Document

Exhibit 10.16

ORDER FORM


			Anchorage Contact			Client Contact

			Name: Christine To			Name: Andrew Madar

			Email: christine.to@anchorlabs.com			Email: amadar@figure.com

This MASTER CUSTODY SERVICE AGREEMENT (“Agreement”) is made and entered into as of the Effective Date provided herein, by and between Anchorage Digital Bank N.A. (“Anchorage”), and each Client as provided herein (each a “Client”) (Anchorage and Client, each a “Party” and collectively, the “Parties”).

The Agreement consists of the terms in this Order Form and the attached Standard Terms and Conditions.


1.	Effective Date:
2.	Initial Term:	One (1) year
3.	Renewal Term:	One (1) year
4.	Client(s). Each “Client” listed herein is subject to the Agreement as if this Agreement were between such individual Client and Anchorage, except specifically the Fees will be calculated on an aggregated basis, including the sum of all Clients’ Assets Under Custody.
		Figure Lending LLC, a Delaware limited liability company

5. FEES

In full consideration for Anchorage’s provision of the Services described herein, Client will pay Anchorage the following fees (“Fees”). Fees will commence on the first date that any Digital Assets are deposited into any Client Account (“Fees Commencement Date”).

Changes to the Services, including the inclusion of new assets or Clients, are subject to changes in Fees.


			Anchorage Proprietary and Confidential


		Access Speed <24 hours
FEE TYPE	AUC	Annual Basis Points
Monthly Custody Fee	Less than $2m	Monthly Minimum: $0 (No Annual Basis Points)

	Greater than or equal to $2m but less than $50m	40

	Greater than or equal to $50m but less than $100m	35

	Greater than or equal to $100m but less than $250m	30

	Greater than or equal to $250m but less than $1b	25

	Greater than or equal to $1b	20

One-Time Onboarding Fee	$0.

On-Chain Services	Varies based on service.

6. Address for Notices:


To Client(s):			Invoice Email: accounting@figure.com
			Notice Email: legal@figure.com
			Attn: Legal
			650 California Street
			Suite 2700
			San Francisco, CA 94108

To Anchorage:			legal@anchorage.com AND
			nathan@anchorage.com
			Anchorage Digital Bank N.A.
			4901 S. Isabel Place, Suite 200
			Sioux Falls, South Dakota 57108


			Anchorage Proprietary and Confidential

IN CONSIDERATION AND WITNESS WHEREOF, Anchorage and Client, by their duly authorized representatives, hereby execute this Agreement as of the Effective Date.


			ANCHORAGE DIGITAL BANK N.A.			ON BEHALF OF EACH CLIENT HEREIN

			By: /s/ Nathan P McCauley			By: /s/ Dan Wallace


			Name: Nathan P McCauley			Name: Dan Wallace

			Title: Chief Executive Officer			Title: General Manager, Figure Lending

						Company: Figure Lending LLC

AFFILIATED BUSINESS DISCLOSURE

AND CONFLICT OF INTEREST WAIVER

Anchorage Digital Bank N.A. is affiliated with Anchor Labs, Inc., Anchorage Hold LLC, and Anchorage Lending CA, LLC (each an “Anchorage Affiliate”), through common ownership and management. In particular, Anchor Labs, Inc. provides certain administrative, technology, marketing, and other support services for custodial accounts on behalf of Anchorage Digital Bank. Because the two companies are under common ownership and management, the owners of Anchor Labs, Inc. will receive an indirect benefit from any fees you pay to Anchorage Digital Bank. In addition, Anchorage Digital Bank and Anchorage Affiliates may also refer clients to each other for the performance of services offered by such companies. Your use of services of Anchorage Digital Bank may result in benefits from such referral to the other companies by virtue of the companies’ common ownership and management.

ACKNOWLEDGEMENT

I, duly authorized and on behalf of each Client as set forth in the Order Form, have read this disclosure form, and I acknowledge and understand that Anchorage Digital Bank and Anchorage Affiliates are under common ownership and control. I further acknowledge and understand that by retaining Anchorage Digital Bank, I am providing an indirect financial benefit to the owners of Anchorage Affiliates. Understanding the common ownership and control of the companies, I agree to utilize the services of Anchorage Digital Bank freely and with no influence from anyone. I also understand and agree that referrals for services among Anchorage Digital Bank and Anchorage Affiliates may result in the owners of the referring company receiving an indirect financial benefit from the services provided.


ON BEHALF OF EACH CLIENT SET FORTH HERETO

By: /s/ Dan Wallace

Name: Dan Wallace

Title: General Manager, Figure Lending

Company: Figure Lending LLC


			Anchorage Proprietary and Confidential

ANCHORAGE DIGITAL BANK

TERMS AND CONDITIONS

Capitalized terms not defined in the Order Form, body of these Terms and Conditions, or supporting Schedules are defined in Schedule A (Definitions).

1. Anchorage Appointment and Provision of the Services.

1.1. Appointment. Client appoints Anchorage to provide the Services, including acting as custodian of Client Digital Assets pursuant to this Agreement, and Anchorage hereby accepts such appointment. The Parties agree that for purposes of this Agreement, Anchorage shall be considered to be an “excluded fiduciary” under SDCL 55-1B-2 and shall follow the Directions from Client. Client for such purposes shall be considered to be a Trust Advisor (in its capacity as a custody account holder) under SDCL 55-1B-1(3), and the provisions of such statutes shall apply to the responsibilities of the parties hereunder.

1.2. Provision of the Services.

(a)Subject to (i) Client’s successful completion of the account acceptance process as provided in Section 2.1, and (ii) provided that Client is in compliance with this Agreement, during the Term, Anchorage will provide the Services to Client.

(b)Anchorage will, in its sole discretion, determine the requirements for any Direction, including Authenticated Instructions, and whether such requirements have been satisfied as to any Direction. Anchorage is entitled to rely upon information, data, and instructions from Client (or any Client designee) related to a Direction in all respects. Client acknowledges that (i) Anchorage’s acceptance of Directions related to Client’s deposit and withdrawal of assets is based on the parameters of Authenticated Instructions and in accordance with Anchorage’s Services requirements; and (ii) Anchorage has no duty to inquire into or investigate the legality, validity, or accuracy of any information, data, or instructions related to a Direction.

(c)The Services are available only in connection with those Digital Assets and protocols that Anchorage, in its sole discretion, supports. Under no circumstances should Client attempt to use the Services to store, send, request, or receive Digital Assets and protocols that Anchorage does not support. Anchorage assumes no responsibility in connection with any attempt to use any Account or Vault with Digital Assets that Anchorage does not support, and any such unsupported Digital Assets deposited to or received in any Account or Vault are subject to forfeiture and loss. The Digital Assets that Anchorage supports may change from time to time, based on Anchorage's sole and absolute discretion. Anchorage will notify Client in advance if it ceases to support a particular Digital Asset.


			Anchorage Proprietary and Confidential

(d)Client acknowledges that Anchorage will not monitor Digital Assets for actions taken by the issuer of such Digital Asset, if any. Such actions may include an issuer instruction requiring the holder of a Digital Asset to transfer it to a certain location. For the avoidance of doubt, Client is solely responsible for satisfying or responding to any such actions of an issuer.

(e)Unless acting in accordance with Section 1.2(f) or (g), Anchorage shall only follow the Directions from Client. Anchorage is released and held harmless by Client for following the Directions from the Client, Client Service Providers and Control Parties, when acting in accordance with any Client Service Provider Agreement or Control Agreement, as the case may be.

(f)In the event Client enters into any of the following agreements (any such agreement, a “Client Service Provider Agreement”):

i)A brokerage services agreement with Anchorage Hold, LLC (“Trader”), under which Client appoints Trader to act as Client’s agent to issue Directions to Anchorage for the transfer of Client’s Digital Assets or fiat currency to an Account or Vault in the name of, and solely controlled by, Trader or its affiliates, for the purpose of trading, clearing, settling, netting, accounting for, and providing other services in connection with, Client’s Digital Assets or fiat currency;

ii)A lending agreement, a loan agreement and security agreement, or other similar agreement, regardless of how titled, with Anchorage Lending CA, LLC (“Lending”), under which Client appoints Lending to act as Client’s agent to issue Directions to Anchorage for the transfer of Client’s Digital Assets or fiat currency to or from an Account or Vault in the name of, and solely controlled by, Lending or its affiliates, or an omnibus account held for Client’s benefit, for the purpose of (i) advancing Client’s Digital Assets or fiat currency to Lending; or (ii) borrowing Digital Assets or fiat currency from Lending and providing collateral in connection therewith; or

iii)An agency appointment with any other party, under which Client appoints such Third Party (“Agent”) to act as Client’s agent to issue Directions to Anchorage for any purpose set forth in the appointment;

then, in each applicable case, Client shall promptly notify Anchorage in writing of any such agency appointment using a form of notice acceptable to Anchorage. Where Client has duly appointed any of Trader, Lending or Agent (each, a “Client Service Provider”) as its agent pursuant to the foregoing agreements or a Control Agreement (defined below, each a “Client Service Provider Agreement”), Client directs Anchorage to follow, and Anchorage shall follow, any Direction initiated by a Client Service Provider related to Digital Assets or Fiat Services as if initiated directly by the Client provided that such Directions followed by Anchorage shall be limited to those contemplated by a Client Service Provider Agreement or otherwise agreed


			Anchorage Proprietary and Confidential

between Client Service Provider and Anchorage, including, without limitation, through an Authenticated Instruction by a Client Service Provider on Client’s behalf.

(g)In the event Client enters into an account control agreement, vault control agreement, or other similar agreement (regardless of how titled, a “Control Agreement”) with Anchorage, a lender (a “Control Party”) and any other parties (each, an “Ancillary Party”), under which Client directs Anchorage to follow such Control Party’s instructions as described therein, Client directs Anchorage to follow, and Anchorage shall follow, any Direction initiated by such Control Party related to Digital Assets or Fiat Services as if initiated directly by the Client. Directions of a Control Party or Ancillary Party may be initiated by any method contemplated by a Control Agreement or otherwise agreed between a Control Party, Ancillary Party and Anchorage, including, without limitation, through an Authenticated Instruction by a Control Party on Client’s behalf or Ancillary Party on Client’s behalf.

1.3. Storage of Digital Assets. Anchorage will receive Digital Assets for storage by generating Private Keys and their Public Key pairs, with Anchorage retaining custody of such Private Keys. Upon receipt, Anchorage will custody the Digital Assets in Client’s name or Accounts established for the benefit of the Client, unless otherwise specified in (a) an applicable Client Service Provider Agreement, or (b) instructions provided by a Client Service Provider or a Control Party pursuant thereto. Anchorage shall be deemed to have received a Digital Asset after the Digital Asset’s receipt has been confirmed on the relevant Blockchain or otherwise ledgered to Anchorage’s satisfaction.

1.4. Accounting for Digital Assets. At all times, Client owns, or is a pledgee of, Digital Assets and fiat currency (if applicable) held by Anchorage on behalf of Client under this Agreement, unless otherwise specified in (a) an applicable Client Service Provider Agreement, or (b) instructions provided by a Client Service Provider or a Control Party pursuant thereto. Client Digital Assets and fiat currency shall be kept separate from the assets of Anchorage and shall not be reflected on Anchorage’s balance sheet as assets of Anchorage. Anchorage will record on its books and records all Digital Assets and fiat currency (if applicable) received by it for the Account, and will segregate Digital Assets from those of any other person or entity, unless otherwise specified in (i) an applicable Client Service Provider Agreement, or (ii) instructions provided by a Client Service Provider or a Control Party pursuant thereto. Anchorage will provide Client with access to the Technology Platform for transaction records and holdings, and will provide Client monthly statements that show balances and transaction records of Client Digital Assets. Upon commercially reasonable notice to Anchorage, Anchorage will provide Client copies of the books and records pertaining to the Client that are in the possession or under the control of Anchorage. The books and records maintained by Anchorage will, to the extent applicable, be prepared and maintained in all material respects as required by applicable Laws.

1.5. Authority to Assign or Pledge. Subject to applicable Law and Section 5.4, Client’s Digital Assets and fiat currency shall not be subject to any right, charge, security interest, lien or claim of any kind in favor of Anchorage or any of its Affiliates or of any creditor of any of them, and


			Anchorage Proprietary and Confidential

Anchorage shall not have the independent right or authority to assign, hypothecate, pledge, encumber or otherwise dispose of any Client Digital Assets or fiat currency. The Digital Assets in the Account and the fiat currency in the Deposit Account, as defined in Section 2.7, are not general assets of Anchorage or of any of its Affiliates and are not available to satisfy claims of any creditors of Anchorage or of any of its Affiliates.

1.6. Application of UCC. Except as may be otherwise provided in this Agreement or applicable Law, the Parties agree the relationship between Anchorage and Client is governed by Article 8 of the Uniform Commercial Code, as adopted and implemented under South Dakota law (“UCC”), and that for the purposes of this Agreement, (i) Client is an “entitlement holder” and any Digital Assets credited to the Account for Digital Assets or the Deposit Account for fiat currency, as defined in Section 2.7, shall be treated as a "financial asset" within the meaning of SDCL 57A-8- 102(a)(7) and (9); (ii) Anchorage is a "securities intermediary" pursuant to SDCL 57A-8-102(a)(14) with respect to all financial assets held in such securities accounts; and (iii) should Client enter into an agreement with Lending, then instructions given by Lending hereunder are "entitlement orders" pursuant to SDCL 57A-8-507, and Lending is an "entitlement holder" pursuant to SDCL 57A-8-102.

1.7. Rights of Use; Limits on Use. Subject to the terms of this Agreement, including compliance with Schedule B (Technical and Equipment Specifications) and Client’s confidentiality obligations under Section 8, Anchorage hereby grants to Client a non-sublicensable, non-exclusive, worldwide right during the Term to access the Technology Platform. The foregoing rights grant extends to access and use by Authorized Persons, and for the Anchorage API only, to Third Parties authorized by Client, subject to Section 2.3(b). Client will not, and will not permit Authorized Persons or Third Parties to: (i) directly or indirectly copy, disseminate, display, distribute, publish, sell, or otherwise use or disclose any part of the Technology Platform, or create any works or other materials based on or derived from any part of the Technology Platform; (ii) reverse engineer, decompile, or disassemble the software used in the Technology Platform; (iii) sell, rent, lease, or license Client’s right to use the Technology Platform except as may be set out under this Agreement; or (iv) use the Technology Platform or Services in any other way not expressly authorized by this Agreement. Client will be responsible for all acts and omissions of Authorized Persons in connection with or relating to this Agreement.

1.8. Service Levels; Support and Maintenance. Subject to applicable Law, as part of the Services and at no additional cost to Client, Anchorage will (i) make available the Technology Platform in accordance with all applicable service levels set forth in Schedule C (Service Level Agreement), and (ii) provide other Support Services as described in this Agreement.

1.9. Business Continuity. Anchorage shall maintain a business continuity program applicable to Anchorage’s performance of Services.


			Anchorage Proprietary and Confidential

1.10. Forks, Airdrops.

(a)Should a Fork occur: (i) Anchorage retains the right, in its sole discretion, to determine whether or not to support (or cease supporting) either Forked Network; (ii) in connection with determining to support a Forked Network, Anchorage may suspend certain operations, in whole or in part (with or without advance notice), for however long Anchorage deems necessary, in order to take the necessary steps, as determined in its sole discretion, to perform obligations hereunder with respect to supporting a Forked Network; (iii) Client hereby agrees that Anchorage shall determines, in its sole discretion, whether to support such Forked Network and that Client shall have no right or claim against Anchorage related to value represented by any change in the value of any Digital Asset (whether on a Forked Network or otherwise), including with respect to any period of time during which Anchorage exercises its rights described herein with respect to Forks and Forked Networks; (iv) Anchorage will use commercially reasonable efforts to timely select, in its sole discretion, at least one (1) of the Forked Networks to support and will identify such selection in a written notice.

1.With respect to a Forked Network that Anchorage chooses not to support, it may, in its sole discretion, elect to (x) abandon or otherwise not pursue obtaining the Digital Assets from that Forked Network, or (y) deliver the Digital Assets from that Forked Network to Client within a time period as determined by Anchorage in its sole discretion, together with any credentials, keys, or other information sufficient to gain control over such Digital Assets (subject to the withholding and retention by Anchorage of any amount reasonably necessary, as determined in Anchorage’s sole discretion, to fairly compensate Anchorage for the efforts expended to obtain and deliver such Digital Assets to Client).

2.With respect to Forked Networks that Anchorage chooses to support, Client may be responsible for the fees for such support (to be negotiated), and Client acknowledges and agrees that Anchorage assumes no responsibility with respect to any Forked Network and related Digital Assets that it chooses not to support.

(b)Client acknowledges that Digital Asset values can fluctuate substantially which may result in a total loss of the value of Digital Assets. The supply of Digital Assets available as a result of a Forked Network and Anchorage’s ability to deliver Digital Assets resulting from a Forked Network may depend on circumstances or Third Party providers that are outside of Anchorage’s control. Anchorage does not own or control any of the protocols that are used in connection with Digital Assets and their related Digital Asset networks, including those resulting from a Forked Network. Accordingly, Anchorage disclaims all liability relating to Forked Network and any change in the value of any Digital Assets (whether on a Forked Network or otherwise), and makes no guarantees regarding the security, functionality, or availability of such protocols or Digital Asset networks. Client accept all risks associated with the use of Anchorage’s services to conduct transactions, including,


			Anchorage Proprietary and Confidential

but not limited to, in connection with the failure of hardware, software, and internet connections.

(c)In the event that a Digital Asset network, entity or person (a “Sender”) attempts to or does contribute (sometimes called “airdropping” or “bootstrapping”) its Digital Assets (collectively, “Airdropped Digital Assets”) to holders of Digital Assets on an existing Digital Asset network and Client notifies Anchorage in writing of such event, Anchorage may, in its sole discretion, acting in a commercially reasonable manner, elect to: (i) subject to an airdrop fee to be determined, support the Airdropped Digital Asset for Custody and, if appropriate, reconcile Account(s); (ii) abandon or otherwise not pursue obtaining the Airdropped Digital Assets; or (iii) within a time period as determined by Anchorage in its sole discretion, deliver the Airdropped Digital Assets from that Digital Asset network to Client, together with any credentials, keys, or other information sufficient to gain control over such Airdropped Digital Assets (subject to the withholding and retention by Anchorage of any amount reasonably necessary, as determined in Anchorage’s sole discretion, to fairly compensate Anchorage for the efforts expended to obtain and deliver such Airdropped Digital Assets to Client). If Anchorage supports, obtains or delivers Airdropped Digital Assets, such actions will not create any relationship between the Sender and Anchorage, grant any interest or rights to the Sender (including, without limitation, any Third Party beneficiary rights), or subject Anchorage to any obligations as it relates to the Sender.

1.11. Generally. Notwithstanding any federal, state or local Law to the contrary regarding any common law or contractual duty, Client agrees that Anchorage will perform only such duties as are expressly set forth herein as Services, and no additional duties or obligations shall be implied. Anchorage has the authority to do all acts that Anchorage reasonably determines are necessary, proper, or convenient for it to perform its obligations under this Agreement, and shall have no obligation to perform acts which it reasonably believes do not comply with applicable Laws. In providing the Services, Anchorage has no duty to inquire as to the provisions of or application of any agreement or document other than this Agreement, notwithstanding its receipt of such agreement or document.

2. Client Responsibilities and Acknowledgements.

2.1. Account Acceptance; Authorized Person Designations.

(a)Services will be provided only after Client’s successful completion of the account acceptance process, as determined in Anchorage’s sole discretion. To complete the acceptance process, Client shall provide Anchorage with information and documents, which include but are not limited to, information necessary for Anchorage’s compliance with the Bank Secrecy Act (“BSA”), and all Laws and regulations relating to anti-money laundering (“AML”), Know-Your-Customer (“KYC”), counter-terrorist financing, sanctions screening requirements, or any other legal obligations, in each case, as determined by Anchorage in its sole discretion. Upon acceptance of Client by Anchorage, Client shall nominate and manage Authorized Persons; provided that if Client has entered into, or at any time enters


			Anchorage Proprietary and Confidential

into, a Client Service Provider Agreement or Control Agreement that (i) contemplates or requires an Authorized Person to be nominated by a Third Party or (ii) can only be reasonably implemented through the use of Authorized Persons that are nominated by at Third Party, then Authorized Persons shall be nominated in accordance with such agreement.

(b)In order to be approved as an Authorized Person, nominated persons must agree to data collection permissions and related policies provided in the Anchorage application and Technology Platform, including privacy policies and other terms, which may be amended from time to time. A copy of the then-current versions of such privacy policies and other terms will be provided at the written request of Client. Client is solely responsible for the actions or inactions of all Authorized Persons at all times, including their intentional, unintentional, or coerced use of the Services. With respect to Client’s primary custody Account, Client will initially nominate three (3) or more individuals as Authorized Persons prior to initiation of Client on-boarding by Anchorage, and a minimum of two (2) of three (3) Authorized Persons must approve an Authenticated Instruction. Anchorage reserves the right in its reasonable sole discretion to change the minimum number of Authorized Persons to be designated or which are required to approve a Direction.

(c)With respect to any Account or Vault opened in connection with a Client Service Provider Agreement or Control Agreement, the applicable Third Party shall nominate the agreed-upon number of individuals as Authorized Persons, and the Quorum shall be determined as required by such agreement. Subsequent to the approval and on boarding of initial Authorized Persons, Client or an approved Third Party (pursuant to a Client Service Provider Agreement or Control Agreement) may nominate additional Authorized Persons or revoke an Authorized Person’s status, each through a Direction to be approved by a Quorum.

2.2. Acceptable Devices. Unless expressly agreed upon otherwise, Client shall maintain a separate Acceptable Device for each Authorized Person. The Acceptable Device must have Internet accessibility and meet other technical specifications prescribed by Anchorage in Schedule B.

2.3. Authorized Persons; Anchorage API.

(a)Each person nominated by Client as an Authorized Person must be confirmed by Anchorage as an Authorized Person. Authorized Persons may be required to successfully complete the onboarding process and training, which may include (i) installing the Anchorage application onto the person’s Acceptable Device; and (ii) training on the Services regarding the creation of Directions or joining a Quorum. Upon completion of Anchorage’s onboarding process and any training, to Anchorage’s satisfaction in its sole discretion, the nominated person will be designated by Anchorage as one of Client’s Authorized Persons and their device designated by Anchorage as an Acceptable Device, such that they may create Directions or join a Quorum.


			Anchorage Proprietary and Confidential

(b)As part of the Services, Anchorage may provide Client with access to the Anchorage API, through which Client may permit Third Party access to the Account(s) or Technology Platform. Anchorage shall follow any Directions submitted via the Anchorage API as though such Directions were submitted from and by Client. Authorized Persons may generate API keys and assign roles to a Third Party, including without limitation, a Third Party application, subject to their compliance with the Anchorage API’s documentation, and applicable Law. Client and all Authorized Persons shall use industry best practices to safeguard any generated Anchorage API keys. Client shall be responsible for all Third Party access to the Account(s) and Directions submitted via the Anchorage API, and Anchorage shall not be liable for following the instructions of any unauthorized person that holds an Anchorage API key unless Anchorage’s gross negligence or willful misconduct caused such unauthorized person’s access to or possession of such key.

2.4. On-Chain Services. From time to time, Anchorage may, in its sole discretion, offer Client additional optional services involving on-chain transactions (other than deposits and withdrawals included in Anchorage’s basic custody service), which may include staking, voting, inflation, signaling, and other activities requiring interaction with the applicable blockchain (“On-Chain Services”).

(a)Offer and Acceptance of On-Chain Services. Anchorage may offer On-Chain Services by presenting the option to elect such services in the Anchorage App to Authorized Persons of Client. Any offer for On-Chain Services will include the following terms:

i)a basic description of the On-Chain Service;

ii)a disclosure of the material risks of the On-Chain Service;

iii)a description of any associated fees;

iv)any other key terms of the On-Chain Service, as applicable (for example, Anchorage will disclose if Digital Assets must be locked for a minimum period and would not be immediately accessible to Client); and

v)an option to expressly agree to the On-Chain Service.

Any Authorized Person may accept an On-Chain Service on behalf of Client by clicking on the button indicating the Authorized Person’s election of such service (“Agree” or similar) on behalf of Client.

(b)Cancellation of On-Chain Services.

i)Any Authorized Person may cancel an On-Chain Service at any time; provided, however, that in cases where Digital Assets are locked up for a certain period pursuant to the blockchain protocol, Anchorage will release locked Digital Assets when and as permitted by the applicable blockchain protocol. If Client desires to cancel an On-Chain service, Client may do so through the Anchorage App.

ii)Anchorage may discontinue an On-Chain Service at any time without notice for any reason. If Anchorage decides to discontinue an On-Chain Service,


			Anchorage Proprietary and Confidential

Anchorage will endeavor to provide as much notice to Client as reasonably possible.

2.5. Legal Compliance. Notwithstanding any other provision in this Agreement, Client agrees at all times to (i) fully satisfy Anchorage’s reasonable information requests and other requirements, including but not limited to those relating to Authorized Persons or Digital Assets; (ii) fully comply with all applicable Laws, including the BSA and all other Laws and regulations related to AML, KYC, counter-terrorist financing, sanctions screening requirements, or other legal obligations; (iii) notify Anchorage if it becomes a named target, in writing, of any BSA or Digital Asset related action, investigation or prosecution; (iv) notify Anchorage of any changes in jurisdiction or material ownership; and (v) provide Anchorage full cooperation in connection with any inquiry or investigation made or conducted by the U.S. Office of the Comptroller of the Currency (“OCC”). Anchorage will have no obligation to provide the Services if Client or Authorized Persons fail to comply with the foregoing to Anchorage’s reasonable satisfaction. Client agrees to immediately notify Anchorage, subject to applicable law, if it becomes aware of any suspicious activity or pattern of activity, or any activity which upon investigation may be a suspicious activity or pattern of activity under applicable Laws. Any requests made by Anchorage pursuant to this Section 2.5 must be reasonable or pursuant to applicable Laws.

2.6. Acknowledgements. Client acknowledges that:

(a)Client is an “Entitlement Holder” in a “Financial Asset,” as defined by, and for purposes of, the UCC.

(b)Anchorage does not provide investment advice or exercise investment discretion. Client is capable of evaluating transaction and investment risks independently, both in general and with regard to all transactions and investment strategies. Client is solely responsible for, and Anchorage has no involvement in, determining whether any Digital Asset transaction (whether an investment or otherwise), investment strategy, or related transaction is appropriate for Client.

(c)Anchorage has no control over the Blockchains and markets in which Digital Assets are purchased and traded, and such may be subject to technology flaws, manipulations, hacks, double spending, “51%” attacks, other attacks, and operational limitations.

(d)Anchorage does not control and makes no guarantee as to the functionality of any Blockchain’s decentralized governance, which could, among other things, lead to delays, conflicts of interest, or operational decisions that may impact Client or its Digital Assets.

(e)Advancements in cryptography could render current cryptography algorithms utilized by a Blockchain supporting a specific Digital Asset inoperative.


			Anchorage Proprietary and Confidential

(f)The price and liquidity of Digital Assets has been subject to large fluctuations in the past and may be subject to large fluctuations in the future;

(g)Deposits into Client Accounts may not be considered “deposits,” as that term may be used under the applicable Laws, rules, or regulations in Client’s jurisdiction;

(h)Digital Assets in Client Accounts are not subject to deposit insurance protection of the Federal Deposit Insurance Corporation (“FDIC”) and may not be subject to the protection afforded customers under the Securities Investor Protection Act of 1970, as amended;

(i)Digital Assets are not legal tender and are not backed by any government;

(j)Legislative and regulatory changes or actions at the state, federal, or international level may adversely affect the use, transfer, exchange, and value of Digital Assets;

(k)Transactions in Digital Assets may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable;

(l)Some Digital Asset transactions shall be deemed to be made when recorded on a public ledger, which is not necessarily the date or time that transaction was initiated;

(m)The value of Digital Assets may be derived from the continued willingness of market participants to exchange fiat currency or Digital Assets for Digital Assets, which may result in the potential for permanent and total loss of value of a particular Digital Asset should the market for that Digital Asset disappear;

(n)There is no assurance that a person who accepts a Digital Asset as payment today will continue to do so in the future;

(o)Due to the volatility and unpredictability of the price of Digital Assets relative to fiat currency trading and owning Digital Assets may result in significant loss over a short period of time;

(p)The nature of Digital Assets may lead to an increased risk of fraud or cyber-attack;

(q)The nature of Digital Assets mean that technological difficulties experienced by Anchorage may prevent the access to or use of Client’s Digital Assets;

(r)Any bond, insurance or trust account maintained by Anchorage for the benefit of its customers may not be sufficient to cover all losses incurred by Client; and

(s)Client agrees to indemnify and hold Anchorage harmless from any loss or liability related to the acknowledgments in this paragraph 2.6 (a)-(r), it being recognized that


			Anchorage Proprietary and Confidential

Anchorage is a passive custodian only and is treated under this agreement as if it were considered an “excluded fiduciary” under SDCL 55-1B-2.

(t)The Fees and any other payments or compensation otherwise agreed to by Anchorage and Client represent reasonable compensation for Anchorage’s Services and expenses.

2.7. Fiat Currency Instructions and Acknowledgements; Undirected Cash Disclosures. Anchorage may, in its sole discretion, offer Fiat Services to Client. If Anchorage offers Fiat Services, and Client accepts Fiat Services, Anchorage will, acting as Client’s agent:

(a)Deposit all cash deposited by Client with Anchorage, for which the Client has not already provided transfer instructions, into deposit accounts at FDIC-insured, regulated depository institutions selected by Anchorage, which accounts will be held for the benefit of (FBO) Anchorage clients (“Deposit Accounts”). Deposit Accounts will be non-interest-bearing and may be segregated by client or pooled into omnibus accounts;

(b)Enter into such sub-accounting agreements as may be required by the depository institution, and;

(c)Initiate wire transfer requests from time to time for the withdrawal of Client funds from the Deposit Accounts, which requests are to be honored by the depository institution for withdrawal of Client’s funds from such Deposit Accounts for distributions, investments, fees and other disbursements directed or agreed to by the Client or Client’s delegate. All applicable wire transfer fees shall be paid by the Client.

Anchorage will keep records to obtain pass-through FDIC coverage of up to the maximum coverage level of $250,000 for the sub-account held for the benefit of Client at a single regulated depository institution or financial organization. Anchorage makes no guarantee that pass-through FDIC coverage will be available, and Client acknowledges and accepts the risk that pass-through FDIC coverage may not be available.

3. Ownership and Intellectual Property Rights.

3.1. Services and Documentation. As between the Parties and subject to Section 3.2 (Outputs of Services) and 3.3 (Client Data), Anchorage owns the Services, the Documentation, and all Intellectual Property Rights in the Services and the Documentation.

3.2. Outputs of Services. Anchorage hereby grants Client a perpetual, royalty-free, non- transferable (except as provided in Section 12.10), non-sublicensable, worldwide license to all output and results from use of the Services by Client or Authorized Persons, including any


			Anchorage Proprietary and Confidential

reports, graphics, data, specification, programs and all other materials or computer output (“Outputs”).

3.3. Client Data. As between the Parties, Client owns all Client Data and all Intellectual Property Rights in Client Data. Client hereby grants Anchorage, and any of its Affiliates that provide or may provide additional services to Client, a perpetual, royalty-free, non-transferable (except as provided in this Section 3.3 or Section 12.10), non-sublicensable, worldwide license to disclose and use Client Data (i) to operate and manage the Services for Client; (ii) to monitor, process and support Directions or as necessary to effect, administer, or enforce a transaction or directive that Client otherwise requests or authorizes, including to facilitate Client’s use of services provided by Anchorage Affiliates; (iii) to comply with legal or regulatory obligations applicable to the Services including financial reporting and retention of related data; and (iv) in de-identified and anonymized form in aggregation with other clients’ data, to improve Anchorage’s services.

3.4. Feedback. From time to time, Client may submit or provide suggestions, requests for features, recommendations, or ideas to Anchorage (“Feedback”). By submitting Feedback, Client grants Anchorage a non-exclusive, worldwide, royalty-free, irrevocable, sub-licensable, perpetual license to use the Feedback, without consideration or compensation to Client or Authorized Persons, Affiliates, agents, partners, or personnel.

4. Term and Termination.

4.1. Term. This Agreement is effective as of the Effective Date, and will continue in full force and effect for the Initial Term period in the Order Form, starting from the Fees Commencement Date, or as otherwise provided in the Order Form, and will be automatically renewed for each successive Renewal Term specified in the Order Form (the Initial Term and each Renewal Term collectively referred to herein as the “Term”). For each Renewal Term, Anchorage reserves the right to change the Fees, institute new charges, or to otherwise change the Services upon written notice to Client no less than sixty (60) days prior to the commencement of the Renewal Term. Either Party may elect not to renew the Agreement by providing written notice of cancellation no less than thirty (30) days prior to the expiration of the current Term or unless sooner terminated as set forth in this Agreement. Notwithstanding anything to the contrary herein, no changes in fees, services or charges for a renewal term hereunder shall be effective without Client’s prior written consent.

4.2. Termination for Cause. This Agreement may be terminated by the non-breaching party upon a material breach which is not cured within thirty (30) days after receipt by the breaching Party of written notice from the non-breaching party of such breach. Notwithstanding the foregoing, this Agreement may be terminated immediately (without an opportunity to cure) upon written notice by the non-breaching Party in the following cases: (i) either Party reasonably determines that any part of the Services is or may become in violation of applicable Laws or raises material regulatory or risk issues; (ii) Client or Authorized Persons have acted fraudulently or made a willful misrepresentation; (iii) the other Party files bankruptcy or is declared insolvent, or has an administrative or other receiver, manager, trustee, liquidator,


			Anchorage Proprietary and Confidential

administrator, or similar officer appointed over all or any substantial part of its assets; (iv) the other Party enters into or proposes any composition or arrangement with its creditors generally; (v) the other Party violates Section 8; or (vi) there is an SLA Termination Event, as defined in Schedule C (Service Level Addendum). Notwithstanding the foregoing, at any time that an agreement granting control to a lender over a Figure Account is in place, except in the circumstances described in clauses (i), (ii), (iii) or (iv) of the immediately preceding sentence, Anchorage will not terminate this Agreement without providing Figure with written notice of the applicable breach and a cure period of sixty (60) days after Figure’s receipt of such notice.

4.3. Effect of Termination Notice. Upon termination of this Agreement, Client will pay Anchorage all Fees, as provided in the Order Form, and documented expenses for Services rendered to Client through the effective date of termination of this Agreement.

4.4. Obligations and Rights on Termination.

(a)Digital Assets. Upon termination, Client shall provide Authenticated Instructions and Anchorage will return Client Digital Assets in its custody, pursuant to Authenticated Instructions, to Client or to an alternative custodian to be held on behalf of Client, subject to applicable Laws and provided that Anchorage has received payment from Client on all Fees and associated costs of such return (if any). A Digital Asset will be deemed to have been returned to Client when: (i) a transfer of the Digital Asset initiated by Anchorage has received a reasonable number of confirmations on the relevant Blockchain; (ii) Anchorage has provided the Private Key associated with the Digital Asset to Client; or (iii) via an alternative method mutually agreed upon between Anchorage and Client. To the extent a Client’s Digital Assets are unable to be transferred out of the Account due to insufficient gas or network fees necessary for the transfer, Client agrees to deposit additional Digital Assets to permit such transfer, or otherwise abandons and forfeits any claims to such Digital Assets upon closure of the Account.

(b)Confidential Information and Client Data. Upon termination and at Disclosing Party’s written request, the Receiving Party will return or destroy all of the Disclosing Party’s Confidential Information. In addition, upon Client’s written request, Anchorage will return or destroy all Client Data. Notwithstanding the foregoing, either Party may retain a copy of Confidential Information and Client Data (i) for audit, legal, accounting or compliance purposes; (ii) if included within unstructured backup files or that technically cannot be deleted; (iii) as licensed pursuant to Section 3.3; or (iv) as may be required by applicable Laws, including requirements of the OCC.

(c)Timeline for Claims. The Parties agree that any claim, suit, proceeding, cause of action, or arbitration request arising out of or relating to this Agreement must be asserted within twelve (12) months of the date the event or circumstances giving rise to such claim, suit, proceeding, cause of action, or arbitration request.

5. Fees and Taxes.

5.1. Fees. Client will pay Anchorage the Fees for the Services as set forth in the Order Form.


			Anchorage Proprietary and Confidential

5.2. Invoices; Payment Terms. Anchorage will submit invoices for the Services as set forth in the Order Form. Except as otherwise set forth in the Order Form, Client agrees to pay all undisputed invoices net fifteen (15) days following receipt. If Client reasonably disputes any portion of an invoice, Client agrees, within the foregoing 15-day period, to (i) pay the undisputed amounts; and (ii) provide a detailed explanation with all supporting documentation of the basis for its dispute.

5.3. Taxes. The Fees do not include all taxes, assessments, duties, and other governmental and similar charges (“Taxes”) that may be assessed on Client or Client’s assets by governmental authorities, which are Client’s sole obligation to remit unless otherwise mandated by law. Client shall be liable for all Taxes relating to any Digital Assets held on behalf of Client or any transaction related thereto. Client shall remit to Anchorage for the amount of any Tax that Anchorage is required under applicable Laws (whether by assessment or otherwise) to pay on behalf of, or in respect of activity in the Account of Client. In the event that Anchorage is required under applicable law to pay any Tax on behalf of Client, Anchorage shall promptly notify Client of the amount required and Client shall promptly transfer to Custodian the amount necessary to pay the Tax.

5.4. Lien and Right of Setoff, Reserve. In order to secure repayment of Client’s obligations to Anchorage, Client hereby pledges and grants to Anchorage and agrees Anchorage will have, to the maximum extent permitted by law, a continuing first lien and security interest in, and right of setoff against, the Account(s) and all property therein.

6. Representations and Warranties; Disclaimers.

6.1. Mutual Representations and Warranties. Each Party represents, warrants, and covenants that: (i) it is a validly organized entity under the laws of the jurisdiction of its incorporation; (ii) it has all rights, power, and authority necessary to enter into this Agreement and perform its obligations hereunder; (iii) its performance of this Agreement, and the other Party’s exercise of its rights under this Agreement, will not conflict with or result in a breach or violation of any of the terms or provisions or constitute a default under any agreement by which it is bound or any applicable Laws; and (iv) it will comply with all applicable Laws in performing its obligations under this Agreement.

6.2. Anchorage Representations and Warranties. Anchorage represents, warrants and covenants that: (i) the Services will conform to this Agreement; (ii) it is the owner of or is duly authorized to provide all Services; (iii) it has all rights necessary to grant all the rights and licenses that it purports to grant and perform all of its obligations under this Agreement; (iv) it is not aware of any claim that the Services, and the use thereof by any Authorized Person in accordance with this Agreement, infringe upon or otherwise violate any statutory, common law or other rights of any Third Party in or to any Intellectual Property Rights therein; and (v) as of the Effective Date, there is no pending, threatened, or anticipated claim, suit, or proceeding affecting or that could affect Anchorage’s ability to perform and fulfill its obligations under this Agreement.


			Anchorage Proprietary and Confidential

6.3. Client Representations and Warranties. The Client represents, warrants and covenants as of the Effective Date and as of each Direction from Client provided hereunder that: (i) to the extent that Client knows or should know based on reasonable inquiry, Client is and has been for the past five (5) years or since its formation, whichever is more recent, based on a reasonable investigation and analysis of such applicable Laws, in compliance with all applicable Laws in all material respects, including but not limited to those relating to anti-money laundering, Know- Your-Customer, customer identification and similar Laws; (ii) Client owns, and will at all times own, or is a pledgee of, all Digital Assets handled under this Agreement, subject only to liens and encumbrances granted to Anchorage pursuant to this Agreement or otherwise created as part of the Client’s business; (iii) to the extent that Client knows or should know based on reasonable inquiry, any Digital Assets or fiat currency deposited into any Account are not proceeds of a crime; and (iv) Client is not directly or indirectly owned or controlled by any person or entity (a) included on the Specially Designated Nationals and Blocked Persons or the Consolidated Sanctions List maintained by the Office of Foreign Assets Controls (“OFAC”) or similar list maintain by any government entity from time to time; or (b) located, organized, or resident in a country or territory that is the target of sanctions imposed by OFAC or any government entity.

6.4. Anchorage Disclaimers. Except to the extent set forth in Sections 6.1 and 6.2 above, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, ANCHORAGE EXPLICITLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF THE COURSE OF DEALING OR USAGE OF TRADE. The Parties further acknowledge and agree that Anchorage has no obligation to inquire into, and shall not be liable for any damages or other liabilities or harm to any person or entity relating to: (i) the ownership, validity or genuineness of any Digital Asset; (ii) the authority of any Authorized Person to act on behalf of the Client with respect to a Digital Asset; (iii) the accuracy or completeness of any Client Data or information provided by Client or any Authorized Person with respect to a Digital Asset or Direction; or (iv) the collectability, insurability, effectiveness, marketability or suitability of any Digital Asset. Client additionally understands and agrees that Anchorage will follow the Directions from Client, is considered by this Agreement to be an “excluded fiduciary” under SDCL 55-1B-2, and shall be released and held harmless for following the Directions from Client, who is considered by the Agreement to be a Trust Advisor (in its capacity as a custody account holder) under SDCL 55-1B-1(3).

7. Security Requirements; Personal Information.

7.1. Security Requirements. Client will comply with, and cause Authorized Persons and its Representatives to comply with, the terms and conditions set forth in the Data Processing Addendum attached as Schedule D to this Agreement.

7.2. Breach Notifications. Anchorage agrees to use commercially reasonable efforts to notify Client of any Data Security Incident involving Client Data within forty-eight (48) hours of becoming aware of the Data Security Incident.


			Anchorage Proprietary and Confidential

7.3. Changes in Law. To the extent that applicable data protection Laws impose any additional compliance obligations that are not sufficiently addressed in this Agreement, the Parties agree to enter into good faith discussions regarding amending this Agreement or taking such other steps as may be mutually agreed as reasonably necessary to achieve compliance with those applicable data protection Laws.

8. Confidentiality.

8.1. Use and Disclosure. The Parties acknowledge that, in the course of performance of this Agreement, it may be necessary for one Party (“Disclosing Party”) to disclose or permit access to Confidential Information to the other Party (“Receiving Party”) and its Representatives. Disclosing Party's disclosure of, or provision of access to, Confidential Information to Receiving Party’s Representatives is solely for the purposes agreed to under this Agreement.

8.2. Confidential Treatment. Confidential Information disclosed to a Receiving Party will be held in confidence by the Receiving Party and not disclosed to others or used except as expressly permitted under this Agreement or as expressly authorized in writing by the Disclosing Party. Each Party will use the same degree of care to protect the other Party’s Confidential Information as it uses to protect its own information of like nature, but in no circumstances less than reasonable care.

8.3. Allowances. Notwithstanding anything to the contrary in this Section 8, Confidential Information may be disclosed by a Receiving Party to its Representatives, service providers, including Vendors, and professional advisors who require it in connection with their duties in performing such Party’s obligations under this Agreement and who bound by confidentiality obligations substantially similar to those of this Agreement and which would extend to the Disclosing Party's Confidential Information. If disclosure is compelled by law, pursuant to a duly authorized subpoena, court order, or government authority, the Receiving Party shall provide the Disclosing Party with prompt notice to permit the Disclosing Party to seek a protective order or other appropriate remedy protecting its Confidential Information from disclosure, and limits the disclosure of the Confidential Information to the portions required to be disclosed. Notwithstanding the foregoing, the Receiving Party may disclose any Confidential Information of the Disclosing Party to the OCC, or that is requested from, or required or appropriate to be provided to, any other state, federal, or international governmental or regulatory body with jurisdiction over Receiving Party, without prior notice to Disclosing Party. In addition, notwithstanding the foregoing, Anchorage may disclose the existence and terms of this Agreement in connection with an actual or prospective sale or transfer of Anchorage’s assets or stock.

8.4. Exceptions. Except with respect to Personal Information, which will in all circumstances remain Confidential Information, obligations under this Section 8 will not apply to information which: (a) is or becomes available in the public domain without breach of this Agreement; (b) was lawfully received by the receiving party from a third party without confidentiality restrictions; (c) was known or legally in the possession of to the receiving party and its


			Anchorage Proprietary and Confidential

Representatives without confidentiality obligations prior to disclosure from the disclosing party; and (d) was independently developed by the receiving party without breach of this Agreement.

9. Indemnification.

9.1. Indemnification Obligation.

(a)Client will defend, indemnify, and hold harmless Anchorage, its directors, officers, employees and agents (collectively, the "Anchorage Indemnified Party") from and against losses, damages, fines, fees (including reasonable fees of attorneys and accountants), and penalties (“Losses”) asserted in or incurred as a result of claims, demands, suits, or proceedings (“Claims”) by a Third Party arising out of or in connection with this Agreement, except to the extent arising out of (i) Anchorage's gross negligence, willful misconduct or fraud as determined by a non-appealable, adjudication by an arbiter of competent jurisdiction ("Bad Acts"), provided, however, that Anchorage shall be released and held harmless for Direction from the Client, and any results thereof, as it would be pursuant to SDCL 55-1B, which is agreed to be applicable hereunder, even if following such Client Direction constitutes gross negligence or misconduct by Anchorage; and (ii) any breach by Anchorage of its obligations, warranties and representations hereunder.

(b)Client further agrees to indemnify Anchorage for actual, reasonable legal costs and expenses directly related to Client Account(s) or any related account that are a result of any regulatory inquiry, legal action, litigation, dispute, or investigation whether such situations occur or are anticipated, that arise or relate to Client. Client further agrees to defend, indemnify and hold Anchorage Indemnified Party and any financial institution harmless from and against any Losses or Claims arising from or related to (i) Anchorage’s execution of the Directions instituted by Client or anyone acting on Client’s behalf or at its direction (such as a Client Service Provider or Control Party), including but not limited to requests for withdrawals by wire transfer made from Client’s portion of the Deposit Accounts; and (ii) instructions submitted via the Anchorage API, provided that such instructions were submitted pursuant to a validly generated Anchorage API key and such API key performs the functions intended for such key, as reflected in the API documentation.

(c) In addition to any other limitations contained herein, the indemnification provisions in this Agreement shall not apply to any Claim arising out of the bad faith, gross negligence or willful misconduct of any Anchorage Indemnified Party, or any Anchorage Indemnified Party’s material breach of this Agreement or applicable law (collectively, “Excluded Claims”).

(d)Anchorage will defend, indemnify and hold harmless Client, its directors, officers, employees and agents from and against Losses asserted or incurred as a result of Claims arising out of or in connection with Anchorage’s (x) infringement on any Intellectual Property Rights or (y) breach of its obligations under the Data Processing Addendum or applicable law.


			Anchorage Proprietary and Confidential

9.2. Notice and Settlement of a Claim. Anchorage will provide Client with prompt notice of any Claim for which indemnification will be sought hereunder and will cooperate in all reasonable respects with Client in connection with any such Claims, at Client’s expense. Client will defend Anchorage at Anchorage’s request, but failure to give notice will not relieve Client of its obligations under this Section 9. Client will be entitled to control the handling of any such Claim and to defend or settle any such Claim, in its sole discretion, with counsel of its own choosing, except that any settlement for other than money damages will be subject to the approval of the Anchorage, which approval will not be unreasonably withheld. Client may not settle any Claim without the prior written consent of Anchorage where such proposed settlement may limit, materially interfere with, or otherwise adversely affect the rights of Anchorage herein.

10. Liability.

10.1. LIMITATION OF LIABILITY. EXCEPT FOR ANCHORAGE’S EXCLUDED CLAIMS AND BAD ACTS, ANCHORAGE SHALL NOT BE LIABLE FOR ANY LOSSES, WHETHER IN CONTRACT, TORT OR OTHERWISE, INCURRED BY CLIENT, FOR ANY AMOUNT IN EXCESS OF FEES PAID BY CLIENT IN THE TWELVE (12) MONTHS PRIOR TO WHEN THE LIABILITY ARISES.

10.2. DAMAGES LIMITATION. IN NO EVENT WILL ANCHORAGE BE LIABLE (I) FOR ACTS OR OMISSIONS UNDER A MERE NEGLIGENCE STANDARD; (II) LOSSES WHICH ARISE FROM ANCHORAGE’S COMPLIANCE WITH APPLICABLE LAWS, INCLUDING SANCTIONS LAWS ADMINISTERED BY OFAC; OR (III) SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS OR LOSS OF BUSINESS ARISING IN CONNECTION WITH THIS AGREEMENT. IN ADDITION TO THE FOREGOING, ANCHORAGE SHALL NOT BE LIABLE FOR ANY LOSSES WHICH ARISE AS A RESULT OF THE NON-RETURN OF DIGITAL ASSETS THAT CLIENT HAS DELEGATED TO ANCHORAGE OR A THIRD-PARTY FOR ON-CHAIN SERVICES, SUCH AS STAKING, VOTING, AND INFLATION, UNLESS SUCH LOSSES OCCUR AS A RESULT OF ANCHORAGE’S FRAUD OR INTENTIONAL MISCONDUCT.

FOR THE AVOIDANCE OF DOUBT, THE LIMITATION OF LIABILITY IN THIS SECTION 10.1 IS A SEPARATE LIMITATION OF LIABILITY AS TO EACH CLIENT AND SHALL NOT INCLUDE ANY AMOUNT PAID BY CLIENTS IN THE AGGREGATE.

11. Dispute Resolution; Binding Arbitration.

11.1. Initial Resolution; Mediation. In the event of any dispute, potential claim, question, or disagreement arising from or relating to this Agreement or the breach thereof (collectively, a “Dispute”), the aggrieved Party shall notify the other of the aggrieved Party’s intent to address and resolve the Dispute, and the specific terms of such Dispute. The Parties shall use their commercially reasonable efforts to promptly settle the Dispute. Such efforts will include, at a minimum, that executives of each Party consult, meet in person, and negotiate with each other in good faith. If the Parties do not resolve the Dispute pursuant to the foregoing paragraph within a period of 30 days following the aggrieved Party’s notice, then, upon notice by either Party to the other, the Parties agree to confidentially mediate the Dispute in good faith according to the American Arbitration Association (“AAA”) Commercial Mediation Procedures


			Anchorage Proprietary and Confidential

in San Francisco, California or another location agreed to by the Parties. The Parties shall work in good faith with the mediator to attempt to complete the mediation within 30 days of such notice.

11.2. Arbitration. If the parties do not resolve the Dispute pursuant to the foregoing paragraph, then, upon notice by either Party to the other, the Dispute shall be finally settled by binding arbitration administered by the AAA in accordance with the provisions of its rules applicable to commercial disputes. The arbitration shall be conducted on a confidential basis in San Francisco, California, or another location agreed to by the Parties. The arbitration shall be conducted before a single arbitrator experienced in contract, finance and technology law. Any decision or award shall be in writing and shall provide an explanation for all conclusions of law and fact. The arbitrator may award the prevailing Party on each claim or defense, if any, as determined by the arbitrator, some or all of its Costs, in the arbitrator’s sole discretion. “Costs” mean all reasonable pre-award expenses of the arbitration, including the arbitrators’ fees, administrative fees, out- of-pocket expenses such as copying and telephone, witness fees, and reasonable attorneys’ fees.

No Party shall bring a putative or certified class action to arbitration, nor seek to enforce any pre dispute arbitration agreement against any person who has initiated in court a putative class action; or who is member of a putative class who has not opted out of the class with respect to any claims encompassed by the putative class action until: (i) the class certification is denied; (ii) the class is decertified; or (iii) the customer is excluded from the class by the court. Such forbearance to enforce any agreement to arbitrate shall not constitute a waiver of any rights under this Agreement except to the extent stated herein.

11.3. Exception for Protection of Confidential Information. The Parties each agree that the protection of Confidential Information is necessary and reasonable in order to protect the Disclosing Party and its business. The Parties each expressly agree that monetary damages would be inadequate to compensate the Disclosing Party for any breach of its Confidential Information. Accordingly, each Party agrees and acknowledges that any such violation or threatened violation would cause irreparable injury to the Disclosing Party and that, in addition to any other remedies that may be available, in law, in equity or otherwise, the Disclosing Party shall be entitled to obtain injunctive relief against the threatened breach or continued breach by the Receiving Party, without the necessity of proving actual damages.

12. General Provisions.

12.1. Independent Contractor. It is understood by the Parties that Anchorage is an independent contractor, and that this Agreement does not create or constitute a partnership, joint venture or employment relationship between the Parties.

12.2. No Third Party Beneficiaries. This Agreement is not intended to and shall not be construed to give any Third Party any interest or rights (including, without limitation, any Third Party beneficiary rights) with respect to or in connection with any agreement or provision


			Anchorage Proprietary and Confidential

contained herein or contemplated hereby, except as otherwise expressly provided for in this Agreement.

12.3. Publicity and Client Identification. The existence and subject matter of this Agreement, including Fees, is deemed the Confidential Information of Anchorage. Notwithstanding the foregoing, for the Term of the Agreement, Client may use Anchorage’s name and approved trademarks to identify Anchorage as its Digital Asset custodian services provider, and Anchorage may use Client’s name and approved trademarks to identify Client as a customer of Anchorage. Any use of a Party’s trademarks shall be in a form reasonably acceptable to that Party. Any other use of a Party’s name or trademarks by the other may only be made with its prior written consent.

12.4. Force Majeure. Neither Party will be liable to the other Party for the failure to perform or delay in the performance of its obligations under this Agreement to the extent such failure or delay is caused by or results from a Force Majeure Event. The affected Party will not be held liable by the other Party for such non-performance or delay as long as the fact of the occurrence of such Force Majeure Event is duly proven or is reasonably provable. In addition, Anchorage will not be liable to Client for any costs or expenses incurred by Client as a result of any Force Majeure Event. Notwithstanding the foregoing, if the delay in performance exceeds thirty (30) days, the Party awaiting performance will be permitted to terminate this Agreement upon five (5) days’ prior written notice to the other Party, with no further obligation to the Party claiming excusable delay.

12.5. Notices. All notices required or permitted under this Agreement will be in writing and delivered by courier, mail, electronic mail, or within the Anchorage application (except for service of legal process which shall be by courier). A Party’s email addresses or physical address may be changed from time to time by either Party by providing written notice to the other in the manner set forth above.

12.6. Execution in Counterparts and by Electronic Means. This Agreement may be executed in counterparts and by electronic means and the Parties agree that such electronic means and delivery will have the same force and effect as delivery of an original document with original signatures.

12.7. Entire Agreement; Amendment. This Agreement includes all exhibits, schedules, and attachments referenced herein, all of which are incorporated herein by this reference. This Agreement is the final, complete, and entire agreement of the Parties. There are no other promises or conditions in any other agreement, oral or written. This Agreement supersedes any prior written agreements or oral agreements between the Parties. The Agreement may only be modified or amended in writing and signed by both Parties.

12.8. Remedies Cumulative. Each Party will have all of the rights and remedies provided by law in addition to the rights and remedies set forth in this Agreement and in any other agreement or writing between the Parties. All of a Party’s rights and remedies are cumulative and may be exercised from time to time, and the pursuit of one right or remedy will not


			Anchorage Proprietary and Confidential

constitute an exclusive election or otherwise preclude or limit its pursuit of any other or additional right or remedy.

12.9. Severability. If any provision of this Agreement will be held to be invalid or unenforceable for any reason, the remaining provisions will continue to be valid and enforceable. If a court finds that any provision of this Agreement is invalid or unenforceable, but that by limiting such provision it would become valid and enforceable, then such provisions will be deemed to be written, construed and enforced as so limited.

12.10. Assignment. No Party may assign any of its rights under this Agreement or delegate its performance under this Agreement without the prior written consent of the other Party; except that Anchorage may assign its rights and delegate its performance under this Agreement to: (i) any entity that acquires all or substantially all of its assets; (ii) any Affiliate that controls, is controlled by, or is under common control with Anchorage; and (iii) any successor in a merger, acquisition, or reorganization, including any judicial reorganization, so long as such assignee is a “qualified custodian” as such term is used by the Securities and Exchange Commission.

12.11. Use of Affiliates. Anchorage may use Anchorage Affiliates to provide certain Services as directed by Anchorage. Without limiting the generality of the foregoing, Anchorage hereby discloses that it is a subsidiary of Anchor Labs, Inc., which provides certain technology and administrative services to Anchorage in support of Anchorage’s provision of Services hereunder, pursuant to an Intercompany Services Agreement between Anchorage and Anchor Labs, Inc. Anchorage is, and will at all times be, responsible for the acts and omissions of its Affiliates, including Anchor Labs, Inc., and all provisions under this Agreement that are applicable to Anchorage will apply equally to its Affiliates, including Anchor Labs, Inc. For the avoidance of doubt, this section does not apply to Anchorage’s use of a Vendor.

12.12. No Waiver of Contractual Right. The failure of either Party to enforce any provision of this Agreement will not be construed as a waiver or limitation of that Party’s right to subsequently enforce and compel strict compliance with every provision of this Agreement. A waiver or consent given on one occasion is effective only in that instance and will not be construed as a bar to or waiver of any other right on any other occasion.

12.13. Governing Law. Except to the extent it is governed by federal banking Law, this Agreement will be governed by and construed exclusively in accordance with the laws of the State of California, without regard to its conflicts of laws provisions or rules. Subject to Section 11, the Parties hereby agree to submit to the exclusive jurisdiction of any appropriate court located in the State of California or the applicable United States District Court for San Francisco, California, as a forum for litigation. Each of the Parties hereto hereby waives all right to trial by jury in any lawsuit, action, proceeding or counterclaim arising out of this Agreement.

12.14. Survival. Any expiration or termination of this Agreement will not affect any accrued claims, rights or liabilities of Parties, and all provisions which must survive to fulfill their intended purposes, or by their nature are intended to survive such expiration or termination will survive, including Sections 3 – 12.


			Anchorage Proprietary and Confidential

SCHEDULE A – DEFINITIONS

“Access Speed” means the maximum time for Anchorage to complete its review of Authenticated Instructions after Quorum approval. Where submitted instructions initially fail Anchorage’s Authenticated Instruction review, the time for Anchorage’s review will reset. This Access Speed excludes (i) the time for a Blockchain to propagate a block and (ii) Support Services.

“Account” means an account established in the name of, or for the benefit of a Client, in which the ownership of Digital Assets is recorded and to which Digital Assets are credited. Each Account is recorded separately on Anchorage's books and records and has one or more unique wallet addresses. An organization may have one or more Accounts, and an Account may have one or more Vaults. The Authorized Persons and Quorum requirements for each Account may differ from those of other Accounts.

“Acceptable Device” means a hardware device with software configuration set forth in Schedule B.

“Affiliate” means an entity controlling, controlled by or under common control with a Party.

“Anchorage API” means the application programming interface, as such may be modified from time to time, made available by Anchorage as part of the Services.

“Annual Basis Points” refers to the annual rate for custody fees. Monthly Custody Fees are charged at the rate of one-twelfth of the listed annual rate.

“AUC” or “Assets Under Custody” means the average daily balance of Client Digital Assets in Anchorage’s custody each month, calculated after the conclusion of each month, where the average daily balance is determined by adding each daily balance and dividing the sum of the daily balances by the number of days in such month (or in the case of the first month, by the number of days in such month following the Fees Commencement Date). Daily balances are calculated by applying closing prices, as provided by CryptoCompare.com at the close of each day (UTC), or if unavailable, other reliable, reputable third party pricing sources, selected at Anchorage’s sole discretion, to the end of day holdings in the Account. If such source(s)’ closing prices for certain Digital Assets are unavailable, or Anchorage reasonably determines that such prices are unreliable due to low or inconsistent trading volumes, Anchorage may use fixed pricing for such Digital Assets, which will be determined in Anchorage’s reasonable sole discretion. The first invoice will be sent after the end of the first full calendar month after the Fees Commencement Date.

“Authenticated Instruction” means a Direction (i) regarding the transfer of specific Digital Assets; (ii) to add or remove Authorized Persons; (iii) to generate or remove, or change permissions for, Anchorage API keys; or (iv) which is otherwise provided for by the Services; by (a) an Authorized Person that has received Quorum approval (where such Quorum approval is required) or (b) an authorized application using an Anchorage API key (generated by an Authorized Person). Anchorage’s authentication processes and procedures will be determined by Anchorage in its sole discretion from time to time, and will include biometric authentication for each Authorized Person, which may include but are not limited to fingerprint, facial recognition, or voiceprint. Where the purpose of an Authenticated Instruction relates to Digital Assets, such an Authenticated Instruction is an Entitlement Order for purposes of the UCC.


			Anchorage Proprietary and Confidential

“Authorized Person” means a person nominated by Client, or another party if so contemplated by a Client Service Provider Agreement or Control Agreement, and thereafter approved by Anchorage pursuant to Section 2.1.

“Basis Point” means 1/100th of 1%.

“Blockchain” means software operating a distributed ledger which is maintained by a network of computers, and that records all transactions in a Digital Asset in theoretically unchangeable data packages known as blocks, each of which are timestamped to reference the previous block so that the blocks are linked in a chain that evidences the entire history of transactions in the Digital Asset.

“Client Data” means any or all of the following, and all copies thereof, regardless of the form or media: (i) Personal Information of Client or an Authorized Person; and (ii) any non-public data or information provided or submitted by or on behalf of Client or an Authorized Person as part of the Services.

“Confidential Information” means information and technical data, which is not generally known to the public, whether disclosed directly or indirectly, in writing, orally, or visually, that the Receiving Party knows or should know is confidential or proprietary. Examples of Confidential Information include, but are not limited to, a Party’s products, software, websites, apps, marketing plans and materials, business strategies, business methods, models, financial reports or projections, product plans and specifications, designs, processes, manuals, ideas, concepts, drawings, pricing, fees, operational plans, know-how, employee information, shareholder information, vendor information, customer information, and ownership or investor information.

“Data Security Incident” has the meaning provided for in Schedule D.

“Digital Asset” means a digital representation of value that may function as a medium of exchange or medium for investment, and which is evidenced on, and can be electronically received and stored using, distributed ledger technology. For the avoidance of doubt, Digital Assets held by Anchorage for the Client are “Financial Assets” for purposes of the UCC and are not assets of Anchorage.

“Direction” means any directions, instructions or requests made by Client through the Services, including but not limited to Authenticated Instructions, through the Anchorage application made by Authorized Persons, or the Anchorage API, relating to the storage or transfer of Digital Assets.

“Documentation” means all Client manuals, training and marketing materials, guides, product descriptions, product specifications, technical manuals, supporting materials, and other information relating to the Services and provided by Anchorage to Client.

“Fee” has the meaning provided in the Order Form.

“Fiat Services” means services related to the custody, management and Directions related to fiat currencies owned by Client and held for Client’s benefit by Anchorage, including (i) holding Client’s fiat currency in an omnibus banking account held for the benefit of Anchorage’s clients, and (ii) transferring Client’s fiat currency as directed by Client, a Client Service Provider or other Client designee.

“Force Majeure Event” means an event occurring after the Effective Date caused by a circumstance beyond a Party’s reasonable control and that could not have been prevented or avoided by the exercise of due diligence, including, but not limited to natural catastrophes, fire, explosions, pandemic or local


			Anchorage Proprietary and Confidential

epidemic, war or other action by a state actor, public power outages, civil unrests and conflicts, labor strikes or extreme shortages, acts of terrorism or espionage, Domain Name System server issues outside a Party’s direct control, technology attacks (e.g., DoS, DDoS, MitM), cyberattack or malfunction on the blockchain network or protocol, or governmental action rendering performance illegal or impossible.

“Fork” means (i) that a Digital Asset network has been changed in a way that makes it incompatible with the unchanged version of the Digital Asset network, (ii) a material population of miners and/or users of the Digital Asset network accept the changes, and (iii) that the two resulting Digital Asset networks have not been merged together in a timely manner. A Fork may create two separate Digital Asset networks (each, a “Forked Network”), and may result in Anchorage holding an identical amount of Digital Assets associated with each Forked Network.

“Intellectual Property Right(s)” means, with respect to any thing, material or work (hereinafter, a “Work”): any and all (i) worldwide copyrights, trademarks, trade secrets and any other intellectual property and proprietary rights and legal protections in and to such Work including but not limited to all rights under treaties and conventions and applications related to any of the foregoing; (ii) all patents, patent applications, registrations and rights to make applications and registrations for the foregoing; (iii) all goodwill associated with the foregoing; (iv) all renewals, extensions, reversions or restorations of all such rights; (v) all works based upon, derived from, or incorporating the Work; (vi) all income, royalties, damages, claims, and payments now or hereafter due or payable with respect thereto; (vii) all causes of action, either in law or in equity for past, present or future infringement based on the Work; (viii) rights corresponding to each of the foregoing throughout the world; and (ix) all the rights embraced or embodied therein, including but not limited to, the right to duplicate, reproduce, copy, distribute, publicly perform, display, license, adapt, prepare derivative works from the Work, together with all physical or tangible embodiments of the Work.

“Laws” means all United States federal, state and local laws, statutes, ordinances, regulations, rules, executive orders, circulars, opinions, agency guidance, interpretive letters and other official releases, request, or recommendation of or by any government, or any authority, department or agency thereof.

“Monthly Custody Fee” refers to the fees for custody of the Digital Assets.

“Monthly Minimum” refers to the minimum Fees per month to Client if AUC is below the designated amount.

“On-Chain Services” has the meaning set forth in Section 2.4.

“One-Time Onboarding Fee” refers to the fees for establishing Client as an Anchorage customer, including: KYC/AML processes; one in-person training session; Authorized Person onboarding; and remote training for up to ten (10) individuals. Credit, if any, may be applied to Client Fees only above the Monthly Minimum, and will be applied fully each month until the credit has been fully expended within the Initial Term. Any remaining credit after the Initial Term shall be forfeited.

“Personal Information” means any information relating to an identified or identifiable individual, such as name, postal address, email address, telephone number, date of birth, Social Security number (or its equivalent), driver’s license number, account number, personal identification number, health or medical information, fingerprint, voice print, or any other unique logical or biometric identifier specific to an individual, regardless of the media in which it is contained, that is: (i) disclosed to Anchorage, its Affiliates or Anchorage Representatives by Client or an Authorized Person in anticipation of, in


			Anchorage Proprietary and Confidential

connection with or incidental to the Services; (ii) processed at any time by Anchorage, an Anchorage Affiliate or Anchorage Representatives in connection with or incidental to the performance of its obligations under this Agreement; or (iii) derived by Anchorage, an Anchorage Affiliate or Anchorage Representatives from the information described in (i) and (ii) above.

“Private Key” means an alphanumeric string known only to the holder of a Digital Asset, which must be used to transact the Digital Asset represented by the corresponding Public Key.

“Public Key” means an alphanumeric string on a Blockchain that indicates ownership/possession of a specific amount of a Digital Asset by a specific network participant. The Public Key is visible to all participants in the Blockchain’s network.

“Quorum” means the minimum number of Authorized Persons required to approve a Direction which requires a quorum. Unless otherwise specified in an applicable Client Service Provider Agreement, Control Agreement, or instructions provided in connection therewith, (i) Client may designate the total number and the minimum number of Authorized Persons required to approve an Authenticated Instruction or other Direction so long as Client designates at least three (3) Authorized Persons, with at least two (2) required to approve any Direction.

“Representative” means any employees, officers, directors, representatives, contractors, and agents of a Party.

“Services” means the services related to the custody of Digital Assets provided by Anchorage to Client under this Agreement, including the Technology Platform and Support Services. “Services” also includes Fiat Services or On-Chain Services if Anchorage has offered such services to Client, and Client has accepted such services. For the avoidance of doubt, “Services” expressly excludes the provision of legal, tax, brokerage, or investment advice or recommendations.

“SLA Termination Event” has the meaning set forth in Schedule C (Service Level Agreement).

“Support Services” means services supporting the use of the Services, including access to Anchorage Representatives for support related to Account(s), training, etc.

“Technology Platform” means the technology platform and application provided by Anchorage and made available to Client to access the Services and Account(s), including the Anchorage API, and any changes, improvements, extensions thereto or other versions thereof in order to: (i) store Client’s Digital Assets and provide related services; (ii) handle Digital Assets according to Authenticated Instructions; and (iii) determine the eligibility of Digital Assets for storage and continued storage. The Technology Platform includes but is not limited to (i) algorithms, computer programs, concepts, ideas, inventions, machines, mask works, procedures, processes, rates, security codes, and works of authorship in all cases whether or not patentable or copyrightable, that are owned or in-licensed by Anchorage or that otherwise are or have been created, developed, owned, incorporated or generated, in whole or in part, by or on behalf of Anchorage for or into or in connection with features, functions, tools or services to be provided pursuant to this Agreement, (ii) all data and other information that are or can be collected, compiled, or derived by or on behalf of Anchorage from any usage by Client or any other person of any work, invention, or other subject matter referred to in the foregoing, and (iii) any work, invention, or other subject matter that constitutes or relates to a suggestion, enhancement, modification, improvement, upgrade, or update regarding, or that is otherwise based on or derived from or related to, any work, invention, or other subject matter referred to in this the foregoing.


			Anchorage Proprietary and Confidential

“Third Party” means a person(s) or any legal entity that is not a Party, a Representative of a Party, or an Affiliate of a Party.

“Vault” means a subdivision of an Account. Each Vault is held separately on Anchorage's books and records and may have one or more unique wallet addresses. The Authorized Persons and Quorum requirements for each Vault may differ from those of other Vaults.

“Vendor” means any Third Party retained by Anchorage or its Affiliates to provide technical or professional services used by Anchorage or its Affiliates to provide the Services to Client.


			Anchorage Proprietary and Confidential

SCHEDULE B – TECHNICAL AND EQUIPMENT SPECIFICATIONS

1. Acceptable Device.

As to each nominated Authorized Person, a unique iPhone with TouchID or FaceID is required for the Services.

Note: The iPhone SE is specifically excluded from the list of compatible devices. Anchorage also reserves the right, upon notice to Client, to exclude new iPhone versions for a brief period as Anchorage deems necessary in its sole discretion (such as to ensure that the new software and/or device is operable with the Anchorage app and systems, is secure, and free from material bugs).

1. Software Specifications.

As to each Acceptable Device of each nominated Authorized Person, the operating system must be iOS 11.2 or later.

3. Changes to Schedule B.

Anchorage may, in its sole discretion, amend the Acceptable Device and Software Specification requirements in this Schedule B for security or service purposes, at any time. Anchorage agrees to use commercially reasonable efforts to provide Client prior notice of any such amendment. Upon amendment of any Acceptable Device and Software Specification requirements, as provided hereunder, Client will update and/or replace the Acceptable Device(s) as may be necessary, at its sole expense. Client understands and agrees that ongoing access to the Services will depend on compliance with Anchorage Acceptable Device and Software Specification requirements.


			Anchorage Proprietary and Confidential

SCHEDULE C – SERVICE LEVEL AGREEMENT

1. General.

1.1. This Service Level Agreement (“SLA”) specifies committed service levels that apply to the Technology Platform, except as provided in Section 3 below (Exclusions). If a service level is not achieved, Client will be entitled to the Service Credits (as defined below) set out in this SLA as its sole and exclusive remedy.

1.2. The service levels will be reported by Anchorage according to its internal tracking systems.

2. Availability.

2.1. Availability will be calculated on a monthly basis as follows:

((Total Time - Downtime)/Total Time * 100) > 99.8%

“Total Time” means the total number of minutes over the previous 90 days.

“Downtime” means the minutes in the previous 90 days during which the Technology Platform is not available, excluding time for Scheduled Maintenance.

“Scheduled Maintenance” means the minutes in the previous 90 days during which the Technology Platform is not available caused by scheduled maintenance, noticed to Client pursuant to this Section 2.2 below.

2.2. Anchorage will provide advance notice of any Scheduled Maintenance, and will perform Scheduled Maintenance outside of standard Business Hours (“Business Hours” means 6 a.m. to 8 p.m. Pacific time, Monday through Friday and excluding holidays) or during other hours reasonably expected to minimize the impact on Client. Anchorage will use commercially reasonable efforts to provide at least 48 hours’ advance notice of any Scheduled Maintenance. Anchorage will attempt to maximize actual availability of the Technology Platform and Services during Scheduled Maintenance.

2.3. If Anchorage fails to meet the foregoing availability in any month, Anchorage will credit Client (a “Service Credit”) according to the following calculation:


Service Level (% Availability in a month)			Service Credit
Less than 99.8% and at least 98%			2% of monthly Fees
Less than 98% and at least 95%			4% of monthly Fees
Less than 95%			8% of monthly Fees

2.4. If Client becomes entitled to any Service Credit for three (3) consecutive months, Client is entitled, at its option, to terminate this Agreement for cause with no opportunity to cure pursuant to Section 4.2 of the Agreement (“SLA Termination Event”).

3. Exclusions. During the first six months of (i) any On-Chain Services, starting from the date of acceptance as provided in Section 2.4 of the Agreement; or (ii) the addition of any new Digital Asset to


			Anchorage Proprietary and Confidential

the Services, starting from the date the new Digital Asset is supported by Anchorage, such On-Chain Services or new Digital Asset shall be excluded from this SLA.


			Anchorage Proprietary and Confidential

SCHEDULE D – DATA PROCESSING ADDENDUM

This Data Processing Addendum (“Addendum”), effective as of the Effective Date, is between Anchorage (for itself and its Affiliates), and Client.

1. Definitions. The following terms apply to this Addendum. Any capitalized terms not defined in this Addendum have the meanings given in the Agreement.

“Data Processing Laws” means all applicable United States federal, state, provincial and local laws, rules, regulations, directives and governmental requirements currently in effect and as they become effective relating in any way to the privacy, confidentiality or security of Personal Data including without limitation: (i) the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. §§ 6801-6827, and all regulations implementing GLBA; the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et seq., as amended by the Fair and Accurate Credit Transactions Act (“FACTA”), and all regulations implementing the FCRA and FACTA; Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) (codified as amended in scattered sections of 29 U.S.C. and 42 U.S.C.), and all regulations implementing HIPAA; the California Consumer Privacy Act of 2018 (the "CCPA"); the Controlling the Assault of Non-Solicited Pornography and Marketing Act (“CAN SPAM”); information security breach notification laws; laws requiring the secure disposal of records containing certain Personal Data; all other similar international, federal, state, provincial, and local requirements; and Anchorage’s data retention and destruction policies.

“Personal Data” means (i) Personal Information, and (ii) other personally identifiable information as defined under Data Processing Laws that is collected, disclosed, stored, accessed or otherwise processed by Anchorage for the purpose of providing the Services to Client.

“Process” or “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. Anchorage Responsibilities.

2.1 Processing. Anchorage will process Personal Data (i) to operate and manage the Services for Client; (ii) to monitor, process and support Directions; (iii) to comply with legal or regulatory obligations applicable to the Services including financial reporting and retention of related data.

2.2 Deletion or Return. Upon Client’s written request, Anchorage will delete or return all Personal Data to Client after the end of the provision of the Services, and delete existing copies. Notwithstanding the foregoing, Anchorage may retain a copy of Personal Data to comply with Data Processing Laws and other applicable laws and regulations; provided, however, that protections are extended to such retained information in accordance with the provisions of this Addendum.

2.3 Programs and Policies.

Security Program. Anchorage maintains and enforces a security program that addresses the management of security and the security controls employed by Anchorage. The security program includes: (i) documented policies that Anchorage formally approves, internally publishes, communicates to appropriate personnel and reviews at least annually; (ii) documented, clear assignment of responsibility and authority for security program activities; (iii)


			Anchorage Proprietary and Confidential

policies covering, as applicable, acceptable computer use, data classification, cryptographic controls, access control, removable media, and remote access; and (iv) regular testing of the key controls, systems and procedures.

Privacy Program. Anchorage maintains and enforces a privacy program and related policies that address how Personal Data is collected, used and shared by Anchorage and Vendors.

2.4 Risk and Asset Management.

Risk Management. Anchorage performs risk assessments and implements and maintains controls for risk identification, analysis, monitoring, reporting, and corrective action.

Asset Management. Anchorage maintains and enforces an asset management program that classifies and controls hardware and software assets throughout their life cycle.

2.5 Worker Education.

Workers. All Anchorage employees, agents, and contractors, and those of any Anchorage Affiliate (collectively “Workers”) acknowledge their data security and privacy responsibilities under Anchorage’s policies.

Worker Controls. For Workers who Process Personal Data, Anchorage or its Affiliates (i) implements reasonable and legally-allowed pre-employment background checks and screening; (ii) conducts security and privacy training; (iii) implements disciplinary processes for violations of data security or privacy requirements; and (iv) upon termination or applicable role change, promptly removes or updates Worker access rights and requires the return or destruction of Personal Data.

2.6 Network and Operations Management.

Policies and Procedures. Anchorage and its Affiliates implement controls and procedures for network and operations management. Such controls and procedures address: hardening, change control, segregation of duties, separation of development and production environments, technical architecture management, network security, virus protection, media controls, protection of data in transit, data integrity, encryption, audit logs, and network segregation.

Vulnerability Assessments. Anchorage and its Affiliates perform periodic vulnerability assessments and network penetration testing on systems and applications that Process Personal Data.

2.7 Access Control.

Access Control. Anchorage implements, and will ensure its Affiliates and Vendors implement, access controls designed to maintain the confidentiality of Personal Data. Such controls will include: (i) authorization processes for physical, privileged, and logical access to facilities, systems, networks, wireless networks, operating systems, mobile devices, system utilities, and other locations containing Personal Data; and (ii) granting access only if it is logged, strictly controlled, and needed for a Worker or Third Party to perform their job function.


			Anchorage Proprietary and Confidential

Authentication. Anchorage authenticates each Worker’s identity through appropriate authentication credentials such as strong passwords, token devices, or biometrics.

2.8 Data Security Incident Management and Notification.

Incident Management Program. Anchorage implements a data security incident management program, compliant with Data Processing Laws, that addresses management of data security incidents including a loss, theft, misuse, unauthorized access, disclosure, or acquisition, destruction or other compromise of Personal Data from Anchorage’s systems or those of its Affiliates or Vendors (“Data Security Incident” or “Incident”).

Incident Notification. Except to the extent necessary to comply with applicable legal, regulatory or law enforcement requirements, Anchorage must inform Client without unreasonable delay, but in no event more than 48 hours, after it becomes aware of any Incident that has occurred in its systems which affects Personal Data.

Response. Anchorage will partner with Client to respond to the Incident. Response may include: identifying key partners, investigating the Incident, providing regular updates, and determining notice obligations. Except as may be required by law, Anchorage may not notify Client’s affected customers about an Incident without first consulting Client.

3. Client Responsibilities.

3.1 Custody and Use of Personal Data. Client is responsible for the security of all Personal Data in its possession, custody or control. When using Personal Data in conjunction with the Anchorage Services, Client will only use such Personal Data as permitted by this Addendum or other agreements between Anchorage and Client.

3.2 Anchorage Account Security. Client is responsible for preventing the compromise of its Anchorage Account credentials, and for ensuring that its Anchorage Account is not used or modified without authorization.

3.3 Disclosure to Data Subjects. Client must ensure that the natural persons to which the Personal Data pertains (“Data Subjects”) are provided with appropriate information regarding the Processing of their Personal Data, including by means of offering a transparent and easily accessible public privacy notice.

3.4 Client Incident Notification. Except to the extent necessary to comply with Data Processing Laws or other applicable Laws, Client must inform Anchorage without unreasonable delay, but in no event more than forty-eight (48) hours, after it becomes aware of any Data Security Incidents (including a loss, theft, misuse, unauthorized access, disclosure, or acquisition, destruction or other compromise) that has occurred in its systems which affects Personal Data of an Authorized Person (“Client Data Incident”). Client will provide reasonable information and cooperation to Anchorage so that Anchorage can fulfill any data breach reporting obligations it may have under (and in accordance with the timescales required by) Data Processing Laws. Client will further take reasonably necessary measures and actions to remedy or mitigate the effects of the Client Data Incident and will keep Anchorage informed of all material developments in connection with the Client Data Incident.


			Anchorage Proprietary and Confidential

4. Compliance with Data Processing Laws. Each Party will perform all of its obligations under applicable Data Processing Laws, including data security and confidentiality obligations. Each Party will hold in strict confidence any and all Personal Data processed under this Addendum.

5. Termination. This Addendum will have the same duration as the Agreement. The obligations of Anchorage to implement appropriate security measures with respect to the Personal Data will survive the termination of this Addendum and will apply for so long as Anchorage retains Personal Data.

6. Governing Law and Dispute Resolution. The governing law and dispute resolution provisions of the Agreement will apply to this Addendum.

7. Security Questionnaire. Upon written request, and no more frequently than annually, Anchorage will provide Client a written data security summary in a form and scope as determined by Anchorage regarding Anchorage’s business practices and data technology environment in relation to the Processing of customer data. The summary will be Anchorage’s Confidential Information.


			Anchorage Proprietary and Confidential