Bank Security and Regulatory Addendum

Fideo Intelligence, Inc.

Effective Date: November 8, 2026

This Bank Security and Regulatory Addendum (the “Bank Addendum”) is entered into by and between Fideo Intelligence, Inc (“Fideo”) and the financial institution identified in the applicable Order Form (“Customer”).

This Bank Addendum supplements the Fideo Services Agreement between Fideo and Customer (the “Services Agreement”) and the Data Processing Addendum incorporated therein (the “DPA”). The Services Agreement, DPA, this Bank Addendum, and applicable Order Forms are collectively referred to as the “Agreement.” The parties acknowledge that Customer is a regulated financial institution subject to applicable federal and state banking laws, regulations, and supervisory requirements. This Bank Addendum establishes additional obligations relating to information security assurance, regulatory oversight, operational resilience, incident notification, and third-party risk management.

Capitalized terms not otherwise defined herein shall have the meanings assigned in the Services Agreement or DPA, as applicable.

1. Scope and Applicability

1.1. Applicability. This Bank Addendum applies solely to Services provided under an Order Form that expressly incorporates this Bank Addendum. It does not apply to other services or agreements between the parties unless expressly agreed in writing.

1.2. Customer Data. For purposes of this Bank Addendum, “Customer Data” means Submitted Information, Customer Personal Data as defined in the DPA, and Customer-specific transaction records or other Customer Confidential Information processed by Fideo in connection with the Services.

Customer Data does not include Fideo Data independently obtained from sources other than Customer, Fideo’s proprietary identity graph, or Matching Intelligence lawfully created and retained in accordance with Section 4(a) of the Services Agreement and the DPA. However, Matching Intelligence that constitutes Personal Data remains subject to applicable privacy and data protection requirements.

1.3. Regulatory Responsibilities. Customer remains responsible for its own compliance with applicable banking laws and regulations, including decisions concerning customer onboarding, account approval, fraud prevention, regulatory reporting, and other regulated financial activities.

Fideo shall comply with laws and regulations applicable to its provision of the Services and its processing of Customer Data. Nothing in this Bank Addendum transfers Customer’s regulatory responsibilities to Fideo.

1.4. Order of Precedence. In the event of a conflict among the Services Agreement, DPA, and this Bank Addendum:

(a) Applicable mandatory legal requirements and any applicable Standard Contractual Clauses shall control to the extent required by law;

(b) The DPA shall control with respect to the Processing of Customer Personal Data, except where this Bank Addendum expressly establishes additional or more protective obligations consistent with the DPA and Applicable Law;

(c) This Bank Addendum shall control with respect to bank-specific regulatory cooperation, operational resilience, supervisory oversight, and enhanced incident notification obligations; and

(d) The Services Agreement shall otherwise control, except to the extent expressly modified by a mutually executed Order Form or other written amendment. No provision shall be interpreted to diminish a mandatory protection or right established by Applicable Law.

2. Information Security and Independent Assurance

2.1. Information Security Program. Fideo shall maintain a documented information security program designed to protect the confidentiality, integrity, and availability of Customer Data.

Fideo’s information security obligations shall be governed primarily by Section 7 and Appendix 2 of the DPA, which are incorporated herein by reference.

2.2. Independent Security Assessments. Fideo shall maintain an annual independent assessment of its information security controls through SOC 2 Type II or a substantially equivalent recognized assurance framework appropriate to its operations.

Upon Customer’s reasonable written request, Fideo shall provide its then-current independent assessment report, subject to appropriate confidentiality protections and restrictions on redistribution.

If completion of an annual assessment is delayed, Fideo shall notify Customer upon reasonable request and provide information concerning the anticipated completion date and any material security implications.

2.3. Material Security Findings. Fideo shall notify Customer without undue delay upon identifying a material security control deficiency that is reasonably likely to compromise Customer Data or materially affect the security of the Services.

Fideo shall maintain a commercially reasonable remediation plan for such deficiencies and provide Customer with appropriate status information upon reasonable request.

2.4. Security Documentation. Upon reasonable request, Fideo shall provide relevant documentation reasonably necessary for Customer’s third party risk management assessments, including:

(a) Current independent security assessment reports;

(b) Summaries of applicable information security policies and procedures;

(d) Business continuity and disaster recovery summaries;

(e) Material remediation status information; and

(f) Responses to reasonable security and third-party risk management questionnaires.

Fideo may redact information where reasonably necessary to protect proprietary technology, security-sensitive information, other customers’ confidential information, or third-party contractual obligations.

2.5. Changes to Security Controls. Fideo may modify its security controls and procedures in accordance with Section 7(a) and Appendix 2 of the DPA, provided such modifications do not materially diminish the security protections applicable to Customer Data.

3. Customer Data Protection and Matching Intelligence

3.1. Data Processing Obligations. Fideo’s processing of Customer Personal Data shall be governed by the DPA, including its provisions concerning processing instructions, data protection, data subject rights, subprocessors, international transfers, and applicable statutory restrictions.

3.2. Authorized Use. Fideo shall process Customer Data only as necessary to provide, maintain, secure, and support the contracted Services or as otherwise expressly permitted under the Agreement and Applicable Law.

Except as expressly authorized under the Agreement and permitted by Applicable Law,
Fideo shall not:

(a) Sell or license Customer Data to third parties;

(b) Incorporate Customer-exclusive personal attributes or identifiers into its shared
identity graph;

(d) Disclose Customer-specific transaction information to other customers; or

(e) Use Customer Data for purposes unrelated to the contracted Services.

3.3. Matching Intelligence. In providing the Services, Fideo may compare Submitted Information against information independently and lawfully obtained and maintained within Fideo’s proprietary identity graph and other data assets.

Fideo may create, retain, and use Matching Intelligence in accordance with Section 4(a) of the Services Agreement and the DPA, including for evaluating, validating, refining, and improving its identity resolution processes and matching algorithms.

Matching Intelligence shall not include personal attributes or identifiers obtained exclusively from Customer, nor shall it include information identifying Customer or Customer-specific transactions, except as separately authorized in writing.

Fideo shall not retain or incorporate Submitted Information into its shared identity graph solely by virtue of its submission by Customer.

Nothing in this Section authorizes Fideo to retain, use, disclose, or combine Customer Personal Data in a manner prohibited by Applicable Law or the DPA.

3.4. Data Minimization. Fideo shall limit its collection, processing, and retention of Customer Data to information reasonably necessary for authorized purposes, including documented operational, security, and legal requirements.

3.5. Return, Retention, and Deletion of Customer Data. Upon expiration or termination of the applicable Services, Fideo shall, at Customer’s election, return or securely delete Customer Personal Data in accordance with Section 9 of the DPA.

Unless otherwise agreed in writing, Fideo shall complete such return or deletion within sixty (60) days following the effective date of termination or expiration, subject to applicable legal retention requirements and the exceptions expressly provided herein.

Customer Personal Data contained in routine backup systems may be retained until deletion in accordance with documented backup retention schedules, provided such information remains protected, is not used for any other purpose, and is deleted in accordance with those schedules.

Any Customer Personal Data retained pursuant to an applicable legal obligation shall remain subject to the confidentiality and security protections of the Agreement.

Fideo shall provide reasonable written certification of deletion upon Customer’s request.

Matching Intelligence lawfully retained in accordance with Section 4(a) of the Services Agreement and the DPA shall remain subject to applicable privacy, retention, and deletion requirements.

3.6. Authorized Data Categories. The categories of Customer Data authorized for processing shall be limited to those reasonably necessary for the contracted Services and identified in the applicable Order Form, product schedule, or mutually agreed data categories schedule.

Where authorized, such categories may include government-issued identifiers, Social Security numbers, dates of birth, financial account identifiers, and other information subject to heightened protection requirements.

Fideo shall apply security controls appropriate to the sensitivity of the information processed.

4. Security Incident and Operational Disruption Management

4.1. Security Incident. For purposes of this Bank Addendum, “Security Incident” shall have the meaning assigned in the DPA.

A “Material Service Disruption” means an unplanned interruption or material degradation of the Services that significantly impairs Customer’s ability to use the contracted Services for their intended purposes.

4.2. Security Incident Notification. Fideo shall notify Customer of a confirmed Security Incident affecting Customer Personal Data without undue delay and, in any event, within twenty-four (24) hours after Fideo becomes aware of such confirmed Security Incident.

Initial notification may contain preliminary information and need not include a completed investigation.

Nothing in this Section limits any shorter notification obligation imposed by Applicable Law.

4.3. Incident Response and Cooperation. In accordance with the DPA, Fideo shall:

(a) Promptly investigate a confirmed Security Incident;

(b) Take commercially reasonable steps to contain and remediate the incident;

(d) Provide periodic updates as material information becomes available; and

(e) Cooperate reasonably with Customer’s legally required incident response and regulatory reporting activities.

Fideo’s notification of or response to a Security Incident shall not, by itself, constitute an acknowledgment of fault or liability.

4.4. Material Service Disruption Notification. Fideo shall notify Customer promptly upon becoming aware of a Material Service Disruption.

Fideo shall provide reasonable status updates concerning the nature of the disruption, material developments, and anticipated restoration timing when such information is reasonably available.

The parties may establish specific operational notification thresholds and escalation procedures in an applicable Service Level Agreement or Order Form.

4.5. Regulatory and Customer Notifications. Customer shall retain responsibility for determining whether notification to its regulators, customers, or other third parties is required, except where Fideo has an independent legal notification obligation.

Fideo shall provide reasonable assistance and information necessary for Customer to evaluate its notification obligations.

Neither party shall issue a public statement identifying the other party in connection with a Security Incident without prior consultation, except as required by Applicable Law.

4.6. Incident Costs and Liability. Responsibility for costs and liabilities arising from a Security Incident shall be governed by the indemnification and limitation of liability provisions of the Agreement.

5. Regulatory Oversight and Examination Cooperation

5.1. Regulatory Compliance. Fideo shall comply with laws and regulations applicable to its provision of the Services and processing of Customer Data.

Fideo acknowledges that Customer may be subject to regulatory requirements concerning the oversight of third-party service providers.

5.2. Regulatory Examinations. Upon reasonable written request, Fideo shall cooperate with Customer and its applicable federal or state banking regulators in connection with lawful examinations, inquiries, or supervisory reviews relating to the Services.

Such cooperation may include providing relevant documentation, independent security assessments, policies, procedures, and other information reasonably necessary to evaluate Fideo’s performance of its contractual obligations.

5.3. Scope of Access. Any examination or review shall be conducted, to the extent legally permissible, in a manner that reasonably protects:

(a) Fideo’s proprietary technology, algorithms, and intellectual property;

(b) Confidential information belonging to other customers;

(d) The security and integrity of Fideo’s systems; and

(e) Information subject to applicable legal restrictions.

Nothing in this Section shall limit access or examination rights that a governmental authority is legally entitled to exercise.

5.4. Regulatory Findings. Fideo shall notify Customer of any material regulatory finding, enforcement action, or governmental restriction directly affecting Fideo’s ability to provide the contracted Services, to the extent legally permitted.

5.5. Regulatory Changes. If changes in Applicable Law materially affect the Services or either party’s obligations, the parties shall cooperate in good faith to determine commercially reasonable modifications necessary to maintain compliance.

Neither party shall be required to assume material additional obligations or costs without mutual written agreement, except to the extent required by Applicable Law.

5.6. No Transfer of Regulatory Responsibility. Nothing in this Bank Addendum shall be construed to designate Fideo as a bank, consumer reporting agency, regulated financial institution, or the party responsible for Customer’s regulated financial decisions.

This provision shall not limit any legal or regulatory obligation independently applicable to Fideo.

6. Audit and Third-Party Risk Assessments

6.1. Standard Assurance. The parties intend that independent assurance reports, certifications, and reasonable documentary assessments serve as the primary means of demonstrating Fideo’s compliance with applicable security and operational requirements where sufficient to satisfy Customer’s legal and regulatory obligations.

Customer may periodically assess Fideo’s controls through reasonable requests for the documentation described in Section 2.4.

6.2. Additional Audits. If Customer reasonably determines that the information provided under Section 6.1 is insufficient to satisfy an applicable legal or regulatory requirement, or if a material Security Incident or material control deficiency has occurred, Customer may request an additional audit or assessment reasonably limited to the affected Services and relevant controls.

The parties shall cooperate in good faith to establish reasonable procedures concerning the scope, timing, confidentiality protections, and operational requirements of such audit.

6.3. Audit Safeguards. Except where required by Applicable Law or a competent regulatory authority, Customer shall not be entitled to:

(a) Unrestricted access to Fideo’s production systems;

(b) Source code or proprietary algorithms;

(d) Third-party licensed data not authorized for disclosure; or

(e) Security-sensitive information whose disclosure would create an unreasonable risk.

6.4. Audit Costs. Each party shall bear its own costs associated with routine audits and assessments.

Any extraordinary audit requirements shall be subject to mutual agreement regarding reasonable costs, except as otherwise required by Applicable Law.

6.5. Coordination with DPA Audit Rights. The procedures and safeguards in this Section supplement the audit and information rights provided under Section 10 of the DPA.

Nothing in this Section shall restrict an audit, inspection, or regulatory examination required by Applicable Law or the exercise of rights that cannot lawfully be limited by contract.

Any additional audit shall be conducted, to the extent legally permissible, using reasonable procedures designed to protect Fideo’s proprietary information, third-party confidential information, and the security of its systems.

7. Subprocessors and Third-Party Service Providers

7.1. Use of Third Parties. Customer acknowledges that Fideo may utilize third-party infrastructure providers, data licensors, technology vendors, and other service providers in delivering the Services.

7.2. Subprocessor Obligations. The appointment, replacement, notification, objection, and related termination rights concerning Subprocessors that Process Customer Personal Data shall be governed by Section 6 of the DPA.

Fideo shall remain responsible for the performance of its Subprocessors to the extent provided in the DPA.

7.3. Subprocessor Information. Upon reasonable request, Fideo shall make available a current list of Subprocessors that Process Customer Personal Data, including their functions and processing locations.

7.4. Third-Party Risk Management. Fideo shall maintain reasonable third-party risk management procedures appropriate to the nature of each material third-party service provider’s activities and access to Customer Data.

Where third parties Process Customer Personal Data on Fideo’s behalf, Fideo shall require appropriate confidentiality, security, and data protection obligations consistent with the DPA.

7.5. Data Licensors. Third-party data licensors supplying independently sourced Fideo Data shall not be considered Subprocessors solely by virtue of supplying such data, unless they also Process Customer Personal Data on Fideo’s behalf.

Nothing in this Section requires Fideo to disclose confidential commercial arrangements, proprietary data sourcing methods, or third-party licensed data, except to the extent required by Applicable Law.

8. Business Continuity and Disaster Recovery

8.1. Continuity Program. Fideo shall maintain documented business continuity and disaster recovery plans reasonably designed to support the continued provision or timely restoration of material Services following a significant operational disruption.

Such plans shall be maintained in accordance with the applicable security and contingency planning requirements of Appendix 2 of the DPA.

8.2. Testing. Fideo shall periodically test its business continuity and disaster recovery capabilities and review the results to identify material deficiencies.

8.3. Service Disruptions. Fideo shall provide notification and reasonable status updates concerning Material Service Disruptions in accordance with Section 4.4.

8.4. Recovery Objectives. Any specific recovery time objectives, recovery point objectives, availability commitments, or service credits shall be established in the applicable Service Level Agreement or Order Form.

8.5. Continuity Information. Upon reasonable request, Fideo shall provide Customer with summaries of its business continuity and disaster recovery procedures, subject to appropriate confidentiality and security protections.

9. Operational Changes and Service Dependencies

9.1. Material Changes. Fideo shall provide reasonable advance notice of material changes to the Services that are reasonably expected to adversely affect Customer’s integrations, security posture, or ability to use the Services for its contracted purposes.

Where commercially practicable, Fideo shall provide at least thirty (30) days’ advance notice of material changes requiring Customer to modify its technical integrations.

9.2. Emergency Changes. Fideo may implement changes without advance notice where reasonably necessary to address security vulnerabilities, comply with Applicable Law, or respond to material operational risks.

Fideo shall provide notice as soon as reasonably practicable where such changes materially affect Customer’s use of the Services.

9.3. Third-Party Dependencies. Customer acknowledges that portions of the Services may depend on third-party data sources, telecommunications networks, cloud infrastructure, and other external services.

Fideo shall use commercially reasonable efforts to manage material dependencies but shall not be responsible for interruptions or limitations beyond its reasonable control, except as otherwise expressly provided in the Agreement.

9.4. Service Modifications. Nothing in this Section shall prohibit Fideo from making changes that do not materially diminish the functionality, security, or availability of the contracted Services.

Material adverse changes affecting Customer’s contracted use shall remain subject to the applicable provisions of the Services Agreement and Order Form.

10. Confidentiality and Regulatory Information Sharing

10.1. Confidentiality. Information disclosed under this Bank Addendum, including security reports, audit findings, infrastructure descriptions, and business continuity documentation, shall be treated as Confidential Information under the Services Agreement.

10.2. Regulatory Disclosures. Customer may disclose information concerning Fideo and the Services to its regulators, auditors, legal advisors, and other authorized representatives to the extent reasonably necessary to satisfy its legal, regulatory, and supervisory obligations, subject to applicable confidentiality requirements.

10.3. Security-Sensitive Information. Customer shall use reasonable safeguards to prevent unauthorized disclosure of Fideo’s security-sensitive information and shall limit access to personnel and representatives with a legitimate need to know.

10.4. Public Disclosures. Neither party shall use the other party’s name, trademarks, or identifying information in public promotional materials without prior written consent, except as otherwise expressly agreed in writing.

11. Termination and Transition Assistance

11.1. Material Noncompliance. If Fideo materially breaches its obligations under this Bank Addendum and fails to cure such breach within the applicable cure period under the Services Agreement, Customer may exercise its contractual termination rights.

11.2. Regulatory Prohibition. If a competent regulatory authority legally prohibits Customer from continuing to use the Services, the parties shall cooperate in good faith to address the restriction.

If continued use is legally prohibited and no commercially reasonable alternative is available, Customer may terminate the affected Services upon written notice.

11.3. Transition Assistance. Upon expiration or termination of the applicable Services, Fideo shall provide reasonable cooperation to facilitate an orderly transition, including the return or deletion of Customer Data as provided in the Agreement.

Any additional transition services, development work, or extended access shall be subject to mutual written agreement regarding scope, duration, and fees.

11.4. Continued Protection. Confidentiality, data protection, and security obligations shall continue to apply to Customer Data retained following termination for so long as such information remains in Fideo’s possession or control.

12. General Provisions

12.1. No Expansion of Regulated Activities. Nothing in this Bank Addendum shall be construed to authorize use of the Services for purposes prohibited by the Services Agreement, including FCRA-regulated eligibility determinations.

Nothing herein shall require Fideo to make credit, underwriting, account eligibility, or other regulated financial decisions on Customer’s behalf.

12.2. Intellectual Property. Nothing in this Bank Addendum transfers ownership of Fideo Data, lawfully retained Matching Intelligence, proprietary algorithms, software, or other Fideo intellectual property to Customer.

Customer retains its rights in Submitted Information and Customer Data as provided in the Services Agreement and DPA.

12.3. Liability. The indemnification and limitation of liability provisions of the Services Agreement, as incorporated by Section 12 of the DPA, shall apply to this Bank Addendum.

Any modification to those provisions must be expressly agreed in writing by the parties.

12.4. Survival. Provisions concerning confidentiality, data protection, regulatory cooperation, retained Customer Data, and other obligations that by their nature should survive shall survive expiration or termination to the extent necessary to fulfill their intended purposes.

12.5. Entire Agreement. This Bank Addendum forms part of the Agreement between the parties. Except as expressly modified herein, all terms of the Services Agreement and DPA remain in full force and effect.

Signatures

FIDEO INTELLIGENCE, INC.
By: __________________________
Name: ________________________
Title: _________________________
Date: _________________________
CUSTOMER
Legal Entity: ___________________
By: __________________________
Name: ________________________
Title: _________________________
Date: _________________________