Money Movement Open Banking Services Agreement
Last Updated: October 12, 2026
This Money Movement Open Banking Services Agreement (the “Open Banking Services Agreement“) is a legally binding agreement between you, the person or entity (“Company“, “you“, or “your“) identified on the applicable proposal (“Proposal“), and Dwolla, Inc. (“NMI“, “us“, “our“, or “we“), an affiliate of Network Merchants, LLC. This Open Banking Services Agreement constitutes Service Terms under the NMI General Terms and Conditions, available at https://www.nmi.com/policy/platform-terms-conditions/ (the “General Terms and Conditions“), and is part of the Agreement (as defined in the General Terms and Conditions); NMI is the NMI Affiliate providing the Open Banking Services. If you have also accepted the Money Movement Service Terms, this Open Banking Services Agreement is one of the “Money Movement Agreements” thereunder. This Open Banking Services Agreement applies to your use of the Open Banking Services, as defined in Exhibit A below (also referred to in any Proposal as the “Money Movement Open Banking Services“), and to your access or use of related technology, software, and services that NMI or its Third-Party Service Providers make available to you. By accessing or using the Open Banking Services, you accept and agree to be bound by this Open Banking Services Agreement. In the event of a conflict between this Open Banking Services Agreement and the General Terms and Conditions or, if applicable, the Money Movement Service Terms, this Open Banking Services Agreement controls as to the Open Banking Services, solely to the extent of the conflict.
It is important that you read and understand this Open Banking Services Agreement as it governs your use of the Open Banking Services. You represent and warrant that you have the authority to accept this Open Banking Services Agreement on behalf of the legal entity you have registered and to provide any information that you share with NMI. By indicating your acceptance of this Open Banking Services Agreement or by executing a Proposal or other agreement that references this Open Banking Services Agreement, you agree to be bound by this Open Banking Services Agreement. If you do not accept this Open Banking Services Agreement, you must not access or use the Open Banking Services.
NMI offers software and services, as more fully described in this Open Banking Services Agreement, to facilitate the accessing of banking and financial data via NMI’s exchange session, which provides a Third-Party Service Provider’s link to a user interface the End User accesses to provide End User Data. You retrieve the End User Data from the user interface that the End User has authorized to be shared with you and NMI through NMI’s application programming interface (“NMI API“). You desire to use these services to help streamline and improve your onboarding process on your platform, website and/or application (each, an “Application“). You agree the terms herein govern your use of NMI’s software and services.
NMI may amend this Open Banking Services Agreement at any time by providing notice to you. The parties therefore agree as follows:
1. Open Banking Services
1.1 Description. The Open Banking Services are accessed through an API which will permit you to:
(A) Utilize NMI’s Third-Party Service Providers to perform the Open Banking Services, ordered by you through a Proposal;
(B) Upon successful authorization from End User, obtain specific details about End User and its financial institution account through the Third-Party Service Provider; and
(C) Obtain certain information, which may include information about payment activity, End Users or External Parties.
2. Account and Open Banking Services Access Requirements
2.1 Authorization. As provided in Exhibit C below, incorporated herein by reference, you must obtain each End User’s agreement to the EULA prior to the use of or access to the Open Banking Services by the End User.
2.2 Credentials. You are solely responsible for maintaining the security of your NMI credentials, including passwords, security codes, and any key and secret issued to you to permit access to the API used for the Open Banking Services (the “Credentials“). Prior to the date NMI makes the Open Banking Services available to you (the “Open Banking Services Go Live Date“), you will be responsible for paying the Implementation Fee (as listed in the Proposal) as applicable. You may not sell, transfer, sublicense or disclose the Credentials to any third party, other than third party service providers who need such information to perform services for you. You are solely responsible for any activity using the Credentials, including any losses or liability that may arise from you sharing or failing to secure the Credentials.
2.3 User Permissions. You may permit your employees, your Affiliates, contractors, agents, or other third parties (each, an “Authorized User“) to access the Open Banking Services on your behalf. You will remain responsible for any actions taken by an Authorized User and for ensuring Authorized Users comply with the terms of this Open Banking Services Agreement. Authorized Users may only access or use the Open Banking Services for your internal business purposes and in accordance with this Open Banking Services Agreement. You are responsible for determining which Authorized Users may obtain access to certain features, functionality and data within the Open Banking Services. NMI is expressly permitted to rely on your creation of Authorized Users and user settings to release data or to initiate payments, if applicable, pursuant to instructions received through the Open Banking Services. Any third parties enabled as Authorized Users do not form any relationship with NMI and NMI will not be liable for any disputes, billing, or other matters between you and such Authorized User(s).
2.4 Third-Party Service Providers. NMI does not guarantee the availability of access to or reliability of services from Third-Party Service Providers.
3. Acceptable Use
3.1 Compliance. You represent and warrant that your use of the Open Banking Services will only be for lawful and legitimate purposes and will at all times comply with: (a) all applicable Laws (as defined in the General Terms and Conditions); (b) this Open Banking Services Agreement; and (c) the Integration Requirements.
3.2 Prohibitions. Without limiting the generality of Section 3.1, and in addition to any prohibitions and/or restrictions set out in Exhibit A, incorporated herein by reference, you agree you will not and will not permit your Authorized Users to:
(A) License, sublicense, sell, resell, transfer, assign or distribute Open Banking Services without express written permission from NMI;
(B) Reverse engineer, disassemble, decompile, disable, copy, modify, or translate the Open Banking Services or any of its features, components, or elements or otherwise attempt to discover the source code of the Open Banking Services;
(C) Replicate and/or resell the Open Banking Services or create a competitive product or any product built using the ideas, features, functions, and other components of the Open Banking Services;
(D) Use the Open Banking Services for any purpose other than your legitimate internal business purposes;
(E) Use the Open Banking Services for any fraudulent, unlawful, deceptive, or abusive purposes or in any manner intended to harm an End User, NMI, or any third party;
(F) Circumvent NMI’s intended limitations for any feature of the Open Banking Services;
(G) Use the Open Banking Services in a manner inconsistent with any developer documentation, integration guidance, or other technical, policy, or other requirements communicated by NMI or posted on NMI’s website, each as may be updated from time to time (the “Integration Requirements“); or
(H) Attempt any of the foregoing.
4. Security and Privacy
4.1 Personal Information. You represent and warrant that you have obtained express consent to provide NMI any identifying information of individuals processed using Open Banking Services (“Company PII“). NMI agrees not to sell or share, retain, use, or disclose Company PII for any purpose other than providing Open Banking Services as described in this Open Banking Services Agreement or meeting regulatory obligations.
4.2 Audit. NMI may audit, examine and otherwise monitor your compliance with this Open Banking Services Agreement and you agree to cooperate fully with any such audit. Within 30 days of notice from NMI, you will provide to NMI or its third party auditor (either, an “NMI Auditor“) access to and assistance with: documents, records, reports, or other data, information or materials compiled, maintained, or otherwise available to the extent related to your compliance with this Open Banking Services Agreement and not prohibited from disclosure by applicable Laws (as defined in the General Terms and Conditions). If an NMI Auditor determines that you are not in compliance with this Open Banking Services Agreement, you will take appropriate action to remedy the non-compliance and will provide NMI with evidence of the steps taken to achieve compliance within the time frame agreed upon by the parties.
5. Confidentiality
For purposes of this Open Banking Services Agreement, “Confidential Information” has the meaning given in the General Terms and Conditions. Confidential Information of a Third-Party Service Provider or Third-Party Data Provider disclosed to you in connection with the Open Banking Services will be subject to the same obligations that apply to NMI’s Confidential Information under the Agreement, and each such Third-Party Service Provider or Third-Party Data Provider retains all right, title, and interest in its own Confidential Information.
6. Intellectual Property
6.1 NMI API License. NMI grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access, use, and integrate the Open Banking Services into your services or payment technology in accordance with this Open Banking Services Agreement (“API License“). This API License may be immediately revoked or terminated by NMI if you share your Credentials in a manner not permitted by this Open Banking Services Agreement or that otherwise breaches this Open Banking Services Agreement. “Dwolla,” the Dwolla logo, and any other service marks, trademarks, logos or graphics used in Open Banking Services (“Dwolla Marks“) are trademarks, registered trademarks, or otherwise intellectual property of NMI and you do not obtain any right or license to the Dwolla Marks under this Open Banking Services Agreement. You may not remove or obscure any Dwolla Marks displayed or contained in Open Banking Services.
6.2 General.
(A) Marketing. You agree to participate in case studies upon written request by NMI. Further, you agree that NMI may include you in materials identifying you as a customer of NMI and a user of the Open Banking Services. You authorize NMI to use your name, website, logo, or other trademarks or service marks to identify you as a customer of NMI on NMI’s websites, marketing materials, and in public presentations. If you desire to opt out of being included in such communications and materials, please contact NMI. Upon receipt of and in accordance with such request, NMI will cease making references to you and make reasonable efforts to remove you from any already existing marketing materials.
(B) Customer Support for End Users. You are solely responsible for providing customer support for your services to End Users and, if applicable, for any goods or services that are sold via your Application. You must clearly disclose your support policy and publish your customer support contact information in an easily accessible manner within any Application through which you offer your services.
(C) Dispute Resolution for End Users. You are responsible for resolving all End User disputes related to your services (“Company Services End User Dispute“), including any Company Services End User Dispute communicated by an End User to NMI. NMI has no obligation nor any liability associated with a Company Services End User Dispute or your resolution policies and procedures. You agree to provide NMI with any requested information regarding the status and/or resolution of a Company Services End User Dispute. NMI has the right but no obligation to provide support to an End User that contacts NMI regarding a Company Services End User Dispute, and in such event, you must provide NMI with any information NMI reasonably requests for the purposes of assisting End User.
7. Term and Termination
7.1 Term. The term of this Open Banking Services Agreement begins on the service start date specified for the Open Banking Services in the applicable Proposal or, if no service start date is specified, on the Open Banking Services Go Live Date, and continues until terminated as provided in this Open Banking Services Agreement or the Agreement (the “Term“).
7.2 Termination. Either party may terminate this Open Banking Services Agreement at any time. NMI may suspend or terminate this Open Banking Services Agreement or your access to the Open Banking Services immediately upon written notice as provided in the General Terms and Conditions or Section 5 of Exhibit A, including if you materially breach this Open Banking Services Agreement, if required by a Third-Party Service Provider or Third-Party Data Provider, or if NMI’s relationship with the applicable Third-Party Service Provider or Third-Party Data Provider terminates or is suspended.
7.3 Effect of Termination; Survival. Upon termination or expiration, you will immediately stop using the Open Banking Services and the NMI API and remove all Dwolla Marks from your Application. Any fees accrued or due survive termination. Sections 4, 5, 6, this Section 7.3, and Section 8 of this Open Banking Services Agreement, and the provisions of Exhibits A, B, C, and D that by their nature extend beyond termination (including post-termination destruction, audit, and insurance obligations), survive termination or expiration.
8. Indemnification
In addition to your indemnification obligations under the General Terms and Conditions, you agree to defend, indemnify and hold harmless NMI, its Third-Party Service Providers and Third-Party Data Providers, and their respective officers, directors, employees, suppliers and agents from and against any and all third party claims, liabilities, damages, actions, proceedings, penalties, fines, costs, losses or expenses, including settlement amounts and reasonable attorneys’ fees and costs, arising out of or in any way connected with your: (i) access to or use of the Open Banking Services; (ii) negligence or willful misconduct; (iii) actual or alleged violation of any third party rights or any Laws; (iv) violation or breach of this Open Banking Services Agreement; or (v) infringement, or infringement by any of your Authorized Users, of any intellectual property or other right of anyone. Your obligations under this Section 8 are not subject to any limitation of liability in the Agreement.
Exhibit A
Money Movement Terms and Conditions for Third-Party Open Banking Services and Products
This Money Movement Terms and Conditions for Third-Party Open Banking Services and Products Exhibit (“Open Banking Services Exhibit“) applies to your use of the Open Banking Services provided to you through one of NMI’s Third-Party Service Providers (as defined below). Hereinafter “you”, “your”, or “Company” means the Company and “us”, “we”, “our” or “NMI” refers to NMI (protecting its third-party service provider).
1. DEFINITIONS
1.1 “Anonymous & Aggregated Data” means End User Data and information that is anonymized and aggregated with similar data and information to the extent that the original End User Data and information is no longer attributable to NMI, you, or to any specific End User, so it meets the prevailing standard of “De-identified” as set out in the applicable Laws. The parties to this Open Banking Services Agreement may use any Anonymous & Aggregated Data that is generated by the Open Banking Services or derived from your use of the Open Banking Services in accordance with the Privacy Laws and NMI’s privacy policy.
1.2 “Balance Check” means an Open Banking Service ordered by you that you can use to periodically gather account balances in an account without collecting transaction data. Account types accessed include depository accounts. You can retrieve these account balances using an API request to help ensure your End Users have the appropriate funds.
1.3 “Destroy” means to delete or destroy information using data destruction procedures that meet or exceed the NIST Special Publication 800-88 Guidelines for Media Sanitization.
1.4 “Documentation” means the Third-Party Service Provider Materials, Third-Party Service Provider User Guide and applicable Spec Sheet(s).
1.5 “End User” means (a) a natural person who is a resident of the United States and at least 18 years old, or (b) a business or other entity formed or registered in the United States, in each case who is authorized by you to use or access the Open Banking Services and who has (i) been supplied an identification and password by you or at your direction or (ii) for whom a unique user record is created by or authorized to be created by you within the Open Banking Services.
1.6 “End User Data” means End User’s login, password, transaction data, account number, any other authentication information required by Third-Party Service Provider or End User’s financial institution, and any other data, in each case received through the Open Banking Services. For the avoidance of doubt, End User Data includes Nonpublic Personal Information.
1.7 “End User Request” means any request by an individual (or by another person acting on behalf of an individual), including End Users (as defined in this Open Banking Services Agreement), to exercise a right under any Privacy Laws, or any other complaint or inquiry or similar communication about the use of services that are based on the Open Banking Services.
1.8 “Instant Account Verification (without identity check)” means an Open Banking Service ordered by you that accesses financial account information, including account and routing numbers, for direct deposit accounts such as checking, savings, and money market accounts.
1.9 “Marks” means the trademarks, marks, logos, trade names, and service marks owned or licensed by a party.
1.10 “Nonpublic Personal Information” means personally identifiable financial information as defined under Regulation P, 12 C.F.R. Part 1016, or the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., any End User Data that is protected as “personal data”, “personally identifiable information” or “personal information” under Privacy Laws, including any and all information that (alone or when used in combination with other information) is capable of being associated with, or could reasonably be associated with an individual, or information otherwise considered privileged, confidential, private, nonpublic or personal given protected status under applicable Laws.
1.11 “Open Banking Services” means Instant Account Verification, Balance Check, and the other products and services ordered by you through a Proposal to which these terms apply and are made available by Third-Party Service Provider through its online, web-based application or mobile components via designated websites, IP addresses, application programming interface(s), or other means.
1.12 “Privacy Laws” means any applicable law, regulation, rule or other mandatory legal obligation which regulates the Processing of Nonpublic Personal Information or that otherwise relates to data protection, data security or data breach notification obligations for Nonpublic Personal Information, including (without limitation and only as applicable between the parties) the U.S. Gramm-Leach-Bliley Act (GLBA); the GDPR, the UK GDPR, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; the California Consumer Privacy Act (CCPA) as amended, superseded or updated from time to time and similar law.
1.13 “Processing” means any operation or set of operations that is performed upon Nonpublic Personal Information or on sets of Nonpublic Personal Information, whether or not by automated means, such as collection, recording, structuring, storage, alteration, accessing, consultation, use, copying, disclosure, combination, de-identification, redaction, erasure or destruction. (“Process“, “Processes” and “Processed” are construed accordingly).
1.14 “Service Provider” means any third-party entity which provides End User Data or other data to a Third-Party Service Provider for use in the Open Banking Services pursuant to a contractual agreement.
1.15 “Spec Sheet” means a document provided by NMI or Third-Party Service Provider that describes the work by Third-Party Service Provider and you that is necessary to configure the Open Banking Services purchased by you in a Proposal.
1.16 “Third-Party Data Provider” means any third-party entity, including financial institutions, which provides End User Data or other data to NMI or NMI’s technology providers for use in the Open Banking Services.
1.17 “Third-Party Service Provider(s)” means a third-party entity that provides the Open Banking Services or professional services.
1.18 “Third-Party Service Provider Materials” means any materials that Third-Party Service Provider provides to you as part of, or in the course of providing, the Open Banking Services or professional services including implementation materials provided through Third-Party Service Provider’s developer portal or through NMI.
1.19 “Third-Party Service Provider Privacy Policy” means Third-Party Service Provider’s privacy policies describing Third-Party Service Providers’ processing of End User Data and Nonpublic Personal Information, as amended from time to time.
1.20 “Third-Party Service Provider Technology” means technology owned by Third-Party Service Provider or licensed to Third-Party Service Provider by a third party (including the Open Banking Services, professional services, software tools, algorithms, software (in source and object forms), user interface designs, architecture, toolkits, plug-ins, objects and Documentation, network designs, processes, know-how, methodologies, trade secrets, and any related intellectual property rights throughout the world) and feedback made to Third-Party Service Provider that are incorporated into any of the foregoing (which are hereby irrevocably assigned to Third-Party Service Provider), as well as any of the modifications or extensions of the above, whenever or wherever developed.
1.21 “Third-Party Service Provider User Guide” means the applicable user guides, frequently asked questions, help, and other documentation provided by Third-Party Service Provider to you including such documentation provided through NMI. For some Third-Party Service Provider products, additional guidance is accessible from within the Open Banking Services under the “help” menu.
2. LICENSE AND RESTRICTIONS
2.1 License Grant. Subject to, and except as explicitly set forth in, the terms of this Open Banking Services Exhibit, NMI grants you a non-exclusive and non-transferable right, solely during the Term and any implementation period preceding the Open Banking Services Go Live Date:
(A) to permit authorized End Users to access and use the Open Banking Services;
(B) to use the Open Banking Services in accordance with the Documentation and Integration Requirements and solely for your internal business purposes; and
(C) to use the Third-Party Service Provider Materials solely in conjunction with your authorized use of the Open Banking Services.
2.2 Restrictions. All rights not expressly granted to you hereunder are reserved by NMI and Third-Party Service Provider. You agree that you must not, and must not permit or authorize any third party (including but not limited to End Users) to:
(A) use the Open Banking Services in (i) violation of any applicable Laws or regulatory guideline or for fraudulent purposes, or (ii) a manner that would cause a material risk to the security or operations of NMI or any of its clients or partners, Third-Party Service Provider or any of its clients, or to the continued normal operation of other NMI or Third-Party Service Provider clients;
(B) copy, sublicense, sell, resell, rent, lease, transfer, assign, distribute, license, publish or publicly display, modify, duplicate, create derivative works from, translate, frame, scrape, mirror, republish, download, display, transmit, disassemble, decompile, reverse engineer all or any portion of the Open Banking Services, time share or otherwise commercially exploit or attempt to derive source code of the Open Banking Services or make the Open Banking Services available to any third party, other than to End Users or as otherwise contemplated by this Open Banking Services Agreement;
(C) attempt to gain unauthorized access to the Open Banking Services or their related systems or networks, or modify, create derivative works of, adapt, translate, reverse engineer (including monitoring or accessing inputs or output flowing through a system or an application), decompile, or otherwise attempt to discover within any Third-Party Service Provider Technology, the source code, data representations, or underlying algorithms, processes and methods. (This restriction will not apply to the extent it limits any non-waivable right you may enjoy under applicable Laws);
(D) access the Open Banking Services in order to build a competitive product or service, or copy any ideas, features, functions or graphics of the Open Banking Services;
(E) frame, scrape, link to, republish, download, display, transmit, or mirror any content forming part of the Open Banking Services, other than on your own intranets or otherwise for your own internal business purposes;
(F) remove, obscure, or alter any copyright, trademark or other proprietary notices associated with the Open Banking Services, Third-Party Service Provider Materials or SDKs;
(G) use End User Data obtained through the Open Banking Services in any way as, or as part of, a consumer report as that term is defined by the Fair Credit Reporting Act 15 U.S.C. §1681 (“FCRA“);
(H) process through Open Banking Services or share with Third-Party Service Provider any data that falls under the protections of the Health Insurance Portability and Accountability Act of 1996 or the Washington My Health My Data Act. You shall promptly notify NMI and/or Third-Party Service Provider, as applicable, if you inadvertently process or share data in breach of this provision;
(I) circumvent, disable, or stress test any security or other technological features of the Open Banking Services or the systems of any Third-Party Data Provider through which End User Data is sourced;
(J) re-identify or attempt to re-identify Anonymous & Aggregated Data or End User Data provided in a de-identified form;
(K) knowingly use the Open Banking Services to send or store infringing, obscene, threatening, libelous, or other unlawful or tortious material, including, without limitation, material harmful to or that causes damage to any property or violative of any person’s or third-party’s privacy rights or in any manner that encourages, supports or promotes illegal activities or unlawful gambling;
(L) use the Open Banking Services or any Third-Party Data Provider systems in any manner to provide service bureau, time sharing or other computer services to third parties, except where necessary to use the Open Banking Services, or in any manner that would cause a material risk to the security or operations of Third-Party Data Providers, or that would constitute excessive or abusive usage;
(M) intentionally or knowingly upload to the Open Banking Services or use the Open Banking Services to intentionally send or store viruses, worms, time bombs, trojan horses, or any other harmful or malicious code, files, scripts, agents or programs;
(N) conduct any platform or system level testing of the Open Banking Services, including, without limitation, load or security testing, without first obtaining Third-Party Service Provider’s written consent;
(O) sell, rent, lease, loan, license, distribute, publish or publicly display, copy, modify, duplicate, create derivate works from, translate, frame, scrape, mirror, republish, download, display, transmit, disassemble, decompile, reverse engineer all or any portion of, or otherwise attempt to derive source code of the Third-Party Data Provider services; or
(P) identify by name any Third-Party Service Provider or Third-Party Data Provider in: any press release, statements to the media, social media postings, or public disclosure except as otherwise expressly authorized or permitted in this Open Banking Services Agreement.
3. THIRD PARTIES
3.1 Third-Party Providers. You are responsible for complying with any applicable terms and conditions of any third-party products, services, and platforms you use in conjunction with the Open Banking Services, which are not provided by NMI or Third-Party Service Provider as part of the Open Banking Services.
3.2 Your Third-Party Access.
(A) Use by your Affiliates. Subject to their compliance with the terms of this Open Banking Services Exhibit, your Affiliates may use and access the Open Banking Services, Documentation or End User Data.
(B) Outsourcing and Third-Party Access. You may allow your third-party contractor to operate, use or access the Open Banking Services or End User Data solely on your behalf, provided such use or access is only for your direct beneficial business purposes.
(C) Responsibility for Third-Party Access. You acknowledge and agree that you are solely responsible for ensuring that any of your Affiliates, contractors, agents, or other third party operating, using or accessing the Open Banking Services or End User Data on your behalf assumes and complies with the obligations flowed down to you under this Open Banking Services Agreement.
(D) Your Responsibility. You are responsible and liable for the acts or omissions of your Affiliates and all third parties authorized by you to access the Open Banking Services, Integration Requirements, Documentation, or End User Data as if they were your own acts or omissions.
3.3 Third-Party Data Providers.
(A) You acknowledge that End User Data may be sourced from Third-Party Data Providers, and such parties may be required by applicable Laws or regulatory enforcement to oversee recipients of End User Data. You agree to cooperate with any reasonable requests of NMI, Third-Party Service Provider or such Third-Party Data Providers to attest or otherwise certify to your compliance with applicable Laws or this Open Banking Services Agreement.
(B) You acknowledge that End User Data may include Nonpublic Personal Information and you agree to protect that End User Data as detailed in the Data Protection Terms set out in Exhibit B, which is incorporated herein by reference.
(C) You acknowledge that End User Data you source from Third-Party Data Providers carries with it the obligations detailed in the Third-Party Data Provider Terms set out in Exhibit C, and you agree to comply therewith.
4. CONSUMER DATA OWNERSHIP, PERMITTED USES, AND RESPONSIBILITY
4.1 Ownership. As between NMI and you, you own (or, where applicable, must ensure you have a valid license to use) the End User Data.
4.2 Permitted Use. You grant NMI and, through NMI, Third-Party Service Provider:
(A) a non-exclusive, worldwide, royalty-free license to reproduce, display, adapt, enhance, aggregate, transmit, distribute and otherwise use and access the End User Data as necessary or reasonable to provide the Open Banking Services and to generate Anonymous & Aggregated Data;
(B) a non-exclusive, royalty-free, revocable, limited license, during the term of this Open Banking Services Agreement, to use your trademarks, marks, logos, trade names and service marks owned or licensed by you (“Your Marks“), and to sublicense the same to Service Provider(s) and Third-Party Data Providers, for the sole purpose of providing the Open Banking Services (e.g., identifying you to End Users as a source or recipient of End User Data, or rebranding of the Open Banking Services in those scenarios where you have licensed such white-labeled rights, if applicable). NMI and/or Third-Party Service Provider will use Your Marks and will require that any Third-Party Data Provider use Your Marks in compliance with any reasonable trademark use policies you may promulgate from time to time and provide to NMI in writing; and
(C) a non-exclusive, royalty-free, worldwide, transferable, sublicensable, perpetual and irrevocable license to reproduce, display, adapt, enhance, transmit, distribute and otherwise use Anonymous & Aggregated Data.
4.3 Responsibility.
(A) End User Consent.
(i) You must only request End User Data through the Open Banking Services that is expressly consented to by the End User or reasonably necessary to provide the End User’s requested product or service. You shall provide all notices and obtain all consents in the form and substance required under Privacy Laws to enable NMI and Third-Party Service Provider to lawfully Process End User Data. Your consent may not include a technology solution that automatically enrolls an End User into an agreement without such End User taking an express action. You shall, and shall ensure that all third parties to whom you provide access to End User Data, (1) Process and disclose End User Data solely in accordance with applicable Laws, this Open Banking Services Agreement, your privacy policy, Third-Party Service Provider’s privacy policies and the End User’s consent, and (2) limit collection, use, and retention of End User Data to what is reasonably necessary to provide the End User’s requested product or service.
(ii) Your disclosures to End Users shall (1) be clear, conspicuous, segregated from other material, and present in valid and enforceable terms and conditions, (2) include the categories of End User Data being collected and processed, the categories of data recipients, a description of how End User Data will be used, accessed, shared or sold, and any other terms or disclosures required by applicable Laws, (3) disclose to the End User any use by you of Anonymous & Aggregated Data, including Processing related to derivatives, compilations or combinations of End User Data, any anonymization and/or de-identification of End User Data, and any aggregation of End User Data with other data, (4) inform End Users that the End User Data does not represent an official record of the End User’s account with its financial institution, (5) state that you are acting independently and that the End User’s financial institution has no responsibility or liability with respect to your service or application, and (6) describe how the End User may exercise their privacy rights.
(iii) If you both access End User Data and initiate payments, you must obtain separate and distinct consents from End User for these separate activities.
(iv) You shall maintain such systems and procedures as may be reasonably necessary or otherwise required by NMI or Third-Party Service Provider (consistent with applicable Laws and industry best practices) to actively track, monitor and document such End User consent and any revocation thereof. You shall maintain records that, at a minimum, (a) include the scope of the consent and related disclosures, covered data elements, the date the End User provided consent, the consent effective date, and the consent expiration or termination date, and, to the extent required by applicable Laws, any consent and disclosure elements described under the applicable sections of this Exhibit A; and (b) are maintained in a system log or database that ensures completeness and integrity of records. Upon request, you will provide copies, or acceptable evidence, of such consents and disclosures.
(v) Third-Party Service Provider, End User’s financial institution and/or NMI will suspend your access to a specific End User’s data if such End User revokes consent with you, Third-Party Service Provider or the financial institution. Third-Party Service Provider or a Third-Party Data Provider may also require End Users to re-authenticate their consent upon (a) a Security Incident impacting such End User, (b) a change in the End User terms and conditions of you, Third-Party Service Provider or Third-Party Data Provider that requires a new consent to be obtained; or (c) the end of a specific period of time as required under applicable Laws or by the Third-Party Data Provider’s policies. You shall limit the duration of your collection of End User Data to the maximum period permitted under applicable Laws, or as consented by the End User (whichever is shorter) and, prior to or following the expiration of such period, shall obtain a new consent from the End User to continue or resume, as applicable, collection and Processing of the End User’s data.
(B) End User Control. You must provide End Users with a simple and readily accessible method to revoke consent in accordance with applicable Privacy Laws and may not charge fees or penalties to End Users for exercising their rights to revoke consent. You shall notify NMI and/or Third-Party Service Provider, as applicable, (including with information sufficient to enable Third-Party Service Provider to notify its Third-Party Data Providers, as necessary) and any other third party required to be notified by you under applicable Laws, promptly upon receiving an End User’s consent revocation. Upon such revocation, you shall cease all attempts to access the applicable End User Data, and shall no longer use or retain any previously collected End User Data unless reasonably necessary to provide the End User’s requested product or service.
(C) End User Data Access. NMI may provide a list of Internet Protocol addresses (“IP Addresses“) to Third-Party Service Provider from which Third-Party Service Provider may access End User Data from you on behalf of End Users. NMI may update the provided list from time to time. You must not block or otherwise obstruct Third-Party Service Provider and/or NMI from accessing End User Data using the IP Addresses in the provided list.
(D) Representations. You will not: (i) make representations or other statements with respect to Nonpublic Personal Information that are contrary to or otherwise inconsistent with Third-Party Service Provider’s privacy policy or (ii) interfere with any independent efforts by Third-Party Service Provider to provide End User notice or obtain End User consent.
(E) End User Requests.
(i) Technical Controls. You shall use the technical controls provided by Third-Party Service Provider through its API and/or the administrative controls NMI makes available to you in order to comply with your obligations to access, retrieve, correct and Destroy End User Data per an End User Request. The parties shall, taking into account the nature of the Processing, cooperate in good faith and provide reasonable assistance to each other in complying with End User Requests. Removal by an End User of a linked account in your Application constitutes an End User Request revoking the End User’s consent, and you shall promptly effectuate such revocation through the technical controls provided by Third-Party Service Provider through its API, such that access to the affected End User Data ceases.
(ii) Requests to You. You shall respond to and fulfill End User Requests, as applicable, made directly to you by an End User or on behalf of an End User in accordance with Privacy Laws.
(iii) Requests to Third-Party Service Provider. Third-Party Service Provider will, as applicable, respond to End User Requests made directly to Third-Party Service Provider in accordance with Privacy Laws provided that Third-Party Service Provider is able to identify the End User. If Third-Party Service Provider is not able to identify the End User or the End User Request has been escalated for any reason, Third-Party Service Provider will advise the End User to contact you. You shall be responsible for identifying any such End Users that contact you to exercise End User Requests and providing Third-Party Service Provider with information sufficient to allow Third-Party Service Provider to identify the End User and fulfill the End User Request as regards the data held by Third-Party Service Provider.
(iv) Suspension of Access. Third-Party Service Provider and/or NMI will have the right to engage with the End User directly regarding any End User Requests and will have the right to suspend your access to any End User Data at any time to address such End User Request.
(F) Information and Assistance. Upon written request, you will provide NMI, Third-Party Service Provider and/or Third-Party Data Provider with information reasonably needed to demonstrate compliance with the obligations in Exhibits A, B and C and the Privacy Laws. You shall provide reasonable assistance in fulfilling legal obligations under applicable Laws, including Privacy Laws (including contributing to data protection impact assessments and consultations with supervisory authorities).
5. Suspension
NMI and/or Third-Party Service Provider will have the right to suspend your Open Banking Services account or your access, in whole or in part, to the Open Banking Services and any End User Data upon reasonable, good-faith belief that:
(A) you are acting in an unauthorized manner with respect to your access to the Open Banking Services or any End User Data;
(B) there is a material risk to the security or integrity of the Open Banking Services, the End User Data, or any systems of NMI, NMI’s technology providers, any Third-Party Data Provider, or you; or
(C) suspending access is reasonably necessary to prevent harm to the business or reputation of NMI, an NMI technology provider, any Third-Party Data Provider, and/or their respective customers.
Your use of the Open Banking Services may be limited if your Open Banking Services account or access to your Open Banking Services is suspended. Any suspension will be reasonably limited in scope. Unless prohibited by applicable Laws, NMI will use reasonable efforts to provide timely notice of the suspension to you, including a description of the scope and reasons for the suspension. Such notice may occur after the suspension or restriction has occurred. NMI may also, in its reasonable discretion, contact any End User for NMI’s purposes, including fraud investigation and/or risk management purposes. If NMI contacts an End User for such purposes, NMI will notify you to the extent permissible under applicable Laws. The parties will cooperate in good faith to remediate the reason for any suspension. Upon resolution of the issue causing the suspension, NMI will promptly permit you to resume using the Open Banking Services.
Exhibit B
Data Protection Terms
1. INFORMATION SECURITY
In connection with this Open Banking Services Agreement, you may have access to and/or be provided with information concerning End Users and their past or present accounts including End User Data, other information falling within the definition of Nonpublic Personal Information, or Confidential Information. In connection with all such End User Data, Nonpublic Personal Information and Confidential Information, you must:
1.1 handle, keep, maintain and secure from others the Nonpublic Personal Information, End User Data, and Confidential Information to which you have access or are provided, with the utmost of care and confidentiality. In no event will you take precautions any less stringent than those employed to protect your own proprietary and confidential information;
1.2 allow the Nonpublic Personal Information and End User Data to be accessed and used by your personnel, including subcontractors, only in connection with the provisions of this Open Banking Services Agreement and ensure that all personnel, including subcontractors, have agreed to maintain the confidentiality of the End User Data, Nonpublic Personal Information and Confidential Information;
1.3 not share, disclose, provide or permit access to any Nonpublic Personal Information or End User Data by any other person or entity, except as permitted hereunder or as permitted by the applicable End User;
1.4 with respect to any third party provided access to Nonpublic Personal Information or Confidential Information, enter into a written agreement with such third party requiring safeguarding of Nonpublic Personal Information, End User Data or Confidential Information in a manner no less restrictive than your obligations under this Open Banking Services Agreement;
1.5 implement appropriate safeguards and programs (including, but not limited to security controls such as physical and logical access, configuration and change management processes, data encryption, strong authentication, vulnerability and risk management (including regular vulnerability assessments and required remediation timelines for identified vulnerabilities), asset management, media protection, application security, network security monitoring and logging to detect unauthorized access to, use of, or tampering with End User Data, intrusion detection, security event monitoring and alerting, internal and external security program audits, security incident detection and response, and employee security training) consistent with best practices in the financial services industry and all applicable Laws, designed to help ensure the security and confidentiality of Nonpublic Personal Information and to protect against unauthorized access to or use of Nonpublic Personal Information that could result in substantial harm and measurable damage to End User, NMI or Third-Party Service Provider;
1.6 establish and maintain a written information security program that is consistent with applicable Laws including Section 501 of the GLBA, or if you are not subject to Section 501 of the GLBA, 16 CFR Part 314 (the Federal Trade Commission’s Standards for Safeguarding Customer Information) as well as generally accepted industry standards, including “Generally Accepted Principles and Practices for Securing Information Technology Systems” (GAPPs) issued by the National Institute of Standards & Technology and/or the ISO 27000, to safeguard against the unauthorized disclosure, destruction, loss, or alteration of End User Data. At a minimum, your written information security program will be designed to: (i) ensure the security, integrity, and confidentiality of all End User Data; (ii) detect patterns, practices, or specific activity that indicates the possible existence of identity theft or other threats or hazards to the security or integrity of End User Data; (iii) protect against unauthorized access, interception, use, or disclosure of End User Data; (iv) ensure that all transfers of End User Data are accomplished in a secure and confidential manner and in compliance with best practices in the financial services industry and latest industry encryption standards, including encryption of all End User Data at rest and in transit, using commercially reasonable encryption; (v) ensure the secure disposal of End User Data, where applicable; (vi) inventory information systems that contain End User Data or are otherwise critical to achieving business purposes; (vii) implement appropriate risk-informed identity and access management, implementing the principles of least privilege and need-to-know; (viii) ensure multi-factor authentication for access to any information system containing End User Data except where a reasonably equivalent or more secure access control has been approved; and (ix) execute regular vulnerability assessments and required remediation timelines for identified vulnerabilities;
1.7 notify the affected party of any known unauthorized access to or use of Nonpublic Personal Information, as soon as is practicable, after confirmation of such event;
1.8 disclose, if you learn of any vulnerability affecting or reasonably believed to affect an NMI, Third-Party Service Provider or Third-Party Data Provider system within the scope of this Open Banking Services Agreement, the vulnerability to NMI or Third-Party Service Provider, as applicable. You shall not make any public disclosures regarding such vulnerability which identify NMI, Third-Party Service Provider or Third-Party Data Provider by name or Marks, or other information which may reasonably allow a third party to associate NMI, Third-Party Service Provider or Third-Party Data Provider with the vulnerability;
1.9 identify and assess reasonably foreseeable threats to the security of Nonpublic Personal Information or End User Data and adjust security mechanisms to address new threats; and
1.10 maintain on all of your systems on which End User Data is accessed, stored, used or otherwise processed (i) real-time intrusion detection systems, and (ii) up-to-date and reputable antivirus software and/or other commensurate anti-malware tools and applications. Without limiting your obligations under Section 2 (Security Incident), you must promptly report any patterns, practices, or specific activity detected with respect to your or NMI’s systems that may indicate the possible existence of identity theft, and must take appropriate steps to prevent or mitigate the same.
2. SECURITY INCIDENT
2.1 Notification. You will promptly (and in any event, within 48 hours of discovery) notify NMI and/or Third-Party Service Provider, as applicable, of a Security Incident (as defined below). Such notice must include a detailed description of the Security Incident, and any other information NMI may reasonably request concerning the Security Incident, including, without limitation, the number of records, types of information, and number of End Users impacted by the Security Incident, the known or suspected causes of the Security Incident, any actual or anticipated impact on NMI or its customers, and remediation plans. You will maintain records of all actual or suspected Security Incidents consistent with security best practices in the financial services industry and will make such reports available to NMI upon request.
2.2 Mitigation. You agree to promptly and at your own cost and expense investigate and take all reasonable measures necessary or advisable to mitigate the effects of and remedy any Security Incident, including, where appropriate and without limitation, providing credit monitoring services and related call center or similar support activities to impacted parties.
2.3 Reasonable Assistance. You further agree to fully cooperate with and provide all reasonable assistance to NMI in regard to its investigation of any Security Incident and agree to provide any information available that NMI reasonably needs to comply with its obligations under Privacy Laws. Without limiting the generality of the foregoing, you will cooperate with NMI in determining its legal obligations with respect to notification of End Users, regulators, and/or law enforcement, if any, and you agree to provide any documentation in your possession which is necessary for NMI to issue required or advisable notifications or communications.
2.4 Disclosure. Unless otherwise required by applicable Laws or pursuant to an agreement with an unrelated third party, you will not (and will ensure that each of your representatives and agents do not) inform or make any statements to any unrelated third party of any Security Incident without first obtaining NMI’s prior written consent. Where any disclosure of a Security Incident is required by applicable Laws, you will use commercially reasonable efforts to obtain NMI’s approval regarding such disclosure.
2.5 Dispute Management. You must notify NMI within 48 hours after receiving confirmation of or receiving any complaint alleging known or reasonably suspected improper or unauthorized access or use of End User Data. You will be responsible for managing all disputes or issues raised by an End User with respect to any of your applications; provided, however, that NMI, Third-Party Service Provider and/or Service Provider may, at its option, as applicable, engage directly with any End User with respect to issues or complaints relating to the authorized access or use of End User Data, and may take all steps deemed necessary by NMI, Third-Party Service Provider or Service Provider to resolve such issues or complaints, including, without limitation, terminating access to the Open Banking Services and/or to any End User Data. Notwithstanding the foregoing, you acknowledge and agree that you will remain responsible for any unauthorized access or use of End User Data once it has been accessed through the Open Banking Services, is in your possession or control, or thereafter.
2.6 Definition. For purposes of this Open Banking Services Agreement, “Security Incident” will mean any actual or reasonably suspected breach, incident or other event that compromises (or would be reasonably likely to result in a compromise of) the security, integrity or confidentiality of the End User Data, NMI’s or Third-Party Service Provider’s Confidential Information, or Confidential Information of NMI or Third-Party Service Provider held by your third party service providers that handle or otherwise process End User Data, or that otherwise results in (or that would be reasonably likely to result in) the unauthorized access, use, disclosure or loss of End User Data, NMI’s or Third-Party Service Provider’s Confidential Information, or Confidential Information of NMI or Third-Party Service Provider held by your third party service providers that handle or otherwise process End User Data, including Nonpublic Personal Information and any non-public Documentation.
3. BACKGROUND INVESTIGATIONS
During the Term hereof and for such period thereafter as you will retain possession or control of End User Data, you will maintain comprehensive hiring and employment policies and procedures designed to ensure that all of your personnel with access to the Open Banking Services or to any End User Data possess appropriate character, disposition and honesty. In connection with the foregoing, you must, to the extent permitted by applicable Laws, conduct at your expense pre-employment background checks and other investigations of your employees and other personnel that may obtain access to the Open Banking Services or End User Data prior to their accessing the Open Banking Services or End User Data. Such background checks and investigations must include, but are not limited to: (a) confirmation of identity and personal information; (b) felony and misdemeanor and national criminal searches (where permissible); and (c) confirmation the individual is not on the Specially Designated Nationals (SDNs) list published by the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) (or national equivalent) and global sanctions enforcement searches. You must not permit any of your employees or other personnel to access the Open Banking Services or End User Data until such individual has passed the outlined background screening. You will not permit any employee or other personnel who has been formally charged with a crime that is a dishonest act or breach of trust as set forth in Section 19 of the Federal Deposit Insurance Act, or who you know has otherwise engaged in any material act of dishonesty or breach of trust, to access or use the Open Banking Services or End User Data, in accordance with all applicable Laws. You must reasonably cooperate with any investigation undertaken by NMI and/or Third-Party Service Provider with respect to any act of dishonesty, breach of trust, or violation of law by any of your employees or personnel with respect to the Open Banking Services or the End User Data.
4. INSURANCE
You must obtain and maintain at your own expense, throughout the Term and for a period of two years thereafter, (a) sufficient insurance coverage for your business, your activities hereunder, and any reasonably anticipated risks; and (b) without limiting the foregoing, as applicable (1) Commercial General Liability Insurance, (2) Crime Insurance (Employee Dishonesty), and (3) with limits of not less than five million dollars per claim, Professional Liability, Cyber Risk/Data Security and Privacy Liability Insurance covering claims (and any associated costs and damages, including acts, errors and omissions, data breach investigation, data breach notification and credit monitoring costs) arising from: (i) breaches of computer systems and data security, (ii) violations of any privacy right, (iii) breaches of data privacy and data security laws and regulations, (iv) breach of PCI-DSS or any similar rules promulgated by the PCI Council, and (v) data theft, damage, destruction, or corruption, including unauthorized access, unauthorized use, identity theft, theft of personally identifiable information, and transmission of a computer virus or other type of malicious code. For the avoidance of doubt, your insurance coverage shall not limit your liability as set forth under this Open Banking Services Agreement.
5. SUBCONTRACTORS
5.1 You will require any subcontractor who Processes or has access to End User Data or Third-Party Data Provider Confidential Information to comply with requirements substantially equivalent to your obligations under this Open Banking Services Agreement, as applicable to the scope and nature of such subcontractor’s work.
5.2 Upon Third-Party Service Provider’s request, you shall provide a list of all subcontractors (a) if necessary for NMI, Third-Party Service Provider or any Third-Party Data Provider to comply with the request of a regulator, or (b) if NMI, Third-Party Service Provider or any Third-Party Data Provider reasonably believes that you have breached your obligations under this Open Banking Services Agreement. In the case of (b), you acknowledge that NMI, Third-Party Service Provider or its Third-Party Data Provider(s) will have the right to refuse (or cease to allow) access to, or to require you to refuse (or cease to allow) access to a subcontractor as necessary to comply with third-party oversight or other risk management obligations under applicable Laws. Any list of subcontractors provided pursuant to this provision shall be your Confidential Information.
Exhibit C
Third-Party Data Provider Terms
1. Money Movement Open Banking Services End User Terms and Conditions
(A) End User Access. You must ensure, prior to any access or use of the Open Banking Services, each End User’s agreement to minimum end user terms and conditions governing such End User’s use and access to the Open Banking Services in the form of an end user license agreement governing such End User’s use of the Open Banking Services that is substantially equivalent to and includes terms at least as protective of NMI, Third-Party Service Provider, and Third-Party Data Provider as those minimum end user terms and conditions as detailed in the Money Movement Open Banking Services End User Terms and Conditions (“EULA“) (set forth at https://www.dwolla.com/legal/open-banking-end-user-terms) and incorporated herein by reference. You are responsible for all activity that occurs in your End User accounts and for your End User’s compliance with this Open Banking Services Agreement and the EULA.
(B) Updates. NMI and Third-Party Service Providers may amend and supplement the EULA at any time during the Term by providing notice to you (in the case of a Third-Party Service Provider, either directly or through NMI). You will have thirty (30) days from receipt of such notice to update your EULA to reflect such amendment or supplement, or as otherwise provided by NMI and/or Third-Party Service Provider.
(C) Your specific Terms. You must update the EULA, based on your specific use case, to: (i) accurately set forth what data, including all compilations, aggregations, and combinations of the same, is collected, how collected data will be used, and how collected data will be accessed, shared, exchanged, or sold; (ii) provide clear and conspicuous disclosures to all End Users and prospective End Users, segregated from other material, and present in valid and enforceable terms and conditions, sufficient to comply with applicable Laws regarding the collection, use, and sharing described, including Anonymous & Aggregated Data; (iii) identify or disclose to each End User any and all categories of third parties to whom End User Data may be provided or how End User Data will be used, accessed, received, stored, shared, sold, or processed; and (iv) describe how the End User Data will be protected in the event that you cease operating as a going concern or otherwise cease to make available your application and/or mobile website to End Users, describing how End User Data in your possession or control will be safeguarded, deleted, and purged in such circumstances. A reference to your privacy policy is included in Section 2 of the EULA. If your privacy policy does not cover the items set out in this Section 1(C), or meet the EULA requirements set out in this Open Banking Services Agreement, you agree to update the EULA or otherwise provide the information required by this Open Banking Services Agreement to each of your End Users and obtain their agreement to such by express consent.
2. DATA REQUIREMENTS
You will provide to Third-Party Service Provider, either directly or through NMI, as determined by Third-Party Service Provider, information regarding your data requirements, which Third-Party Service Provider may disclose to Service Provider(s) and/or Third-Party Data Providers, who, in the event Confidential Information is being shared, are under written confidentiality obligations with Third-Party Service Provider consistent with those set out in this Open Banking Services Agreement, in order to facilitate its provision of the Open Banking Services. You shall not charge End User any fees that identify, or are identifiable to, NMI, Third-Party Service Provider, any Service Provider(s), Third-Party Data Provider, or to End User’s use of the Open Banking Services.
3. API MONITORING
NMI, Third-Party Service Provider, Service Provider(s) and/or Third-Party Data Providers, as applicable, have the right to monitor any and all use of the Open Banking Services and Third-Party Data Provider connections to the Open Banking Services (including frequency of access and types of data received) without notice to you or your personnel.
4. DATA HOSTING
You may only host and/or store End User Data and any Third-Party Data Provider Confidential Information you receive from locations within the United States unless otherwise approved in advance and in writing by Third-Party Service Provider and/or applicable Third-Party Data Providers.
5. DATA USE AND CREDENTIALS
(A) Credentials and Previously Collected Data.
(i) Credentials. Except as otherwise expressly permitted in this Open Banking Services Agreement, you shall not, and you shall not permit or enable any third party or service provider to collect, store, or use any End User bank account credentials as part of their integration with the Open Banking Services, or access any data relating to an End User that you know or have reason to believe was procured via screen scraping. Before accessing the Open Banking Services, you must stop using and Destroy any End User bank account credentials you hold. Upon NMI’s and/or Third-Party Service Provider’s request, you must certify and provide reasonable verification that you have Destroyed such data and that you do not have any End User bank account credentials.
(ii) Previously Collected Data. Prior to accessing the Open Banking Services, you shall delete any End User data which was not obtained in accordance with the terms of this Open Banking Services Agreement or through a provider with a valid agreement with the applicable Third-Party Data Provider.
(iii) Deletion of End User Data. You shall delete or anonymize End User Data (1) as required by Privacy Laws, (2) upon request by an End User or (3) upon notification of a deletion request from Third-Party Service Provider. If you access or retain End User Data that is not expressly consented to by the End User, you shall promptly delete such End User Data. To the extent permitted under applicable Laws, you may retain Nonpublic Personal Information for the period reasonably necessary to provide the services requested by the applicable End User or as otherwise required by applicable Laws. Upon termination of this Open Banking Services Agreement for any reason, you shall Destroy all End User Data in accordance with your retention policies, unless you have permission from the applicable End User to retain such End User Data, you continue to maintain appropriate technical and organizational safeguards for such End User Data and such retention is not prohibited under applicable Laws. Within sixty (60) days following termination of this Open Banking Services Agreement you must certify and provide verification to NMI and/or Third-Party Service Provider that you have complied with the deletion requirements of this Section 5(A)(iii).
(B) End User Data. With respect to End User Data made available through the Open Banking Services from Third-Party Data Provider, you will not, nor will you attempt to or otherwise enable a third party to: (i) use, disclose or process the End User Data to target market products or services to End Users that are directly competitive to those offered by any Third-Party Data Provider, by using such End Users’ status as a customer of a Third-Party Data Provider as criteria; (ii) use any information obtained through the Open Banking Services, including, without limitation, any APR, APY, credit limit or any other information contained in the End User Data to ascertain confidential or proprietary information of any Service Provider or any Third-Party Data Provider, including, without limitation, credit models, credit algorithms, and other business processes and calculations not available to the public. Further, you shall not, and shall not allow any third party to, collect, use, or retain any historical APR, APY, or credit information once updated values have been received via the Open Banking Services; (iii) sell, transfer or rent Nonpublic Personal Information to marketers or any other third party; (iv) use End User Data or Nonpublic Personal Information for marketing purposes, including, without limitation, cross-selling or targeted advertising, unless you obtain NMI or Third-Party Service Provider’s prior express written consent, as applicable, and express consent from the applicable End User for such use and such use is in strict compliance with Privacy Laws; (v) combine Nonpublic Personal Information relating to an End User with data relating to other End Users or with data obtained from third parties or other sources with the intent of extracting unconsented data or unauthorized data; (vi) Process End User’s bank credentials other than as required to access or use the Open Banking Services, as authorized by End User, as permitted by Third-Party Service Provider, and as permitted under Privacy Laws; (vii) process any Nonpublic Personal Information, or access or use the Open Banking Services, other than in strict compliance with Privacy Laws; or (viii) process any Nonpublic Personal Information, or access or use the Open Banking Services, in any manner that would be a breach of contract or agreement between NMI and Third-Party Service Provider or between End User and Third-Party Service Provider.
(C) Suspension of Access. A Third-Party Data Provider may immediately limit, suspend, or terminate your access to such Third-Party Data Provider’s End User Data (i) in the event of a material financial or reputational risk to such Third-Party Data Provider; (ii) in the event of a Security Incident or a threat that affects the stability, security and integrity of the Third-Party Data Provider’s End User Data or systems; (iii) if such Third-Party Data Provider reasonably believes that you are in breach of the data protection and security requirements; or (iv) for any other reason in Third-Party Data Provider’s sole discretion, including, without limitation, if reasonably necessary to avoid violating applicable Laws or regulatory guidance.
(D) FCRA. In addition to the restrictions set forth in this Open Banking Services Agreement, you shall notify Third-Party Service Provider and/or NMI, as applicable, as legally permitted and practicable of any regulatory investigation initiated by any regulator with jurisdiction over you involving FCRA. You will not use the End User Data as a factor in establishing an individual’s eligibility for credit, insurance, employment or any government license or benefit, to take any “adverse action” (as defined in the FCRA), or in any manner that would cause Third-Party Service Provider, any Third-Party Data Provider or the End User’s applicable financial institution, to be deemed a “furnisher” as the term is defined in the FCRA. If Third-Party Service Provider or its Third-Party Data Providers reasonably determine that your use of End User Data may reasonably cause Third-Party Service Provider or its Third-Party Data Providers to be deemed a “furnisher”, Third-Party Service Provider may terminate this Open Banking Services Agreement upon notice to you in writing by certified or registered mail, a nationally recognized overnight courier service or, where specified, via email. Notices shall be deemed to have been received (i) on the date delivered if by a recognized overnight courier, fees prepaid; (ii) on the date received, if by registered or certified mail (fees prepaid, return receipt requested); or (iii) in the case of email, on the day the email is sent if sent during normal business hours, or, if not, on the subsequent business day.
6. COMPLIANCE; AUDITS
(A) In addition to the audit set out in Section 4.2 of the Open Banking Services Agreement, during the Term of the Open Banking Services Agreement and for one year thereafter, you will, upon reasonable advance written notice from Third-Party Service Provider and/or NMI, (i) permit Third-Party Service Provider, through its internal and external auditors or those of any Third-Party Data Provider, to audit, review and inspect (1) your books, records, and other documents, including security logs, and (2) your systems, networks, and facilities (an “Audit“), or (ii) provide to NMI, Third-Party Service Provider or any Third-Party Data Provider a written attestation of your compliance with the terms and conditions of this Open Banking Services Agreement governing the Processing of End User Data, the prompt reporting of all Security Incidents, and obligation to refrain from re-identifying or attempting to re-identify any aggregated or de-identified End User Data (an “Attestation“).
(B) All Audits will be conducted for the sole and exclusive purposes of confirming your compliance with the data handling and security terms and conditions of this Open Banking Services Agreement, and will occur during regular business hours, at NMI’s, Third-Party Service Provider’s or an applicable Third-Party Data Provider’s sole cost and expense, and, except following the occurrence of a Security Incident, no more frequently than once per year. You agree to reasonably cooperate with any Audit performed pursuant to this Section 6 and must promptly take all actions necessary to remediate any material deficiencies and non-compliance discovered as a result of any Audit or Attestation.
(C) Information Security Audits. At least annually during the Term, you must have a certified independent public accounting firm or another independent, certified, industry-recognized third party: (i) conduct a review or assessment and provide a full attestation, review, or report under SOC 2 Type II or an equivalent assessment framework such as ISO 27001 (or such reasonably comparable standard acceptable to Third-Party Service Provider in its reasonable sole discretion) of all your systems and operational controls used by you to access the Open Banking Services or access, store, or process any End User Data; and (ii) conduct and provide a full report of an independent network and application penetration test.
(D) You must provide copies of all such reports and the results of any testing to NMI and Third-Party Service Provider (each, a “Security Assessment Report“).
(E) All Attestations, Security Assessment Reports and the results of any of your Audits will be considered your Confidential Information; provided, however, that NMI, Third-Party Service Provider and/or Service Providers may disclose copies of the same to any Third-Party Data Provider at their sole discretion, provided such Third-Party Data Provider is bound by written obligations of confidentiality which are in no event less than a reasonable standard of care.
(F) Government Audits. Nothing in this Exhibit C is or will be construed as limiting the rights of any governmental or regulatory authority to conduct audits or investigations. You acknowledge that NMI and Third-Party Service Provider intend to fully comply with all governmental and regulatory authorities of NMI, Third-Party Service Provider and Third-Party Data Provider, including with respect to any law enforcement or judicial investigations, and that in connection with the foregoing, NMI and Third-Party Service Provider may disclose the identity of, and any information transmitted or received by, persons accessing the Open Banking Services. You agree to fully cooperate with any audits or investigations conducted by a governmental or regulatory authority pursuant to applicable Laws.
(G) Data Protection Audits.
(i) You shall be audited or assessed at least annually by internal auditors and/or accredited external auditors/auditing firms on various components of your enterprise and platforms in accordance with industry best practices. At least annually, you shall provide NMI and Third-Party Service Provider with an audit report, issued by an independent third-party auditor, demonstrating your compliance with Privacy Laws and your related obligations under this Open Banking Services Agreement (each a “Data Protection Audit Report“). In addition, you shall make available to NMI and Third-Party Service Provider all information reasonably requested by NMI and Third-Party Service Provider required pursuant to NMI’s or Third-Party Service Provider’s risk assessment policy, as applicable. Notwithstanding the foregoing, you will not provide a copy of your internal risk assessment to NMI or Third-Party Service Provider. NMI and Third-Party Service Provider shall treat all such Data Protection Audit Reports as your Confidential Information and shall not use the Data Protection Audit Reports for any other purpose. Notwithstanding the foregoing, NMI and Third-Party Service Provider may disclose copies of the same to Third-Party Data Provider(s) in their sole discretion, provided that such Third-Party Data Providers are subject to a confidentiality agreement with NMI, Third-Party Service Provider, or Service Provider(s) that binds such Third-Party Data Provider to maintaining the confidentiality of your Confidential Information consistent with the confidentiality provisions of this Open Banking Services Agreement.
(ii) In the event of (1) a Security Incident or (2) NMI or Third-Party Service Provider, in each of their sole and reasonable discretion, determine that a Data Protection Audit Report you provide fails to adequately demonstrate your compliance with Privacy Laws or your related obligations under this Open Banking Services Agreement, you shall upon NMI’s or Third-Party Service Provider’s reasonable written request, make available to NMI or Third-Party Service Provider, as applicable, all reasonably required information necessary to demonstrate compliance with your obligations under the Privacy Laws and your related obligations under this Open Banking Services Agreement, and allow for (and contribute to) audits, including inspections conducted by NMI or Third-Party Service Provider or another auditor under the instruction of NMI or Third-Party Service Provider, subject to the following:
(a) Such audits, including inspections, shall begin upon not less than 15 days’ notice except in the event of a Security Incident, provided that the audit will (1) not disrupt your business; (2) be conducted during business hours; (3) not interfere with the interest of your other customers; and (4) not exceed a period of two successive business days;
(b) NMI, Third-Party Service Providers (or their third party auditors, respectively) will comply with your relevant security policies and appropriate confidentiality obligations as set out in this Open Banking Services Agreement;
(c) You will contribute to the audit by providing NMI or Third-Party Service Provider, as applicable, with reasonable assistance; and
(d) Notwithstanding anything herein to the contrary, physical or logical access to your computer systems will not be permitted, and you will not be required to display or otherwise disclose any confidential information of any third party or any information that could jeopardize the security or integrity of your computer systems.
(H) Notwithstanding anything to the contrary, upon written request, you will provide information reasonably needed to demonstrate compliance with the obligations in this Exhibit C and Privacy Laws.
Exhibit D
Terms and Conditions for Plaid Open Banking Services and Products
The Terms and Conditions for Plaid Open Banking Services and Products (“Open Banking Services Exhibit – Plaid“) applies to your use of the Open Banking Services provided to you through Plaid Inc. (“Plaid“). Hereinafter “you”, “your”, or “Company” means the Company and “us”, “we” or “our” refers to NMI (protecting Plaid).
For purposes of this Open Banking Services Exhibit – Plaid, Third-Party Service Provider or Third-Party Service Providers, as referenced in the Open Banking Services Agreement, refers to Plaid Inc. In addition, for the sake of clarity and for purposes of this Open Banking Services Exhibit – Plaid, any reference in the Open Banking Services Agreement to Exhibit A will be to this Exhibit D instead and Exhibits B and C of the NMI Open Banking Services Agreement do not apply to your use of the Open Banking Services provided to you through Plaid.
Definitions
“Anonymous & Aggregated Data” means End User Data and information that is anonymized and aggregated with similar data and information to the extent that the original End User Data and information is no longer attributable to NMI, Plaid, you, or to any specific End User.
“Balance Check” means an Open Banking Service ordered by you that you can use to periodically gather account balances in an account without collecting transaction data. Account types accessed include depository accounts. You can retrieve these account balances using an API request to help ensure your End Users have the appropriate funds.
“End User” or “End Users” means (a) a natural person who is a resident of the United States and at least 18 years old, or (b) a business or other entity formed or registered in the United States, in each case who is authorized by you to use or access the Open Banking Services and who has (i) been supplied an identification and password by you or at your direction or (ii) for whom a unique user record is created by or authorized to be created by you within the Open Banking Services.
“End User Data” means End User’s login, password, any other authentication information required by you or an End User’s third-party financial institution, and any End User transaction data.
“Instant Account Verification (without identity check)” means an Open Banking Service ordered by you that accesses financial account information, including account and routing numbers, for direct deposit accounts such as checking, savings, and money market accounts.
“Nonpublic Personal Information” means personally identifiable financial information as defined under Regulation P, 12 C.F.R. Part 1016, or the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., or information otherwise considered privileged, confidential, private, nonpublic or personal given protected status under applicable law.
“Open Banking Services” means Instant Account Verification, Balance Check, and the other products and services ordered by you through a Proposal to which these terms apply and are made available by Plaid through its online, web-based application or mobile components via designated websites, IP addresses, application programming interface(s), or other means.
“Third-Party Data Provider” means any third-party entity, including financial institutions, which provides End User Data or other data to NMI or NMI’s technology providers for use in the Open Banking Services.
1. Restrictions
Unless Plaid specifically agrees otherwise in writing, you will not, and will not enable or assist any third party to: (i) attempt to reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid services described at https://www.plaid.com (“Plaid Services“); (ii) modify, translate, or create derivative works based on the Plaid Services; (iii) make the Plaid Services or information and data of End Users provided to you via the Plaid Services (such information and data, the “Plaid-Provided Data“) or any derivative work thereof available to, or use the Plaid Services or Plaid-Provided Data (or any derivative work thereof) for the benefit of, anyone other than you or End Users; (iv) sell, resell, license, sublicense, distribute, rent, or lease any Plaid Services or Plaid-Provided Data (or any derivative work thereof) to any third party, or include any Plaid Services or Plaid-Provided Data (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate information from any source regarding the performance of the Plaid Services or Plaid-Provided Data; or (vi) attempt to create a substitute or similar service through use of, or access to, the Plaid Services or Plaid-Provided Data. You will use the Plaid Services and Plaid-Provided Data only in compliance with: (a) your application, use case, and other restrictions agreed between Plaid and NMI; (b) the Plaid developer policies (available at https://www.plaid.com/legal); (c) Plaid’s applicable technical user documentation (available at https://www.plaid.com/docs); and (d) any agreements between you and End Users (for clarity, including any privacy policy or statement). Notwithstanding anything to the contrary, as between Plaid and you, you accept and assume all responsibility for complying with all applicable Laws in connection with your activities involving any Plaid Services, Plaid-Provided Data, or End User data. You acknowledge and agree that: (I) Plaid is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the Fair Credit Reporting Act (“FCRA“); and (II) the Plaid-Provided Data is not a “consumer report” under the FCRA. You represent and warrant that you will not, and will not permit or enable any third party to, use the Plaid Services (including Plaid-Provided Data) as, or as part of, a “consumer report” as that term is defined in the FCRA, or otherwise use the Plaid Services (including Plaid-Provided Data) such that the Plaid Services (including Plaid-Provided Data) would be deemed “consumer reports” under the FCRA. Notwithstanding anything to the contrary, you will be bound by, and will only use the Plaid Services and Plaid-Provided Data in compliance with, the terms and conditions set forth in the Open Banking Services Agreement.
2. Secondary Investors
If applicable and agreed to by you and NMI, and subject to this Section 2 (Secondary Investors), you may request that Plaid or NMI disclose Plaid-Provided Data or an NMI product or service including or incorporating Plaid-Provided Data (collectively, the “Shared Data“) to your Secondary Investors. “Secondary Investor” means a third-party investor or purchaser of a financial product originated by you and provided to an End User (e.g., a loan), with which investor or purchaser Plaid maintains a separate technical integration.
(i) You represent and warrant to Plaid that, before disclosure of Shared Data to any Secondary Investor, you will provide and obtain all required (including under applicable Laws) notices and consents from the applicable End User with respect to disclosure of Shared Data to such Secondary Investor by Plaid or NMI.
(ii) Notwithstanding anything to the contrary: (a) as between Plaid and you, solely you are responsible for your relationships with Secondary Investors and with NMI, including any related billing matters, technical support, or disputes; (b) you will enter into legally binding written agreements with each Secondary Investor that are consistent with this Section 2 (Secondary Investors) and all applicable terms and conditions of this Open Banking Services Exhibit – Plaid (Terms and Conditions for Plaid Open Banking Services and Products), including Section 1 (Restrictions); and (c) as between Plaid and you, you will remain responsible for the Secondary Investors’ compliance with all of the terms and conditions of this Open Banking Services Exhibit – Plaid (Terms and Conditions for Plaid Open Banking Services and Products) (including terms relating to use of Plaid-Provided Data or Shared Data).
(iii) As between Plaid and you, you will be fully liable for: (a) any breach by you of this Section 2 (Secondary Investors); (b) any acts or omissions of Secondary Investors; and (c) any dispute arising among you, NMI, Secondary Investors, and/or End Users relating to the disclosure or use of Shared Data as contemplated in this Section 2 (Secondary Investors).
3. Privacy and Authorizations
Before any End User engages with NMI products or services which include, are derived from, or incorporate the Plaid Services, you warrant and will ensure that you provide all notices and obtain all consents required under applicable Laws to enable Plaid to process End User data in accordance with Plaid’s privacy policy (currently available at https://www.plaid.com/privacy). You will not: (i) make representations or other statements with respect to End User data that are contrary to or otherwise inconsistent with Plaid’s privacy policy; or (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent.
4. DISCLAIMER; ENFORCEMENT
THE PLAID SERVICES, PLAID-PROVIDED DATA, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES AND MATERIALS PROVIDED BY PLAID IN CONNECTION WITH THIS OPEN BANKING SERVICES EXHIBIT – PLAID ARE PROVIDED “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE SERVICES ARE FREE FROM DEFECTS. WITHOUT LIMITING THE FOREGOING IN THIS SECTION 4 (DISCLAIMER; ENFORCEMENT), NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY REPRESENTATION OR WARRANTY AS TO THE PLAID-PROVIDED DATA THAT MAY BE OBTAINED FROM USE OF THE PLAID SERVICES OR THAT ANY PLAID SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. PLAID WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN NMI AND YOU AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST YOU, WITHOUT NMI’S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE PLAID-PROVIDED DATA (INCLUDING FI DATA) AND PLAID SERVICES THAT ARE PROVIDED BY PLAID TO NMI OR YOU.
5. FI Data
Through the Open Banking Services or Plaid Services, you may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other data source (each, as designated by Plaid, “FI“, and such information, the “FI Data“).
(i) Your Obligations.
(A) End User Consents. You will provide all notices to, and obtain all express consents from, each End User as required under applicable Laws in connection with your use, storage, and other processing of any FI Data (such notices and consents, the “Express Consents“). Express Consents will: (1) be clear and conspicuous; (2) generally specify the categories of FI Data that you will receive and how you will use, store, and otherwise process FI Data; (3) be valid, enforceable, and expressly accepted by each End User; (4) identify any and all third parties or categories of third parties to whom you may provide FI Data for processing; (5) specify how End Users may exercise their right to revoke their Express Consent; and (6) include any other required disclosures under applicable Laws. You will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) sufficient to demonstrate your compliance with this Section 5(i)(A) (End User Consents) and will promptly provide such records to Plaid upon request.
(B) Scope of Access. You will only access FI Data for which you have obtained Express Consents from the End User for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User (such use case, the “Permitted Use Case“). For clarity, key factors Plaid will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with your application that the End User has enrolled in, whether your application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which you operate and/or store FI Data. If you possess FI Data that exceeds the scope of the End User’s Express Consents, you will use industry-standard means to permanently and securely delete (“Delete“) such FI Data; provided that you may retain such FI Data to the extent required by applicable Laws. If you become aware that any data you receive from Plaid does not relate to the End User that you originally requested FI Data for, you will promptly notify Plaid and will Delete such data.
(C) Data Use. You will use, store and otherwise process FI Data solely in accordance with the End User’s Express Consents and applicable Laws.
(D) Data Disclosure. You will not disclose, transfer, syndicate or distribute FI Data to any third party (including your service providers) except as permitted by the End User’s Express Consent and in accordance with applicable Laws. Notwithstanding anything to the contrary, you will not sell FI Data.
(E) Data Deletion. You will promptly Delete any FI Data upon request by the applicable End User; provided that you may retain copies of FI Data solely to the extent required by applicable Laws.
(F) No Attribution. You will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User’s account with an FI in connection with your application. In addition, you will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on your receipt of FI Data under the Open Banking Services Agreement or this Section 5 (FI Data).
(G) No Other Access. During the term of the Open Banking Services Agreement, you will only access FI Data through the Plaid Services or another manner that uses the FI’s authorized APIs. You will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. You will immediately Delete any such End User log-on credentials in your possession. You will maintain records to demonstrate compliance with this Section 5(i)(G) (No Other Access). For the avoidance of doubt, nothing in this Section 5(i)(G) (No Other Access) will prohibit you from engaging any third party to obtain services similar to the Plaid Services, provided that such third-party services enable your access to FI Data solely via the FI’s authorized APIs.
(H) Compliance with Laws. You will comply with all applicable privacy, security, and other laws pertaining to FI Data. You will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable Laws. For the avoidance of doubt, you acknowledge that Section 1033 of the Dodd-Frank Act may include obligations on you relating to processing, handling and protecting FI Data. You will maintain a program designed to ensure compliance with applicable Laws, including appropriately training your personnel.
(I) Information Security Program. You will maintain a comprehensive written information security program approved by your senior management (“Infosec Program“). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to your risk profile and activities, the nature of your application, and the nature of the FI Data received by you. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable Laws. You will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in your application or on your systems.
(J) Security Breach Obligations. You will notify NMI and Plaid promptly (and in any event within twelve (12) hours) via an email to security@plaid.com, following you becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information related to such Security Breach that Plaid and/or NMI may reasonably request. You will reasonably cooperate with Plaid and/or NMI in investigating and remediating Security Breaches. You will be responsible for the costs of investigating, mitigating, and remediating the Security Breach. “Security Breach” means any event that compromises your application or your systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in the unauthorized use, disclosure, or loss of FI Data.
(K) FI Confidential Information. If Plaid discloses to you any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, “FI Confidential Information“), such materials will be subject to the same obligations that apply to NMI’s Confidential Information under the Open Banking Services Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section 5(i) (Your Obligations). You will promptly Delete FI Confidential Information in your possession upon Plaid’s request and will provide a written certification regarding such Deletion.
(L) Oversight and Cooperation. Toward assessing your material compliance with this Section 5 (FI Data), you will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that you are not in material compliance with this Section 5 (FI Data), Plaid will notify you and, upon Plaid’s request, you will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided by you in accordance with the immediately prior sentence is insufficient (in Plaid’s reasonable discretion) to demonstrate such material compliance, you will submit to a third-party audit by a firm selected by you from a list of audit firms reasonably approved by Plaid to verify such compliance. Plaid and FIs may also conduct technical or operational assessments of you, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.
(M) Information Sharing. Where required by an FI or relevant to your access or use of FI Data from that FI, Plaid may share with such FI certain information related to your compliance with this Section 5 (FI Data), including with respect to your Infosec Program. Plaid will use commercially reasonable efforts to require that such FI treat any such information in a confidential manner.
(N) Insurance. You will maintain insurance coverage appropriate to your risk profile and activities, the nature of your application, and the nature of the FI Data received by you; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.
(O) Access Frequency. The parties acknowledge that as of the effective date of the Open Banking Services Agreement, no guidelines regarding your frequency of “batch” pulls of FI Data (such guidelines, the “Guidelines“) apply to Plaid end clients. Notwithstanding the foregoing in this paragraph: (1) You will comply with any Guidelines provided in writing by Plaid (including via NMI); and (2) Plaid and NMI may enforce such Guidelines to the extent necessary in accordance with Plaid’s standard practices, which may include throttling, suspension or termination of your access.
(P) Your Marks License. You hereby grant to Plaid, each FI (and each of their third-party service providers), and NMI the non-exclusive and non-transferable right and license to use your trademarks and service marks solely in connection with consent management activities, including use associated with your End User-facing consent management portals operated by Plaid or an FI.
(ii) Suspension. Plaid and/or NMI may suspend your access to the Open Banking Services, Plaid Services or FI Data, in whole or in part, if Plaid and/or NMI determines or reasonably believes that: (a) there is unauthorized access to the Plaid Services and/or the Open Banking Services via the administrative controls NMI makes available to you; (b) you have breached this Section 5 (FI Data); (c) your use of the Open Banking Services, Plaid Services or FI Data will or has materially violated the Open Banking Services Agreement and/or an agreement between Plaid and an applicable FI; (d) your use of the Open Banking Services, Plaid Services or FI Data will or does pose a risk of material harm, including material reputational harm, to End Users, an FI, the Open Banking Services or the Plaid Services. In addition, an FI may suspend your access to FI Data with respect to such FI. Plaid will use commercially reasonable efforts to: (1) notify NMI prior to any suspension described in this paragraph; (2) discuss with NMI in good faith any such suspension; and (3) resume your access to the Plaid Services and FI Data as promptly as is practicable after the basis for such suspension is cured to Plaid’s (and, as applicable, the relevant FI’s) reasonable satisfaction. Unless prohibited by applicable Laws, in the event of a suspension by NMI, NMI will use reasonable efforts to provide timely notice of the suspension to you, including a description of the scope and reasons for the suspension. Such notice may occur after the suspension or restriction has occurred. NMI may also, in its reasonable discretion, contact any End User for NMI’s purposes, including fraud investigation and/or risk management purposes. If NMI contacts an End User for such purposes, NMI will notify you to the extent permissible under applicable Laws. The parties will cooperate in good faith to remediate the reason for any suspension. Upon resolution of the issue causing the suspension, NMI will promptly permit you to resume using the Open Banking Services.
(iii) Indemnity. In addition to Section 8 of the Open Banking Services Agreement, you will indemnify, defend and hold harmless each FI, Plaid, NMI and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to you hereunder; or (b) your unauthorized or improper use of FI Data provided to you hereunder (including any unauthorized data sharing, transmission, access, display, storage, or loss). This Section 5(iii) (Indemnity) is not subject to any limitation of liabilities set forth in the Open Banking Services Agreement. Each FI is a third-party beneficiary of this Section 5(iii) (Indemnity).
(iv) Modifications. You acknowledge that continued access to FI Data provided by certain FIs may necessitate modifications to this Section 5 (FI Data) pertaining to all applicable Plaid end clients. You will accept such modifications to continue accessing or using the Plaid Services with respect to such FIs. Plaid will use commercially reasonable efforts to notify NMI of the modifications and the effective date of such modifications. If you object to the modifications, your exclusive remedy is to cease any and all access and use of the Plaid Services as it relates to the applicable FI(s). Continued access to or use of such Plaid Services after the effective date of such modifications to this Section 5 (FI Data) will constitute your acceptance of such modifications.
(v) Miscellaneous. In the event of a conflict with any other agreement or provision (including other provisions within the Open Banking Services Agreement), the terms and conditions of this Section 5 (FI Data) will govern and prevail. Capitalized terms used in this Section 5 (FI Data) and not otherwise defined will have the meanings ascribed to them in the Open Banking Services Agreement. All provisions of this Section 5 (FI Data) will remain in force in the event of the termination or expiration of this Section 5 (FI Data), this Open Banking Services Exhibit – Plaid, or the Open Banking Services Agreement.