IBM Payments Gateway

Transcription

1 Description IBM Payments Gateway This Description describes the Cloud IBM provides to Client. Client means and includes the company, its authorized users or recipients of the Cloud. 1. Cloud 1.1 IBM Payments Gateway IBM Payments Gateway is a SaaS payment solution. The Cloud, using a PCI-compliant environment, connects to Client systems to collect and process payment information from end customers. 1.2 Additional Offerings Client must purchase IBM Payments Gateway along with at least one (1) of the following Cloud Payment offerings: IBM Payments Gateway API Payment Transactions which are transmitted through an API that consists of a set of web services designed to facilitate integration with Client systems. The API provides a single interface to global payments across banks and processors in a large number of countries and currencies IBM Payments Gateway Hosted-Page Payment Transactions which are transmitted through the Hosted Payment Page (HPP), a payment collection and wallet management GUI that is designed to be integrated into websites, mobile commerce sites, Smart Phone apps, call center applications, and back-office collection systems. The Hosted Payment Page is designed to be delivered in an HMTL inline frame (iframe) IBM Payments Gateway Advanced API Payment Transactions which are transmitted through the JavaScript Object Notation (JSON) interface which is designed to facilitate development of payment functions in native smart phone applications. The JSON interface offers a set of payment APIs that are performed using HTTP methods on the related URL, with data delivered in the JSON format IBM Payments Gateway Price Group (PG) 0 Payments Transactions in the form of authorization or payment requests which are transmitted through the Hosted Payment Page (HPP) or through an API interface, to one of the banks/processors listed in the IBM Payments Gateway PG 0 acquirers document, available at the product website IBM Payments Gateway Price Group(PG) 1 Payments Transactions in the form of authorization or payment requests which are transmitted through the Hosted Payment Page (HPP) or through an API interface, to one of the banks/processors listed in the IBM Payments Gateway PG 1 acquirers document, available at the product website IBM Payments Gateway Stored Value Payments The Stored Value Payments offering processes transactions which are initiated from a Client's stored value account and accepted by a merchant inside a marketplace. This part facilitates this value transfer inside this closed loop marketplace structure IBM Payments Gateway IBM Pay Transactions IBM Pay Transactions are transactions accepted by merchants from the merchant application in a rich mobile checkout scenario. This offering includes an orchestration function, which allows interaction between CRM, POS, and token vault systems; the IBM token vault, which allows Clients to save and then i (12/2016) Page 1 of 10

2 access payment methods in a PCI-compliant data vault; and a connection to a payment switch, which allows those transactions to go out for processing IBM Payments Gateway Payments Reconciliation This offering provides reports which track expected settlement transactions and amounts, and compares them to actual settlements, highlighting for resolution the problematic individual transactions BM Payments Gateway Settlement Transactions which are transmitted from a seller to a buyer's financial institution that contain payment information to enable transaction settlement to be completed IBM Premium Account Support The Payment Gateway Premium Account Support service package provides an extended ongoing service solution to our Clients. The service includes up to 10 hours per month from a s Delivery manager. The service is delivered remotely and includes operational reviews including metrics, upcoming event & change control review and issues escalation review. Unused hours do not roll over month to month. 1.3 Setup s IBM Payments Gateway Basic Payments Setup The IBM Payments Gateway- Basic Payment Setup is a self-services onboarding solution that enables a Client to setup one merchant account with one acquirer for multiple payment methods. This package includes one project ID for the merchant account in one country. The package includes up to 6 hours of assistance via thru the client portal and expires 90 days from the date Client is notified by IBM that access to the Cloud is available regardless of whether all hours have been used IBM Payments Gateway Payments Reconciliation Setup The IBM Payments Gateway- Payment Reconciliation Setup is a service to configure the Payment Reconciliation module. The service includes the setup of one Merchant Account (i.e. Project Code), including pre-enabled acquirers, in the defined countries. The Client will provide the accounting reconciliation setup detail including the settlement and reconciliation flow, and accounting details used to configure the module. This service includes 46 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Stored Value Payments Setup The IBM Payments Gateway- Stored Value Payment Configuration service is an optional package for the configuration the Stored Value Payment module. The stored value scheme is set up with multiple participating merchants, tax and fee accounts including e-vouchers and stored value account balanced for individual end users. The Client will provide details on the accounting setup and acquiring bank account information to enable the stored value feature. Each stored value scheme is owned by a specific Stored Value provide and has a single currency. This service includes 12 hours of configuration expertise. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client regardless of whether all hours have been used IBM Payments Gateway IBM Pay Transactions Setup IBM Pay Transactions Setup gives Clients access to the IBM Pay orchestration function, access to the PCI-compliant token vault, and the ability to communicate transaction details between the point of sale, the token vault, and the designated payment switch. This setup service is required to enable Client's subscription to the IBM Pay Transactions service. 1.4 Remotely Delivered s IBM Payments Gateway Premium Payments Configuration Remotely Delivered The IBM Payments Gateway Premium Product Configuration service includes best practices, project guidance, and access to a subject matter expert to facilitate the provisioning of the IBM Payments Gateway service. This package includes up to 27 hours of access to the SME. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used. i (12/2016) Page 2 of 10

3 1.4.2 IBM Payments Gateway Virtual Account Payment Configuration Remotely Delivered The IBM Payments Gateway- Virtual Account Payment Configuration service is a of a range of virtual collection accounts, for one pre-enabled collections bank in one country, including automated receipt and processing of bank statements, policies for automated matching, rules for de-allocation of virtual account numbers, and reports and notifications to merchant. The Virtual Account Payments is only pre-enabled for a predetermined list of collections banks. Some collections banks do not offer virtual account facilities at all. Other collections banks will require a separate "Electronic Payment Advise" connection to be established. Please consult the IBM Payment Gateway Acquirer List for further information. The Client will provide IBM with the merchant account information for processing the virtual account payments. This service includes 9 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Data File Transaction Configuration Remotely Delivered The IBM Payments Gateway- Data File Transaction Configuration package is a service to configure one directory for storage of a Client data files. Access to the directories provided for a specific set up subaccounts or project codes. The Client will provide the data to be stored via a web services request. This service includes 5 hours of configuration. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway New Payment Method Configuration Remotely Delivered The IBM Payments Gateway New Payment Method Configuration service is an optional service enabling the specified payment method for the defined acquirer in the deployment country. The Client will provide IBM with the merchant ID setup information to configure the Cloud solution. The Client will then perform a sales country acceptance test to validate the configuration prior to the move to production. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. This service includes 4 hours of configuration time. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Additional Project Codes Remotely Delivered The IBM Payments Gateway Additional Project Codes provide for additional (priced in packs of one or ten) merchant ID account(s) on the Payments Gateway solution. Each merchant ID represents a unique project code in the solution. This option allows the Client to request a new or additional merchant ID/project code to be added to the Cloud. The number of merchant ID/project codes that may be requested depends upon the number of additional project codes purchased. Each additional project code(s)/merchant ID is utilized under the master project code, and existing connectivity and certificate. The Client is responsible for providing the merchant ID information to IBM for configuration. Each priced project code addition service includes up to 7 hours of configuration time. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Account Updater Configuration Remotely Delivered The IBM Payments Gateway Account Updater Configuration service is available for the Client to manage several acquirers. Once configured by IBM and the specific acquirer, the Account Updater will automatically retrieve information about replacement cards and bank accounts for the cards and accounts stored in IBM's Wallet. This service excludes any fees that the acquirer(s) may charge to the Client for delivery, connection or transaction fees. This service includes 89 hours of remote service. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway New card Acquirer CnP connection (Auth & Settle) Remotely Delivered The IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle) service builds and certifies an Acquirer connection to the Payments Gateway base service, including a business and technical review of the acquirer specifications, mapping to the Cloud solution, and certification with the acquirer to support authorization and for card not present transactions. E-commerce, MOTO, i (12/2016) Page 3 of 10

4 Recurring MCC code and support for 3DSecure are included if available through the requested acquirer using the public internet. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 219 hours of remotely delivered design and implementation services for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle & EPA) Remotely Delivered The IBM Payments Gateway New card Acquirer CnP connection (Auth, Settle & EPA) service package is an optional service to build and certify an acquirer connection to the Cloud service. The package includes business and technical review of the acquirer specifications, mapping to the Cloud solution, certification with the acquirer to support authorization, settlement and electronic payment advice (EPA) for card not present transactions. E-commerce, MOTO, Recurring MCC code and support for 3DSecure are included if available thru the requested acquirer. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 223 hours of remotely delivered design and implementation for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway New Electronic Payment Advise (EPA only) Remotely Delivered The IBM Payments Gateway New Electronic Payment Advise (EPA only) service is an optional service to build and certify an acquirer to the Cloud. The Electronic Payment Advise (EPA) is used to provide electronic payment data in the payment reconciliation process reporting. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. This service excludes any fees that the acquirer may charge to the Client for delivery, connection or transaction fees. The Client is responsible for the introduction of IBM to the acquirer and assisting with the relationship management of establishing the new connection. This service includes 223 hours of remotely delivered design and implementation for the defined acquirer. The Remote expires 180 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Payment Architecture Consulting Remotely Delivered The IBM Payments Gateway Payment Architecture Consulting services assists the Client with the establishment of an overview of all integration points and system interfaces for the payment solution. The service includes a review of the Client integration points, including payment channels, call center, credit management, fraud management, and financial systems. The approach includes a review and recommendation for the IBM APIs to use with the defined integration point. This includes 15 hours of remotely delivered services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been used IBM Payments Gateway Online Payment Solution Design Consulting Remotely Delivered IBM Payments Gateway Online Payment Solution Design Consulting assists Client in the integration of the IPG Hosted Payment Page API into the Client's existing web infrastructure. The service includes a review of the web interface, page sequencing, split payments, payment policies and configuration considerations. This service includes 24 hours of remote expertise. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been used IBM Payments Gateway Customer Wallet Solution Design Consulting Remotely Delivered IBM Payments Gateway Client Wallet Solution Design Consulting service assists the Client in documenting the payment checkout solution for their web sites, m-commerce sites and smart phone applications. The offering reviews the wallet instruments including cards, bank accounts, PayPal and i (12/2016) Page 4 of 10

5 Stored Value. The solution documents common use cases, such as one click payment in ecommerce and smartphone applications, wallet management in the my account settings, Auto Pay sign up and Automatic payments. The service includes 19 hours of remote services. The Remote expires 90 days the date IBM confirmsto the order for the Remote s with Client, regardless of whether all hours have been used IBM Payments Gateway Order Management Solution Design Consulting Remotely Delivered The IBM Payments Gateway Order Management Solution Design Consulting service assists the Client with documenting the order confirmation and order fulfilment processes. IBM will review with Client order confirmation practices, including offline payments, handling declined payments, and split payments. Specifically, the solution includes a review of: the order release process, including risk management and assumed approval processing; and the capture process, including one step payment, and two step payments, online transaction capture (OLTC), split shipments and amount deviations as well as the long fulfilment cycle and expired authorization processes. The service includes 40 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote with Client, regardless of whether all hours have been used IBM Payments Gateway Call Center Payments Solution Design Consulting Remotely Delivered The IBM Payments Gateway Call Center Payments Solution Design Consulting service helps the Client design their payment solution for a Client call center environment. The service includes a review of: manual payment processes using the IBM Payments Gateway Virtual Terminal and Integration of the IBM Hosted Payment Page into a call center environment; and the payment methods available in the Client call center, including the use of Virtual Terminal to search, retrieve and continuation of the Virtual Terminal. The service includes 15 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been used IBM Payments Gateway Payment Reconciliation Solution Design Consulting Remotely Delivered The IBM Payments Gateway Payment Reconciliation Consulting services is an optional service that provides a reconciliation expert to help the Client design a straight-through-processing of payments using IBM's Payment Reconciliation service. The consulting service includes a review of automated matching of offline payments, straight through processing data feeds, and settlement operational reporting. This service includes 40 hours of remote expertise to facilitate, design and document the use of the Payment Reconciliation. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been used IBM Payments Gateway Stored Value Solution Design Consulting Remotely Delivered The IBM Payments Gateway Stored Value Solution Design Consulting service helps Client design and implement prepaid or post-paid stored value solutions, using IBM's Stored Value Host. The solution includes a review of: the configuration of schema and Stored Value Host accounts, user accounts, merchant accounts, authentication, stored payments, vouchers and risk management; and the blocking, unblocking of user and merchant accounts, reporting and data feeds. The service includes 34 hours of remote services. The Remote expires 90 days from the date IBM confirms the order for the Remote s with Client, regardless of whether all hours have been used. i (12/2016) Page 5 of 10

6 2. Security Description 2.1 Security Policies IBM has an information security team and maintains privacy and security policies that are communicated to IBM employees. IBM requires annual privacy and security training for personnel. IBM security policies are revalidated annually based on industry practices and IBM business requirements. Security incidents are handled based on comprehensive incident response procedures. IBM maintains physical security standards designed to limit access to authorized personnel at IBM data centers, including limited and monitored access points. Visitors register upon entering and are escorted while on the premises. 2.2 Access Control IBM authorized staff use two factor authentication to an intermediate "gateway" management host. IP Blocking may be utilized to prevent access by known compromised Internet sites and users in U.S. embargoed countries. Access to Client data and transfer of data in or out of the hosting environment is logged. WIFI use is prohibited within the IBM data centers that support this Cloud. The Cloud requires encryption of content during data transmission between the IBM network and Client's network access point. The specific encryption methods are specified by contractual agreement with the Client, and the encryption requires installation of SSL certificates at both IBM and Client's sites. Only personal information that is required for the payment processing is collected. The Cloud does encrypt that content when at rest awaiting data transmission. 2.3 Integrity and Availability Modifications to operating systems, application software, and firewall rules are handled under IBM's change management process. Changes to firewall rules are reviewed by the IBM security staff before implementation. IBM monitors the data center 24x7. Internal and external vulnerability scanning is conducted regularly by authorized administrators and third party vendors to help detect and resolve potential system security exposures. Malware detection systems (antivirus, intrusion detection, vulnerability scanning, and intrusion prevention) are used in all IBM data centers. IBM's data center services support a variety of information delivery protocols for transmission of data over public networks. Examples include HTTPS/SFTP/FTPS/S/MIME and site-to-site VPN. Backup data intended for off-site storage is encrypted prior to transport. 2.4 Activity Logging IBM maintains logs of its activity for systems, applications, data repositories, middleware and network infrastructure devices that are capable of and configured for logging activity. To minimize the possibility of tampering and to enable central analysis, alerting and reporting, activity logging is done in real-time at central log repositories. Data is signed to prevent tampering. Logs are analyzed in real-time and via periodic analysis reports to detect anomalous behavior. Operations staff is alerted to anomalies and contacts a 24x7 on-call security specialist when needed. 2.5 Compliance IBM performs industry standard ISAE3402 audits (or their equivalent) annually in production IBM Payments Gateway data centers for compliance with IBM information security policies. IBM's annual PCI DSS certification includes on site audits by external Qualified Security Assessor (Trustwave) in all IBM Payments Gateway data centers. The Attestation of Compliance (AoC) or Compliance Letter is available to Client and its auditors upon request. 2.6 Statement of Security Practices IT system security involves protecting systems and information through prevention, detection, and response to improper access from within and outside Client's enterprise. Improper access can result in information being altered, destroyed, or misappropriated or can result in misuse of your systems to attack others. Without a comprehensive approach to security, no IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products, or services to be most effective. IBM does not warrant that systems and products are immune from the malicious or illegal conduct of any party. i (12/2016) Page 6 of 10

7 2.7 Data Privacy IBM and Client are each responsible for complying with their respective obligations under the applicable data protection laws governing the personal data (as defined in the applicable data protection laws) that is stored or processed by IBM for Client under this Agreement ("Client Data"). By executing this Agreement, Client appoints IBM as a data Processor of Client Data. Client remains solely responsible for determining the purposes and means of IBM's processing of Client Data under this Agreement, including that such processing in accordance with Client's instructions will not place IBM in breach of the applicable data protection laws. IBM and Client each acknowledge that it is not investigating the steps the other is taking to comply with applicable data protection laws. Nothing in this Agreement prevents IBM or Client from taking the steps it deems necessary to comply with applicable data protection laws. If Client requests additional or different services to comply with the applicable data protection laws, such services shall be requested by using the Change Control Process described in Appendix C and using the Change Authorization for attached as Appendix E. Client acknowledges it is solely responsible for determining that the security measures specified in this Agreement constitute appropriate technical and organizational measures to protect Client Data as required by the applicable data protection laws. IBM is not required to perform or adhere to any security measures concerning Client Data other than those specified in this Agreement and as a Processor of Client Data; IBM will process Client Data as specified in this Agreement, and as IBM reasonably considers necessary or appropriate to perform the s. Client is solely responsible for determining that any transfer by IBM or Client of Client Data across a country border under this Agreement complies with the applicable data protection laws. 2.8 Personal Information and Regulated Content The Cloud will enable Client to input and manage content containing the following information which may be considered personal or sensitive information pursuant to under applicable privacy laws: Contact Information including name, address, phone number, address End customer payment credential information The communication, storage, and use of this data is governed and audited on a yearly basis to conform with Payment Card Industry Data Security Standards (PCI-DSS). 3. Level Agreement IBM provides the following availability service level agreement ("SLA") for the Cloud as specified in a PoE. The SLA is not a warranty. The SLA is available only to Client and applies only to use in production environments. 4. Availability Credits Client must log a Severity 1 support ticket with the IBM technical support help desk within 24 hours of first becoming aware of an event that has impacted the Cloud availability. Client must reasonably assist IBM with any problem diagnosis and resolution. A support ticket claim for failure to meet an SLA must be submitted within three business days after the end of the month. Compensation for a valid SLA claim will be a credit against a future invoice for the Cloud based on the duration of time during which production system processing for the Cloud is not available ("Downtime"). Downtime is measured from the time Client reports the event until the time the Cloud is restored and does not include time related to a scheduled or announced maintenance outage; causes beyond IBM's control; problems with Client or third party content or technology, designs or instructions; unsupported system configurations and platforms or other Client errors; or Client-caused security incident or Client security testing. IBM will apply the highest applicable compensation based on the cumulative availability of the Cloud during each month, as shown in the table below. The total compensation with respect to any month cannot exceed 10 percent of one twelfth (1/12th) of the annual charge for the Cloud. 4.1 Levels The Client may only make a claim against one of the following service level obligations in a month. * If the Cloud was acquired from an IBM Business Partner, the monthly subscription fee will be calculated on the then-current list price for the Cloud in effect for the contracted month which is the subject of a claim, discounted at a rate of 50%. IBM will make a rebate directly available to Client. i (12/2016) Page 7 of 10

8 4.1.1 Availability of the Cloud during a month IBM's Web s, Hosted Payment Page and Virtual Terminal interfaces will be available to the Client at least 99.95% of the time during a month. Availability during a contracted month Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) < 99.95% 2% < 99.80% 4% < 99.60% 6% < 99.30% 8% < 99.00% 10% Availability, expressed as a percentage, is calculated as: the total number of minutes in a month that IBM's Web s, Hosted Payment Page and Virtual Terminal are available and responding to Client's requests, divided by the total number of minutes in the month, multiplied by IBM Web Response Time during a month IBM offers two Response Time SLAs as follows: a. Median IBM Web Response Time The median IBM Response Time for CheckoutStartSession and CardAuthorize Web s will be less than 100 milliseconds. The IBM Response Time for a given Web is measured as the elapsed time from when the Web request is received at the entry point to IBM's system, until IBM's web service response is sent back to the Client, minus any time IBM's system has spent waiting for responses from downstream Third Party Processors. The service level target is calculated as the median IBM Response Time for CheckoutStartSession and CardAuthorize Web s respectively, across all such Web requests in a given month. Median Response Time (during a contracted month) Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) > 100 ms 2% > 500 ms 6% > 1 second 10% b. 99% IBM Web Response Time 99% of CheckoutStartSession and CardAuthorize Web s will have an IBM response time of less than 1 second. The IBM Response Time is calculated the same as defined above for the Median IBM Web Response Time. The service level target is calculated as the 99 percentile IBM Response Time for CheckoutStartSession and CardAuthorize Web s respectively, across all such Web requests in a given calendar month. 99% Response Time (during a contracted month) Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) > 1 second 2% > 5 seconds 6% > 10 seconds 10% i (12/2016) Page 8 of 10

9 4.2 Exclusions If Client reports Downtime related to: a. Web s, Hosted Payment Page and Virtual Terminal occurring simultaneously; or b. CheckoutStartSession and CardAuthorize Web s Response Time occurring simultaneously, IBM will treat the overlapping periods of Downtime as a single period. Client may not submit a claim for a Response Time SLA when an availability service level outage has been recorded for the same period of time. 5. Level Objectives The following service level objectives are a goal and do not constitute a warranty to Client. There is no refund, credit, or remedy available to Client in the event IBM does not meet the service level objectives. Batch Processing Turn- Around-Time Objective 90% of all transaction batches will be processed to completion in less than 60 minutes from receipt. Responsiveness 95% of sent to IBM's shared support mailbox will be answered within 24 business hours. 24x7 Help Desk Call Answer Response Tim4e Security Management Pre-Production system availability IBM's 24x7 Help Desk will answer phone calls in less than 60 seconds. IBM acknowledges responsibility for the security of the Client's cardholder data processed and will renew IBM's PCI-DSS Level 1 Certification at least once per annum. IBM will remediate High severity security vulnerabilities within 10 days. IBM will remediate Low severity security vulnerabilities within 30 days. Available for client testing 24x7 Pre-Production system is unattended outside normal Central European work hours. Pre-Production system incidents will, by default, be handled as severity Technical Support Technical support for the Cloud is provided via and telephone. Any enhancements, updates, and other materials provided by IBM as part of any such technical support are considered to be part of the Cloud and therefore governed by this Description. Technical support is included with the Cloud and is not available as a separate offering. More information about hours of availability, addresses, online problem reporting systems, and other technical support communication vehicles and processes are described in the IBM Software as a Support Handbook. Severity Severity Definition Response Time Objectives Response Time Coverage 1 Critical business impact/service down: Business critical functionality is inoperable or critical interface has failed. This usually applies to a production environment and indicates an inability to access services resulting in a critical impact on operations. This condition requires an immediate solution. 2 Significant business impact: A service feature or function is severely restricted in its use or Client is in jeopardy of missing business deadlines. Notification of Client within 15 minutes Notification of Client within 15 minutes 24x7 M-F local business hours i (12/2016) Page 9 of 10

10 Severity Severity Definition Response Time Objectives Response Time Coverage 3 Minor business impact: Indicates the service or functionality is usable and it is not presenting a critical impact on operations. 4 Minimal business impact: An inquiry or non-technical request. No notification required No notification required M-F local business hours M-F local business hours 7. Entitlement and Billing Information 7.1 Charge Metrics The Cloud is available under the charge metric specified in the Transaction Document: a. Instance is a unit of measure by which the Cloud can be obtained. An Instance is access to a specific configuration of the Cloud. Sufficient entitlements must be obtained for each Instance of the Cloud made available to access and use during the measurement period specified in Client's Proof of Entitlement (PoE) or Transaction Document. b. Thousand Events is a unit of measure by which the Cloud can be obtained. Thousand Events entitlements are based on the number of occurrences of a specific event related to the use of the Cloud, measured in packs of one thousand. Thousand Events entitlements are specific to the Cloud and the type of event may not be exchanged, interchanged, or aggregated with other Thousand Events entitlements of another Cloud or type of event. Sufficient entitlements must be obtained to cover every event that occurs during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. For this Cloud, an Event is defined as a Master Transaction, counted in packs of one thousand. A Master Transaction is a set of instructions initiated from an application external to the program (for example, business banking web channel or manual message entry channel) or triggered by an event in the program (for example, recurring payment or time of day to start bulk processing). The Master Transaction manages the related business activity and logical unit of work including all updates and events associated with the various processing steps and ending when the final instruction is sent to an external application or the processing lifecycle is complete. A Master Transaction will initiate underlying transactions during its processing lifecycle. 7.2 Partial Month Charges A partial month charge as specified in the Transaction Document may be assessed on a pro-rated basis. 7.3 Overage Charges If actual usage of the Cloud during the measurement period exceeds the entitlement specified in the PoE, Client will be charged for the overage as specified in the Transaction Document. 8. Term and Renewal Options The term of the Cloud begins on the date IBM notifies Client of their access to the Cloud, as documented in the PoE. The PoE will specify whether the Cloud renews automatically, proceeds on a continuous use basis, or terminates at the end of the term. For automatic renewal, unless Client provides written notice not to renew at least 90 days prior to the term expiration date, the Cloud will automatically renew for the term specified in the PoE. For continuous use, the Cloud will continue to be available on a month to month basis until Client provides 90 days written notice of termination. The Cloud will remain available to the end of the calendar month after such 90 day period. 9. Additional Terms 9.1 General Client agrees IBM may publicly refer to Client as a subscriber to the Cloud offerings in a publicity or marketing communication. i (12/2016) Page 10 of 10