User Data.

(B) Outsourcing and Third-Party Access. You may allow your third-party contractor to operate, use or access the Open Banking Services or End User Data solely on your behalf, provided such use or access is only for your direct beneficial business purposes.

(C) Responsibility for Third-Party Access. You acknowledge and agree that you are solely responsible for ensuring that any of your Affiliates, contractors, agents, or other third party operating, using or accessing the Open Banking Services or End User Data on your behalf assumes and complies with the obligations flowed down to you under this Open Banking Services Agreement.

(D) Your Responsibility. You are responsible and liable for the acts or omissions of your Affiliates and all third parties authorized by you to access the Open Banking Services, Integration Requirements, Documentation, or End User Data as if they were your own acts or omissions.

3.3 Third-Party Data Providers.

(A) You acknowledge that End User Data may be sourced from Third-Party Data Providers, and such parties may be required by applicable Laws or regulatory enforcement to oversee recipients of End User Data. You agree to cooperate with any reasonable requests of NMI, Third-Party Service Provider or such Third-Party Data Providers to attest or otherwise certify to your compliance with applicable Laws or this Open Banking Services Agreement.

(B) You acknowledge that End User Data may include Nonpublic Personal Information and you agree to protect that End User Data as detailed in the Data Protection Terms set out in Exhibit B, which is incorporated herein by reference.

(C) You acknowledge that End User Data you source from Third-Party Data Providers carries with it the obligations detailed in the Third-Party Data Provider Terms set out in Exhibit C, and you agree to comply therewith.

4. CONSUMER DATA OWNERSHIP, PERMITTED USES, AND RESPONSIBILITY

4.1 Ownership. As between NMI and you, you own (or, where applicable, must ensure you have a valid license to use) the End User Data.

4.2 Permitted Use. You grant NMI and, through NMI, Third-Party Service Provider:

(A) a non-exclusive, worldwide, royalty-free license to reproduce, display, adapt, enhance, aggregate, transmit, distribute and otherwise use and access the End User Data as necessary or reasonable to provide the Open Banking Services and to generate Anonymous & Aggregated Data;

(B) a non-exclusive, royalty-free, revocable, limited license, during the term of this Open Banking Services Agreement, to use your trademarks, marks, logos, trade names and service marks owned or licensed by you (“Your Marks“), and to sublicense the same to Service Provider(s) and Third-Party Data Providers, for the sole purpose of providing the Open Banking Services (e.g., identifying you to End Users as a source or recipient of End User Data, or rebranding of the Open Banking Services in those scenarios where you have licensed such white-labeled rights, if applicable). NMI and/or Third-Party Service Provider will use Your Marks and will require that any Third-Party Data Provider use Your Marks in compliance with any reasonable trademark use policies you may promulgate from time to time and provide to NMI in writing; and

(C) a non-exclusive, royalty-free, worldwide, transferable, sublicensable, perpetual and irrevocable license to reproduce, display, adapt, enhance, transmit, distribute and otherwise use Anonymous & Aggregated Data.

4.3 Responsibility.

(A) End User Consent.

(i) You must only request End User Data through the Open Banking Services that is expressly consented to by the End User or reasonably necessary to provide the End User’s requested product or service. You shall provide all notices and obtain all consents in the form and substance required under Privacy Laws to enable NMI and Third-Party Service Provider to lawfully Process End User Data. Your consent may not include a technology solution that automatically enrolls an End User into an agreement without such End User taking an express action. You shall, and shall ensure that all third parties to whom you provide access to End User Data, (1) Process and disclose End User Data solely in accordance with applicable Laws, this Open Banking Services Agreement, your privacy policy, Third-Party Service Provider’s privacy policies and the End User’s consent, and (2) limit collection, use, and retention of End User Data to what is reasonably necessary to provide the End User’s requested product or service.

(ii) Your disclosures to End Users shall (1) be clear, conspicuous, segregated from other material, and present in valid and enforceable terms and conditions, (2) include the categories of End User Data being collected and processed, the categories of data recipients, a description of how End User Data will be used, accessed, shared or sold, and any other terms or disclosures required by applicable Laws, (3) disclose to the End User any use by you of Anonymous & Aggregated Data, including Processing related to derivatives, compilations or combinations of End User Data, any anonymization and/or de-identification of End User Data, and any aggregation of End User Data with other data, (4) inform End Users that the End User Data does not represent an official record of the End User’s account with its financial institution, (5) state that you are acting independently and that the End User’s financial institution has no responsibility or liability with respect to your service or application, and (6) describe how the End User may exercise their privacy rights.

(iii) If you both access End User Data and initiate payments, you must obtain separate and distinct consents from End User for these separate activities.

(iv) You shall maintain such systems and procedures as may be reasonably necessary or otherwise required by NMI or Third-Party Service Provider (consistent with applicable Laws and industry best practices) to actively track, monitor and document such End User consent and any revocation thereof. You shall maintain records that, at a minimum, (a) include the scope of the consent and related disclosures, covered data elements, the date the End User provided consent, the consent effective date, and the consent expiration or termination date, and, to the extent required by applicable Laws, any consent and disclosure elements described under the applicable sections of this Exhibit A; and (b) are maintained in a system log or database that ensures completeness and integrity of records. Upon request, you will provide copies, or acceptable evidence, of such consents and disclosures.

(v) Third-Party Service Provider, End User’s financial institution and/or NMI will suspend your access to a specific End User’s data if such End User revokes consent with you, Third-Party Service Provider or the financial institution. Third-Party Service Provider or a Third-Party Data Provider may also require End Users to re-authenticate their consent upon (a) a Security Incident impacting such End User, (b) a change in the End User terms and conditions of you, Third-Party Service Provider or Third-Party Data Provider that requires a new consent to be obtained; or (c) the end of a specific period of time as required under applicable Laws or by the Third-Party Data Provider’s policies. You shall limit the duration of your collection of End User Data to the maximum period permitted under applicable Laws, or as consented by the End User (whichever is shorter) and, prior to or following the expiration of such period, shall obtain a new consent from the End User to continue or resume, as applicable, collection and Processing of the End User’s data.

(B) End User Control. You must provide End Users with a simple and readily accessible method to revoke consent in accordance with applicable Privacy Laws and may not charge fees or penalties to End Users for exercising their rights to revoke consent. You shall notify NMI and/or Third-Party Service Provider, as applicable, (including with information sufficient to enable Third-Party Service Provider to notify its Third-Party Data Providers, as necessary) and any other third party required to be notified by you under applicable Laws, promptly upon receiving an End User’s consent revocation. Upon such revocation, you shall cease all attempts to access the applicable End User Data, and shall no longer use or retain any previously collected End User Data unless reasonably necessary to provide the End User’s requested product or service.

(C) End User Data Access. NMI may provide a list of Internet Protocol addresses (“IP Addresses“) to Third-Party Service Provider from which Third-Party Service Provider may access End User Data from you on behalf of End Users. NMI may update the provided list from time to time. You must not block or otherwise obstruct Third-Party Service Provider and/or NMI from accessing End User Data using the IP Addresses in the provided list.

(D) Representations. You will not: (i) make representations or other statements with respect to Nonpublic Personal Information that are contrary to or otherwise inconsistent with Third-Party Service Provider’s privacy policy or (ii) interfere with any independent efforts by Third-Party Service Provider to provide End User notice or obtain End User consent.

(E) End User Requests.

(i) Technical Controls. You shall use the technical controls provided by Third-Party Service Provider through its API and/or the administrative controls NMI makes available to you in order to comply with your obligations to access, retrieve, correct and Destroy End User Data per an End User Request. The parties shall, taking into account the nature of the Processing, cooperate in good faith and provide reasonable assistance to each other in complying with End User Requests. Removal by an End User of a linked account in your Application constitutes an End User Request revoking the End User’s consent, and you shall promptly effectuate such revocation through the technical controls provided by Third-Party Service Provider through its API, such that access to the affected End User Data ceases.

(ii) Requests to You. You shall respond to and fulfill End User Requests, as applicable, made directly to you by an End User or on behalf of an End User in accordance with Privacy Laws.

(iii) Requests to Third-Party Service Provider. Third-Party Service Provider will, as applicable, respond to End User Requests made directly to Third-Party Service Provider in accordance with Privacy Laws provided that Third-Party Service Provider is able to identify the End User. If Third-Party Service Provider is not able to identify the End User or the End User Request has been escalated for any reason, Third-Party Service Provider will advise the End User to contact you. You shall be responsible for identifying any such End Users that contact you to exercise End User Requests and providing Third-Party Service Provider with information sufficient to allow Third-Party Service Provider to identify the End User and fulfill the End User Request as regards the data held by Third-Party Service Provider.

(iv) Suspension of Access. Third-Party Service Provider and/or NMI will have the right to engage with the End User directly regarding any End User Requests and will have the right to suspend your access to any End User Data at any time to address such End User Request.

(F) Information and Assistance. Upon written request, you will provide NMI, Third-Party Service Provider and/or Third-Party Data Provider with information reasonably needed to demonstrate compliance with the obligations in Exhibits A, B and C and the Privacy Laws. You shall provide reasonable assistance in fulfilling legal obligations under applicable Laws, including Privacy Laws (including contributing to data protection impact assessments and consultations with supervisory authorities).

5. Suspension

NMI and/or Third-Party Service Provider will have the right to suspend your Open Banking Services account or your access, in whole or in part, to the Open Banking Services and any End User Data upon reasonable, good-faith belief that:

(A) you are acting in an unauthorized manner with respect to your access to the Open Banking Services or any End User Data;

(B) there is a material risk to the security or integrity of the Open Banking Services, the End User Data, or any systems of NMI, NMI’s technology providers, any Third-Party Data Provider, or you; or

(C) suspending access is reasonably necessary to prevent harm to the business or reputation of NMI, an NMI technology provider, any Third-Party Data Provider, and/or their respective customers.

Your use of the Open Banking Services may be limited if your Open Banking Services account or access to your Open Banking Services is suspended. Any suspension will be reasonably limited in scope. Unless prohibited by applicable Laws, NMI will use reasonable efforts to provide timely notice of the suspension to you, including a description of the scope and reasons for the suspension. Such notice may occur after the suspension or restriction has occurred. NMI may also, in its reasonable discretion, contact any End User for NMI’s purposes, including fraud investigation and/or risk management purposes. If NMI contacts an End User for such purposes, NMI will notify you to the extent permissible under applicable Laws. The parties will cooperate in good faith to remediate the reason for any suspension. Upon resolution of the issue causing the suspension, NMI will promptly permit you to resume using the Open Banking Services.

Exhibit B
Data Protection Terms

1. INFORMATION SECURITY

In connection with this Open Banking Services Agreement, you may have access to and/or be provided with information concerning End Users and their past or present accounts including End User Data, other information falling within the definition of Nonpublic Personal Information, or Confidential Information. In connection with all such End User Data, Nonpublic Personal Information and Confidential Information, you must:

1.1 handle, keep, maintain and secure from others the Nonpublic Personal Information, End User Data, and Confidential Information to which you have access or are provided, with the utmost of care and confidentiality. In no event will you take precautions any less stringent than those employed to protect your own proprietary and confidential information;

1.2 allow the Nonpublic Personal Information and End User Data to be accessed and used by your personnel, including subcontractors, only in connection with the provisions of this Open Banking Services Agreement and ensure that all personnel, including subcontractors, have agreed to maintain the confidentiality of the End User Data, Nonpublic Personal Information and Confidential Information;

1.3 not share, disclose, provide or permit access to any Nonpublic Personal Information or End User Data by any other person or entity, except as permitted hereunder or as permitted by the applicable End User;

1.4 with respect to any third party provided access to Nonpublic Personal Information or Confidential Information, enter into a written agreement with such third party requiring safeguarding of Nonpublic Personal Information, End User Data or Confidential Information in a manner no less restrictive than your obligations under this Open Banking Services Agreement;

1.5 implement appropriate safeguards and programs (including, but not limited to security controls such as physical and logical access, configuration and change management processes, data encryption, strong authentication, vulnerability and risk management (including regular vulnerability assessments and required remediation timelines for identified vulnerabilities), asset management, media protection, application security, network security monitoring and logging to detect unauthorized access to, use of, or tampering with End User Data, intrusion detection, security event monitoring and alerting, internal and external security program audits, security incident detection and response, and employee security training) consistent with best practices in the financial services industry and all applicable Laws, designed to help ensure the security and confidentiality of Nonpublic Personal Information and to protect against unauthorized access to or use of Nonpublic Personal Information that could result in substantial harm and measurable damage to End User, NMI or Third-Party Service Provider;

1.6 establish and maintain a written information security program that is consistent with applicable Laws including Section 501 of the GLBA, or if you are not subject to Section 501 of the GLBA, 16 CFR Part 314 (the Federal Trade Commission’s Standards for Safeguarding Customer Information) as well as generally accepted industry standards, including “Generally Accepted Principles and Practices for Securing Information Technology Systems” (GAPPs) issued by the National Institute of Standards & Technology and/or the ISO 27000, to safeguard against the unauthorized disclosure, destruction, loss, or alteration of End User Data. At a minimum, your written information security program will be designed to: (i) ensure the security, integrity, and confidentiality of all End User Data; (ii) detect patterns, practices, or specific activity that indicates the possible existence of identity theft or other threats or hazards to the security or integrity of End User Data; (iii) protect against unauthorized access, interception, use, or disclosure of End User Data; (iv) ensure that all transfers of End User Data are accomplished in a secure and confidential manner and in compliance with best practices in the financial services industry and latest industry encryption standards, including encryption of all End User Data at rest and in transit, using commercially reasonable encryption; (v) ensure the secure disposal of End User Data, where applicable; (vi) inventory information systems that contain End User Data or are otherwise critical to achieving business purposes; (vii) implement appropriate risk-informed identity and access management, implementing the principles of least privilege and need-to-know; (viii) ensure multi-factor authentication for access to any information system containing End User Data except where a reasonably equivalent or more secure access control has been approved; and (ix) execute regular vulnerability assessments and required remediation timelines for identified vulnerabilities;

1.7 notify the affected party of any known unauthorized access to or use of Nonpublic Personal Information, as soon as is practicable, after confirmation of such event;

1.8 disclose, if you learn of any vulnerability affecting or reasonably believed to affect an NMI, Third-Party Service Provider or Third-Party Data Provider system within the scope of this Open Banking Services Agreement, the vulnerability to NMI or Third-Party Service Provider, as applicable. You shall not make any public disclosures regarding such vulnerability which identify NMI, Third-Party Service Provider or Third-Party Data Provider by name or Marks, or other information which may reasonably allow a third party to associate NMI, Third-Party Service Provider or Third-Party Data Provider with the vulnerability;

1.9 identify and assess reasonably foreseeable threats to the security of Nonpublic Personal Information or End User Data and adjust security mechanisms to address new threats; and

1.10 maintain on all of your systems on which End User Data is accessed, stored, used or otherwise processed (i) real-time intrusion detection systems, and (ii) up-to-date and reputable antivirus software and/or other commensurate anti-malware tools and applications. Without limiting your obligations under Section 2 (Security Incident), you must promptly report any patterns, practices, or specific activity detected with respect to your or NMI’s systems that may indicate the possible existence of identity theft, and must take appropriate steps to prevent or mitigate the same.

2. SECURITY INCIDENT

2.1 Notification. You will promptly (and in any event, within 48 hours of discovery) notify NMI and/or Third-Party Service Provider, as applicable, of a Security Incident (as defined below). Such notice must include a detailed description of the Security Incident, and any other information NMI may reasonably request concerning the Security Incident, including, without limitation, the number of records, types of information, and number of End Users impacted by the Security Incident, the known or suspected causes of the Security Incident, any actual or anticipated impact on NMI or its customers, and remediation plans. You will maintain records of all actual or suspected Security Incidents consistent with security best practices in the financial services industry and will make such reports available to NMI upon request.

2.2 Mitigation. You agree to promptly and at your own cost and expense investigate and take all reasonable measures necessary or advisable to mitigate the effects of and remedy any Security Incident, including, where appropriate and without limitation, providing credit monitoring services and related call center or similar support activities to impacted parties.

2.3 Reasonable Assistance. You further agree to fully cooperate with and provide all reasonable assistance to NMI in regard to its investigation of any Security Incident and agree to provide any information available that NMI reasonably needs to comply with its obligations under Privacy Laws. Without limiting the generality of the foregoing, you will cooperate with NMI in determining its legal obligations with respect to notification of End Users, regulators, and/or law enforcement, if any, and you agree to provide any documentation in your possession which is necessary for NMI to issue required or advisable notifications or communications.

2.4 Disclosure. Unless otherwise required by applicable Laws or pursuant to an agreement with an unrelated third party, you will not (and will ensure that each of your representatives and agents do not) inform or make any statements to any unrelated third party of any Security Incident without first obtaining NMI’s prior written consent. Where any disclosure of a Security Incident is required by applicable Laws, you will use commercially reasonable efforts to obtain NMI’s approval regarding such disclosure.

2.5 Dispute Management. You must notify NMI within 48 hours after receiving confirmation of or receiving any complaint alleging known or reasonably suspected improper or unauthorized access or use of End User Data. You will be responsible for managing all disputes or issues raised by an End User with respect to any of your applications; provided, however, that NMI, Third-Party Service Provider and/or Service Provider may, at its option, as applicable, engage directly with any End User with respect to issues or complaints relating to the authorized access or use of End User Data, and may take all steps deemed necessary by NMI, Third-Party Service Provider or Service Provider to resolve such issues or complaints, including, without limitation, terminating access to the Open Banking Services and/or to any End User Data. Notwithstanding the foregoing, you acknowledge and agree that you will remain responsible for any unauthorized access or use of End User Data once it has been accessed through the Open Banking Services, is in your possession or control, or thereafter.

2.6 Definition. For purposes of this Open Banking Services Agreement, “Security Incident” will mean any actual or reasonably suspected breach, incident or other event that compromises (or would be reasonably likely to result in a compromise of) the security, integrity or confidentiality of the End User Data, NMI’s or Third-Party Service Provider’s Confidential Information, or Confidential Information of NMI or Third-Party Service Provider held by your third party service providers that handle or otherwise process End User Data, or that otherwise results in (or that would be reasonably likely to result in) the unauthorized access, use, disclosure or loss of End User Data, NMI’s or Third-Party Service Provider’s Confidential Information, or Confidential Information of NMI or Third-Party Service Provider held by your third party service providers that handle or otherwise process End User Data, including Nonpublic Personal Information and any non-public Documentation.

3. BACKGROUND INVESTIGATIONS

During the Term hereof and for such period thereafter as you will retain possession or control of End User Data, you will maintain comprehensive hiring and employment policies and procedures designed to ensure that all of your personnel with access to the Open Banking Services or to any End User Data possess appropriate character, disposition and honesty. In connection with the foregoing, you must, to the extent permitted by applicable Laws, conduct at your expense pre-employment background checks and other investigations of your employees and other personnel that may obtain access to the Open Banking Services or End User Data prior to their accessing the Open Banking Services or End User Data. Such background checks and investigations must include, but are not limited to: (a) confirmation of identity and personal information; (b) felony and misdemeanor and national criminal searches (where permissible); and (c) confirmation the individual is not on the Specially Designated Nationals (SDNs) list published by the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) (or national equivalent) and global sanctions enforcement searches. You must not permit any of your employees or other personnel to access the Open Banking Services or End User Data until such individual has passed the outlined background screening. You will not permit any employee or other personnel who has been formally charged with a crime that is a dishonest act or breach of trust as set forth in Section 19 of the Federal Deposit Insurance Act, or who you know has otherwise engaged in any material act of dishonesty or breach of trust, to access or use the Open Banking Services or End User Data, in accordance with all applicable Laws. You must reasonably cooperate with any investigation undertaken by NMI and/or Third-Party Service Provider with respect to any act of dishonesty, breach of trust, or violation of law by any of your employees or personnel with respect to the Open Banking Services or the End User Data.

4. INSURANCE

You must obtain and maintain at your own expense, throughout the Term and for a period of two years thereafter, (a) sufficient insurance coverage for your business, your activities hereunder, and any reasonably anticipated risks; and (b) without limiting the foregoing, as applicable (1) Commercial General Liability Insurance, (2) Crime Insurance (Employee Dishonesty), and (3) with limits of not less than five million dollars per claim, Professional Liability, Cyber Risk/Data Security and Privacy Liability Insurance covering claims (and any associated costs and damages, including acts, errors and omissions, data breach investigation, data breach notification and credit monitoring costs) arising from: (i) breaches of computer systems and data security, (ii) violations of any privacy right, (iii) breaches of data privacy and data security laws and regulations, (iv) breach of PCI-DSS or any similar rules promulgated by the PCI Council, and (v) data theft, damage, destruction, or corruption, including unauthorized access, unauthorized use, identity theft, theft of personally identifiable information, and transmission of a computer virus or other type of malicious code. For the avoidance of doubt, your insurance coverage shall not limit your liability as set forth under this Open Banking Services Agreement.

5. SUBCONTRACTORS

5.1 You will require any subcontractor who Processes or has access to End User Data or Third-Party Data Provider Confidential Information to comply with requirements substantially equivalent to your obligations under this Open Banking Services Agreement, as applicable to the scope and nature of such subcontractor’s work.

5.2 Upon Third-Party Service Provider’s request, you shall provide a list of all subcontractors (a) if necessary for NMI, Third-Party Service Provider or any Third-Party Data Provider to comply with the request of a regulator, or (b) if NMI, Third-Party Service Provider or any Third-Party Data Provider reasonably believes that you have breached your obligations under this Open Banking Services Agreement. In the case of (b), you acknowledge that NMI, Third-Party Service Provider or its Third-Party Data Provider(s) will have the right to refuse (or cease to allow) access to, or to require you to refuse (or cease to allow) access to a subcontractor as necessary to comply with third-party oversight or other risk management obligations under applicable Laws. Any list of subcontractors provided pursuant to this provision shall be your Confidential Information.

Exhibit C
Third-Party Data Provider Terms

1. Money Movement Open Banking Services End User Terms and Conditions

(A) End User Access. You must ensure, prior to any access or use of the Open Banking Services, each End User’s agreement to minimum end user terms and conditions governing such End User’s use and access to the Open Banking Services in the form of an end user license agreement governing such End User’s use of the Open Banking Services that is substantially equivalent to and includes terms at least as protective of NMI, Third-Party Service Provider, and Third-Party Data Provider as those minimum end user terms and conditions as detailed in the Money Movement Open Banking Services End User Terms and Conditions (“EULA“) (set forth at https://www.dwolla.com/legal/open-banking-end-user-terms) and incorporated herein by reference. You are responsible for all activity that occurs in your End User accounts and for your End User’s compliance with this Open Banking Services Agreement and the EULA.

(B) Updates. NMI and Third-Party Service Providers may amend and supplement the EULA at any time during the Term by providing notice to you (in the case of a Third-Party Service Provider, either directly or through NMI). You will have thirty (30) days from receipt of such notice to update your EULA to reflect such amendment or supplement, or as otherwise provided by NMI and/or Third-Party Service Provider.

(C) Your specific Terms. You must update the EULA, based on your specific use case, to: (i) accurately set forth what data, including all compilations, aggregations, and combinations of the same, is collected, how collected data will be used, and how collected data will be accessed, shared, exchanged, or sold; (ii) provide clear and conspicuous disclosures to all End Users and prospective End Users, segregated from other material, and present in valid and enforceable terms and conditions, sufficient to comply with applicable Laws regarding the collection, use, and sharing described, including Anonymous & Aggregated Data; (iii) identify or disclose to each End User any and all categories of third parties to whom End User Data may be provided or how End User Data will be used, accessed, received, stored, shared, sold, or processed; and (iv) describe how the End User Data will be protected in the event that you cease operating as a going concern or otherwise cease to make available your application and/or mobile website to End Users, describing how End User Data in your possession or control will be safeguarded, deleted, and purged in such circumstances. A reference to your privacy policy is included in Section 2 of the EULA. If your privacy policy does not cover the items set out in this Section 1(C), or meet the EULA requirements set out in this Open Banking Services Agreement, you agree to update the EULA or otherwise provide the information required by this Open Banking Services Agreement to each of your End Users and obtain their agreement to such by express consent.

2. DATA REQUIREMENTS

You will provide to Third-Party Service Provider, either directly or through NMI, as determined by Third-Party Service Provider, information regarding your data requirements, which Third-Party Service Provider may disclose to Service Provider(s) and/or Third-Party Data Providers, who, in the event Confidential Information is being shared, are under written confidentiality obligations with Third-Party Service Provider consistent with those set out in this Open Banking Services Agreement, in order to facilitate its provision of the Open Banking Services. You shall not charge End User any fees that identify, or are identifiable to, NMI, Third-Party Service Provider, any Service Provider(s), Third-Party Data Provider, or to End User’s use of the Open Banking Services.

3. API MONITORING

NMI, Third-Party Service Provider, Service Provider(s) and/or Third-Party Data Providers, as applicable, have the right to monitor any and all use of the Open Banking Services and Third-Party Data Provider connections to the Open Banking Services (including frequency of access and types of data received) without notice to you or your personnel.

4. DATA HOSTING

You may only host and/or store End User Data and any Third-Party Data Provider Confidential Information you receive from locations within the United States unless otherwise approved in advance and in writing by Third-Party Service Provider and/or applicable Third-Party Data Providers.

5. DATA USE AND CREDENTIALS

(A) Credentials and Previously Collected Data.

(i) Credentials. Except as otherwise expressly permitted in this Open Banking Services Agreement, you shall not, and you shall not permit or enable any third party or service provider to collect, store, or use any End User bank account credentials as part of their integration with the Open Banking Services, or access any data relating to an End User that you know or have reason to believe was procured via screen scraping. Before accessing the Open Banking Services, you must stop using and Destroy any End User bank account credentials you hold. Upon NMI’s and/or Third-Party Service Provider’s request, you must certify and provide reasonable verification that you have Destroyed such data and that you do not have any End User bank account credentials.

(ii) Previously Collected Data. Prior to accessing the Open Banking Services, you shall delete any End User data which was not obtained in accordance with the terms of this Open Banking Services Agreement or through a provider with a valid agreement with the applicable Third-Party Data Provider.

(iii) Deletion of End User Data. You shall delete or anonymize End User Data (1) as required by Privacy Laws, (2) upon request by an End User or (3) upon notification of a deletion request from Third-Party Service Provider. If you access or retain End User Data that is not expressly consented to by the End User, you shall promptly delete such End User Data. To the extent permitted under applicable Laws, you may retain Nonpublic Personal Information for the period reasonably necessary to provide the services requested by the applicable End User or as otherwise required by applicable Laws. Upon termination of this Open Banking Services Agreement for any reason, you shall Destroy all End User Data in accordance with your retention policies, unless you have permission from the applicable End User to retain such End User Data, you continue to maintain appropriate technical and organizational safeguards for such End User Data and such retention is not prohibited under applicable Laws. Within sixty (60) days following termination of this Open Banking Services Agreement you must certify and provide verification to NMI and/or Third-Party Service Provider that you have complied with the deletion requirements of this Section 5(A)(iii).

(B) End User Data. With respect to End User Data made available through the Open Banking Services from Third-Party Data Provider, you will not, nor will you attempt to or otherwise enable a third party to: (i) use, disclose or process the End User Data to target market products or services to End Users that are directly competitive to those offered by any Third-Party Data Provider, by using such End Users’ status as a customer of a Third-Party Data Provider as criteria; (ii) use any information obtained through the Open Banking Services, including, without limitation, any APR, APY, credit limit or any other information contained in the End User Data to ascertain confidential or proprietary information of any Service Provider or any Third-Party Data Provider, including, without limitation, credit models, credit algorithms, and other business processes and calculations not available to the public. Further, you shall not, and shall not allow any third party to, collect, use, or retain any historical APR, APY, or credit information once updated values have been received via the Open Banking Services; (iii) sell, transfer or rent Nonpublic Personal Information to marketers or any other third party; (iv) use End User Data or Nonpublic Personal Information for marketing purposes, including, without limitation, cross-selling or targeted advertising, unless you obtain NMI or Third-Party Service Provider’s prior express written consent, as applicable, and express consent from the applicable End User for such use and such use is in strict compliance with Privacy Laws; (v) combine Nonpublic Personal Information relating to an End User with data relating to other End Users or with data obtained from third parties or other sources with the intent of extracting unconsented data or unauthorized data; (vi) Process End User’s bank credentials other than as required to access or use the Open Banking Services, as authorized by End User, as permitted by Third-Party Service Provider, and as permitted under Privacy Laws; (vii) process any Nonpublic Personal Information, or access or use the Open Banking Services, other than in strict compliance with Privacy Laws; or (viii) process any Nonpublic Personal Information, or access or use the Open Banking Services, in any manner that would be a breach of contract or agreement between NMI and Third-Party Service Provider or between End User and Third-Party Service Provider.

(C) Suspension of Access. A Third-Party Data Provider may immediately limit, suspend, or terminate your access to such Third-Party Data Provider’s End User Data (i) in the event of a material financial or reputational risk to such Third-Party Data Provider; (ii) in the event of a Security Incident or a threat that affects the stability, security and integrity of the Third-Party Data Provider’s End User Data or systems; (iii) if such Third-Party Data Provider reasonably believes that you are in breach of the data protection and security requirements; or (iv) for any other reason in Third-Party Data Provider’s sole discretion, including, without limitation, if reasonably necessary to avoid violating applicable Laws or regulatory guidance.

(D) FCRA. In addition to the restrictions set forth in this Open Banking Services Agreement, you shall notify Third-Party Service Provider and/or NMI, as applicable, as legally permitted and practicable of any regulatory investigation initiated by any regulator with jurisdiction over you involving FCRA. You will not use the End User Data as a factor in establishing an individual’s eligibility for credit, insurance, employment or any government license or benefit, to take any “adverse action” (as defined in the FCRA), or in any manner that would cause Third-Party Service Provider, any Third-Party Data Provider or the End User’s applicable financial institution, to be deemed a “furnisher” as the term is defined in the FCRA. If Third-Party Service Provider or its Third-Party Data Providers reasonably determine that your use of End User Data may reasonably cause Third-Party Service Provider or its Third-Party Data Providers to be deemed a “furnisher”, Third-Party Service Provider may terminate this Open Banking Services Agreement upon notice to you in writing by certified or registered mail, a nationally recognized overnight courier service or, where specified, via email. Notices shall be deemed to have been received (i) on the date delivered if by a recognized overnight courier, fees prepaid; (ii) on the date received, if by registered or certified mail (fees prepaid, return receipt requested); or (iii) in the case of email, on the day the email is sent if sent during normal business hours, or, if not, on the subsequent business day.

6. COMPLIANCE; AUDITS

(A) In addition to the audit set out in Section 4.2 of the Open Banking Services Agreement, during the Term of the Open Banking Services Agreement and for one year thereafter, you will, upon reasonable advance written notice from Third-Party Service Provider and/or NMI, (i) permit Third-Party Service Provider, through its internal and external auditors or those of any Third-Party Data Provider, to audit, review and inspect (1) your books, records, and other documents, including security logs, and (2) your systems, networks, and facilities (an “Audit“), or (ii) provide to NMI, Third-Party Service Provider or any Third-Party Data Provider a written attestation of your compliance with the terms and conditions of this Open Banking Services Agreement governing the Processing of End User Data, the prompt reporting of all Security Incidents, and obligation to refrain from re-identifying or attempting to re-identify any aggregated or de-identified End User Data (an “Attestation“).

(B) All Audits will be conducted for the sole and exclusive purposes of confirming your compliance with the data handling and security terms and conditions of this Open Banking Services Agreement, and will occur during regular business hours, at NMI’s, Third-Party Service Provider’s or an applicable Third-Party Data Provider’s sole cost and expense, and, except following the occurrence of a Security Incident, no more frequently than once per year. You agree to reasonably cooperate with any Audit performed pursuant to this Section 6 and must promptly take all actions necessary to remediate any material deficiencies and non-compliance discovered as a result of any Audit or Attestation.

(C) Information Security Audits. At least annually during the Term, you must have a certified independent public accounting firm or another independent, certified, industry-recognized third party: (i) conduct a review or assessment and provide a full attestation, review, or report under SOC 2 Type II or an equivalent assessment framework such as ISO 27001 (or such reasonably comparable standard acceptable to Third-Party Service Provider in its reasonable sole discretion) of all your systems and operational controls used by you to access the Open Banking Services or access, store, or process any End User Data; and (ii) conduct and provide a full report of an independent network and application penetration test.

(D) You must provide copies of all such reports and the results of any testing to NMI and Third-Party Service Provider (each, a “Security Assessment Report“).

(E) All Attestations, Security Assessment Reports and the results of any of your Audits will be considered your Confidential Information; provided, however, that NMI, Third-Party Service Provider and/or Service Providers may disclose copies of the same to any Third-Party Data Provider at their sole discretion, provided such Third-Party Data Provider is bound by written obligations of confidentiality which are in no event less than a reasonable standard of care.

(F) Government Audits. Nothing in this Exhibit C is or will be construed as limiting the rights of any governmental or regulatory authority to conduct audits or investigations. You acknowledge that NMI and Third-Party Service Provider intend to fully comply with all governmental and regulatory authorities of NMI, Third-Party Service Provider and Third-Party Data Provider, including with respect to any law enforcement or judicial investigations, and that in connection with the foregoing, NMI and Third-Party Service Provider may disclose the identity of, and any information transmitted or received by, persons accessing the Open Banking Services. You agree to fully cooperate with any audits or investigations conducted by a governmental or regulatory authority pursuant to applicable Laws.

(G) Data Protection Audits.

(i) You shall be audited or assessed at least annually by internal auditors and/or accredited external auditors/auditing firms on various components of your enterprise and platforms in accordance with industry best practices. At least annually, you shall provide NMI and Third-Party Service Provider with an audit report, issued by an independent third-party auditor, demonstrating your compliance with Privacy Laws and your related obligations under this Open Banking Services Agreement (each a “Data Protection Audit Report“). In addition, you shall make available to NMI and Third-Party Service Provider all information reasonably requested by NMI and Third-Party Service Provider required pursuant to NMI’s or Third-Party Service Provider’s risk assessment policy, as applicable. Notwithstanding the foregoing, you will not provide a copy of your internal risk assessment to NMI or Third-Party Service Provider. NMI and Third-Party Service Provider shall treat all such Data Protection Audit Reports as your Confidential Information and shall not use the Data Protection Audit Reports for any other purpose. Notwithstanding the foregoing, NMI and Third-Party Service Provider may disclose copies of the same to Third-Party Data Provider(s) in their sole discretion, provided that such Third-Party Data Providers are subject to a confidentiality agreement with NMI, Third-Party Service Provider, or Service Provider(s) that binds such Third-Party Data Provider to maintaining the confidentiality of your Confidential Information consistent with the confidentiality provisions of this Open Banking Services Agreement.

(ii) In the event of (1) a Security Incident or (2) NMI or Third-Party Service Provider, in each of their sole and reasonable discretion, determine that a Data Protection Audit Report you provide fails to adequately demonstrate your compliance with Privacy Laws or your related obligations under this Open Banking Services Agreement, you shall upon NMI’s or Third-Party Service Provider’s reasonable written request, make available to NMI or Third-Party Service Provider, as applicable, all reasonably required information necessary to demonstrate compliance with your obligations under the Privacy Laws and your related obligations under this Open Banking Services Agreement, and allow for (and contribute to) audits, including inspections conducted by NMI or Third-Party Service Provider or another auditor under the instruction of NMI or Third-Party Service Provider, subject to the following:

(a) Such audits, including inspections, shall begin upon not less than 15 days’ notice except in the event of a Security Incident, provided that the audit will (1) not disrupt your business; (2) be conducted during business hours; (3) not interfere with the interest of your other customers; and (4) not exceed a period of two successive business days;

(b) NMI, Third-Party Service Providers (or their third party auditors, respectively) will comply with your relevant security policies and appropriate confidentiality obligations as set out in this Open Banking Services Agreement;

(c) You will contribute to the audit by providing NMI or Third-Party Service Provider, as applicable, with reasonable assistance; and

(d) Notwithstanding anything herein to the contrary, physical or logical access to your computer systems will not be permitted, and you will not be required to display or otherwise disclose any confidential information of any third party or any information that could jeopardize the security or integrity of your computer systems.

(H) Notwithstanding anything to the contrary, upon written request, you will provide information reasonably needed to demonstrate compliance with the obligations in this Exhibit C and Privacy Laws.

Exhibit D
Terms and Conditions for Plaid Open Banking Services and Products

The Terms and Conditions for Plaid Open Banking Services and Products (“Open Banking Services Exhibit – Plaid“) applies to your use of the Open Banking Services provided to you through Plaid Inc. (“Plaid“). Hereinafter “you”, “your”, or “Company” means the Company and “us”, “we” or “our” refers to NMI (protecting Plaid).

For purposes of this Open Banking Services Exhibit – Plaid, Third-Party Service Provider or Third-Party Service Providers, as referenced in the Open Banking Services Agreement, refers to Plaid Inc. In addition, for the sake of clarity and for purposes of this Open Banking Services Exhibit – Plaid, any reference in the Open Banking Services Agreement to Exhibit A will be to this Exhibit D instead and Exhibits B and C of the NMI Open Banking Services Agreement do not apply to your use of the Open Banking Services provided to you through Plaid.

Definitions

“Anonymous & Aggregated Data” means End User Data and information that is anonymized and aggregated with similar data and information to the extent that the original End User Data and information is no longer attributable to NMI, Plaid, you, or to any specific End User.

“Balance Check” means an Open Banking Service ordered by you that you can use to periodically gather account balances in an account without collecting transaction data. Account types accessed include depository accounts. You can retrieve these account balances using an API request to help ensure your End Users have the appropriate funds.

“End User” or “End Users” means (a) a natural person who is a resident of the United States and at least 18 years old, or (b) a business or other entity formed or registered in the United States, in each case who is authorized by you to use or access the Open Banking Services and who has (i) been supplied an identification and password by you or at your direction or (ii) for whom a unique user record is created by or authorized to be created by you within the Open Banking Services.

“End User Data” means End User’s login, password, any other authentication information required by you or an End User’s third-party financial institution, and any End User transaction data.

“Instant Account Verification (without identity check)” means an Open Banking Service ordered by you that accesses financial account information, including account and routing numbers, for direct deposit accounts such as checking, savings, and money market accounts.

“Nonpublic Personal Information” means personally identifiable financial information as defined under Regulation P, 12 C.F.R. Part 1016, or the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., or information otherwise considered privileged, confidential, private, nonpublic or personal given protected status under applicable law.

“Open Banking Services” means Instant Account Verification, Balance Check, and the other products and services ordered by you through a Proposal to which these terms apply and are made available by Plaid through its online, web-based application or mobile components via designated websites, IP addresses, application programming interface(s), or other means.

“Third-Party Data Provider” means any third-party entity, including financial institutions, which provides End User Data or other data to NMI or NMI’s technology providers for use in the Open Banking Services.

1. Restrictions

Unless Plaid specifically agrees otherwise in writing, you will not, and will not enable or assist any third party to: (i) attempt to reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid services described at https://www.plaid.com (“Plaid Services“); (ii) modify, translate, or create derivative works based on the Plaid Services; (iii) make the Plaid Services or information and data of End Users provided to you via the Plaid Services (such information and data, the “Plaid-Provided Data“) or any derivative work thereof available to, or use the Plaid Services or Plaid-Provided Data (or any derivative work thereof) for the benefit of, anyone other than you or End Users; (iv) sell, resell, license, sublicense, distribute, rent, or lease any Plaid Services or Plaid-Provided Data (or any derivative work thereof) to any third party, or include any Plaid Services or Plaid-Provided Data (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate information from any source regarding the performance of the Plaid Services or Plaid-Provided Data; or (vi) attempt to create a substitute or similar service through use of, or access to, the Plaid Services or Plaid-Provided Data. You will use the Plaid Services and Plaid-Provided Data only in compliance with: (a) your application, use case, and other restrictions agreed between Plaid and NMI; (b) the Plaid developer policies (available at https://www.plaid.com/legal); (c) Plaid’s applicable technical user documentation (available at https://www.plaid.com/docs); and (d) any agreements between you and End Users (for clarity, including any privacy policy or statement). Notwithstanding anything to the contrary, as between Plaid and you, you accept and assume all responsibility for complying with all applicable Laws in connection with your activities involving any Plaid Services, Plaid-Provided Data, or End User data. You acknowledge and agree that: (I) Plaid is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the Fair Credit Reporting Act (“FCRA“); and (II) the Plaid-Provided Data is not a “consumer report” under the FCRA. You represent and warrant that you will not, and will not permit or enable any third party to, use the Plaid Services (including Plaid-Provided Data) as, or as part of, a “consumer report” as that term is defined in the FCRA, or otherwise use the Plaid Services (including Plaid-Provided Data) such that the Plaid Services (including Plaid-Provided Data) would be deemed “consumer reports” under the FCRA. Notwithstanding anything to the contrary, you will be bound by, and will only use the Plaid Services and Plaid-Provided Data in compliance with, the terms and conditions set forth in the Open Banking Services Agreement.

2. Secondary Investors

If applicable and agreed to by you and NMI, and subject to this Section 2 (Secondary Investors), you may request that Plaid or NMI disclose Plaid-Provided Data or an NMI product or service including or incorporating Plaid-Provided Data (collectively, the “Shared Data“) to your Secondary Investors. “Secondary Investor” means a third-party investor or purchaser of a financial product originated by you and provided to an End User (e.g., a loan), with which investor or purchaser Plaid maintains a separate technical integration.

(i) You represent and warrant to Plaid that, before disclosure of Shared Data to any Secondary Investor, you will provide and obtain all required (including under applicable Laws) notices and consents from the applicable End User with respect to disclosure of Shared Data to such Secondary Investor by Plaid or NMI.

(ii) Notwithstanding anything to the contrary: (a) as between Plaid and you, solely you are responsible for your relationships with Secondary Investors and with NMI, including any related billing matters, technical support, or disputes; (b) you will enter into legally binding written agreements with each Secondary Investor that are consistent with this Section 2 (Secondary Investors) and all applicable terms and conditions of this Open Banking Services Exhibit – Plaid (Terms and Conditions for Plaid Open Banking Services and Products), including Section 1 (Restrictions); and (c) as between Plaid and you, you will remain responsible for the Secondary Investors’ compliance with all of the terms and conditions of this Open Banking Services Exhibit – Plaid (Terms and Conditions for Plaid Open Banking Services and Products) (including terms relating to use of Plaid-Provided Data or Shared Data).

(iii) As between Plaid and you, you will be fully liable for: (a) any breach by you of this Section 2 (Secondary Investors); (b) any acts or omissions of Secondary Investors; and (c) any dispute arising among you, NMI, Secondary Investors, and/or End Users relating to the disclosure or use of Shared Data as contemplated in this Section 2 (Secondary Investors).

3. Privacy and Authorizations

Before any End User engages with NMI products or services which include, are derived from, or incorporate the Plaid Services, you warrant and will ensure that you provide all notices and obtain all consents required under applicable Laws to enable Plaid to process End User data in accordance with Plaid’s privacy policy (currently available at https://www.plaid.com/privacy). You will not: (i) make representations or other statements with respect to End User data that are contrary to or otherwise inconsistent with Plaid’s privacy policy; or (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent.

4. DISCLAIMER; ENFORCEMENT

THE PLAID SERVICES, PLAID-PROVIDED DATA, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES AND MATERIALS PROVIDED BY PLAID IN CONNECTION WITH THIS OPEN BANKING SERVICES EXHIBIT – PLAID ARE PROVIDED “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE SERVICES ARE FREE FROM DEFECTS. WITHOUT LIMITING THE FOREGOING IN THIS SECTION 4 (DISCLAIMER; ENFORCEMENT), NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY REPRESENTATION OR WARRANTY AS TO THE PLAID-PROVIDED DATA THAT MAY BE OBTAINED FROM USE OF THE PLAID SERVICES OR THAT ANY PLAID SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. PLAID WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN NMI AND YOU AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST YOU, WITHOUT NMI’S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE PLAID-PROVIDED DATA (INCLUDING FI DATA) AND PLAID SERVICES THAT ARE PROVIDED BY PLAID TO NMI OR YOU.

5. FI Data

Through the Open Banking Services or Plaid Services, you may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other data source (each, as designated by Plaid, “FI“, and such information, the “FI Data“).

(i) Your Obligations.

(A) End User Consents. You will provide all notices to, and obtain all express consents from, each End User as required under applicable Laws in connection with your use, storage, and other processing of any FI Data (such notices and consents, the “Express Consents“). Express Consents will: (1) be clear and conspicuous; (2) generally specify the categories of FI Data that you will receive and how you will use, store, and otherwise process FI Data; (3) be valid, enforceable, and expressly accepted by each End User; (4) identify any and all third parties or categories of third parties to whom you may provide FI Data for processing; (5) specify how End Users may exercise their right to revoke their Express Consent; and (6) include any other required disclosures under applicable Laws. You will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) sufficient to demonstrate your compliance with this Section 5(i)(A) (End User Consents) and will promptly provide such records to Plaid upon request.

(B) Scope of Access. You will only access FI Data for which you have obtained Express Consents from the End User for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User (such use case, the “Permitted Use Case“). For clarity, key factors Plaid will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with your application that the End User has enrolled in, whether your application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which you operate and/or store FI Data. If you possess FI Data that exceeds the scope of the End User’s Express Consents, you will use industry-standard means to permanently and securely delete (“Delete“) such FI Data; provided that you may retain such FI Data to the extent required by applicable Laws. If you become aware that any data you receive from Plaid does not relate to the End User that you originally requested FI Data for, you will promptly notify Plaid and will Delete such data.

(C) Data Use. You will use, store and otherwise process FI Data solely in accordance with the End User’s Express Consents and applicable Laws.

(D) Data Disclosure. You will not disclose, transfer, syndicate or distribute FI Data to any third party (including your service providers) except as permitted by the End User’s Express Consent and in accordance with applicable Laws. Notwithstanding anything to the contrary, you will not sell FI Data.

(E) Data Deletion. You will promptly Delete any FI Data upon request by the applicable End User; provided that you may retain copies of FI Data solely to the extent required by applicable Laws.

(F) No Attribution. You will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User’s account with an FI in connection with your application. In addition, you will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on your receipt of FI Data under the Open Banking Services Agreement or this Section 5 (FI Data).

(G) No Other Access. During the term of the Open Banking Services Agreement, you will only access FI Data through the Plaid Services or another manner that uses the FI’s authorized APIs. You will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. You will immediately Delete any such End User log-on credentials in your possession. You will maintain records to demonstrate compliance with this Section 5(i)(G) (No Other Access). For the avoidance of doubt, nothing in this Section 5(i)(G) (No Other Access) will prohibit you from engaging any third party to obtain services similar to the Plaid Services, provided that such third-party services enable your access to FI Data solely via the FI’s authorized APIs.

(H) Compliance with Laws. You will comply with all applicable privacy, security, and other laws pertaining to FI Data. You will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable Laws. For the avoidance of doubt, you acknowledge that Section 1033 of the Dodd-Frank Act may include obligations on you relating to processing, handling and protecting FI Data. You will maintain a program designed to ensure compliance with applicable Laws, including appropriately training your personnel.

(I) Information Security Program. You will maintain a comprehensive written information security program approved by your senior management (“Infosec Program“). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to your risk profile and activities, the nature of your application, and the nature of the FI Data received by you. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable Laws. You will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in your application or on your systems.

(J) Security Breach Obligations. You will notify NMI and Plaid promptly (and in any event within twelve (12) hours) via an email to security@plaid.com, following you becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information related to such Security Breach that Plaid and/or NMI may reasonably request. You will reasonably cooperate with Plaid and/or NMI in investigating and remediating Security Breaches. You will be responsible for the costs of investigating, mitigating, and remediating the Security Breach. “Security Breach” means any event that compromises your application or your systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in the unauthorized use, disclosure, or loss of FI Data.

(K) FI Confidential Information. If Plaid discloses to you any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, “FI Confidential Information“), such materials will be subject to the same obligations that apply to NMI’s Confidential Information under the Open Banking Services Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section 5(i) (Your Obligations). You will promptly Delete FI Confidential Information in your possession upon Plaid’s request and will provide a written certification regarding such Deletion.

(L) Oversight and Cooperation. Toward assessing your material compliance with this Section 5 (FI Data), you will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that you are not in material compliance with this Section 5 (FI Data), Plaid will notify you and, upon Plaid’s request, you will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided by you in accordance with the immediately prior sentence is insufficient (in Plaid’s reasonable discretion) to demonstrate such material compliance, you will submit to a third-party audit by a firm selected by you from a list of audit firms reasonably approved by Plaid to verify such compliance. Plaid and FIs may also conduct technical or operational assessments of you, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.

(M) Information Sharing. Where required by an FI or relevant to your access or use of FI Data from that FI, Plaid may share with such FI certain information related to your compliance with this Section 5 (FI Data), including with respect to your Infosec Program. Plaid will use commercially reasonable efforts to require that such FI treat any such information in a confidential manner.

(N) Insurance. You will maintain insurance coverage appropriate to your risk profile and activities, the nature of your application, and the nature of the FI Data received by you; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.

(O) Access Frequency. The parties acknowledge that as of the effective date of the Open Banking Services Agreement, no guidelines regarding your frequency of “batch” pulls of FI Data (such guidelines, the “Guidelines“) apply to Plaid end clients. Notwithstanding the foregoing in this paragraph: (1) You will comply with any Guidelines provided in writing by Plaid (including via NMI); and (2) Plaid and NMI may enforce such Guidelines to the extent necessary in accordance with Plaid’s standard practices, which may include throttling, suspension or termination of your access.

(P) Your Marks License. You hereby grant to Plaid, each FI (and each of their third-party service providers), and NMI the non-exclusive and non-transferable right and license to use your trademarks and service marks solely in connection with consent management activities, including use associated with your End User-facing consent management portals operated by Plaid or an FI.

(ii) Suspension. Plaid and/or NMI may suspend your access to the Open Banking Services, Plaid Services or FI Data, in whole or in part, if Plaid and/or NMI determines or reasonably believes that: (a) there is unauthorized access to the Plaid Services and/or the Open Banking Services via the administrative controls NMI makes available to you; (b) you have breached this Section 5 (FI Data); (c) your use of the Open Banking Services, Plaid Services or FI Data will or has materially violated the Open Banking Services Agreement and/or an agreement between Plaid and an applicable FI; (d) your use of the Open Banking Services, Plaid Services or FI Data will or does pose a risk of material harm, including material reputational harm, to End Users, an FI, the Open Banking Services or the Plaid Services. In addition, an FI may suspend your access to FI Data with respect to such FI. Plaid will use commercially reasonable efforts to: (1) notify NMI prior to any suspension described in this paragraph; (2) discuss with NMI in good faith any such suspension; and (3) resume your access to the Plaid Services and FI Data as promptly as is practicable after the basis for such suspension is cured to Plaid’s (and, as applicable, the relevant FI’s) reasonable satisfaction. Unless prohibited by applicable Laws, in the event of a suspension by NMI, NMI will use reasonable efforts to provide timely notice of the suspension to you, including a description of the scope and reasons for the suspension. Such notice may occur after the suspension or restriction has occurred. NMI may also, in its reasonable discretion, contact any End User for NMI’s purposes, including fraud investigation and/or risk management purposes. If NMI contacts an End User for such purposes, NMI will notify you to the extent permissible under applicable Laws. The parties will cooperate in good faith to remediate the reason for any suspension. Upon resolution of the issue causing the suspension, NMI will promptly permit you to resume using the Open Banking Services.

(iii) Indemnity. In addition to Section 8 of the Open Banking Services Agreement, you will indemnify, defend and hold harmless each FI, Plaid, NMI and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to you hereunder; or (b) your unauthorized or improper use of FI Data provided to you hereunder (including any unauthorized data sharing, transmission, access, display, storage, or loss). This Section 5(iii) (Indemnity) is not subject to any limitation of liabilities set forth in the Open Banking Services Agreement. Each FI is a third-party beneficiary of this Section 5(iii) (Indemnity).

(iv) Modifications. You acknowledge that continued access to FI Data provided by certain FIs may necessitate modifications to this Section 5 (FI Data) pertaining to all applicable Plaid end clients. You will accept such modifications to continue accessing or using the Plaid Services with respect to such FIs. Plaid will use commercially reasonable efforts to notify NMI of the modifications and the effective date of such modifications. If you object to the modifications, your exclusive remedy is to cease any and all access and use of the Plaid Services as it relates to the applicable FI(s). Continued access to or use of such Plaid Services after the effective date of such modifications to this Section 5 (FI Data) will constitute your acceptance of such modifications.

(v) Miscellaneous. In the event of a conflict with any other agreement or provision (including other provisions within the Open Banking Services Agreement), the terms and conditions of this Section 5 (FI Data) will govern and prevail. Capitalized terms used in this Section 5 (FI Data) and not otherwise defined will have the meanings ascribed to them in the Open Banking Services Agreement. All provisions of this Section 5 (FI Data) will remain in force in the event of the termination or expiration of this Section 5 (FI Data), this Open Banking Services Exhibit – Plaid, or the Open Banking Services Agreement.

Money Movement Account Terms of Service

Last Updated: October 12, 2026

These Account Terms of Service (“TOS“) are a legally binding agreement between you, Dwolla, Inc. (“NMI“, “us“, “our“, or “we“) as an affiliate of Network Merchants, LLC, and our financial institution partners, each a party insofar as you will access one of the services they provide (“Financial Institution Partner“). This TOS applies to your creation and use of a money movement account (“Money Movement Account“) provided to you through one of NMI’s clients. NMI offers a payment software platform (the “Money Movement Platform“) to its clients, who use the Money Movement Platform to provide services to consumers and/or businesses like you. The Money Movement Platform permits users to initiate and send payment instructions to one or more of our Financial Institution Partners, who will provide the funds transfer services based on those instructions.

Our Financial Institution Partners are party to this TOS only in each entity’s capacity as the financial institution that holds funds or performs funds transfers, as more fully described at https://www.dwolla.com/legal/about-our-financial-institution-partners. Except as specifically set forth in this TOS, the Financial Institution Partners are not responsible for the Money Movement Platform or fulfillment of NMI’s obligations under this TOS.

It is important that you read and understand this TOS, as it governs your use of your Money Movement Account and any features of the NMI client’s application that rely on the Money Movement Platform. This TOS includes a binding arbitration provision, which affects your legal rights and may be enforced by the parties. By accessing or using your Money Movement Account and the NMI-Enabled Services, you accept and agree to be bound by this TOS. If you do not agree to these terms, you must immediately stop using the Money Movement Account and notify the NMI client who is providing you access to the NMI-Enabled Services that you wish to deactivate your Money Movement Account.

We may amend this TOS at any time by posting a revised version on dwolla.com or any other website we maintain for purposes of providing the Money Movement Platform or Money Movement Accounts. Amendments to the TOS are effective at the time we post them and your continued use of your Money Movement Account constitutes acceptance of any amendments.

1. Definitions.

In addition to the terms defined elsewhere in this TOS, the following capitalized terms have the meanings set forth below:

“Affiliate” of any party means any person or entity that controls, is controlled by, or is under common control with, such party.

“Business Customer” means a business, non-profit organization, or other entity that (a) is registered and located in the United States, and (b) creates a Money Movement Account for use other than primarily for personal, family, or household purposes.

“Laws” means all applicable federal, state, and local laws, statutes, rules, regulations, and guidance (including those governing privacy and protection of data), as amended from time to time, and any orders of any court, governing body, or agency having jurisdiction, together with the Rules.

“Money Movement Services” means, for purposes of this TOS only, your Money Movement Account, the NMI-Enabled Services, the Money Movement Platform, and the funds transfer and funds holding services provided by our Financial Institution Partners under this TOS, collectively.

“NMI client” means a Company (as such term is defined in the NMI General Terms and Conditions) that has entered into the Partner Terms and Conditions and Money Movement Service Terms with an NMI Affiliate and provides you with access to your Money Movement Account and the NMI-Enabled Services.

“NMI Affiliate” means Network Merchants, LLC or any of its Affiliates. NMI is an NMI Affiliate.

“Personal Customer” means a natural person who (a) is at least 18 years old, (b) is a legal resident of the United States, and (c) creates a Money Movement Account.

“Rules” means the operating rules, requirements, policies, procedures, and standards issued by the operators, sponsors, or regulators of the payment systems used by our Financial Institution Partners to effect transactions initiated through the NMI-Enabled Services, including the Nacha Operating Rules and Guidelines, the RTP Operating Rules and Guidelines of The Clearing House, the FedNow Service Operating Circular 8 and the FedNow Service Operating Procedures, and any other rules applicable to payment methods offered through the NMI-Enabled Services, as each may be amended from time to time.

2. Money Movement Platform and Money Movement Open Banking Services.

2.1 The Money Movement Platform is provided to one or more clients of NMI that provide you with access to services enabled by the Money Movement Platform, including the ability to create a Money Movement Account in the client’s application and to transmit instructions to initiate payments between you and such NMI client or another end user of the client’s application. These services are the “NMI-Enabled Services.”

2.2 In the event you use or access digital money management tools, including balance check or instant account verification, that one or more of NMI’s clients may provide to you and that access third party account information (“Open Banking Services“), such use or access is subject to and governed by the Money Movement Open Banking Services End User Terms and Conditions found at https://www.dwolla.com/legal/open-banking-end-user-terms (“EULA“). It is important that you read and understand this EULA. By accessing or using the Open Banking Services, you accept and agree to be bound by the EULA. If you do not agree to the terms and conditions in the EULA or no longer wish to use or access the Open Banking Services, you must notify the NMI client who is providing you access to the Open Banking Services that you wish to revoke your consent by removing the associated account from the NMI client’s application.

3. About Money Movement Accounts and the NMI-Enabled Services.

Your Money Movement Account can only be accessed through the NMI-Enabled Services in the NMI client’s application. NMI is not a money transmitter and does not perform money transmission or money transfer or payment services. All payments made based on the instructions transmitted to NMI through the NMI-Enabled Services are processed and disbursed by our Financial Institution Partners, who are regulated financial institutions. To the extent that your Money Movement Account permits you to hold a stored value of funds associated with your Money Movement Account (a “Money Movement Balance“), any funds recorded as held in your Money Movement Balance are held by our Financial Institution Partners in one or more pooled holding accounts. FUNDS HELD IN SUCH HOLDING ACCOUNTS MAY NOT BE ELIGIBLE FOR SHARE INSURANCE OFFERED BY THE NATIONAL CREDIT UNION SHARE INSURANCE FUND AND ARE NOT ELIGIBLE FOR INSURANCE SPONSORED BY THE FEDERAL DEPOSIT INSURANCE CORPORATION. IN THE EVENT OF A FINANCIAL INSTITUTION PARTNER RECEIVERSHIP, YOU MAY LOSE VALUE.

4. Creating Your Money Movement Account.

Money Movement Accounts are available to Business Customers and to Personal Customers. Money Movement Accounts must be used in accordance with any terms and conditions the NMI client imposes on your use of the application as well as this TOS. You agree that any information you provide to NMI to create your Money Movement Account is true and accurate at the time you create your Money Movement Account and you agree to update that information from time to time to ensure it remains true and accurate at all times you have an open Money Movement Account. If you fail to update this information, we may suspend or terminate your Money Movement Account. You authorize us to share this information with our Financial Institution Partners and other third parties in accordance with NMI’s privacy policy, available at https://www.nmi.com/policy/privacy/ (the “Privacy Policy“), as it may be updated from time to time. You also agree you have read and accepted Veridian Credit Union’s Notice of Your Financial Privacy Rights, available at https://www.veridiancu.org/webres/File/privacy-policy.pdf.

4.1 Business Customers. Business Customers must be businesses (including sole proprietorships), non-profit organizations, and other entities registered and located in the United States. If you create a Money Movement Account as a Business Customer, you represent and attest that (a) your Money Movement Account is not used primarily for personal, family, or household purposes; (b) you are authorized to provide the information described below; and (c) you are authorized to bind the Business Customer to this TOS.

4.2 Information Required. To create your Money Movement Account, we require that you provide us with your business name, and the full name and email address of the individual creating the Money Movement Account on behalf of your business. To access certain additional features, including a Money Movement Balance, we will request that you provide additional information to permit us to verify your identity, including: your business entity type, a valid U.S. physical address (not a P.O. Box or the address of a commercial mail receiving agency), phone number, and your tax identification number. Additionally, we may require personal information (including the full name, date of birth, social security number, and in some cases a form of photo identification) of any beneficial owners of your business, including at least one controller.

4.3 Businesses Owned by Minors. If you are a Business Customer that is owned by an individual who is not at least 18 years old, an authorized officer of your business who is at least 18 years old must create your Money Movement Account. In any case, businesses owned by minors under the age of 13 may not create a Money Movement Account.

4.4 NMI Master Accounts. If you are a NMI client, the Money Movement Account you create hereunder is a “NMI Master Account.” Your NMI Master Account is subject to all the terms contained herein as well as the Partner Terms and Conditions and Money Movement Service Terms you have accepted with NMI.

4.5 Personal Customers. If you are creating a Money Movement Account as a natural person, you must be (1) at least 18 years old and (2) a legal resident of the United States to create a Money Movement Account. To create your Money Movement Account, we require that you provide us with your first and last name and email address. To access certain additional features, including a Money Movement Balance, we will request that you provide additional information to permit us to verify your identity, including: your date of birth, social security number, and in some cases a form of photo identification.

4.6 USA PATRIOT Act Notice. Important information about procedures for opening a new account under the USA PATRIOT Act of 2001: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you create a Money Movement Account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see a form of identification with your photograph or other identifying documents.

5. Using Your Money Movement Account.

5.1 Linked Payment Account; Authorization to Debit or Credit. To transmit payment instructions, you must link at least one bank or credit union account at a state- or federally-chartered financial institution in the United States (each, a “Linked Payment Account“) to your Money Movement Account. When you transmit payment instructions using the NMI-Enabled Services, you authorize NMI to send such instructions to our Financial Institution Partner, who you authorize to credit or debit your Linked Payment Account in accordance with your instructions. You expressly authorize NMI, as originator, to originate such credit and debit entries to your Linked Payment Account. You are solely responsible for complying with any terms set by your bank or credit union with respect to your Linked Payment Account, including any fees (e.g., nonsufficient fund or overdraft fees).

5.2 Security. You are solely responsible for keeping secret your login information and password on the NMI client’s application that you use to access the NMI-Enabled Services. You are responsible for all activity conducted using your Money Movement Account whether or not you authorized the use of your Money Movement Account. NMI will never ask you for your login information or password on any application.

5.3 Compliance with Laws. You shall only use your Money Movement Account and the NMI-Enabled Services for lawful and legitimate purposes and you will at all times comply with all applicable Laws.

5.4 Prohibited Money Movement Account Activities. You shall not use your Money Movement Account or the NMI-Enabled Services to: (i) engage in illegal or fraudulent activities; (ii) benefit any country, organization, entity, or person embargoed or blocked by any government, including those on the sanctions lists maintained by the U.S. Office of Foreign Asset Control (OFAC); or (iii) engage in transactions related to or in furtherance of the following activities (“Prohibited Activities“):

Sale or purchase of illegal goods, including but not limited to stolen goods, illegal or controlled substances, and substances that pose a risk to consumer safety;
Cannabis and CBD-related businesses (including but not limited to manufacturers, dispensaries, and those engaged in the business of marketing, buying, growing, selling, or otherwise promoting medical or recreational cannabis or CBD products);
Cryptocurrency, virtual currency, or foreign exchange trading services, in each case other than funding or withdrawal transactions to or from a NMI client authorized by NMI to offer such services, and in all cases excluding decentralized cryptocurrency exchanges and unlicensed virtual asset service providers (VASPs);
Illegal services, including but not limited to counterfeit services, illegal gambling, multi-level marketing (MLM) programs, Ponzi or pyramid schemes, and money laundering;
Adult entertainment, including but not limited to escort services, encounter clubs, and pornographic products and services;
Debt collection, relief, counseling, or credit repair services;
Gun sellers, firearm or ammunition sales, related accessories, and the production or manufacture of weapons of mass destruction;
Manufacture, wholesale, distribution, or sale of e-cigarettes, vaping products, tobacco or nicotine products, and related paraphernalia, other than incidental retail sale by general-merchandise retailers;
Unlicensed or unregistered Money Services Businesses, as that term is defined at 31 C.F.R. 1010.100(ff) and under corresponding state regulations, including unlicensed payment facilitators, unregistered peer-to-peer transfer services, and informal value transfer systems;
White label ATM services; and
Promotion of hate, violence, harassment, or abuse.

In addition to the above Prohibited Activities, NMI and its Financial Institution Partners reserve the right to suspend your Money Movement Account or terminate this TOS in the event that you are using your Money Movement Account and the NMI-Enabled Services to conduct any activity we determine to be high risk or to expose us or other NMI clients or customers to an unacceptable level of risk. If we learn or suspect that you are using your Money Movement Account or the NMI-Enabled Services for any illegal or fraudulent purpose, we may share your information with any government or regulatory authority, financial institution, or law enforcement agency we deem necessary to fulfill our obligations to comply with applicable laws.

5.5 Support. You should contact the NMI client who provides you access to your Money Movement Account and the NMI-Enabled Services with any requests or questions related to your Money Movement Account. If you cannot obtain adequate assistance from such NMI client, you may contact NMI at support@dwolla.com.

5.6 Terminating Your Money Movement Account. If you desire to terminate your Money Movement Account, please contact the NMI client who provides you access to your Money Movement Account to request they close your Money Movement Account and to be sure that you have met all requirements for account termination. You may also contact support@dwolla.com, but you agree and acknowledge that NMI cannot close any account you have created with the NMI client directly or to resolve any dispute you may have with the NMI client. If your Money Movement Account is eligible to hold a balance, you must provide instructions as to where to transfer that balance, if any, prior to closing your Money Movement Account.

5.7 Dormant Money Movement Accounts. If your Money Movement Account is terminated or deactivated by you, by NMI, or as a result of the termination of expiration of the NMI client’s agreement with NMI, and you fail to provide instructions for any remaining Money Movement Balance, you authorize the return of your remaining Money Movement Balance to your Linked Payment Account or to you by other reasonable means. If we are unable to return your Money Movement Balance to you, our Financial Institution Partners may be required by law to deem the funds to be abandoned after a certain period of inactivity (a “Dormant Money Movement Account“). Where required by law, we will attempt to notify you if we believe your account is a Dormant Money Movement Account. If you do not respond to such attempts to notify you by providing instructions as to how to handle your remaining Money Movement Balance, our Financial Institution Partners will deliver them to the appropriate government authority. If we do not have sufficient information from you to determine your state of residence, we will deliver your Money Movement Balance to the Iowa Treasurer of State.

6. Payment Method Specific Terms.

6.1 ACH Payments. You agree that you will provide us sufficient information to satisfy the requirements of the Nacha Operating Rules to create instructions to make or receive a payment in the automated clearinghouse (“ACH“) network. NMI has established cutoff times for receipt of payment instructions and you understand that NMI cannot and does not guarantee any specific time in which ACH transactions initiated through your Money Movement Account will be completed. For questions regarding any specific transaction or its anticipated timing, please contact the NMI client who provides you access to your Money Movement Account or the NMI-Enabled Services.

6.2 Instant Payments. If the NMI client who provides you access to your Money Movement Account or the NMI-Enabled Services offers instant payments as an eligible payment method, the following terms apply. Instant payments may be processed through the RTP® network operated by The Clearing House (“RTP“) and/or the FedNow® Service operated by the Federal Reserve Banks (“FedNow“), and the rail used for any given transaction may be determined by NMI or our Financial Institution Partners. The terms below apply to each such transaction based on the rail used.

(a) Real-time payments. The following terms apply to any transaction processed through the RTP network. RTP transfers are made by our Financial Institution Partners. By submitting a payment instruction that is processed as a RTP transaction, you agree that we may share your information with our Financial Institution Partners and that you have read and you accept Veridian Credit Union’s Notice of Your Financial Privacy Rights, available at https://www.veridiancu.org/webres/File/privacy-policy.pdf. You shall transmit to NMI all information necessary to effectuate payment in accordance with the RTP Rules established by The Clearing House. You represent and warrant that (i) each RTP instruction you submit is made in accordance with the RTP Rules; (ii) as sender of such RTP transaction, you authorize our Financial Institution Partners to initiate such payment and to debit your Linked Payment Account and send a credit to the receiver’s account in the amount set out in your instruction; (iii) your RTP transaction is initiated in connection with a separate agreement with the receiver; and (iv) such RTP transaction does not violate applicable law. You agree that you shall enter into an agreement with each of the receivers prior to sending NMI an RTP transaction in which they authorize you to send such RTP transaction. Further, you agree that you waive, release, and discharge all rights or claims against our Financial Institution Partners in connection with the RTP services. You agree to retain records related to your RTP transactions for 7 years following the date you send such RTP instruction to NMI and to provide such data to NMI upon request. Without limiting the generality of the foregoing, you may not send RTP transactions (y) that exceed the limits provided for in the RTP Rules or any other applicable transaction limits expressly imposed on your Money Movement Account or (z) to any account not located within the United States.

(b) The following terms apply to any transaction processed through the FedNow Service. FedNow is a service for instant payments built by the Federal Reserve. Instant payments refers to, according to the Federal Reserve, the ability for consumers and businesses to send and receive funds from their accounts at financial institutions in real time, any time of day, any day of the year, with immediate funds (within a matter of seconds) availability to receivers. FedNow transfers are made by our Financial Institution Partners. By submitting a payment instruction that is processed as a FedNow transaction, you agree that we may share your information with our Financial Institution Partners and that you have read and you accept Veridian Credit Union’s Notice of Your Financial Privacy Rights, available at https://www.veridiancu.org/webres/File/privacy-policy.pdf. You shall transmit to NMI all information necessary to effectuate payment in accordance with all current operational rules, policies, procedures, regulations, agreements, manuals, messaging standards, bulletins, notices and similar documents or other standards of the FedNow Service issued or established by the Board of Governors of the Federal Reserve System or any Federal Reserve Bank to the extent applicable to the FedNow Service and including by way of example only, the FedNow Operating Circular 8 and the FedNow Service Operating Procedures (collectively, the “FedNow Rules“). You represent and warrant that (i) each FedNow instruction you submit is made in accordance with the FedNow Rules; (ii) as the sender of such FedNow transaction, you authorize our Financial Institution Partners to submit such payment to the FedNow Service, debit your Linked Payment Account and send a credit to the receiver’s account in the amount set out in your instruction payment message; (iii) your FedNow transaction is initiated in connection with a separate agreement with the receiver; and (iv) such FedNow transaction does not violate applicable law. You agree that you shall enter into an agreement with each of the receivers prior to sending NMI a FedNow transaction in which they authorize you to send such FedNow transaction. Further, you agree that you waive, release, and discharge all rights or claims against our Financial Institution Partners in connection with the FedNow services. You agree to retain records related to your FedNow transactions for 7 years following the date you send such FedNow instruction to NMI and to provide such data to NMI upon request. Without limiting the generality of the foregoing, you may not send FedNow transactions (y) that exceed the limits provided for in the FedNow Rules or any other applicable transaction limits expressly imposed on your Money Movement Account or (z) to any account not located within the United States.

6. No Endorsement.

NMI does not endorse, guarantee, or sponsor any of the NMI clients who provide you with the NMI-Enabled Services. We are not responsible for the provision or failure to provide any services or goods by the NMI client or any other act or omission of such NMI client. Your relationship with such NMI client is governed by the terms of the agreements you enter into directly for the NMI client’s services.

8. Unauthorized Transactions and Error Resolution.

8.1 Notification of Money Movement Account Errors. Contact NMI immediately at compliance@dwolla.com or 1-888-289-8744 if you believe that (i) your Money Movement Account has been accessed without your authorization; (ii) a transaction has occurred that you did not authorize; (iii) a transaction has been processed incorrectly to or from your Money Movement Account or your Linked Payment Account; or (iv) your Money Movement Account transaction history made available to you by the NMI client providing the NMI-Enabled Services contains an error (each, an “Error“). For clarity, if you give a third party access to your Money Movement Account and that person conducts transactions you did not anticipate, these transactions are not Errors. You must notify us within sixty (60) days after the Error first appeared in your transaction history.

8.2 Required Information for Notice. When you notify us of the Error, you must provide: (i) Your name and the name of the NMI client who provides you with access to your Money Movement Account; (ii) the nature of the suspected Error and why you believe it is an Error; and (iii) the dollar amount of the Error. If you notify us by phone, you must provide this information in an email within ten (10) business days.

8.3 Investigation of Errors. We will determine whether an Error occurred within ten (10) business days after you notify us and provide all required information in Section 8.2. If we need more time, we may take up to 45 days to investigate but we will credit your Money Movement Account within ten (10) business days for the amount of the suspected error. For Errors involving new Money Movement Accounts, we may take up to 90 days to investigate and may take up to 20 business days to credit your Money Movement Account. We will tell you the results of our investigation within 3 business days after completing our investigation. If we determine there was no Error, we will provide you a written explanation. You may ask for copies of the documents that we used in our investigation.

9. Your Liability and Actions We May Take.

9.1 Your Liability. You are responsible for all reversed or failed transactions, fees, claims, fines, penalties, and other liabilities incurred by NMI, our Financial Institution Partners, or other NMI customers arising from your use of your Money Movement Account or the NMI-Enabled Services or any breach of this TOS. Without limiting the foregoing, you agree to reimburse NMI or our Financial Institution Partners for any liability relating to a transaction that: (i) is reversed in accordance with NMI or its Financial Institution Partners’ risk management policies; (ii) is reversed in accordance with applicable laws, including without limitation, by ACH return (as that term is defined under the Nacha Rules), (iii) fails due to your error; (iv) fails due to the provision of inaccurate information; or (v) is cancelled or rejected by you or the recipient or sender, or your or their bank or credit union (each, a “Reversal“).

9.2 Actions We May Take. To recover any amounts lost due to a Reversal, you authorize NMI to debit your Money Movement Account or your Linked Payment Account for such amount. Additionally, at NMI’s option, NMI may suspend your Money Movement Account or engage in collection activities. For all other liabilities or if NMI determines, in our sole discretion, that you have breached this TOS or that your Money Movement Account or use of the NMI-Enabled Services presents a risk or other threat to NMI, NMI’s clients, or the Money Movement Platform, or if we are unable to verify your identity, we may take any of the following actions (without limiting or foregoing any other remedies available to us under the law or the terms of this TOS):

Suspending your access to your Money Movement Account or the NMI-Enabled Services;
Suspending your access to your funds held in a Money Movement Balance for up to 90 days;
Closing your Money Movement Account;
Contacting the NMI client providing you access to your Money Movement Account and NMI-Enabled Services to notify them of your activity, contacting your bank or credit union, contacting law enforcement or other third parties impacted by your activities; and
Taking legal action against you.

10. Consent to Receive Electronic Communications.

10.1 Communications. By opening a Money Movement Account and using the NMI-Enabled Services, you consent to receive all communications, terms, disclosures, notices, and statements (“Communications“) from NMI electronically and you confirm that you can access, receive and retain such Communications. NMI will provide Communications by posting them on dwolla.com or by emailing them to you at the email address you provided when opening or updating your Money Movement Account.

10.2 Tax Communications. In certain circumstances, NMI may be required to issue a tax form to you as a Money Movement Account holder. You consent to receive such tax forms and all communications related to such filings (the “Tax Communications“) electronically for so long as you maintain your Money Movement Account and through the tax filing period immediately following, unless you notify us that you have withdrawn consent in accordance with Section 10.5 below. It is your responsibility to maintain a current email address associated with your account, which can be updated by contacting the NMI client providing the NMI-Enabled Services to you.

10.3 Receipt of Notices. A Communication to you will be deemed to have been received twenty-four hours after we have posted it to our website or emailed it to you.

10.4 Delivery Requirements. In order to access and retain our Communications you will need: a computer or mobile device that is Internet-enabled, a valid email address, Internet connectivity, and a web browser which includes 128-bit encryption, with cookies and javascript enabled.

10.5 Withdrawing Consent. You may withdraw your consent to receive Communications electronically by contacting us at support@dwolla.com or 1-888-289-8744. Because the nature of the NMI-Enabled Services requires delivery of Communications electronically, we will close your Money Movement Account upon receipt of notice of your intent to withdraw such consent. If you withdraw such consent specifically with regard to Tax Communications, NMI will provide you a paper copy of your tax forms at the mailing address you provide to us or the NMI client providing you with access to the NMI-enabled services.

11. Intellectual Property.

NMI is the owner of all rights, interest, and title in and to the intellectual property in the Money Movement Platform and any NMI documentation (including without limitation any patents, copyrights, rights of publicity, trademarks, logos, designs, trade dress, and trade secrets). All rights in the NMI intellectual property not expressly granted to you in this TOS are reserved. You shall not and shall not allow any third party to use your Money Movement Account and the NMI-Enabled Services to: (i) claim or register any NMI intellectual property on your behalf or on behalf of others; (ii) import or export any portion of the Money Movement Platform to a person or country in violation of export control laws; (iii) copy, reproduce, post, transmit, resell or distribute the NMI-Enabled Services or any content or data obtained through the NMI-Enabled Services or our website; (iv) access or attempt to access non-public NMI information; (v) hack or develop workarounds to any technical limitations placed on your Money Movement Account by NMI or NMI’s client; (vi) reverse engineer the Money Movement Platform or any component of the NMI-Enabled Services; (vii) engage in any activity that would interfere with or affect NMI’s ability to provide the Money Movement Platform or the NMI-Enabled Services, including sending an unreasonably large number of requests in quick succession to the Money Movement Platform; or (viii) attempt any of the foregoing.

12. Termination.

12.1 By You. You may stop using your Money Movement Account at any time. You may terminate this TOS by notifying NMI that you intend to close your Money Movement Account or by terminating your relationship with the NMI client who provides you access to your Money Movement Account and the NMI-Enabled Services.

12.2 By NMI. We may close your Money Movement Account or terminate your access to the NMI-Enabled Services without liability, for any reason, upon notice to you. NMI reserves the right to modify or terminate the Money Movement Platform at any time, for any reason.

13. Disputes with NMI.

13.1 Binding Arbitration. You, NMI, and our Financial Institution Partners (the “Parties“) agree that any past, present, or future dispute, claim or controversy relating in any way to your Money Movement Account or use of the NMI-Enabled Services, or any other relationship or transaction between you and us, will be resolved by binding arbitration as discussed below, and not through litigation in any court. Such disputes are called “Claims” for purposes of this TOS. This binding agreement to arbitrate applies regardless of whether the dispute is between you and us jointly or separately. This arbitration agreement is entered into pursuant to the Federal Arbitration Act, 9 U.S.C. §§ 1-16. Before initiating arbitration, you and we must first comply with Section 13.3. The arbitration shall be conducted by a single neutral arbitrator acting under the administration of United States Arbitration and Mediation, MidWest, Inc., and in accordance with the then-applicable United States Arbitration and Mediation Rules of Arbitration. If United States Arbitration and Mediation, MidWest, Inc. is unavailable or declines to administer an arbitration, the arbitration will be administered by the American Arbitration Association in accordance with its then-applicable Consumer Arbitration Rules. Unless the Parties agree otherwise, or unless the arbitration administrator’s rules or law require otherwise, the arbitration shall be held in the county in which you reside or, at your or our election, by videoconference or telephone. The arbitrator will decide the Claim in accordance with all applicable law, including recognized principles of equity and statutes of limitations, and will honor all privileges recognized by law. The arbitrator will have the authority to award to a Party any damages or relief provided for under applicable law. The arbitrator’s decision shall be final and legally binding, and may be enforced by any court having jurisdiction. If you elect to proceed with respect any Claim by an individual action in a small claims court, or its equivalent, instead of arbitration, we will not object, however, any such action shall be taken in small claims court in Delaware. If the arbitrator or arbitration administrator would impose filing fees or other administrative costs on you, we will reimburse you, upon request and provided you have complied with Section 13.3, to the extent such fees or costs would exceed those that you would otherwise have to pay if you were proceeding instead in a court. We will also pay additional fees or costs if required to do so by the arbitration administrator’s rules or applicable law. Apart from the foregoing, each Party will be responsible for any other fees or costs, such as attorney fees that the Party may incur. If you consider that you are unable to afford any fees or costs that would be yours to pay, you may request that we pay or reimburse them, and we will consider your request in good faith. ARBITRATION WITH RESPECT TO A CLAIM IS BINDING AND NEITHER PARTY WILL HAVE THE RIGHT TO LITIGATE THAT CLAIM THROUGH A COURT. IN ARBITRATION THE PARTIES WILL NOT HAVE THE SAME RIGHTS THAT APPLY IN COURT, SUCH AS THE RIGHT TO A TRIAL BY JUDGE OR JURY AND THE RIGHT TO PARTICIPATE OR BE REPRESENTED IN PROCEEDINGS BROUGHT BY OTHERS SUCH AS CLASS ACTIONS OR SIMILAR PROCEEDINGS. IN ADDITION, THE RIGHT TO DISCOVERY AND THE RIGHT TO APPEAL MAY ALSO BE LIMITED OR ELIMINATED IN ARBITRATION. ALL OF THESE JUDICIAL RIGHTS ARE WAIVED WITH RESPECT TO CLAIMS.

13.2 Class Waiver; Waiver of Trial by Jury. To the fullest extent permitted by law, the Parties agree that no class actions or similar process, and no joinder or consolidation of any Claim with a Claim of any other person or entity, shall be allowable. In arbitration, the arbitrator shall have no authority to entertain any Claim on behalf of a class, group, person, or entity who is not a named party to the arbitration, nor shall any arbitrator have authority to make any award for the benefit of, or against, any class, group, person, or entity who is not a named party to the arbitration. In the event that there is a dispute about whether limiting arbitration to non-class proceedings, or to the named parties, is enforceable under applicable law, then that question shall be resolved by a court rather than by an arbitrator; and to the extent it is determined that resolution of a Claim must proceed on a class basis, it shall so proceed in a court of competent jurisdiction rather than in arbitration. In the event that any dispute proceeds in court, each party irrevocably waives any right to trial by jury in any proceeding with regard to any Claim.

13.3 Informal Dispute Resolution. Before filing a Claim in arbitration, the Party asserting the Claim must send the other an individualized written notice describing the Claim, the relief sought, and the facts supporting it. Notice to us must be sent to legal@dwolla.com and must be personally signed by you. Notice to you will be sent to the email or mailing address associated with your Money Movement Account. For sixty (60) days after a notice is received, the Parties shall attempt in good faith to resolve the Claim, including through an individualized telephone or videoconference discussion if either Party requests one. A Claim may be filed in arbitration only after this period ends without resolution. All applicable statutes of limitations are tolled while this Section 13.3 is being followed.

13.4 Coordinated Claims. If twenty-five (25) or more Claims of a substantially similar nature are asserted against us by the same or coordinated counsel or Parties, the Claims shall be administered in staged proceedings: the Parties shall each select up to twenty-five (25) Claims to be filed and resolved first, and no other Claims may be filed until those are resolved. This process shall repeat in successive stages. Statutes of limitations are tolled for Claims awaiting filing under this Section. Nothing in this Section prevents you from proceeding in small claims court, or from opting out under Section 13.5. If a court determines this Section is unenforceable as to a Claim, that Claim shall proceed in a court of competent jurisdiction rather than in arbitration.

13.5 Your Right to Opt Out. You may reject this Section 13 (Disputes) by sending written notice to legal@dwolla.com within thirty (30) days after you first accept this TOS, stating your name, the NMI client through which you access your Money Movement Account, and your intent to opt out of arbitration. Opting out will not affect any other provision of this TOS and will not result in any penalty or change to your Money Movement Account.

13.6 Changes to this Section. Notwithstanding anything to the contrary in this TOS, changes to this Section 13 will not apply to any Claim of which either Party had written notice before the effective date of the change.

14. General.

14.1 Indemnity. You agree to defend, indemnify and hold harmless NMI, our Financial Institution Partners, and our and their respective officers, directors, agents, employees, and suppliers from any third party claims, actions, proceedings, and suits and related liabilities, damages, settlements, penalties, fines, costs or expenses (including reasonable attorneys’ fees and other litigation expenses) arising from: (a) your violation of this TOS or any other applicable terms or policies of NMI or our Financial Institution Partners; (b) your use of your Money Movement Account or the NMI-Enabled Services; (c) your negligence or willful misconduct; and/or (d) your actual or alleged violation of any third party rights, or any applicable Laws.

14.2 Limitation of Liability. IN NO EVENT SHALL NMI, OUR FINANCIAL INSTITUTION PARTNERS, OR OUR OR THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, OR SUPPLIERS BE LIABLE TO YOU OR ANY THIRD PARTY UNDER ANY CIRCUMSTANCES FOR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES OR LOSSES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES INCURRED IN CONNECTION WITH: (i) THIS TOS, (ii) YOUR USE OF, INABILITY TO USE, OR UNAVAILABILITY OF THE MONEY MOVEMENT SERVICES, OR (iii) ANY GOODS OR SERVICES PURCHASED, RECEIVED, OR PAID FOR USING THE MONEY MOVEMENT SERVICES, UNDER ANY THEORY OF LIABILITY OR CAUSE OF ACTION WHETHER IN TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, REGARDLESS OF WHETHER NMI OR OUR FINANCIAL INSTITUTION PARTNER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT SHALL NMI OR OUR FINANCIAL INSTITUTION PARTNERS’ LIABILITY AND THE LIABILITY OF OURS AND ITS RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, AND SUPPLIERS EXCEED THE GREATER OF (A) THE FEES NMI HAS RECEIVED FROM YOU THROUGH YOUR USE OF THE MONEY MOVEMENT SERVICES AND (B) $200. NMI AND OUR FINANCIAL INSTITUTION PARTNER SHALL NOT BE JOINTLY LIABLE FOR ANY MATTERS HEREUNDER. THIS LIMITATION OF LIABILITY SECTION SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION.

14.3 No Warranty. YOUR MONEY MOVEMENT ACCOUNT AND THE MONEY MOVEMENT-ENABLED SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT ANY REPRESENTATION OF WARRANTY, WHETHER EXPRESS, IMPLIED, OR STATUTORY. USE OF THE MONEY MOVEMENT SERVICES IS AT YOUR OWN RISK. NMI, OUR FINANCIAL INSTITUTION PARTNERS, AND OUR AND THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, AND SUPPLIERS, SPECIFICALLY DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. NEITHER NMI NOR OUR FINANCIAL INSTITUTION PARTNERS HAS CONTROL OF, OR LIABILITY FOR, ANY ACTS OR OMISSIONS OF OR SERVICES OR GOODS OFFERED BY THE NMI CLIENT WHO PROVIDES YOU ACCESS TO YOUR MONEY MOVEMENT ACCOUNT. NEITHER NMI NOR OUR FINANCIAL INSTITUTION PARTNERS REPRESENTS OR WARRANTS THAT YOUR MONEY MOVEMENT ACCOUNT OR THE MONEY MOVEMENT-ENABLED SERVICES WILL MEET YOUR REQUIREMENTS, BE CONTINUOUS, UNINTERRUPTED, SECURE, TIMELY, OR ERROR-FREE, OR THAT DEFECTS WILL BE CORRECTED. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY YOU FROM NMI WILL CREATE ANY WARRANTY NOT EXPRESSLY STATED HEREIN. NEITHER NMI NOR OUR FINANCIAL INSTITUTION PARTNERS SHALL BE RESPONSIBLE FOR ANY SERVICE INTERRUPTIONS OR SYSTEM FAILURES THAT MAY AFFECT THE PROCESSING, COMPLETION, OR SETTLEMENT OF TRANSACTIONS. THIS DISCLAIMER OF WARRANTY SECTION SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION.

14.4 Force majeure. You understand and agree we will not be held responsible for any losses or damages resulting from suspension of service due to extraordinary events or circumstances beyond our control. In such an event, NMI may suspend your Money Movement Account and the NMI-Enabled Services and our Financial Institution Partner may suspend service and access to funds in a holding account.

14.5 Assignment. You may not transfer or assign any rights or obligations you have under this TOS. NMI and our Financial Institution Partners reserve the right to transfer or assign any rights or obligations under this TOS at any time.

14.6 Governing Law. You agree that the laws of the State of Delaware, without regard to principles of conflict of laws, govern this TOS and any claim or dispute that has arisen or may arise between the Parties.

14.7 Complete Agreement; No Waiver; Survival. This TOS, along with any applicable terms and policies of NMI or our Financial Institution Partners, set forth the entire understanding between the Parties with respect to your Money Movement Account and the NMI-Enabled Services. Any failure of NMI or our Financial Institution Partners to enforce any right or provision of this TOS shall not constitute a waiver of such right or provision. Any provision of this TOS held to be invalid or unenforceable under applicable law shall be struck, and the remaining provisions will continue in full force and effect. Sections 9 (Your Liability and Actions We May Take), 10 (Consent to Receive Electronic Communications), 11 (Intellectual Property), 13 (Disputes with NMI), and 14 (General), as well as any other terms which by their nature should survive, will survive the termination of this TOS.

14.8 Order of Precedence. If this TOS conflicts with any agreement between you and the NMI client that provides you access to your Money Movement Account or the NMI-Enabled Services, this TOS shall control with respect to your Money Movement Account and the NMI-Enabled Services, solely to the extent of the conflict.

Money Movement Open Banking Services End User Terms and Conditions

Last Updated: October 12, 2026

These Money Movement Open Banking Services End User Terms and Conditions (“EULA“) are a legal agreement between you and Dwolla, Inc. (“NMI“, “us“, “we“, or “our“), an affiliate of Network Merchants, LLC. This EULA applies to your use of digital money management tools and Money Movement Open Banking Services that an NMI Client may provide to you (“you” or “your“) and that involve accessing third-party account information (for purposes of this EULA, the “Open Banking Services“, which are distinct from any other open banking services offered by NMI). “NMI Client” means the NMI client whose platform, application, or website you use to access the Open Banking Services. We may amend this EULA at any time by posting a revised version on any website maintained for purposes of providing the Money Movement Platform or Open Banking Services. Amendments to the EULA are effective at the time they are posted and your continued use of the Open Banking Services constitutes acceptance of any amendments.

1. Provide Accurate Information. You represent and agree that all information you provide to NMI in connection with the Open Banking Services is accurate, current, and complete. You agree not to misrepresent your identity or account information. You agree to keep account information secure, up to date and accurate. You represent that you are a legal owner, or an authorized user, of the accounts at third-party sites which you include or access through the Open Banking Services, and that you have the authority to (i) designate NMI and its service providers as your agent, (ii) use the Open Banking Services, and (iii) give NMI and its service providers the passwords, usernames, and all other information you provide.

2. Content You Provide. Your use of the Open Banking Services is your authorization for NMI or its service providers, as your agent, to access third-party sites which you designate in order to retrieve information. In order to use the Open Banking Services and by using the Open Banking Services, you must accept the NMI Privacy Policy (available at www.nmi.com/policy/privacy) which (i) sets out what of your data is collected, how data will be used, and how collected data will be accessed, shared, exchanged, or sold; (ii) sets out disclosures regarding the collection, use and sharing of such data; (iii) identifies the categories of third parties to whom your data may be provided or who may use, receive, store or process the same; and (iv) describes how your data will be protected in the event that NMI ceases to make available the Open Banking Services to you. Further, in order to use the Open Banking Services, you must accept the applicable NMI Client’s privacy policy, which sets out the NMI Client’s policies for items (i) through (iv) as applied to the NMI Client, not NMI, and will be provided to you when you sign up for an account with the applicable NMI Client. You are licensing to NMI and its service providers any information, data, passwords, usernames, PINs, personally identifiable information or other content you provide through the Open Banking Services. You authorize NMI or its service providers to use any information, data, passwords, usernames, PINs, personally identifiable information or other content you provide through the Open Banking Services or that NMI or its service providers retrieve on your behalf for purposes of providing the Open Banking Services and as otherwise described in the NMI Privacy Policy and permitted by applicable law and NMI’s agreements with its service providers. Except as otherwise provided herein, NMI or its service providers may store, use, change, or display such information or create new content using such information. You authorize NMI to share this information with other third parties in accordance with the NMI Privacy Policy.

3. Authority to Access Information. Unless and until this EULA is terminated, you grant NMI and its service providers the right to access information at third-party sites on your behalf. Third-party sites shall be entitled to rely on the authorizations granted by you or through your account. For all purposes hereof, you hereby grant NMI and its service providers the right to access third-party sites to retrieve information, use such information, as described herein, with the full power and authority to do and perform each and every act and thing required and necessary to be done in connection with such activities, as fully to all intents and purposes as you might or could do in person. You may revoke NMI’s and its service providers’ right to access information at third-party sites on your behalf at any time by removing the associated linked account in the NMI Client’s application or, if you are unable to do so through the NMI Client’s application, by contacting NMI at support@dwolla.com. You may also request deletion of information collected from third-party sites by the same means, except that NMI and its service providers may retain and continue to use anonymized, aggregated data described in Section 7, and information they are required or permitted to retain under applicable law. If you revoke your consent as to all linked accounts and cease using the Open Banking Services, this EULA terminates, except that Sections 7, 8, and 11 through 19 survive, and information already collected will continue to be handled in accordance with the NMI Privacy Policy. You understand and agree that the Open Banking Services are not sponsored or endorsed by any third-party site. YOU ACKNOWLEDGE AND AGREE THAT WHEN NMI OR ITS SERVICE PROVIDERS ACCESS AND RETRIEVE INFORMATION FROM THIRD-PARTY SITES, THEY ARE ACTING AT YOUR REQUEST AND WITH YOUR PERMISSION AND AUTHORIZATION, AND NOT ON BEHALF OF THE THIRD-PARTY SITES.

4. Third-Party Accounts. With respect to any third-party sites NMI may enable you to access through the Open Banking Services, or with respect to any accounts at third-party sites you include in the Open Banking Services, you agree to the following:

(A) You are responsible for all fees charged by the third party in connection with any accounts at third-party sites and transactions. You agree to comply with the terms and conditions of those accounts and agree that this EULA does not amend any of those terms and conditions. If you have a dispute or question about any transaction on an account at third-party sites, you agree to direct these to the account provider.

(B) Any links to third-party sites that NMI may provide are for your convenience only, and NMI and its service providers do not sponsor or endorse those sites. Any third-party services, which you may be able to access through the Open Banking Services, are services of the respective institutions. Neither NMI nor its service providers have responsibility for any transactions and inquiries you initiate at third-party sites. The third-party sites you select are solely responsible for their services to you. Neither NMI nor its service providers are liable for any damages or costs of any type arising out of or in any way connected with your use of the services of those third parties.

5. Limitations of Open Banking Services. When using the Open Banking Services, you may incur technical or other difficulties. Neither NMI nor its service providers are responsible for any technical or other difficulties or any resulting damages that you may incur. Any information displayed or provided as part of the Open Banking Services is for informational purposes only, does not represent an official record of your account, may not reflect your most recent transactions, and should not be relied on for transactional purposes. NMI and its service providers reserve the right to change, suspend or discontinue any or all of the Open Banking Services at any time without prior notice. In the event that the Open Banking Services are discontinued, your information shall be retained in accordance with this EULA and the NMI Privacy Policy.

6. Acceptance of EULA. Your use of the Open Banking Services constitutes your acceptance of this EULA. The licenses, user obligations, and authorizations described herein are ongoing.

7. Aggregated Data. Anonymous, aggregate information, comprising financial account balances, other financial account data, or other available data that is collected through your use of the Open Banking Services, may be used by NMI and its service providers to conduct certain analytical research, performance tracking and benchmarking. Our service providers may publish summary or aggregate results relating to metrics comprised of research data, from time to time, and distribute or license such anonymous, aggregated research data for any purpose, including but not limited to, helping to improve products and services and assisting in troubleshooting and technical support. Your personally identifiable information will not be shared with or sold to third parties under this Section 7.

8. Ownership. You agree that NMI and its service providers, as applicable, retain all ownership and proprietary rights in the Open Banking Services, associated content, technology, mobile applications and websites.

9. Support. You should contact your NMI Client with any requests or questions related to the Open Banking Services. If you cannot obtain adequate assistance from such NMI Client, you may contact NMI at support@dwolla.com.

10. User Conduct. You agree not to use the Open Banking Services or the content or information delivered through the Open Banking Services in any way that would: (a) be fraudulent or involve the sale of counterfeit or stolen items, including but not limited to use of the Open Banking Services to impersonate another person or entity; (b) violate any law, statute, ordinance or regulation (including without limitation those governing export control, consumer protection, unfair competition, anti-discrimination or false advertising); (c) create liability for NMI or its service providers or cause NMI to lose the services of its service providers; (d) access the information and content programmatically by macro or other automated means; (e) use the Open Banking Services in such a manner as to gain unauthorized entry or access to computer systems; or (f) use the Open Banking Services in any manner that would constitute a Prohibited Activity under Section 5.4 of the Money Movement Account Terms of Service (available at www.dwolla.com/legal/dwolla-account-terms-of-service), whether or not you hold a Money Movement Account.

11. Indemnification. You agree to defend, indemnify and hold harmless NMI, its service providers and third-party data providers, and their respective officers, directors, employees, suppliers and agents from and against any and all third-party claims, liabilities, damages, actions, proceedings, penalties, fines, costs, losses or expenses, including settlement amounts and reasonable attorneys’ fees and costs, arising out of your access to or use of the Open Banking Services, your negligence or willful misconduct, your actual or alleged violation of any third-party rights, or any applicable laws, regulations or rules, your violation of this EULA, or your infringement, or infringement by any other user of your account, of any intellectual property or other right of anyone.

12. Disclaimer. The Open Banking Services are not intended to provide legal, tax or financial advice. The Open Banking Services, or certain portions and/or functionalities thereof, are provided as strictly educational in nature and are provided with the understanding that neither NMI nor its service or third-party providers are engaged in rendering accounting, investment, tax, legal, or other professional services. If legal or other professional advice, including financial advice, is required, the services of a competent professional person should be sought. NMI and its service and third-party providers specifically disclaim any liability, loss, or risk which is incurred as a consequence, directly or indirectly, of the use and application of any of the content through the Open Banking Services. Further, NMI and its service and third-party providers are not responsible for any credit, insurance, employment or investment decisions or any damages or other losses resulting from decisions that arise in any way from the use of the Open Banking Services or any materials or information accessible through them. Past performance does not guarantee future results. NMI and its service and third-party providers do not warrant that the Open Banking Services comply with the requirements of the Financial Industry Regulatory Authority (“FINRA“) or those of any other organization anywhere in the world.

13. DISCLAIMER OF WARRANTIES. YOU AGREE YOUR USE OF THE OPEN BANKING SERVICES AND ALL INFORMATION AND CONTENT (INCLUDING THAT OF THIRD PARTIES) IS AT YOUR RISK AND IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. NMI AND ITS SERVICE PROVIDERS DISCLAIM ALL WARRANTIES OF ANY KIND AS TO THE USE OF THE OPEN BANKING SERVICES, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. NMI AND ITS SERVICE PROVIDERS MAKE NO WARRANTY THAT (i) THE OPEN BANKING SERVICES WILL MEET YOUR REQUIREMENTS, (ii) THE OPEN BANKING SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, (iii) THE RESULTS THAT MAY BE OBTAINED FROM THE OPEN BANKING SERVICES WILL BE ACCURATE OR RELIABLE, (iv) THE QUALITY OF ANY PRODUCTS, SERVICES, INFORMATION, OR OTHER MATERIAL OBTAINED BY YOU THROUGH THE OPEN BANKING SERVICES WILL MEET YOUR EXPECTATIONS, OR (v) ANY ERRORS IN THE OPEN BANKING SERVICES OR TECHNOLOGY WILL BE CORRECTED. ANY MATERIAL DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE OPEN BANKING SERVICES IS DONE AT YOUR OWN DISCRETION AND RISK AND YOU ARE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR COMPUTER SYSTEM OR LOSS OF DATA THAT RESULTS FROM THE DOWNLOAD OF SUCH MATERIAL. NMI, ON BEHALF OF ITSELF AND ALL THIRD-PARTY DATA PROVIDERS AND SERVICE PROVIDERS, EXPRESSLY DISCLAIMS ANY TYPE OF REPRESENTATION OR WARRANTY REGARDING THE AVAILABILITY OR RESPONSE TIME OF THE OPEN BANKING SERVICES OR CONTENT OR INFORMATION OBTAINED THROUGH THE OPEN BANKING SERVICES OR THAT SUCH ACCESS WILL BE UNINTERRUPTED OR ERROR-FREE AND, EXCEPT AS EXPRESSLY PROVIDED FOR HEREIN, EXPRESSLY DISCLAIMS THE ACCURACY, COMPLETENESS AND CURRENCY OF ALL INFORMATION COLLECTED ON YOUR BEHALF. NO ADVICE OR INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY YOU FROM NMI OR ITS SERVICE PROVIDERS THROUGH OR FROM THE OPEN BANKING SERVICES WILL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THIS EULA.

14. LIMITATION OF LIABILITY. YOU AGREE THAT NMI, ITS SERVICE PROVIDERS, AND NMI’S AND THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES OR SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, CONSEQUENTIAL OR EXEMPLARY DAMAGES OR LOSSES, INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA OR OTHER LOSSES, EVEN IF NMI HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, RESULTING FROM (i) THIS EULA, (ii) THE USE OR THE INABILITY TO USE OR THE UNAVAILABILITY OF THE OPEN BANKING SERVICES, INCLUDING AT NMI’S WEBSITE/MOBILE APPLICATION/API OR OF ANY THIRD-PARTY ACCOUNT PROVIDER’S WEBSITE/MOBILE APPLICATION, (iii) THE COST OF GETTING SUBSTITUTE GOODS AND SERVICES, (iv) ANY PRODUCTS, DATA, INFORMATION, GOODS OR SERVICES PURCHASED, RECEIVED, PAID FOR OR OBTAINED OR MESSAGES RECEIVED OR TRANSACTIONS ENTERED INTO, THROUGH OR FROM THE OPEN BANKING SERVICES, (v) UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR TRANSMISSION OR DATA, (vi) STATEMENTS OR CONDUCT OF ANYONE ON THE OPEN BANKING SERVICES, (vii) THE USE, INABILITY TO USE, UNAUTHORIZED USE, PERFORMANCE OR NON-PERFORMANCE OF ANY THIRD-PARTY ACCOUNT PROVIDER SITE, EVEN IF THE PROVIDER HAS BEEN ADVISED PREVIOUSLY OF THE POSSIBILITY OF SUCH DAMAGES, OR (viii) ANY OTHER MATTER RELATING TO THE OPEN BANKING SERVICES. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF NMI, ITS SERVICE PROVIDERS, AND THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, AND SUPPLIERS EXCEED THE GREATER OF (A) THE FEES NMI HAS RECEIVED FROM YOU THROUGH YOUR USE OF THE OPEN BANKING SERVICES AND (B) $200. NMI AND ITS SERVICE PROVIDERS SHALL NOT BE JOINTLY LIABLE FOR ANY MATTERS HEREUNDER. THIS LIMITATION OF LIABILITY SECTION SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION.

15. DISPUTES WITH NMI AND BINDING ARBITRATION.

15.1. Agreement to Arbitrate. This Section 15 is referred to as the “Arbitration Agreement.” Except where prohibited by applicable law, each party agrees that any and all disputes or claims that have arisen or may arise between you and NMI, whether arising out of or relating to this EULA or in connection with your use of the Open Banking Services or NMI’s websites, shall be resolved exclusively through final and binding arbitration, rather than a court, in accordance with the terms of this Arbitration Agreement, except that you may assert individual claims in small claims court, if your claims qualify. Each party agrees that, by agreeing to this EULA, you and NMI are each waiving the right to a trial by jury or to participate in a class action. The party’s rights will be determined by a neutral arbitrator, not a judge or jury. The Federal Arbitration Act governs the interpretation and enforcement of this Arbitration Agreement. Notwithstanding the foregoing, this Arbitration Agreement shall not preclude either party from pursuing a court action for the sole purpose of obtaining a temporary restraining order or preliminary injunction in circumstances in which such relief is appropriate; provided that any other relief shall be pursued through an arbitration proceeding pursuant to this Arbitration Agreement. In any event, any action or proceeding by a party against another party relating to any dispute must commence within one year after the cause of action accrues.

15.2. Class Action Waiver. Except where prohibited by applicable law, you and NMI agree that each may bring claims against the other only on an individual basis and not as a plaintiff or class member in any purported class or representative action or proceeding. Unless both you and NMI agree otherwise, the arbitrator may not consolidate or join more than one person’s or party’s claims and may not otherwise preside over any form of a consolidated, representative, or class proceeding. Also, the arbitrator may award relief (including monetary, injunctive, and declaratory relief) only in favor of the individual party seeking relief and only to the extent necessary to provide relief necessitated by that party’s individual claims.

15.3. Pre-Arbitration Dispute Resolution. The parties agree that each is interested in resolving disputes amicably and efficiently and, in that way, you agree to initially work with the support team at NMI. If such efforts prove unsuccessful, a party who intends to seek arbitration must first send to the other, by certified mail, a written notice of dispute. The notice to NMI should be sent to NMI at the address set forth below. The notice to you should be sent to the address that NMI has on file for you. The notice of dispute must (i) describe the nature and basis of the claim or dispute and (ii) set forth the specific relief sought. If you and NMI do not resolve the claim within forty five (45) calendar days after the notice of dispute is received, you or NMI may commence an arbitration proceeding. During the arbitration, the amount of any settlement offer made by you and NMI shall not be disclosed to the arbitrator until after the arbitrator determines the amount, if any, to which you or NMI is entitled.

15.4. Arbitration Procedure. The arbitration will be conducted by a neutral arbitrator in accordance with the American Arbitration Association’s (“AAA“) rules and procedures, including the AAA’s Commercial Arbitration Rules (collectively, the “AAA Rules“), as modified by this Arbitration Agreement. If there is any inconsistency between any term of the AAA Rules and any term of this Arbitration Agreement, the applicable terms of this Arbitration Agreement will control unless the arbitrator determines that the application of the inconsistent Arbitration Agreement terms would not result in a fundamentally fair arbitration. All issues are for the arbitrator to decide, including, but not limited to, issues relating to the scope, enforceability, and arbitrability of this Arbitration Agreement. The arbitrator can award issues relating to, without limitation, the scope, enforceability, and arbitrability of this Arbitration Agreement. The arbitrator can award the same damages and relief on an individual basis that a court can award to an individual under this EULA and applicable law. Decisions by the arbitrator are enforceable in court and may be overturned by a court only for very limited reasons. Unless you and NMI agree in writing, any arbitration hearings will take place in a reasonably convenient location for both parties with due consideration of their ability to travel and other pertinent circumstances. If the parties are unable to agree on a location, the determination shall be made by AAA. If your claim is for $10,000 or less, NMI agrees that you may choose whether the arbitration will be conducted solely on the basis of documents submitted to the arbitrator, through a telephonic hearing or by an in- person hearing as established by the AAA Rules. If your claim exceeds $10,000, the right to a hearing will be determined by the AAA Rules. Regardless of the manner in which the arbitration is conducted, the arbitrator shall issue a reasoned written decision sufficient to explain the essential findings and conclusions on which the award is based.

15.5. Cost of Arbitration. Payment of all filing, administration, and arbitrator fees (collectively, the “Arbitration Fees“) will be governed by the AAA Rules unless otherwise provided in this Arbitration Agreement. The arbitrator shall award the prevailing party in any arbitration such party’s reasonable attorney’s fees.

15.6. Confidentiality; Severability. All aspects of the arbitration proceeding, and any ruling, decision, or award by the arbitrator, will be strictly confidential for the benefit of all parties. If a court or the arbitrator decides that any term or provision of this Arbitration Agreement other than Section 15.2 above (Class Action Waiver) is invalid or unenforceable, the parties agree to replace such term or provision with a term or provision that is valid and enforceable and that comes closest to expressing the intention of the invalid or unenforceable term or provision, and this Arbitration Agreement shall be enforceable as so modified. If a court or the arbitrator decides that any of the provisions of Section 15.2 above is invalid or unenforceable, then the entirety of this Arbitration Agreement shall be null and void. The remainder of this EULA will continue to apply.

16. WAIVER OF JURY TRIAL AND CLASS ACTION. You agree that, with respect to any dispute with NMI or NMI’s service providers or third-party data providers, arising out of or relating to your use of the Open Banking Services or this EULA: (i) YOU ARE GIVING UP YOUR RIGHT TO HAVE A TRIAL BY JURY; and (ii) YOU ARE GIVING UP YOUR RIGHT TO SERVE AS A REPRESENTATIVE, AS A PRIVATE ATTORNEY GENERAL, OR IN ANY OTHER REPRESENTATIVE CAPACITY, OR TO PARTICIPATE AS A MEMBER OF A CLASS OF CLAIMANTS, IN ANY LAWSUIT INVOLVING SUCH DISPUTE. In arbitration, the arbitrator shall have no authority to entertain any Claim on behalf of any class, group, person, or entity who is not a named party to the arbitration, nor shall any arbitrator have authority to make any award for the benefit of, or against, any class, group, person, or entity who is not a named party to the arbitration. In the event that there is a dispute about whether limiting arbitration to non-class proceedings, or to the named parties, is enforceable under applicable law, then that question shall be resolved by a court rather than by an arbitrator; and to the extent it is determined that resolution of a Claim must proceed on a class basis, it shall so proceed in a court of competent jurisdiction rather than in arbitration.

17. Export Restrictions. You acknowledge that the Open Banking Services and any software underlying such Open Banking Services are subject to the U.S. Export Administration Regulations (15 CFR, Chapter VII) and that you will comply with these regulations. You will not export or re-export the software or Open Banking Services, directly or indirectly, to: (1) any countries that are subject to U.S. export restrictions; (2) any end user who has been prohibited from participating in U.S. export transactions by any federal agency of the U.S. government; or (3) any end user who you know or have reason to know will utilize them in the design, development or production of nuclear, chemical or biological weapons. You further acknowledge that the Open Banking Services may include technical data subject to export and re-export restrictions imposed by U.S. law.

18. Governing Law. You agree that the laws of the State of Delaware, without regard to principles of conflict of laws, govern this EULA and any claim or dispute that has arisen or may arise between the Parties, except that the Federal Arbitration Act governs the interpretation and enforcement of Sections 15 and 16.

19. General. (a) Entire Agreement. This EULA, together with the NMI Privacy Policy and the applicable NMI Client’s privacy policy, constitutes the entire agreement between you and NMI with respect to the Open Banking Services and supersedes all prior or contemporaneous understandings with respect thereto. (b) No Waiver. Any failure of NMI or its service providers to enforce any right or provision of this EULA shall not constitute a waiver of such right or provision. No waiver shall be effective unless made in writing. (c) Assignment. You may not assign or transfer this EULA without NMI’s prior written consent, and any attempted assignment in violation of this Section is void. NMI may assign or transfer this EULA, in whole or in part, at any time without notice to you. (d) Third-Party Beneficiaries. Except for NMI’s service providers and third-party data providers, who are intended third-party beneficiaries solely of the protections expressly extended to them in Sections 11, 13, 14, 15, and 16, this EULA does not confer any rights or remedies on any person other than you and NMI. (e) Severability. A determination that any provision of this EULA is unenforceable or invalid shall not render any other provision of this EULA unenforceable or invalid.

20. Eligibility. You represent and warrant that you are at least 18 years old and a legal resident of the United States. If you access or use the Open Banking Services on behalf of a business or other entity, you represent and warrant that you are authorized to bind that business or entity to this EULA. If you do not meet these requirements, you may not access or use the Open Banking Services.

21. Consent to Electronic Communications. By accepting this EULA and using the Open Banking Services, you consent to receive all notices, disclosures, communications, and agreements from NMI electronically, whether provided by NMI directly or through the NMI Client that provides you access to the Open Banking Services, and you confirm that you can access, receive, and retain such electronic communications. You may withdraw this consent by discontinuing your use of the Open Banking Services.

22. Force Majeure. Neither NMI nor its service providers will be liable for any delay or failure to perform, or for any interruption or unavailability of the Open Banking Services, resulting from causes beyond their reasonable control, including acts of God, natural disasters, war, terrorism, riots, governmental action, labor conditions, power or Internet failures, or the acts or omissions of third-party data providers or other third parties.

23. Third-Party Service Providers and Data Providers. The Open Banking Services rely on one or more third-party service providers and third-party data providers to access information from third-party sites at your request. Your access to and use of the Open Banking Services, and the information accessed through them, is also subject to the applicable third-party service provider’s end user privacy policy. You agree not to use the Open Banking Services in any manner inconsistent with the applicable third-party service provider’s end user privacy policy. Categories of third parties to whom your information may be provided, or who may receive, store, or process it, include NMI’s third-party service providers and data providers that support the Open Banking Services.

Platform Misconduct

This statement outlines NMI’s operational stance on platform integrity involving merchants or other parties using payment flows that leverage NMI technology.

NMI may receive reports or allegations regarding merchants or other parties that allege involvement in fraudulent, deceptive, unlawful, or otherwise harmful activity. When NMI becomes aware of information concerning alleged misuse or misconduct, it evaluates the matter based on the information available to NMI, including the credibility, authority, and relevance to NMI’s platform, which may include consideration of:

• Direction or notification from an acquiring bank, sponsor bank, or payment processor;
• Card network communications, monitoring programs, or rule enforcement actions;
• Law enforcement inquiries, legal process, or regulatory requests;
• Credible technical or security indicators involving NMI systems (e.g., system abuse, malware, credential compromise, etc.); or
• Clear violations of NMI contractual terms, acceptable use provisions, or security requirements.

Unsubstantiated, anonymous, or speculative claims, without supporting evidence or appropriate authority, do not typically warrant direct action by NMI.

Where supported by applicable agreements, network rules, acceptable use considerations and/or posing a business, operational, or reputational risk to NMI (each, in NMI’s sole and absolute discretion), NMI may take appropriate action, including termination of any party’s usage of the NMI platform.

To ensure fairness and clarity, NMI does not:
• Act as a regulator, law enforcement authority, or adjudicator of legal disputes
• Restrict merchants solely based on unsupported accusations or competitive complaints
• Publish or maintain public lists of alleged “bad actors”

Any reports of suspected misuse or misconduct may be submitted to fraud@nmi.com. Submission of a report does not guarantee investigation or action by NMI.

Legal Process Guidelines

Government, Law Enforcement, and Civil Litigants within the United States

The purpose of this document is to provide guidance to law enforcement and civil litigants seeking records from Network Merchants, LLC (“NMI”). These Guidelines do not create any obligation or enforceable right against NMI, nor do they constitute legal advice or a waiver of any objection by NMI. These Guidelines and NMI’s policies may be updated in the future without further notice.

Protecting the privacy of all who rely on our services is paramount to us. To this end, NMI requires valid and binding legal process before disclosing data, except in emergencies, where lawful consent has been provided, or in other circumstances in NMI’s sole discretion and consistent with applicable law. We review all legal process for authenticity, facial validity, and legal sufficiency, including by ensuring the form of legal process is sufficient under applicable law to obtain the type of data requested. NMI reserves the right to object to requests that do not comply with applicable laws.

1. About NMI

NMI is a global leader in embedded payment solutions – we are not a bank. Our payment software tools enable thousands of partners that serve merchants around the world and across the commerce ecosystem. Our products and solutions include industry-leading payment gateway technology and our seamless merchant underwriting, acquiring, onboarding and management platform and more.

Because NMI is not a bank, we do not hold funds nor manage bank accounts, and we cannot freeze assets and cannot process garnishment requests. Banking services are provided by Merrick Bank, Member FDIC.

2. General Requirements for Law Enforcement Requests and Civil Requests

All legal process must be:

addressed to Network Merchants, LLC;
dated and signed by an attorney, government official, or judicial officer (as applicable);

assembled in the complete form as issued by the competent authority and issued on government letterhead or with a caption that identifies the court that issued the process and the case/docket number; and

issued under the authority of a court with jurisdiction over NMI.
State law enforcement and state civil litigants outside of Illinois and Delaware generally must domesticate their legal process in Illinois or Delaware, where the company is headquartered and incorporated, respectively. If you believe your request is binding on NMI and need not be domesticated, please identify the legal basis for your position.

Additionally, all legal process must identify:

Sufficient information for NMI to locate the relevant business and/or individual whose data is being requested.
- Names, dates of birth, and social security numbers alone cannot be used to accurately locate responsive data. Accordingly, please include additional identifying information, including but not limited to email address, physical address, Gateway IDs, and/or transaction IDs, to the extent available.
The specific types of data requested (see Section 5) and the applicable date range for the request;

The legal basis for the request; and
How and to whom the responsive data should be produced.

3. Law Enforcement Requests

a. Service of Preservation Requests, Data Requests, and Testimony Requests

Preservation requests and requests seeking the production of data must be submitted in PDF format to NMI at legalnotices@nmi.com. Acceptance of legal process via email is for convenience only and does not waive any objections, including lack of jurisdiction or proper service.

Requests that include a demand for witness testimony must be personally served on NMI at its Illinois offices. For more information about testimony requests, please see Section 6.

b. Preservation Requests

NMI will preserve data for 90 days upon receipt of a formal preservation request from law enforcement in connection with an official criminal investigation and pending the issuance of a court order or other legal process. Law enforcement may request one extension of the preservation request for an additional 90 days. If law enforcement agents do not request an extension before the expiration of the initial 90-day preservation period and/or do not serve NMI with compulsory legal process before the expiration of the preservation period, the preserved information will be deleted after the preservation period expires. It is the responsibility of law enforcement to track the expiration date for a preservation request and notify NMI of any request to extend the preservation period.

Preservation requests must be sent on official law enforcement letterhead, signed by a law enforcement official and must include sufficient identifiers for the entity and/or individual whose data is requested to be preserved (see Section 2) and a statement that steps are being taken to obtain a court order or other legal process for the data sought to be preserved.

c. Emergency Disclosure Request Procedures

If law enforcement believes there is an ongoing emergency involving an imminent threat of death or serious bodily harm to a person, please complete the NMI Emergency Disclosure Request form and submit it to us at legalnotices@nmi.com. The subject line of the email should include “Emergency Request.” We review these requests on a case-by-case basis.

Please note that we will only review and respond to emergency requests from law enforcement. We will not respond to emergency requests sent to this address by non-law enforcement officials.

4. Civil Requests

a. Service and Jurisdiction Requirements

Except for requests related to bankruptcy proceedings, all civil requests, including requests for records and/or testimony, must be personally served on NMI at its Illinois offices. Civil requests related to bankruptcy proceedings may be submitted via email at legalnotices@nmi.com.

All state civil requests must be properly domesticated in Illinois or Delaware.

b. Bankruptcy Requests

Please note NMI is not a bank, and therefore we do not hold funds or manage bank accounts, and we cannot freeze assets and generally cannot process garnishment requests. Accordingly, please consider whether NMI is the appropriate recipient of your request or whether it should be directed to NMI’s sponsor bank, Merrick Bank (Member FDIC), or another entity.

5. Information That May Be Available

Our Privacy Policy sets forth the categories of information that may be available from us. However, the information we may have for a particular request depends on whose data is being requested and which of our services they have used. We cannot guarantee the availability of any information. We retain data in accordance with our Privacy Policy.

Absent exigent circumstances or other lawful exceptions, certain categories of information may only be obtained pursuant to a court order or a search warrant.

6. Witness Testimony Requests

NMI provides a business record certification with its productions, which generally eliminates the need for live testimony to authenticate records. Should you believe that a custodian of records is still necessary to provide testimony, we require domestication of all state subpoenas pursuant to, as applicable, the Uniform Act to Secure the Attendance of Witnesses from Within or Without a State in Criminal Proceedings, 735 Ill. Comp. Stat. 220/1, et seq., or the Uniform Interstate Depositions and Discovery Act, 735 Ill. Comp. Stat. 35/1, et seq. All subpoenas seeking witness testimony must be personally served on NMI at its Illinois offices.

NMI does not provide expert witness testimony.

7. Notice Policy

We reserve the right to notify people who use our service of requests for their information prior to disclosure, unless we are prohibited by law from doing so or in exceptional circumstances as determined in our sole discretion.

8. Cost Reimbursement

We reserve the right to seek reasonable reimbursement costs for responding to requests for information.

DMCA Notice

Network Merchants, LLC (dba NMI) strongly respects copyright protections. We will respond as promptly as possible to any reports of copyright infringement on our primary and supplemental websites. NMI works within the guidelines of the US Digital Millennium Copyright Act (“DMCA”) to address and rectify any and all reports and instances of copyright infringement.

Infringement Reporting Procedure. To report copyright infringement, please email all of the below required information, in written English, to ComplianceDepartment@nmi.com:

Signature (hand-signed or electronic) of the owner, or a person authorized by the owner, of a copyright that is allegedly infringed.
Identification of the original copyrighted work that is allegedly infringed, including website address / URL, location on the webpage, type of material (such as whether it is text, a photo, or both), a description of the work, and any other relevant information, sufficient for NMI to identify it.
Identification of the material in a NMI website or display that is allegedly infringing upon the work from point ii. above, including website address / URL, location on the webpage, type of material (such as whether it is text, a photo, or both), a description of the work, and any other relevant information, sufficient for NMI to identify it.
Statement that the complaining Party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.
Contact information for the complaining Party, including email address, mailing address, and phone number.
Statement that the information in the notification is accurate, and under penalty of perjury, that the complaining Party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

Copyright Agent Contact. NMI’s Copyright Agent contact information is as follows. Email is our preferred method of communication.

Network Merchants, LLC

Attention: NMI DMCA/Copyright Designated Agent

PO Box 120

Portsmouth, NH 03802

+1-847-352-4850

ComplianceDepartment@nmi.com

Take-Down Procedure. Upon receipt and verification of notice of infringement, NMI will remove the infringing materials, at its sole discretion. To the extent possible, NMI will notify the infringing party in writing after removal. Advance notice of removal is generally not possible.

Termination for Repeat Infringement. NMI reserves the right to terminate access, for any or all of our Software and Services, to any Party, if that Party is found to be repeatedly infringing copyrights.

Anti-Harassment and Bullying Policy

Network Merchants, LLC and all its subsidiaries and Affiliates (herewith referred to as NMI, we, our or us) are committed to providing a working environment free from harassment and bullying and ensuring all our employees are treated, and treat others, with dignity and respect. We recognize that harassment and bullying can occur not only among employees but also from Third Parties, and we take such incidents very seriously.

Purpose

The purpose of this Policy is to set out our commitment to preventing and addressing harassment or bullying may occur by Third Parties such as partners, merchants, vendors, suppliers, visitors to our premises, and any other Third Party involved in our operations (herewith referred to as Third Parties).

At NMI, we maintain a strict zero-tolerance policy towards harassment or bullying. Harassment, bullying or victimization of any kind will not be tolerated and failure to uphold the dignity and respect of all NMI employees may result in corrective action. All parties are encouraged to report any incident of harassment or bullying involving NMI’s employees. To address and prevent future complaints, we will focus on constructive measures such as providing feedback to customers, collaborating with them to resolve issues, and reporting any serious concerns to the authorities.

What is Harassment by a third party

Harassment by a Third Party is any unwanted physical, verbal or non-verbal conduct that has the purpose or effect of violating a person’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them. A single incident can amount to harassment.

It also includes treating someone less favorably because they have submitted or refused to submit to such behavior in the past.

Unlawful harassment may involve sexual harassment (unwanted behaviour of a sexual nature), or it may be related to age, disability, gender reassignment, marital or civil partner status, pregnancy or maternity, race, colour, nationality, ethnic or national origin, religion or belief, sex or sexual orientation. Harassment is unacceptable even if it does not fall within any of these categories.

Harassment may include, but is not limited to:

unwanted physical conduct or “horseplay”, including touching, pinching, pushing and grabbing;
continued suggestions for social activity after it has been made clear that such suggestions are unwelcome;
sending or displaying material that is pornographic or that some people may find offensive (including emails, text messages, video clips and images sent by mobile phone or posted on the internet);
unwelcome sexual advances or suggestive behavior (which the harasser may perceive as harmless);
racist, sexist, homophobic or ageist jokes, or derogatory or stereotypical remarks about a particular ethnic or religious group or gender;
outing or threatening to out someone as LGBTQ+;
offensive emails, text messages or social media content;
mocking, mimicking or belittling a person’s disability; or
using your position of authority to offer job benefits or promotions in exchange for sexual favors.

A person may be harassed even if they were not the intended “target”. For example, a person may be harassed by racist jokes about a different ethnic group if the jokes create an offensive environment.

A person may be harassed even if the comments or behavior was not intended to cause harm or offense (i.e. if comments were meant to be a joke).

What is Bullying by a third party

Bullying is offensive, intimidating, malicious or insulting behavior involving the misuse of power that can make a person feel vulnerable, upset, humiliated, undermined or threatened. Power does not always mean being in a position of authority, but can include both personal strength and the power to coerce through fear or intimidation.

Bullying may include physical or psychological threats, overbearing and intimidating levels of supervision or inappropriate derogatory remarks about someone’s performance. Please be aware that harassment and bullying can take place in many forms, from face to face encounters to messages via text, social media platforms or through official communication channels or chats.

Preventing Harassment & Bullying

NMI takes a proactive approach to preventing harassment and bullying and as part of those efforts we offer regular training sessions to all employees about harassment and bullying, including what it is, how to recognise it and how to report it.

What should a third party expect

When we receive a report of Third-Party harassment, NMI’s People Team will carefully initiate an investigation to understand the situation fully. This will involve gathering important information, which may include conversations with the person making the report, any witnesses, and any other individual(s) involved in the incident. We will document all findings and consider any relevant evidence.

Once the investigation is complete, we will share the findings with the appropriate parties and take any necessary actions based on the outcome. Throughout this journey, our People Team is dedicated to creating a respectful and safe workplace for everyone.

Third Parties have a responsibility to conduct themselves in a manner that respects the rights and dignity of all NMI employees. If a Third Party is found to have engaged in harassment or bullying, NMI will take appropriate corrective actions, which may include:

Issuing a formal written warning to the individual or entity. Banning the individual or entity from our premises or events.
Termination of contracts or business relationships.
Reporting the behavior to law enforcement authorities if it constitutes a criminal offense.

In cases where harassment or bullying by a Third Party leads to emotional distress or damages for our employees, NMI reserves the right to seek restitution from the offending party. This may include claims for damages related to lost wages, emotional distress, or any other applicable remedies under the law.

Retaliation against a complainant will not be tolerated and NMI will take appropriate action against anyone who subjects a complainant to retaliatory conduct. NMI will offer the necessary assistance and support to its employees to protect or enforce the complainant’s rights.

Conclusion

NMI is dedicated to maintaining a work environment free from harassment and bullying, including Third Party harassment. By following this policy and working together, we can create a safe and respectful workplace for all employees. This Policy will be reviewed at regular intervals and will be monitored for effectiveness.

For any inquiries related to the policy, or to report an incident of harassment or bullying, please email NMI’s People Team at peopleteam@nmi.com. We’re here to help and ensure you have all the information you need.

Legal Test

Legal Page

Search results

Money Movement Open Banking Services Agreement

1. Open Banking Services

2. Account and Open Banking Services Access Requirements

3. Acceptable Use

4. Security and Privacy

5. Confidentiality

6. Intellectual Property

7. Term and Termination

8. Indemnification

Exhibit A Money Movement Terms and Conditions for Third-Party Open Banking Services and Products

1. DEFINITIONS

2. LICENSE AND RESTRICTIONS

3. THIRD PARTIES

4. CONSUMER DATA OWNERSHIP, PERMITTED USES, AND RESPONSIBILITY

5. Suspension

Exhibit B Data Protection Terms

1. INFORMATION SECURITY

2. SECURITY INCIDENT

3. BACKGROUND INVESTIGATIONS

4. INSURANCE

5. SUBCONTRACTORS

Exhibit C Third-Party Data Provider Terms

1. Money Movement Open Banking Services End User Terms and Conditions

2. DATA REQUIREMENTS

3. API MONITORING

4. DATA HOSTING

5. DATA USE AND CREDENTIALS

6. COMPLIANCE; AUDITS

Exhibit D Terms and Conditions for Plaid Open Banking Services and Products

Definitions

1. Restrictions

2. Secondary Investors

3. Privacy and Authorizations

4. DISCLAIMER; ENFORCEMENT

5. FI Data

Money Movement Account Terms of Service

1. Definitions.

2. Money Movement Platform and Money Movement Open Banking Services.

3. About Money Movement Accounts and the NMI-Enabled Services.

4. Creating Your Money Movement Account.

5. Using Your Money Movement Account.

6. Payment Method Specific Terms.

6. No Endorsement.

8. Unauthorized Transactions and Error Resolution.

9. Your Liability and Actions We May Take.

10. Consent to Receive Electronic Communications.

11. Intellectual Property.

12. Termination.

13. Disputes with NMI.

14. General.

Money Movement Open Banking Services End User Terms and Conditions

15. DISPUTES WITH NMI AND BINDING ARBITRATION.

Platform Misconduct

Legal Process Guidelines

1. About NMI

2. General Requirements for Law Enforcement Requests and Civil Requests

3. Law Enforcement Requests

4. Civil Requests

5. Information That May Be Available

6. Witness Testimony Requests

7. Notice Policy

8. Cost Reimbursement

DMCA Notice

Anti-Harassment and Bullying Policy

Purpose

What is Harassment by a third party

What is Bullying by a third party

Preventing Harassment & Bullying

What should a third party expect

Conclusion

Legal Test

Exhibit A
Money Movement Terms and Conditions for Third-Party Open Banking Services and Products

Exhibit B
Data Protection Terms

Exhibit C
Third-Party Data Provider Terms

Exhibit D
Terms and Conditions for Plaid Open Banking Services and Products