This Service Level Agreement for the Confirmation.com Service  (this “SLA”) is a part of the Confirmation.com Service Agreement (the “Agreement”). Provider may update this SLA from time to time. Capitalized terms used but not defined in this SLA will have the meaning assigned to them in the Agreement. This SLA applies to the Confirmation.com Service listed herein (the “Service”), but does not apply to separately branded services made available with or connected to the Service or to any on-premise software, including but not limited to any API that is part of the Service.

1.0 Overview

1.1 Service Level Agreement (SLA)

This SLA defines the service levels for:

1. Hours of Operation and Service Maintenance.
2. Service Availability.
3. Problem Management.
4. Change Management.

1.2 General Terms and Definitions

Business Impact: The effect of a Problem on Bank systems, products, services or operations from Line of Business perspective, including business, financial, legal, or public relations factors.

Force Majeure Event: Such event may include action or inaction of governmental, civil or military authority; fire; strike; lockout or other labor dispute (but not including delays caused by subcontractors or providers); flood; war; riot; theft; earthquake and other natural disasters.

Help Desk: Providers place to call to report Problems or ask for assistance. (Note: Include phone number for Help Desk.)

Line of Business: Organization inside or outside Bank that services Bank customers and clients. Notification: The process of Providers informing Bank that a Problem has occurred or of Bank’s informing Provider that a Problem has occurred. Bank and Provider will agree on mutually acceptable methods for sending notifications and for documenting notifications.

Outage: A period commencing at the earlier of the time when (1) Bank notifies Provider, or (2) Provider otherwise becomes aware, that the conditions for a Severity 1 or Severity 2 Problem have occurred and ending when Provider has notified Bank that Provider has restored the Service. Outages will not include any time that is due to:

1. Scheduled Downtime.
2. A failure of communications lines that is not due to Provider’s negligence or willful misconduct.
3. A failure or fault of the Bank’s or end user’s systems or of any system not under the reasonable control of Provider or its contractors.
4. A Force Majeure Event.
5. Bank’s or end users’ failing to operate the Services in accordance with the terms of this Agreement.

Problem: One or more events that cause a disruption of Service, or which, if not causing a service disruption nevertheless require further monitoring and/or repair.

Problem Identification: The earlier of the time when Provider first becomes aware of a Problem, or Bank notifies Provider of the Problem.

Problem Management: The process, by which Problems are identified, recorded, assigned, and managed through to resolution.

Problem Resolution: Changes to software or procedures that create a permanent fix for a Problem. Problem Resolution may occur at the time of Service Restoration or later, if a Workaround was installed to perform Service Restoration.

Response Time:  The time required for a computer system or an associate (employee) to act upon input and deliver results to the user or requester.

Service Restoration: Restoration of a service that was disrupted during a Problem. Service Restoration may be either Problem Resolution (permanent fix) or a Workaround reasonable in Bank’s judgment.

Service Delivery Path: The components required to deliver the Service, including, without limitation, the primary applications, the underlying operating systems, the network connectivity, any software and hardware required to support these components and any supporting processes. If a Service utilizes more than one platform (2-tier and 3-tier architecture), all the platforms and components of those tiers are included.

Severity: A classification of a Problem in terms of business impact.

Severity Level 1: A problem whose impact on business functions and practices is critical and service is unavailable, unreliable or severely degraded.

Severity Level 2: A problem whose impact on business functions and practices is moderate and had recurring problems that jeopardized delivery of service.

Severity Level 3: A problem whose impact on business functions and practices is minor.

Workaround: A temporary fix or bypass for a Problem or incident that restores disrupted service.

2.0 Hours of Operations and Service Maintenance

2.1 Core Business Hours for the Service

3.0 Service Availability

3.1 Availability Definitions Availability Metric Definition

Availability (“Availability”) means that a service is accessible to the end user at the time the end user is scheduled to use it, i.e., excluding Scheduled Downtime. The metric for Availability is Percentage Availability.

Availability Formula

Percentage Availability (“Percentage Availability”) is calculated by dividing the Actual Minutes of Availability by the total number of Scheduled Minutes for the month multiplied by 100. Actual Minutes of Availability equals Scheduled Minutes minus Unscheduled Downtime Minutes. All quantities in the formula are totals for a month.

A% = (Scheduled Minutes – Unscheduled Downtime Minutes) / Scheduled Minutes x 100

Definition of Availability Formula Variables

Scheduled Minutes: Total minutes in the month falling within the start and end times stated in the “Availability” panel of the table less Scheduled Downtime. If no start and end times are stated, Scheduled Minutes equals total minutes in the month less Scheduled Downtime minutes. Scheduled Downtime: Total minutes during the maintenance periods specified in the “Scheduled Maintenance” panel of the table and at such other times as the parties may agree in advance. The total number of minutes in such maintenance periods will be “Scheduled Downtime.”

Actual Minutes of Availability: Scheduled Minutes during the month less Unscheduled Downtime Minutes during the month.

Unscheduled Downtime: Total duration in minutes of all Outages and controlled shutdown time during the month. If Provider performs a controlled shutdown of the Service for emergency maintenance or the like, Provider will make reasonable efforts to give notice thereof before such event.

3.2 Availability Measurement Responsibility

Provider will calculate the monthly Percentage Availability and will provide supporting documentation showing Scheduled Minutes, Unscheduled Downtime and a log showing day and time for each Outage. Upon the Bank’s request, Provider will forward a copy of the availability report and log for each month to the Bank within five Business Days after the last day of each month. Bank may review the availability report and log and may question omission from the log of any Outage for which it has preexisting written documentation. The parties will cooperate in good faith to resolve any disagreement about the number and duration of Outages.

3.3 Availability Service Level Standards

The Percentage Availability service level standard will be 99.0%.

3.4 Failure to Achieve Availability Service Level Standard

Failure to Fulfill Availability Standard over One Month

If the monthly Percentage Availability falls below the standard set forth above, during any calendar month, Provider will deliver to Bank within 20 Business Days after the close of the month, a written plan of corrective action describing the steps that Provider will take to cause Percentage Availability to equal or exceed the standard during the current month and each month thereafter. Bank may comment on this plan, and Provider will consider in good faith implementing Bank’s suggestions. Provider will carry out the steps set forth in such plan, as modified in response to Bank’s suggestions. Provider will bear the expense of implementing such plan.

Failure to Fulfill Availability Standard over Several Months

If monthly Percentage Availability falls below the standard set forth above for any three months during a six-month period, Provider will meet with Bank’s representative at Bank’s request to determine a course of action. Bank may make commercially reasonable requests to Provider to add redundant facilities, eliminate single points of failure, replace components and otherwise to supply additional resources, at Provider’s sole expense, that are reasonably designed to improve availability, and Provider will comply with those requests. Bank’s making requests and Provider’s complying with them do not relieve Provider of its obligation to fulfill its obligations under this Agreement.

3.5 Termination Due to Force Majeure Event

If Provider is affected by a Force Majeure Event, Provider will take reasonable action to minimize the consequences of any such cause. Provider will give Bank prompt notice in writing of the facts which constitute such cause when the cause arises; and, when the cause ceases to exist, will give prompt notice thereof to the other party.

If Provider is unable to fulfill its obligations under this SLA and the Service is not available to Bank for a period of ten (10) consecutive days due to a Force Majeure Event, Bank will have the right to terminate this Agreement without any liability or further obligation to Provider as of the date of termination.

4.0 Problem Management

The Problem Management process involves Initial Notification about Problems, periodic Status Updates, Service Restoration and Problem Resolution.

4.1 Problem Management Definitions

Initial Notification Time:  The period elapsed from Problem Identification until Provider informs Bank by telephone about the Problem. Such notice is the “Initial Notification.”

Status Update: Information given orally or in other mutually agreeable form to Bank regarding Provider’s progress toward Service Restoration.

Status Update Time: The time interval within which Provider will provide a Status Update for an Outage.

Service Restoration Time: The period elapsed from Problem Identification until the time that Provider has diagnosed the Problem, provided Service Restoration and communicated to Bank that Service Restoration has occurred.

Problem Resolution Time: The period elapsed from Problem Identification until the time that Provider has installed the Problem Resolution.

4.2 Measurement Responsibility

Provider will keep a permanent record of Severity 1 Problem resolution activities for each Severity 1 Problem in a permanent record of resolution activity. Within 20 Business Days after the end of each month, Provider will prepare a Problem Summary report. This report will provide detail on individual Problems occurring, and on the steps Provider took to resolve them. Upon Bank’s request, Provider will deliver a report (a) on resolution of a specific Problem, (b) progress through a specific date or (c) other reasonable customized report.

4.3 Problem Management Standards

Each Problem will receive appropriate attention in accordance with the Severity of the Problem. When Bank encounters a Problem with use of the Services, Bank will contact Provider in accordance with the procedure described by Severity Level set forth below. Provider will make reasonable efforts to respond to Bank’s request for assistance in achieving Service Restoration within the times specified below for each Severity level. Provider’s response will include assigning fully qualified technicians to work with Bank to diagnose and cause Service Restoration. After the service restoration of Severity 1 problems, a root cause analysis will be performed by personnel from the Development, QA, and other departments as needed. Proceedings of the analysis will be documented. The root cause analysis will:

1. Identify and investigate any actions that may have caused the issue.
2. Identify current practices that may lead to future occurrences of the issue.
3. Recommend any applicable changes to policies and procedures designed to prevent similar issues.
4. Recommend any applicable operational and organizational changes to ensure best practices are being adhered to.
5. Submit findings to the Chief Information Officer for review.

Severity 1 Problems

A problem whose impact on business functions and practices is critical and service is unavailable, unreliable or severely degraded, and would violate the stated availability service level standard as defined in this policy.

1. Confirmation will provide status updates after initial notification once the problem has been diagnosed and a resolution has been determined, further updates will be provided as a course of action is determined and a solution is implemented.
2. Every effort will be made to restore service to normal operating status as quickly as possible. Solutions may involve temporary workarounds to restore service until a more permanent solution can be applied. Resources will be assigned to work on the problem full time, until a solution has been provided.

Severity 2 Problems

A problem whose impact on business functions and practices is moderate, and had recurring problems that jeopardized delivery of service, and would violate the stated availability service level standard as defined in this policy.

1. Confirmation will provide status updates after initial notification once the problem has been diagnosed and a resolution has been determined, further updates will be provided as a course of action is determined and a solution is implemented.
2. Every effort will be made to stabilize the service and ensure business functions can continue. A permanent solution to resolve the problem will be delivered within 30 days.

Severity 3 Problems

A problem whose impact on business functions and practices is minor.

1.    The impact of the problem will be determined, and a solution will be provided in a timeframe commensurate with the scope of the problem and other business activities currently in progress. Problems will be resolved no later than by the next release of the Confirmation platform.

4.4 Problem Resolution Process – Normal Hours

US – Normal Business Hours

Site Contact:	Customer Service – US Mon – Fri 8:00 AM – 5:00 PM
Contact Numbers:	Work: 866-325-7201
Email:	customer.support@confirmation.com

London

Site Contact:	Customer Service – UK Mon-Fri 9:00 AM – 5:00 PM UKT
Contact Numbers:	Work: +44 20 3770 5450
Email:	customer.support@confirmation.com

Melbourne

Site Contact:	Customer Service – Australia 9.00 AM – 5.30 PM AEST (GMT +10)
Contact Numbers:	Work: +61 3 7000 6080
Email:	customer.support@confirmation.com

Nouvelle-Zélande

Site Contact:	Customer Service 11:00 AM – 7:30 PM NZDT (GMT +12)
Contact Numbers:	Work: +64 9 913 4900
Email:	customer.support@confirmation.com

Hong Kong

Site Contact:	Customer Service 8:00 AM – 5:00 PM HKT (GMT +8)
Contact Numbers:	Work: +852 3462 7878
Email:	customer.support@confirmation.com

Singapour

Site Contact:	Customer Service 8:00 AM – 5:00 PM SGT (GMT +8)
Contact Numbers:	Work: +65 6407 5116
Email:	customer.support@confirmation.com

Mumbai

Site Contact:	Customer Service 9.30 AM – 6:00 PM IST (GMT +5.5)
Contact Numbers:	Work: 0008000503184 (toll free)
Email:	customer.support@confirmation.com

Johannesbourg

Site Contact:	Customer Service 8:30 AM – 5:00 PM WST (GMT +1)
Contact Numbers:	Work: +27 10 494 1001
Email:	support@confirmationafrica.com

São Paulo

Site Contact:	Customer Service 9:00 AM – 5.30 PM BRST (GMT -2)
Contact Numbers:	Work: +55 11 93384-2811
Email:	customer.support@confirmation.com

Tokyo

Site Contact:	Customer Service 9:00 AM – 6:00 PM JST (GMT +9)
Contact Numbers:	Work: +81 3 4233 9195
Email:	customer.support@confirmation.com

Note: Auto-process file issues are dealt with during normal US business hours

4.5 Failure to Fulfill Problem Management Standards

Failure to Fulfill Standards Over One Month

If Provider fails to fulfill any of the following thresholds for the Problem Management standards for Outages specified in paragraphs set forth above, Provider will deliver to Bank within 20 Business Days after month-end a written plan of corrective action describing the steps that Provider will achieve the standards for the current month and each month thereafter. Bank may comment on this plan, and Provider will consider in good faith implementing Bank’s suggestions. Provider will implement the steps set forth in such plan, as modified in response to Bank’s suggestions. Provider will bear the expense of implementing such plan. These thresholds are:

1. Three or more Initial Notifications for Outages exceed the Initial Notification Time.
2. Three or more Outages have Status Updates that exceed the Status Update Time.
3. Three or more Service Restorations for Outages occur after the applicable Service Restoration Time.
4. Three or more Problem Resolutions for Outages occur after the applicable Problem Resolution Time.

Failure to Fulfill Standards over Several Months

If Provider’s performance exceeds any of the following thresholds for the Problem Management standards for Outages as set forth above during any three-month period, Provider will meet with Bank’s representative at Bank’s request to determine a course of action. Bank may make commercially reasonable requests to Provider to add resources, change procedures, or use different Problem management systems that are reasonably designed to improve Problem management performance and Provider will comply with such requests at its sole expense. Bank’s making suggestions and Provider’s complying with them does not relieve Provider of its obligation to fulfill its obligations under this SLA. The thresholds are:

1. Five or more Initial Notifications for Outages exceed the Initial Notification Time.
2. Five or more Outages have Status Updates that exceed the Status Update Time.
3. Eight or more Service Restorations for Outages occur after the applicable Service Restoration Time.
4. Eight or more Problem Resolutions for Outages occur after the applicable Problem Resolution Time.

5.0 Change Management Standards

The Service Level Standards for Change Management will foster problem-free changes to systems and platforms covered by the Agreement. The intent of these standards is to minimize the disruption that could be caused by the changes.

5.1 Change Management Definitions

Non-Intrusive Change – A change to the system or platform that does not require any downtime or that does not cause any changes to the application functions, operations or processes.

Intrusive Change – A change to the system or platform that requires downtime or that requires changes in other systems that interface with the system or component undergoing change.

Functionality Change – A change to the system, application or process that requires communications and training for associates or customers because they will need to learn how to handle the change in the application’s functions, access rules, monitoring connections, etc.

Planned Change – Any change other than an Emergency Change that the Provider has planned for in advance.

Advance Notification Timeframes – The number of business days from the point the Provider provides Bank with the Required Change Management Documentation for Planned Changes to the point that the Provider makes the change.

Scheduled Maintenance Timeframes – Scheduled downtime periods specified in this agreement during which the Provider will perform maintenance and changes to the systems.

Emergency Change – A change that must be done as soon as possible to achieve Service Restoration that will correct a Problem.

Excluded Changes – Content changes or file updates that are part of an approved production process–for example, periodic updates of market news, feeds of changing commodity prices, account transaction updates, etc.

Necessary Testing Support – Assignment of technically competent people, sample data, and testing time to support changes initiated by Bank or by the Provider. The Necessary Testing Support will be outlined in formal written requests submitted by Bank to the Provider by the specified deadlines.

5.2 Measurement Responsibility

The Provider will track the number of times the Provider failed to:

1. Provide Advance Notification of Planned Changes within the specified timeframes.
2. Provide the required Change Management documentation.
3. Perform the changes during the Scheduled Maintenance Period for the Service.
4. Provide the necessary testing support Bank formally requested for changes initiated by Bank or the Provider.
5. Obtain the necessary Bank signoffs for Changes.

Within ten (10) business days after the end of each month, the Provider will compile an exceptions report listing each occurrence of the Provider’s failure to meet the specified Change Management Service Level Standards. Bank will review this exceptions report and will comment on any omissions for which it has preexisting written documentation. The parties will cooperate in good faith to resolve any disagreement about the number of Change Management exceptions.

5.3 Change Management Service Level Standards

The Provider will provide Advance Notification of the following changes, if they do not occur during the Scheduled Maintenance Period listed above:

1. No notification is provided for planned Non-Intrusive Changes.
2. One (1) business days for planned Intrusive Changes.
3. Three (3) business days for planned Functionality Changes.

While these are the minimum Service Level Standards required by this SLA, the Provider is encouraged to provide Advance Notification as soon as the Provider starts planning the change.

The Provider will perform the changes to the system and platform during the Scheduled Maintenance Period for the Service.

5.4 Failure to Achieve Change Management Service Level Standards

Failure to Achieve Standards over One Month

If the Provider fails to meet the specified Change Management Service Level Standards specified for three (3) or more occurrences in a calendar month, the Provider will deliver to Bank within 20 business days after the close of the month a written plan of corrective action describing the steps the Provider will take to eliminate future exceptions to the Change Management standards. Bank may comment on this plan, and the Provider will consider in good faith implementing Bank’s suggestions. Provider will carry out the steps set forth in such plan, as modified in response to Bank’s suggestions. Provider will bear the expense of implementing such plan.

Failure to Achieve Standards over Several Months

If the Provider fails to meet the specified Change Management Service Level Standards for three (3) or more occurrences per calendar month for any three months in a six-month period, the Provider will meet with Bank’s representative at Bank’s request to determine a course of action. Bank may make commercially reasonable requests to Provider to change its processes, at Provider’s sole expense, that are reasonably designed to improve compliance with the Change Management standards, and the Provider will comply with those requests.