8-K

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 8-K

CURRENT REPORT

PURSUANT TO SECTION 13 OR 15(d)

OF THE SECURITIES EXCHANGE ACT OF 1934

Date of report (Date of earliest event reported): July 1, 2022

 EVERTEC, Inc.

(EXACT NAME OF REGISTRANT AS SPECIFIED IN ITS CHARTER)

Puerto Rico		66-0783622
(State or other jurisdiction of incorporation or organization)		(I.R.S. employer identification number)
Cupey Center Building,	Road 176, Kilometer 1.3,
San Juan,	Puerto Rico	00926
(Address of principal executive offices)		(Zip Code)

(787) 759-9999

(Registrant’s telephone number, including area code)

Not applicable

(Former name, former address and former fiscal year, if changed since last report)

COMMISSION FILE NUMBER 001-35872

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

☐ Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

☐ Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)

☐ Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))

☐ Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Securities registered pursuant to Section 12(b) of the Act:

Title of Class	Trading Symbol(s)	Name of each exchange on which registered
Common Stock, $0.01 par value per share	EVTC	New York Stock Exchange

Indicate by check mark whether the registrant is an emerging growth company as defined in as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item 1.01 Entry into a Definitive Material Agreement.

On July 1, 2022, Evertec, Inc (“Evertec”) and its main operating subsidiary, Evertec Group, LLC (“Evertec Group”) completed the previously announced sale to Banco Popular de Puerto Rico and its parent, Popular, Inc. (“Popular”) of certain technology services assets that are used exclusively to service Popular and its affiliates (the “Popular Assets” and such transaction, the “Asset Sale”). Contemporaneously with the Asset Sale, the parties modified and extended the main commercial agreements between the parties which had initial terms ending in 2025, including a 10-year extension of the Merchant Acquiring Independent Sales Organization Agreement (as amended, the “A&R ISO Agreement”), a 5-year extension of the ATH Network Participation Agreement and a 3-year extension of the Master Services Agreement (as amended, the “A&R MSA”).

Pursuant to General Instruction B. 3 of Form 8-K, descriptions of the A&R MSA and the A&R ISO Agreement contained in Item 1.01 of the Company’s Current Report on Form 8-K filed with the Securities and Exchange Commission on February 24, 2022 are incorporated by reference herein. Such descriptions do not purport to be complete and are qualified in their entirety by reference to the full text of such agreements, copies of which are attached as Exhibits 10.1 and 10.2, respectively, to this Current Report on Form 8-K.

Additionally, on July 1, 2022, Evertec Group completed the previously announced purchase of 100% of the share capital of BBR SpA, a Santiago, Chile based payment and technology solutions company with an office in Perú. The aggregate purchase price for the shares is CLP 48,600 million, approximately USD$53 million.

7.01. Regulation FD Disclosure.

On July 1, 2022, Evertec issued a press release announcing the closing of the transactions described above in Item 1.01 of this Current Report on Form 8-K, a copy of which is attached hereto as Exhibit 99.1 and incorporated herein by reference.

The information contained in this Item 7.01 of Current Report on Form 8-K (including Exhibit 99.1) shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liabilities of that section, nor shall it be deemed incorporated by reference in any filing under the Securities Act of 1933, as amended, except as expressly set forth by specific reference in such a filing.

Item 9.01 Financial Statements and Exhibits.

(d)          Exhibits.

Number	Exhibit
10.1	Second Amended and Restated Master Service Agreement, dated as of July 1, 2022, among Popular, Inc., Banco Popular de Puerto Rico and Evertec Group, LLC and its subsidiaries.
10.2	Second Amended and Restated Independent Sales Organization Sponsorship and Services Agreement, dated as of July 1, 2022, between Evertec Group, LLC and Banco Popular de Puerto Rico.
99.1	Press Release re: Evertec closes Popular Transaction and BBR acquisition dated July 1, 2022
104	Cover Page Interactive Data File (embedded within the Inline XBRL document)

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

	EVERTEC, Inc.
	(Registrant)
Date: July 1, 2022	By:	/s/ Joaquin A. Castrillo-Salgado
		Name: Joaquin A. Castrillo-Salgado
		Title: Chief Financial Officer

EX-10.1

Exhibit 10.1

EXECUTION VERSION

SECOND AMENDED AND RESTATED

MASTER SERVICE AGREEMENT

AMONG

POPULAR, INC.,

BANCO POPULAR DE PUERTO RICO,

AND

EVERTEC GROUP, LLC AND ITS SUBSIDIARIES

DATED AS OF JULY 1, 2022

TABLE OF CONTENTS

 

		Page
ARTICLE ONE – GENERAL PROVISIONS
1.1	Definitions	2
1.2	Survival	16
1.3	Relationship between the Parties	16
1.4	Non-Exclusive	16
1.5	Assignment	16
1.6	Binding Effect	18
1.7	No Third Party Beneficiaries	18
1.8	Entire Agreement	18
1.9	Interpretation	18
1.10	Severability	19
1.11	Waiver	19
1.12	Governing Law	19
1.13	Trial by Jury	19
1.14	Dispute Resolution; Arbitration	20
1.15	Cumulative Remedies	21
1.16	Subcontracting the Services	21
1.17	Non-solicitation	22
1.18	Prohibition on Publicity	23
1.19	Business Days and Legal Holidays	23
1.20	Notices	24
1.21	Incorporation	24
1.22	Headings	24
1.23	Language	25
1.24	Counterparts	25
1.25	Representations and Warranties	25
1.26	Specific Performance	25
1.27	Limitation of Actions	25
1.28	Release of Existing Claims	26
1.29	Additional Assurances	26
1.30	No BPPR Guarantee	26
1.31	EVERTEC Change of Control	27
ARTICLE TWO – THE SERVICES
2.1	Services	27
2.2	Annual Minimums	29
2.3	Service Personnel	32
2.4	Service Level Agreement	32
2.5	Reports and Errors	33
2.6	Specifications for Services	33
2.7	Modifications to Services	35

2.8	Mandatory Enhancements	36
2.9	Non-Circumvention Covenants	37
2.10	Non-Compete Covenants	38
2.11	Equipment and Other Resources	39
2.12	Import/Export Control	40
2.13	Contingency Planning	41
2.14	Procedures Manual.	42
ARTICLE THREE – PAYMENT FOR SERVICES
3.1	Fees	43
3.2	Terms of Payment	44
3.3	Services Rendered during Legal Holidays	44
3.4	Additional Services	44
3.5	Out-of-pocket and Third Party Expenses	45
3.6	Taxes	45
3.7	Disputed Charges; Requests for Information	45
3.8	Supporting Documentation	46
3.9	No Right to Set-Off	46
3.10	Core API Layer SOW	46
3.11	Phase 2 SOW	48
ARTICLE FOUR – DISCLAIMER OF WARRANTIES & LIMITED LIABILITY
4.1	DISCLAIMER OF WARRANTIES	49
4.2	Reliance on COMPANY Provided Data	49
4.3	Force Majeure	50
4.4	Systems and/or Services Not Provided by EVERTEC	50
4.5	LIMITATION OF LIABILITY	51
ARTICLE FIVE – CONFIDENTIALITY, PRIVACY & DATA PROTECTION
5.1	Confidential Information	53
5.2	Protection of Confidential Information	54
5.3	Security of Personal Data	55
5.4	Required Disclosures	60
5.5	Remedies	60
5.6	Term of Obligation	60
5.7	Destruction	61
ARTICLE SIX – SECURITY, BPPR DATA & RECORDS
6.1	Authorized Persons	61
6.2	Security Measures	61
6.3	Ownership of BPPR Data	64
6.4	Records Retention.	64
6.5	Data Backup	65

-iii-

ARTICLE SEVEN – INTELLECTUAL PROPERTY
7.1	Title	65
7.2	General	66
7.3	Developments	66
7.4	Intellectual Property Infringement	67
ARTICLE EIGHT – REGULATORY COMPLIANCE, AUDIT & SERVICE REVIEWS
8.1	Compliance	68
8.2	Legal Requirements	69
8.3	BSA/AML/OFAC	70
8.4	Audit	70
8.5	IT Infrastructure Network Diagram	71
8.6	Data Flow Diagram	72
8.7	Service Center Reviews.	72
ARTICLE NINE – TERM & TERMINATION
9.1	Term	73
9.2	Termination for Cause	74
9.3	Termination without Cause	75
9.4	Effect upon Termination	76
9.5	Transition Assistance	76
ARTICLE TEN – INSURANCE AND INDEMNIFICATION
10.1	Insurance	79
10.2	Indemnity	82
10.3	Indemnification Procedures	83
ARTICLE ELEVEN – SERVICES FOR CLIENTS
11.1	Scope of Services	84
11.2	Special Representations Regarding EVERTEC’s Performance of Services under Service Agreements with Governmental Agencies	85
11.3	Client Agreements	85

-iv-

EXHIBITS

Exhibit A – Intentionally Omitted

Exhibit B – Services and Fees

Exhibit C – Service Level Agreement – General Terms and Conditions

Exhibit D – Strategic Clients

Exhibit E – Intentionally Omitted

Exhibit F – Outsourcing Policies and Procedures

Exhibit G – Data Protection and Privacy – Minimum Data Safeguards for Popular Infrastructure

Exhibit H – Shortfall Payments and Bi-Annual True-Up Calculation

-v-

This Second Amended and Restated Master Service Agreement (the “Master Agreement”) is made as of July 1, 2022 (the “Effective Date”), amongPopular, Inc. (“Popular” or the “COMPANY”), a corporation organized under the laws of the Commonwealth of Puerto Rico, Banco Popular de Puerto Rico (“BPPR” and, together with Popular, the“Popular Parties”), a bank organized under the laws of the Commonwealth of Puerto Rico, and Evertec Group, LLC, a limited liability company organized under the laws of the Commonwealth of Puerto Rico, and its Subsidiaries (hereinafter referred to as “EVERTEC”).

WITNESSETH

WHEREAS, COMPANY, acting through its Subsidiaries, is a financial services provider based in Puerto Rico with operations in Puerto Rico, the United States and the Caribbean;

WHEREAS, EVERTEC is in the business of, among other things, providing data processing, application processing, check imaging, transmission, telecommunications, credit and debit card transaction processing, and related operational, technical, and consulting services, and such other services as EVERTEC may engage in from time to time;

WHEREAS, Popular and EVERTEC previously entered into a Master Service Agreement on April 1, 2010 (the “April 2010 MSA”) and an Amended and Restated Master Service Agreement on September 30, 2010 (the “September 2010 MSA”);

WHEREAS, the Popular Parties and EVERTEC have entered into that certain Asset Purchase Agreement, dated as of February 24, 2022 (the “Asset Purchase Agreement”), pursuant to which BPPR is, contemporaneously with entering into this Master Agreement, acquiring a portion of the business of Evertec, Inc., a corporation organized under the laws of the Commonwealth of Puerto Rico and the ultimate parent entity of EVERTEC (“EVERTEC Parent”);

WHEREAS, the applicable Popular Parties and EVERTEC are simultaneously on the date hereof amending and restating the Amended and Restated ATH Network Participation Agreement, dated as of September 30, 2010 (as amended and restated as of the date hereof, the “ATH Network Agreement”), the Amended and Restated Independent Sales Organization Sponsorship and Services Agreement, dated as of September 30, 2010 (as amended and restated as of the date hereof, the “ISO Agreement”), the Technology Agreement dated as of September 30, 2010 (as amended and restated as of the date hereof, the “Technology Agreement”), and certain other documents; and

WHEREAS, the Popular Parties and EVERTEC desire to amend and restate the September 2010 MSA in order to, among other things and as further described in the terms of this Master Agreement, provide for certain changes to services provided under and revisions to the terms of the September 2010 MSA.

NOW THEREFORE, in consideration of the payments to be made and services to be performed hereunder, upon the terms and subject to the conditions set forth in this Master Agreement and intending to be legally bound, the parties hereto agree to the following terms and conditions:

ARTICLE ONE– GENERAL PROVISIONS

1.1            Definitions. Capitalized terms not otherwise defined herein will have the meanings set forth in this Section 1.1:

(1) “Affected Persons” has the meaning set forth in Section 5.3(e)(ii)(1).

(2) “Affiliate” means, with respect to any Person, any other Person, directly or indirectly, through one or more intermediaries, Controlling, Controlled by, or under common Control with, such Person. Notwithstanding the foregoing, with respect to COMPANY (to the extent that at the time of determination it is engaged in a private equity or similar business), the term “Affiliate” shall not include portfolio companies of COMPANY or its Controlled Affiliates.

(3) “Annual Minimum” has the meaning set forth in Section 2.2.

(4) “April 2010 MSA” has the meaning set forth in the Recitals.

(5) “Asset Acquirer” has the meaning set forth in Section 1.5(c).

(6) “Asset Purchase Agreement” has the meaning set forth in the Recitals.

(7) “Assignee Sub” has the meaning set forth in Section 1.5(b).

(8) “ATH Network Agreement” has the meaning set forth in the Recitals.

(9) “Audit” has the meaning set forth in Section 8.4(b).

(10) “Audit Report” has the meaning set forth in Section 8.4(c).

(11) “Authorized Locations” means the Data Centers and other locations owned or leased by EVERTEC, or COMPANY, BPPR, or one of their respective Affiliates, from time to time, for providing the Services and/or maintaining, processing, or storing BPPR Data under this Master Agreement.

(12) “Authorized Persons” has the meaning set forth in Section 6.1.

(13) “Base Date” has the meaning set forth in Section 9.3(d)(i).

(14) “beneficially owned”, “beneficial ownership” and similar phrases have the same meanings as such terms have under Rule 13d-3 (or any successor rule then in effect) under the Exchange Act, except that in calculating the beneficial ownership of any Person, such Person shall be deemed to have beneficial ownership of all securities that such Person has the right to acquire, whether such right is currently exercisable or is exercisable upon the occurrence of a subsequent event. Notwithstanding the foregoing, no Person shall be deemed to beneficially own any securities beneficially owned by another Person who is not an Affiliate of such Person.

-2-

(15) “Best Efforts” means the efforts that a prudent Person desirous of achieving a result would use in similar circumstances to ensure that such result is achieved in the time period expressly contemplated or, in the absence of an expressly contemplated time period, within a commercially reasonable time period.

(16) “Bi-Annual True-Up” has the meaning set forth in Section 2.2(c).

(17) “BPPR” has the meaning set forth in the Preamble.

(18) “BPPR Data” means data, records and information of COMPANY, BPPR, or one of their respective Subsidiaries that is maintained or processed by EVERTEC, including all Personal Data and all data and information derived from or works of any of the foregoing.

(19) “BPPR Infrastructure” means (i) the servers, storage, connectivity and other infrastructure used in hosting Services or applications owned or licensed from a third party by COMPANY or BPPR; and (ii) any additional IaaS or data center hosting or colocation Services provided for COMPANY or BPPR under this Master Agreement that are dedicated solely to COMPANY and/or BPPR.

(20) “BPPR Instructions” has the meaning set forth in Section 5.3(f).

(21) “BPPR Pass Through License” means a license to Intellectual Property provided by a Third Party that is assigned, novated or otherwise transferred to COMPANY or BPPR in connection with the Asset Purchase Agreement.

(22) “Business Continuity Plan” means the documented processes, preventive arrangements, and measures taken by a party to be able to respond, recover, resume or restore to a predefined level of operation following an Event in order to be able to continue offering its services or to prevent or mitigate the adverse effects of an Event. A Business Continuity Plan must include specific elements, such as incident response, disaster recovery and crisis management.

(23) “Business Day” will be each day from Monday through Friday, except for Legal Holidays.

(24) “Client” means any person or entity who establishes or maintains a contractual relationship with COMPANY, BPPR, or one of their respective Subsidiaries for obtaining any service or product offered by EVERTEC and/or COMPANY, BPPR, or one of their respective Subsidiaries.

(25) “Client Agreements” has the meaning set forth in Section 11.1(b).

(26) “COI” has the meaning set forth in Section 10.1(b).

(27) “COMPANY” has the meaning set forth in the Preamble.

(28) “COMPANY Resources” has the meaning set forth in Section 2.11(d).

-3-

(29) “Competitor” has the meaning set forth in Section 2.9(c).

(30) “Confidential Information” means any and all confidential and/or proprietary non-public information or material, whether in electronic or hard copy format, that is generated, collected or utilized in COMPANY’s, BPPR’s (or any of their respective Subsidiary’s) or EVERTEC’s business or operations. Confidential Information includes:

(i) information received from or concerning any Third Party (such as Clients, customers or suppliers);

(ii) product or services information concerning any of COMPANY’s, BPPR’s (or one of their respective Subsidiary’s) or EVERTEC’s research, or products or services being provided or developed, algorithms, supplier or vendor information, plans, ideas, drawings, specifications, documentation, quality guidelines, and analyses of strengths or weaknesses of each product or service;

(iii) trade secrets, source code and object code, other confidential Intellectual Property, technical and technological information, including designs, processes, methods, technical specifications, drawings, prototypes, troubleshooting guidelines, formulas, data, files, performance characteristics, computer software information and related documentation, databases, programs, systems engineering, research and development plans, disks and other storage media, drawings, notes, proposals, reports, photographs, hardware, card files and recordings;

(iv) financial information, such as overhead costs, profit margins, banking and financing data, budgeting data and reports, and pricing policies;

(v) organizational information, information concerning the utilization of facilities, merger, acquisition and expansion information, equipment utilization information;

(vi) marketing and sales information, such as marketing and sales techniques and data, identification and authorizing source, account status and ability to pay, product development and delivery schedules, transportation and logistical requirements, market research and forecasts, strategic planning, and marketing and advertising plans, techniques and budgets;

(vii) COMPANY’s, BPPR’s (or one of their respective Subsidiary’s) or EVERTEC’s overall strategies, the specific programs and strategies utilized by COMPANY, BPPR (one of their respective Subsidiaries) or EVERTEC; and the success or lack of success of those programs and strategies; and

(viii) Personal Data.

-4-

For the avoidance of doubt, Confidential Information includes, with respect to each party to this Master Agreement, such party’s Data Protection Program (including the Data Safeguards established pursuant to such Data Protection Program), its Business Continuity Plan, proprietary non-public materials with respect to EVERTEC’s physical security systems, access control systems, recovery equipment and techniques and all reports and information regarding the Services other than reports and information that are specifically designated as public. For the avoidance of doubt, COMPANY’s and BPPR’s Confidential Information includes all BPPR Data. EVERTEC’s Confidential Information shall not include any (1) Intellectual Property, books and records or other information or materials acquired pursuant to the Asset Purchase Agreement (except to the extent that any books and records are designated as confidential information of EVERTEC pursuant to the Asset Purchase Agreement), or (2) modifications, enhancements or derivative works based on such Intellectual Property in the immediately preceding clause (1).

(31) “Control,” and its correlative meanings, “Controlling,” and “Controlled,” means the possession, direct or indirect, or the power to direct or cause the direction of the management and policies of a Person, whether through the ownership of voting securities, by contract or otherwise.

(32) “Control Acquirer” has the meaning set forth in Section 1.31(a).

(33) “Core API Completion” has the meaning set forth in Section 3.10(a)(i).

(34) “Core API Deadline” means the deadline set forth in the Core API Layer SOW.

(35) “Core API Delay Window” has the meaning set forth in Section 9.3(d)(i).

(36) “Core API Layer SOW” means the Core API Layer SOW dated July 1, 2022^.

(37) “Covered Revenue” has the meaning set forth in Section 2.2(d).

-5-

(38) “CPI” means the All Items Consumer Price Index All Urban Consumers, U.S. City Average (1982-84 – 100), which is published by the U.S. Department of Labor, Bureau of Labor Statistics.

(39) “CVSS” has the meaning set forth in Exhibit G.

(40) “Data Cap” has the meaning set forth in Section 4.5(c).

(41) “Data Centers” means the facilities and data centers where EVERTEC performs Data Processing of BPPR Data, including alternate sites.

(42) “Data Processing” means any operation or set of operations which is performed on BPPR Data or on sets of BPPR Data, whether or not by automated means, physical or virtual, on premises or in the cloud, such as access, collection, recording, storing, organization, structuring, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(43) “Data Protection Measures” has the meaning set forth in Section 5.3(d)(ii).

(44) “Data Protection Program” means a written program that complies with applicable Legal Requirements, establishing the policies, procedures, controls and Data Safeguards reasonably designed and implemented in accordance with applicable Industry Standards to protect the confidentiality, privacy, security, integrity or availability of BPPR Data, the proper Data Processing of BPPR Data, and the security and reliability of the related infrastructure in order to prevent, detect and respond to any threats or hazards or intentional or accidental unauthorized access, use, disclosure, alteration, loss, destruction, or disposal.

(45) “Data Safeguards” means reasonable administrative, technical and physical data protection processes, procedures and controls designed and implemented in accordance with Industry Standards.

(46) “Data Subcontractors” has the meaning set forth in Section 1.16(a).

(47) “DFD” has the meaning set forth in Section 8.6.

(48) “Direction” has the meaning set forth in Section 5.7.

(49) “Disabling Device” means any program, mechanism, programming device, malware or other computer code: (i) designed to disrupt, disable, harm, or otherwise impede in any manner the operation of any software program or code, or any computer system or network (commonly referred to as “malware”, “spyware”, “viruses” or “worms”); (ii) that would disable or impair the operation thereof or of any software, computer system or network in any way based on the elapsing of a period of time or the advancement to a particular date or other numeral (referred to as “time bombs”, “time locks”, or “drop dead” devices); (iii) designed to or that could reasonably be used to permit any Person to gain unauthorized or unintended access any computer system or network (referred to as “trojans”, “traps”, “access codes” or “trap door” devices); or (iv) designed to or that could reasonably be used to permit any unauthorized Person to track, monitor or otherwise report the operation and use of any software program or any computer system or network by any Person.

-6-

(50) “Disaster Recovery Plan” means the processes, policies, and procedures related to preparing for recovery or continuation of technology infrastructure, systems, and applications, which are vital to an organization after a disaster or other disruption. Disaster recovery focuses on the information or technology systems that support business functions, as opposed to business continuity, which involves planning for keeping all aspects of a business functioning in the midst of disruptive events. A Disaster Recovery Plan is a subset of a Business Continuity Plan.

(51) “Disaster Recovery Services Addendum” means the Disaster Recovery Services Addendum referenced in Schedule 2 to Exhibit B, as amended.

(52) “Disaster Recovery Strategy” is a strategy for restoring IT infrastructure, data, and systems with a coordinated effort for the recovery of Data Centers, networks, servers, storage, service monitoring, user support, and related software during adverse events (e.g., natural disasters, infrastructure failures, technology failures, unavailability of staff, or cyber-attacks) in order to return such operations to a normalized state with minimum disruption. A Disaster Recovery Strategy is a subset of a Business Continuity Plan.

(53) “Disclosing Party” has the meaning set forth in Section 5.1(a).

(54) “Dispute” has the meaning set forth in Section 1.14.

(55) “Effective Date” has the meaning set forth in the Preamble.

(56) “Encumbrances” means any direct or indirect encumbrances, lien, pledge, security interest, claim, charges, option, right of first refusal or offer, mortgage, deed of trust, easement, or any other restriction or third party right, including restrictions on the right to vote equity interests.

(57) “Errors” has the meaning set forth in Section 2.5(b).

(58) “Event” means any event, occurrence or circumstance that has resulted in, or could reasonably result in any impairment or disruption of a Person’s normal business and operations or its ability to provide services.

(59) “EVERTEC” has the meaning set forth in the Preamble.

-7-

(60) “EVERTEC Change of Control” means, with respect to EVERTEC, any:

(i) merger, consolidation or other business combination of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries that results in the stockholders of EVERTEC (or such Subsidiary or Subsidiaries) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries or the surviving entity thereof, as applicable, immediately before the consummation of such transaction or a series of related transactions, holding, directly or indirectly, less than 50% of the voting power of EVERTEC (or such Subsidiary or Subsidiaries) or any such successor, other entity or surviving entity, as applicable, immediately following the consummation of such transaction or series of related transactions; provided that this clause (i) shall not be deemed applicable to any merger, consolidation or other business combination, if, as a result of any such merger, consolidation or other business combination, no Person or Group of Persons that had not had “control” of EVERTEC immediately prior to such transaction, as such term is defined under the Bank Holding Company Act of 1956, as amended, shall have obtained such “control”;

(ii) Transfer (other than in the form of a pledge, hypothecation or similar grant of a security interest only and which shall not involve the grant of a proxy or other right with respect to the voting of such equity), in one or a series of related transactions, of equity representing 50% or more of the voting power of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries to a Person or Group of Persons;

(iii) transaction in which a majority of the board of directors or equivalent governing body of EVERTEC (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) immediately following or as a proximate cause of such transaction is comprised of persons who were not members of the board of directors or equivalent governing body of EVERTEC (or such successor or other entity) immediately prior to such transaction; or

(iv) sale or other disposition in one or a series of related transactions of all or substantially all of the assets of EVERTEC and its Subsidiaries (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) to a Person who is not an Affiliate of EVERTEC at such time.

(61) “EVERTEC Equipment” has the meaning set forth in Section 2.11(a).

(62) “EVERTEC Parent” has the meaning set forth in the Recitals.

-8-

(63) “EVERTEC Pass Through License” means a license to Intellectual Property owned by a Third Party procured by EVERTEC at the written direction of, or with the written consent of, BPPR, COMPANY or any of their respective Affiliates and used in connection with the provision of the Services.

(64) “EVERTEC Security Requirements” means reasonable security policies and procedures provided in writing to COMPANY and BPPR with reasonable advance notice by EVERTEC; provided the EVERTEC Security Requirements will not include any of the following: (a) representations, warranties or disclaimers; (b) indemnities, cost reimbursements, suspension or termination rights, or other remedies for EVERTEC; (c) rights for EVERTEC to conduct audits or assessments of BPPR or COMPANY networks or Systems; or (d) obligations for BPPR or COMPANY to provide certifications or conduct audits or assessments.

(65) “Exchange Act” means the Securities Exchange Act of 1934.

(66) “Exclusive Mandatory Enhancement” has the meaning set forth in Section 2.8(b).

(67) “Extended Transition Period” has the meaning set forth in Section 9.5(e).

(68) “FFIEC” means the Federal Financial Institutions Examination Council.

(69) “Firm” has the meaning set forth in Section 8.7.

(70) “For Cause Audit” has the meaning set forth in Section 8.4(b).

(71) “Force Majeure Event” has the meaning set forth in Section 4.3(a).

(72) “General Liability Cap” has the meaning set forth in Section 4.5(c).

(73) “Governmental Authority” means the government or any agency or court thereof, of any nation or country (including the European Union, if applicable), state, commonwealth (including the Commonwealth of Puerto Rico), city, municipality or political subdivision thereof, any entity exercising executive, legislative, judicial, regulatory or administrative functions of or pertaining to any such government that have regulatory, supervisory, and/or examination authority with respect to COMPANY, BPPR, or one of their respective Subsidiaries and/or of EVERTEC with respect to the matters covered by the Services or their respective operations or financial condition, any quasi-governmental entity or arbitral body, any SRO and any applicable stock exchange.

(74) “Group of Persons” means a group of Persons that would constitute a “group” as determined pursuant to Section 13(d) of the Exchange Act and the rules and regulations promulgated thereunder.

-9-

(75) “Incident” means the actual or reasonably suspected occurrence of an intentional or accidental unauthorized event that could reasonably pose a threat to the confidentiality, privacy, security, integrity or availability of BPPR Data, including: (1) unauthorized access or disclosure of BPPR Data; (2) unauthorized access or intrusion to information Systems; (3) loss/theft of an electronic or storage device containing BPPR Data; (4) loss/theft of printed materials containing Personal Data; and (5) unauthorized Disabling Devices.  For the avoidance of doubt, an Incident will not be deemed to exist solely as a result of EVERTEC’s receipt of an automated system alert or a ping or scan of EVERTEC’s Systems, unless and until such time as EVERTEC reasonably believes that an Incident has occurred or has reasonable grounds to suspect that an Incident has occurred (provided, that EVERTEC has appropriate systems and procedures for the establishment and use of such automated systems).

(76) “Incident Response Program” means a written program that complies with applicable Legal Requirements establishing policies, procedures, activities and internal controls reasonably designed and implemented in accordance with applicable Industry Standards to prevent, detect, identify, mitigate, address and notify relevant Persons of Incidents.

(77) “Incremental BPPR Requirements” has the meaning set forth in Section 8.7(b).

(78) “Indebtedness” means, with respect to any Person, (a) all indebtedness of such Person, whether or not contingent, for borrowed money, and (b) all obligations of such Person evidenced by notes, bonds, debentures or other similar debt instruments.

(79) “Indemnified Party” has the meaning set forth in Section 10.1.

(80) “Indemnifying Party” has the meaning set forth in Section 10.1.

(81) “Industry Standards” means the procedural and technical rules and controls generally followed by financial and information technology and data processing providers when providing services to banks and their Affiliates, as they may be adopted from time to time, including as may be required under applicable Legal Requirements.

(82) “Infrastructure-as-a-Service” or “IaaS” means the capability provided to COMPANY or BPPR to provision processing, storage, networks, and other fundamental computing resources where COMPANY or BPPR is able to deploy and run arbitrary software, which can include operating systems and applications. COMPANY and BPPR do not manage or control the underlying cloud infrastructure but have control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

(83) “Initial Term” has the meaning set forth in Section 9.1.

-10-

(84) “Intellectual Property” means all world-wide know-how, ideas, concepts, techniques, designs, materials, formulae, computer programs and related documentation, writings, works of authorship, trade secrets, Confidential Information (as defined herein), proprietary information, research, developments, registered and unregistered copyrights, copyrightable materials, derivatives, trademarks, mask works, moral rights, design rights, industrial property rights, discoveries, inventions, rights in and to inventions, improvements, patent rights, patent applications, patents and any other intellectual property rights in any jurisdiction in the world including modifications and other applications using or based upon the resulting technology or required for the use of such technology.

(85) “Interchange Fee” means a fee paid by a merchant or acquirer for the purpose of compensating an issuer for its involvement in an electronic debit transaction.  It is paid via the network according to its compensation rules and subject to federal regulations when a debit account is involved.

(86) “IP Developments” has the meaning set forth in Section 7.3.

(87) “IP Indemnified Parties” has the meaning set forth in Section 7.4(a).

(88) “ISO” has the meaning set forth in Section 10.1(a)(i)(2).

(89) “ISO Agreement” has the meaning set forth in the Recitals.

(90) “Legal Holiday” means Saturday, Sunday or any federal and/or local legal holiday in the Commonwealth of Puerto Rico, except as otherwise provided in the Service Level Agreement, a Service Addendum, or as agreed to in writing between the parties.

(91) “Legal Requirements” means any applicable federal, state, Puerto Rico, local, municipal, foreign, international, multinational, or other administrative order, constitution, law, ordinance, principle of law, regulation, statute, rule, regulation, guidance or treaty, and any policy statement or interpretation that has the force of law, issued by a Governmental Authority, and any standards or guidance issued by the FFIEC (for clarity, with respect to EVERTEC, including the Bank Service Company Act and any other Legal Requirement to which EVERTEC is subject as a result of EVERTEC’s provision of services to COMPANY, BPPR or other financial institutions).

(92) “Loss(es)” means losses, liabilities, claims, damages, fines, expenses, penalties, interest expense, costs and fees and disbursements (including reasonable legal counsel and experts’ fees and disbursements), net of any amounts recovered with respect thereto under insurance policies covering any liability thereof if and to the extent applicable in each case, individually or collectively.

(93) “Mandatory Enhancements” has the meaning set forth in Section 2.8(a).

(94) “Master Agreement” has the meaning set forth in the Preamble.

(95) “Material Adverse Effect” has the meaning set forth in Section 9.2(b)(ii).

-11-

(96) “Material Breach” has the meaning set forth in Section 9.2(b)(i).

(97) “Monthly Benchmark” has the meaning set forth in Section 2.2(a).

(98) “Notice of Dispute” has the meaning set forth in Section 1.14.

(99) “Notice of Election” has the meaning set forth in Section 10.3(a).

(100) “Outsourcing Policy” has the meaning set forth in Section 1.16(a).

(101) “Penetration Tests” has the meaning set forth in Section 6.2(c)

(102) “Permitted Assignment” means a Permitted Subsidiary Assignment or a Permitted Third-Party Assignment.

(103) “Permitted Subsidiary Assignment” means an assignment by EVERTEC of any of its rights, duties or obligations under this Master Agreement to an Assignee Sub in compliance with the provisions of Section 1.5(b).

(104) “Permitted Third-Party Assignment” means an assignment by EVERTEC of all its rights, duties and obligations under this Master Agreement to an Asset Acquirer in compliance with the provisions of Section 1.5(c).

(105) “Person” means any individual, corporation, partnership, trust, incorporated or unincorporated association, joint venture, joint stock company, limited liability company, Governmental Authority or other entity of any kind, and will include any assignee and/or successor (by merger or otherwise) of such entity in connection therewith.

(106) “Personal Data” means any information in any medium or format that alone or in conjunction with other information, identifies, or can reasonably be used to identify or authenticate, directly or indirectly, a natural person or household related to BPPR’s past, present or prospective customers, guarantors, claimants, beneficiaries, employees or agents. Personal Data includes, individuals’ (1) names, date and place of birth, biometric data, home or business addresses, legal domicile, telephone numbers, email addresses, photographs, handwriting, human race, religion, family status, or criminal record; (2) health information such as genetics, medical history or treatment, or medical insurance data; (3) government-issued identification numbers (such as social security number, passport number, driver’s license number); (4) online information such as computer IP address, user names, passwords or PINs, answers to security questions, online identifier, geolocation data, internet or other website activity information; (5) financial information such as financial account numbers, income or other financial information, transaction records, credit report information, applications, loan or claim information; and (6) other information of or relating to an individual that is protected from unauthorized disclosure by Legal Requirements related to data protection and privacy.

-12-

(107) “Personnel” means, with respect to any Person, such Person’s Representatives and Subcontractors.

(108) “Phase 2 SOW” has the meaning set forth in the Asset Purchase Agreement.

(109) “Popular” has the meaning set forth in the Preamble.

(110) “Popular Parties” has the meaning set forth in the Preamble.

(111) “Popular Services and Products” has the meaning set forth in Section 11.1(b).

(112) “Procedures Manual” has the meaning set forth in Section 2.14(a).

(113) “Proprietary Application Information” has the meaning set forth in Section 2.14.

(114) “Reasonable and Customary Costs” has the meaning set forth in Section 4.5(f).

(115) “Receiving Party” has the meaning set forth in Section 5.1(a).

(116) “Recovery Point Objectives” or “RPOs” means the point in time to which data used by an activity is restored to enable the resumption of business functions upon occurrence of an Event. The RPO is expressed backwards in time from the point of disruption and can be specified in increments of time (e.g., minutes, hours, or days).

(117) “Recovery Time Objectives” or “RTOs” means the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources and business processes.

(118) “Region” means Puerto Rico, the U.S. Virgin Islands and the British Virgin Islands.

(119) “Release Event” has the meaning set forth in the Technology Agreement.

(120) “Released Parties” has the meaning set forth in Section 1.28.

(121) “Releasing Parties” has the meaning set forth in Section 1.28.

(122) “Reports” has the meaning set forth in Section 2.5(a).

(123) “Representative” means with respect to a particular Person, any director, officer, partner, member, employee, agent, consultant, advisor, or other representative of such Person, including legal counsel, accountants, and financial advisors.

(124) “Requested Enhancement” has the meaning set forth in Section 2.7(b).

(125) “Resolution Forum” has the meaning set forth in Section 1.14.

-13-

(126) “Role-Based Access Controls” means documented controls that require that each individual providing Services be assigned one or more roles, and that each role be granted and limited to specific System and data access and administration privileges permitted for individuals in those roles.

(127) “September 2010 MSA” has the meaning set forth in the Recitals.

(128) “Service Addendum” has the meaning set forth in Section 2.1(d).

(129) “Service Center Review” has the meaning set forth in Section 8.7(a).

(130) “Service Level Agreement” has the meaning set forth in Section 2.4(a).

(131) “Service Levels” has the meaning set forth in Section 2.4(a).

(132) “Services” means the services and functions set forth on Exhibit B.

(133) “Shortfall Payment” has the meaning set forth in Section 2.2(b).

(134) “SOC 1” has the meaning set forth in Section 8.7(a).

(135) “SOC 2” has the meaning set forth in Section 8.7(a).

(136) “Solvent” with regard to any Person, means that (i) the sum of the assets of such Person, both at a fair valuation and at a present fair salable value, exceeds its liabilities, including contingent, subordinated, unmatured, unliquidated, and disputed liabilities; (ii) such Person has sufficient capital with which to conduct its business; and (iii) such Person has not incurred debts beyond its ability to pay such debts as they mature. For purposes of this definition, “debt” means any liability on a claim, and “claim” means (x) a right to payment, whether or not such right is reduced to judgment, liquidated, unliquidated, fixed, contingent, matured, unmatured, disputed, undisputed, legal, equitable, secured or unsecured or (y) a right to an equitable remedy for breach of performance to the extent such breach gives rise to a payment, whether or not such right to an equitable remedy is reduced to judgment, fixed, contingent, matured, unmatured, disputed, undisputed, secured or unsecured. With respect to any such contingent liabilities, such liabilities shall be computed at the amount which, in light of all the facts and circumstances existing at the time, represents the amount which can reasonably be expected to become an actual or matured liability.

(137) “SOW” has the meaning set forth in Section 2.1(f).

(138) “Specifications” has the meaning set forth in Section 2.6(a).

(139) “SRO” means any domestic or foreign securities, broker-dealer, investment adviser or insurance industry self-regulatory organization.

(140) “SSAE 18” has the meaning set forth in Section 8.7(a).

-14-

(141) “Subcontractor” has the meaning set forth in Section 1.16(a).

(142) “Subsidiary” means, with respect to any Person, any corporation, association, partnership, limited liability company or other business entity of which 50% or more of the total voting power or equity interests (including partnership interests) entitled (without regard to the occurrence of any contingency) to vote in the election of directors, managers, representatives or trustees thereof is at the time owned or Controlled, directly or indirectly, by (a) such Person, (b) such Person and one or more Subsidiaries of such Person, or (c) one or more Subsidiaries of such Person.

(143) “Supplemental Mandatory Enhancements” has the meaning set forth in Section 2.8(d).

(144) “System” means any hardware, software, technology, applications, network infrastructure and/or combination thereof used to provide or use the Services under this Master Agreement.

(145) “Technology Agreement” has the meaning set forth in the Recitals.

(146) “Term” means the Initial Term and any subsequent renewal term that the parties may agree to in an amendment to this Master Agreement.

(147) “Termination Notice Date” has the meaning set forth in Section 9.5(a).

(148) “Third Party” means any Person that is not a party to this Master Agreement and is not an Affiliate of any party to this Master Agreement.

(149) “Transfer” means any direct or indirect sale, assignment, transfer, conveyance, gift, bequest by will or under intestacy laws, pledge, hypothecation or other Encumbrance, or any other disposition, of the stated security (or any interest therein or right thereto, including the issuance of any total return swap or other derivative whose economic value is primarily based upon the value of the stated security) or of all or part of the voting power (other than the granting of a revocable proxy) associated with the stated security (or any interest therein) whatsoever, or any other transfer of beneficial ownership of the stated security, with or without consideration and whether voluntarily or involuntarily (including by operation of law).

(150) “Transition Assistance” has the meaning set forth in Section 9.5(d).

(151) “Transition Period” has the meaning set forth in Section 9.5(c).

(152) “True-Up Calculation Period” has the meaning set forth in Section 2.2(c).

(153) “Virtusa Work Order” has the meaning set forth in Section 3.10(a)(iii).

-15-

1.2           Survival. Provisions relating to limitation of liability, indemnity, payment, transition services and other provisions that by their nature are intended to survive shall survive the termination or expiration of this Master Agreement.

1.3           Relationship between the Parties. The parties hereto are independent contractors, and this Master Agreement will not be construed in any way as establishing a partnership, joint venture, or express or implied agency relationship between or among them.

1.4         Non-Exclusive. Except as otherwise set forth herein or agreed to by the parties in writing, the parties hereto acknowledge that this Master Agreement is not exclusive and nothing contained herein will be construed to create an exclusive relationship between EVERTEC, on the one hand, and COMPANY, BPPR, or any of their respective Subsidiaries, on the other. As such, EVERTEC will not be limited in entering into similar agreements with other Persons to provide the same or similar services.

1.5           Assignment.

(a)          Other than a Permitted Assignment pursuant to Section 1.5(b) or (c), this Master Agreement may not be assigned by any party without the prior written consent of the other parties; provided, that any party may assign its rights, duties and obligations under this Master Agreement to its financing sources solely in connection with the granting of a security interest and the enforcement of all rights and remedies that the assigning party has against the other party under this Master Agreement, subject to the claims, defenses and rights, including rights of set off, that such other party may have against the assigning party.

(b)          Assignment to Subsidiaries. EVERTEC may assign any of its rights, duties or obligations to a direct or indirect wholly-owned Subsidiary of EVERTEC (an “Assignee Sub”) if (i) such Assignee Sub is identified by EVERTEC to COMPANY and BPPR at least 20 Business Days prior to the consummation of the proposed assignment; (ii) (A) such proposed assignment is legally required in order for EVERTEC to provide to COMPANY, BPPR or their respective Subsidiaries, in the country, state, territory or other jurisdiction in which the Assignee Sub is organized, the specific services to be performed pursuant to the assignment of this Master Agreement, and only (x) to the extent of such legal requirement and (y) if EVERTEC provides a written opinion of qualified counsel that opines that such legal requirement is applicable and is based upon reasonable assumptions with respect to such legal requirement or (B) COMPANY has provided its prior written consent, such consent not to be unreasonably delayed, withheld or conditioned; (iii) such Assignee Sub will be Solvent immediately after and giving effect to such proposed assignment and COMPANY is reasonably satisfied with the terms and conditions of the proposed assignment; (iv) COMPANY is a third-party beneficiary to the assignment agreement, which is in form and substance that is reasonably satisfactory to COMPANY, and which provides that the Assignee Sub’s rights under the assignment agreement will be terminated if the Assignee Sub ceases to be a wholly-owned Subsidiary, directly or indirectly, of EVERTEC and (v) EVERTEC remains fully liable with respect to the performance of all its obligations under this Master Agreement and EVERTEC guarantees the performance of all of the obligations of EVERTEC to COMPANY assumed by Assignee Sub under this Master Agreement, which guarantee provides that, for the avoidance of doubt, after any termination of the proposed assignment, EVERTEC shall continue to be obligated with respect to any obligation undertaken by Assignee Sub prior to such termination.

-16-

(c)          Assignment to Third Parties. EVERTEC may assign all of its rights, duties and obligations (or those rights, duties and obligations arising after the effectiveness of the assignment) in a transaction with a third-party assignee (an “Asset Acquirer”) if (i) such Asset Acquirer is identified by EVERTEC to COMPANY and BPPR at least 30 Business Days prior to the consummation of the proposed assignment; (ii) such Asset Acquirer (A) acquires at least 90% of the consolidated gross assets (excluding cash) of EVERTEC and its Subsidiaries and (B) assumes at least 90% of the consolidated gross liabilities (excluding Indebtedness) of EVERTEC and its Subsidiaries (including the assignment and assumption of all commercial agreements between EVERTEC or any of its Subsidiaries, on the one hand, and COMPANY, BPPR or any of their respective Subsidiaries, on the other hand) through one legal entity; (iii) neither the Asset Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from Puerto Rico in excess of $50 million unless none of them has a physical presence in Puerto Rico that is used to conduct any such business; (iv) the Asset Acquirer will be Solvent immediately after and giving effect to such proposed assignment; and (v) EVERTEC reasonably believes that the Asset Acquirer, after completion of the proposed purchase and assumption transaction, will be capable of providing the Services at the level of service required under this Master Agreement.

(d)        Cooperation. EVERTEC shall use its Best Efforts to cooperate with COMPANY and BPPR in evaluating whether any proposed assignment pursuant to this Section 1.5 would be in compliance with the requirements of the provisions contained in this Section 1.5, including the ability of Assignee Sub or Asset Acquirer, as applicable, to comply with the terms of this Master Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed assignment other than information that would create any potential liability under applicable Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(e)          Notice of Objection. COMPANY or BPPR shall notify EVERTEC in writing within 15 Business Days following receipt of EVERTEC’s notice of the proposed assignment of any objection to any proposed assignment to an Assignee Sub or Asset Acquirer unless EVERTEC has failed to satisfy its obligations pursuant to Section 1.5(d) and COMPANY or BPPR asserts such failure prior to the expiration of the 15 Business Day objection period, in which case such 15 Business Day period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 1.5(d). If BPPR or COMPANY fails to timely object to such proposed assignment (taking into account any tolling of the 15 Business Day objection period), it shall be deemed to have consented to such proposed assignment.

(f)          Invalidity of Impermissible Assignments. Any attempted or purported assignment in violation of this Section 1.5 hereof shall be null and void and the assignee’s rights assigned pursuant to any assignment made in compliance with this Section 1.5 will terminate in the event and to the extent of the termination of this Master Agreement.

-17-

(g)          BPPR Asset Transfer. If BPPR or any of its Subsidiaries transfers, in a single transaction or series of related transactions (including in a merger, business combination, reorganization, or similar transaction (including by operation of law)) 50% or more of BPPR’s consolidated assets in the Region as of the time of transfer, or assets that generate 50% or more of BPPR’s consolidated revenues in the Region for the full twelve-month period ending at the time of transfer, to any Person, then BPPR shall assign (or cause its applicable Subsidiaries to assign) to such Person its rights, duties and obligations under this Master Agreement in respect of the Services provided to the applicable transferors and shall cause such Person to assume its liabilities under this Master Agreement in respect of the Services provided to the applicable transferor. For the avoidance of doubt, no such assignment shall relieve COMPANY, BPPR or any of their respective Subsidiaries of their obligations under this Master Agreement to the extent COMPANY, BPPR or any of their respective Subsidiaries survive any such sale of assets, merger, business combination, reorganization, or similar transaction.

1.6          Binding Effect. This Master Agreement and all the provisions hereof will be binding upon and inure to the benefit of the parties hereto and their respective successors and permitted assigns. The parties hereto intend that this Master Agreement will not benefit or create any right or cause of action in, or on behalf of, any Person other than the parties hereto.

1.7          No Third Party Beneficiaries. Each party intends that this Master Agreement will not benefit, or create any right or cause of action in or on behalf of, any Person other than COMPANY, BPPR, and their respective Subsidiaries, and EVERTEC.

1.8         Entire Agreement. This Master Agreement, the Asset Purchase Agreement, the Technology Agreement and the other Ancillary Agreements (as such term is defined in the Asset Purchase Agreement) contain the entire understanding of all agreements between the parties hereto with respect to the subject matter hereof and supersede any prior agreement or understanding, oral or written, pertaining to any such matters, which other agreements or understandings will be of no force or effect for any purpose. This Master Agreement may not be amended or supplemented in any manner except by mutual agreement of the parties and as set forth in a writing signed by the parties hereto or their respective permitted successors in interest.

1.9          Interpretation.

(a)          The general terms and conditions of this Master Agreement and the Exhibits, Addenda, and Schedules made a part hereof from time to time will be interpreted as a single document. However, in the event of a conflict between the general terms and conditions of this Master Agreement and the terms of any Exhibit, Addendum or Schedule hereto, then the terms of the Exhibits, Addenda, and Schedules will prevail and control the interpretation of this Master Agreement with respect to the subject matter of the applicable Exhibits, Addenda, and/or Schedules; provided, however, that the specific provisions of each SOW and other written instructions listed in Schedule 3 to Exhibit B relating to the term and termination of such SOW and other written instructions shall be governed in accordance with Schedule 3 to Exhibit B. Furthermore, in the event of any conflict or inconsistency between this Master Agreement and any other document referenced herein (including the EVERTEC Security Requirements), regarding the interpretation of the terms of this Master Agreement, this Master Agreement together with its Exhibits, Addenda, and Schedules will prevail and control.

-18-

(b)          For purposes of this Master Agreement: (i) “include”, “includes” or “including” shall be deemed to be followed by “without limitation”; (ii) “hereof”, “herein”, “hereby”, “hereto” and “hereunder” shall refer to this Master Agreement as a whole and not to any particular provision of this Master Agreement; (iii) “extent” in the phrase “to the extent” shall mean the degree to which a subject or other item extends and shall not simply mean “if”; (iv) “dollars” and “$” shall mean United States dollars; (v) the singular includes the plural and vice versa; (vi) reference to a gender includes the other gender; (vii) “any” shall mean “any and all”; (viii) “or” is used in the inclusive sense of “and/or”; (ix) reference to any agreement, document or instrument means such agreement, document or instrument as amended, supplemented, modified and in effect from time to time in accordance with its terms; and (x) reference to any statute or regulation means such statute or regulation as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder.

1.10          Severability. Any term or provision of this Master Agreement which is held by a court of competent jurisdiction or as the result of an arbitration proceeding pursuant to Section 1.14, to be invalid or unenforceable in any jurisdiction shall, as to that jurisdiction, be ineffective to the extent of such invalidity or unenforceability without rendering invalid or unenforceable the remaining terms and provisions of this Master Agreement or affecting the validity or enforceability of any of the terms or provisions of this Master Agreement in any other jurisdiction; provided that this Section 1.10 shall not apply if such severability would materially and adversely affect the economic benefits of the parties resulting from this Master Agreement. Upon a determination that any term or other provision is invalid, illegal, or unenforceable, the parties hereto shall negotiate in good faith to modify this Master Agreement so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that this Master Agreement be consummated as originally contemplated to the greatest extent possible.

1.11          Waiver. The tardiness or failure by any of the parties hereto in exercising any right or privilege pursuant to this Master Agreement will not operate as a waiver thereof, nor will the exercise of any right by any party serve as an obstacle to the exercise of any other rights, powers or privileges, or any portion thereof. The waiver of any breach of any provision under this Master Agreement by any party will not be deemed to be a waiver of any preceding or subsequent breach under this Master Agreement. No such waiver will be effective unless in writing.

1.12         Governing Law. This Master Agreement will be governed by and interpreted in accordance with the laws of the Commonwealth of Puerto Rico applicable to contracts made and entirely to be performed therein, without regard to the place of performance hereunder.

1.13         Trial by Jury. The parties hereby mutually agree that no party, nor any permitted assignee, successor, heir or Representative thereof, will seek a jury trial in any lawsuit, proceeding, counterclaim, or any other litigation procedure based upon or arising out of this Master Agreement, or any related agreement or instrument among the parties. None of the parties will seek to consolidate any such action, in which a jury trial has been waived, with any other action in which a jury trial has not been waived. The provisions of this Section 1.13 have been fully negotiated by the parties. The waiver contained herein is irrevocable, constitutes a knowing and voluntary waiver, and will be subject to no exceptions.

-19-

1.14        Dispute Resolution; Arbitration. Except as otherwise provided in writing with respect to EVERTEC’s failure to achieve or maintain a Service Level (as such term is defined below), or except as may otherwise be agreed to in writing among the parties, any dispute, controversy or claim between EVERTEC, on the one hand, and any of the Popular Parties or their respective Subsidiaries, on the other, or against any Representative of one of the parties, related to this Master Agreement, and any dispute or claim related to the relationship or duties contemplated hereunder, including the validity of this Section 1.14 (a “Dispute”) will be resolved in accordance with this Section 1.14. Each party will give written notice (a “Notice of Dispute”) to the others of any Dispute claimed by it within thirty (30) days of learning of the cause of such a Dispute. The Notice of Dispute will include a reasonable description of the basis of the Dispute, including, (i) the specific charge or charges being disputed, (ii) if available and/or applicable, the supporting documentation that is reasonably required for verification of the charge or charges, and (iii) any amounts being withheld. Following delivery of a Notice of Dispute, a Representative of each party will meet and will attempt in good faith to resolve the Dispute. Any Dispute that remains unresolved for more than twenty (20) days after the receipt of a Notice of Dispute shall be referred to designated representatives of the parties hereto who shall negotiate in good faith to resolve such dispute (the “Resolution Forum”). If a Dispute is not resolved in the Resolution Forum, the Dispute shall be submitted to the consideration of a representative from the senior management of EVERTEC who shall be identified in a written notice delivered to the Popular Parties from time to time, the Chief Operating Officer, the Chief Financial Officer or the Chief Information Officer of BPPR and the Chief Operating Officer or the Chief Financial Officer of COMPANY. Any Disputes that may remain unresolved for more than ninety (90) days following the receipt of a Notice of Dispute may be referred to binding arbitration at the request of any party upon written notice to the other. Such arbitration proceeding will be administered by the American Arbitration Association in accordance with the then-current Commercial Arbitration Rules and will be aired in the Commonwealth of Puerto Rico. The arbitration will be governed by the United States Arbitration Act, 9 U.S.C. §§ 1-16 to the exclusion of any provision of state law inconsistent therewith or which would produce a different result. A panel of three neutral arbitrators will determine the Dispute of the parties and render a final award in accordance with the applicable substantive law. If the Dispute is between EVERTEC, on the one hand, and one or both of the Popular Parties and their respective Subsidiaries, on the other hand, each of EVERTEC and the Popular Parties shall select one neutral arbitrator and, unless those parties agree on a third neutral arbitrator, such two arbitrators shall select the third arbitrator (subject to such limitations, if any, mutually agreed by those parties). If the Dispute is between the Popular Parties, then each of the Popular Parties shall select one neutral arbitrator and, unless those parties agree on a third neutral arbitrator, such two arbitrators shall select the third arbitrator (subject to such limitations, if any, mutually agreed by those parties). Strict confidentiality will govern the arbitration proceedings, including all information submitted to the arbitrators and the decision or award entered by the arbitrators. Any court having jurisdiction may enter judgment upon the award rendered by the arbitrators. The terms hereof will not limit any obligation of a party to defend, indemnify or hold harmless another party against court proceedings or other Losses. The procedures specified in this Section 1.14 will be the sole and exclusive procedures for the resolution of Disputes among the parties arising out of or relating to this Master Agreement; provided, however, that a party may request temporary remedies in a court of law to maintain the status quo or to protect goods or property until the arbitration has initiated and the selected arbitrators have had the opportunity to resolve the request for temporary relief. Each party is required to continue to perform its obligations under this Master Agreement pending final resolution of any Dispute arising out of or relating to this Master Agreement, unless to do so would be impossible or impracticable under the circumstances.

-20-

1.15          Cumulative Remedies. Except as otherwise expressly provided, all rights and remedies provided for in this Master Agreement will be cumulative and in addition to and not in lieu of any other rights and remedies available to any party at law, in equity or otherwise and will not serve to exclude the exercise of any right or remedy provided by law.

1.16          Subcontracting the Services.

(a)        EVERTEC shall provide COMPANY and BPPR with the written notice required below in this Section 1.16(a) prior to outsourcing, delegating or subcontracting the performance of any part of the Services to a Third Party vendor, including any Third Party computer programmers, software developers or Data Center, collocation, hosting or cloud service providers (each, a “Subcontractor”), to the extent such Subcontractor would store, process, transport or otherwise have access to BPPR Data or other Confidential Information or Intellectual Property of COMPANY or BPPR or their respective Subsidiaries (a Subcontractor with such access, including those who perform Data Processing of Personal Data or provide Data Center services, a “Data Subcontractor”), except to the extent such Data Subcontractor is in use by EVERTEC as of the Effective Date. The Data Subcontractors used by EVERTEC as of the Effective Date are listed in Schedule 1.16. For the avoidance of doubt, such information related to EVERTEC’s Data Centers, Data Subcontractors and Subcontractors shall be considered EVERTEC Confidential Information and EVERTEC may otherwise engage Subcontractors who are not Data Subcontractors without the obligation to inform COMPANY or BPPR, as applicable, subject to the terms of this Master Agreement and to applicable Legal Requirements. EVERTEC agrees that, prior to assigning a Data Subcontractor under this Master Agreement: EVERTEC must (i) provide COMPANY and BPPR with at least 180 days’ written notice for Data Subcontractors that will perform Services at a new Data Center and at least 30 days’ written notice for all other Data Subcontractors (or such shorter period as may be necessary to assign a Data Subcontractor in order to remedy an Incident or other similar emergency event); (ii) within 10 days of a request from COMPANY or BPPR, provide COMPANY or BPPR the information described in Section 1.16(c) to evaluate the proposed Data Subcontractor during the applicable notice period provided above; and (iii) comply with the outsourcing policies and procedures set forth in Exhibit F (the “Outsourcing Policy”) and applicable Legal Requirements relating to the outsourcing of services. Without limiting the foregoing, prior to the commencement of any work by any Data Subcontractor, EVERTEC must: (i) perform the necessary due diligence to manage related vendor risks and ensure it only assigns Subcontractors that (A) are qualified industry vendors that EVERTEC reasonably believes to be competent, (B) meet or exceed any requirements as may be required under applicable Legal Requirements and (C) have the requisite skills to perform the subcontracted obligations; (ii) enter into written agreements that bind the Data Subcontractors to data security and confidentiality obligations no less stringent than to those herein; and (iii) monitor its Subcontractor’s performance to ensure it is consistent and compliant with all the requirements of the Outsourcing Policy.

-21-

(b)        EVERTEC shall monitor its Data Subcontractors’ performance to ensure such performance is consistent and compliant with all the applicable requirements of this Master Agreement and the Outsourcing Policy. Notwithstanding the foregoing, EVERTEC shall remain exclusively and fully responsible and liable towards COMPANY, BPPR, and their respective Subsidiaries for the due performance of such Services, compliance with this Master Agreement, and any gross negligence, fraud or willful misconduct by such Subcontractors (including any Fourth Party) and there shall be no direct relationship whatsoever between COMPANY, BPPR, or their respective Subsidiaries, on the one hand, and such Subcontractors or Fourth Parties, on the other, solely by virtue of this Master Agreement.

(c)       Subject to Section 1.16(f), at COMPANY’s or BPPR’s request, upon reasonable advance written notice, EVERTEC will provide COMPANY or BPPR with copies of any documents in EVERTEC’s possession that are related to EVERTEC’s due diligence and risk analysis of its Data Subcontractors; provided, that (i) such requests shall be conducted in such a manner as not to interfere with the normal operations of EVERTEC’s business, (ii) disclosure of such information by EVERTEC shall be subject to, and limited by, applicable Legal Requirements, (iii) EVERTEC may redact from such copies information related solely to EVERTEC or customers other than COMPANY, BPPR or their respective Subsidiaries and (iv) EVERTEC shall not be obligated to provide any information if doing so would reasonably be expected to result in the waiver of any attorney-client or other legal privilege.

(d)          EVERTEC represents that its vendor risk management policies and procedures include commercially reasonable audit rights with respect to its Data Subcontractors.

(e)         If a Data Subcontractor uses or permits another party (a “Fourth Party”) to store, transport, process otherwise access Personal Data or Confidential Information or Intellectual Property of COMPANY, BPPR, or their respective Subsidiaries, EVERTEC will comply with this Section 1.16 with respect to such Fourth Party, subject to Section 1.16(f).

(f)          If there are terms in EVERTEC’s contracts existing as of the Effective Date with its Data Subcontractors that limit EVERTEC’s rights to provide the information requested by COMPANY or BPPR under Section 1.16(c) or (e), EVERTEC will use Best Efforts to obtain the right to provide the requested information but will not be in breach of this Master Agreement to the extent it is unable to do so as a result of such contract terms.  If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.

1.17          Non-solicitation.

(a)        Each party agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the end of the Transition Period, without the prior written consent of the other party, such party shall not, and it shall cause its Subsidiaries not to, directly or indirectly, (i) induce or encourage any employee of the other party to terminate his or her employment with the other party or (ii) solicit for employment or any similar arrangement any employee of the other party; provided that such party and its Subsidiaries shall not be restricted from (A) accepting referrals for employment made by a placement agency or employment service so long as such placement agency or employment service has not targeted employees of the other party, (B) making any general advertisement not targeted at employees of the other party appearing in a newspaper, magazine, Internet sites or trade publication, (C) soliciting any person who has not been an employee of the other party for at least one hundred eighty (180) days prior to being solicited or hired by such party or its Subsidiaries and whom neither the other party nor any of its Subsidiaries, subject to clauses (A) and (B) of this proviso, have solicited over such 180-day period, or (D) soliciting any person who the other party or its Subsidiaries are permitted to solicit under the Asset Purchase Agreement in accordance with the terms thereof.

-22-

(b)          Each of COMPANY and BPPR agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the end of the Transition Period, without the prior written consent of EVERTEC, such party shall not, and it shall cause its Subsidiaries not to, directly or indirectly, hire or assist any other Person in hiring any Restricted Employee; provided that COMPANY, BPPR and their Subsidiaries shall not be restricted from hiring any person who has not been an employee of the other party for at least one hundred eighty (180) days prior to being solicited or hired by such party or its Subsidiaries and whom neither the other party nor any of its Subsidiaries, subject to clauses (A) and (B) of the proviso in clause (a) above, have solicited over such 180-day period.  For purposes of this Section 1.17(b), “Restricted Employee” means any employee of the following EVERTEC groups or divisions: Business Solutions division, Payment Services division, Information Technology and Quality and Change Management groups within EVERTEC’s Information Technology and Operations division, and Information Security division (including any functional successor thereto).

(c)        EVERTEC agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the expiration or termination of this Master Agreement, without the prior written consent of COMPANY, EVERTEC shall not, and it shall cause its Affiliates not to, directly or indirectly, hire or assist any other Person in hiring any Restricted Employee; provided that EVERTEC shall not be restricted from hiring any person who has not been an employee COMPANY, BPPR or any of its Affiliates for at least one hundred eighty (180) days prior to being solicited or hired by EVERTEC or its Affiliate and whom neither EVERTEC nor any of its Affiliates, subject to clauses (A) and (B) of the proviso in clause (a) above, have solicited over such 180-day period.  For purposes of this Section 1.17(c), “Restricted Employee” means (A) any employee of COMPANY or BPPR’s Digital Banking and Payment Division, Information Technology Division and Cybersecurity Division (including any functional successor thereto); and (B) any former employee of EVERTEC that is hired by COMPANY, BPPR or their Subsidiaries in connection with solicitations permitted under the Asset Purchase Agreement.

1.18          Prohibition on Publicity. Neither EVERTEC nor the Popular Parties (or their respective Subsidiaries) may advertise or promote using the name or description of the other parties or party, respectively, without in each instance the express written consent of EVERTEC or the Popular Parties, as applicable.

1.19          Business Days and Legal Holidays. Except as expressly agreed to otherwise for a particular Service, in the event that any action, payment, or time period, under this Master Agreement is scheduled to occur on or becomes due on a day that is a Legal Holiday, such action, payment or time period will be performed and/or expire, as applicable, on the next Business Day immediately following the Legal Holiday.

-23-

1.20         Notices. Except as expressly agreed to otherwise for a particular Service, all notices, requests, demands, consents and other communications given or required to be given under this Master Agreement and under the related documents will be in writing and may be given in any manner described below to the address or number set out below, and shall be deemed effective as follows: (a) if delivered personally to the Person designated below, (b) when the same is actually received, if sent by express overnight courier service, with charges prepaid and return receipt requested, or (c) if sent by email, if notice of nondelivery is not received, (i) at or prior to 5:00 pm local time of the recipient on a Business Day, on that Business Day or (ii) later than 5:00 pm local time of the recipient, on the next succeeding Business Day; provided notices of default, non-renewal or termination must be delivered personally or by courier as provided in Sections 1.20(a) or (b); provided further that all such notices, requests, demands, consents and other communications shall be accompanied by an email notification.

To EVERTEC:

Evertec, Inc.
Cupey Center Building, Road 176, Kilometer 1.3
San Juan, Puerto Rico 00926
Facsimile:  787-766-4585
Email:  luis.rodriguez@evertecinc.com
Attention:  Luis A. Rodríguez, General Counsel and Executive Vice President of Corporate Development

To the Popular Parties:

Popular, Inc.
PO Box 362708
San Juan, Puerto Rico 00936-2708
Email:  legaldivision@popular.com

Attention:  Jose R Coleman Tio, Executive Vice President and Chief Legal Officer

Any party hereto may change its address or contact details from time to time by giving notice to that effect as provided in this Master Agreement.

1.21         Incorporation. All Exhibits, Addenda, Schedules, certificates, agreements and other documents attached hereto and to which reference is made herein are incorporated by reference as if fully set forth herein.

1.22          Headings. The headings used in this Master Agreement are inserted for purposes of convenience of reference only and will not limit or define the meaning of any provisions of this Master Agreement.

-24-

1.23          Language. This Master Agreement has been executed in the English language and all Exhibits, Addenda, and Schedules to this Master Agreement shall be in English, except that any Addenda in effect prior to the date hereof may be in Spanish.

1.24          Counterparts. This Master Agreement may be executed in counterparts, each of which when so executed shall be deemed to be an original and all of which when taken together shall constitute one and the same instrument. Any signature to this Master Agreement may be delivered by facsimile, electronic mail (including pdf) or any electronic signature complying with the U.S. federal ESIGN Act of 2000 or the New York Electronic Signature and Records Act or other transmission method and any counterpart so delivered shall be deemed to have been duly and validly delivered and be valid and effective for all purposes to the fullest extent permitted by applicable Legal Requirements. For the avoidance of doubt, the foregoing also applies to any amendment, extension or renewal of this Master Agreement and any Addenda, Schedule, SOW or other document to be executed by the parties pursuant hereto or thereto.

1.25          Representations and Warranties. EVERTEC, COMPANY and BPPR each represent and warrant that (i) it has the power and authority to grant the rights and perform the obligations to which it commits herein; (ii) the execution of this Master Agreement by the person representing it will be sufficient to render this Master Agreement binding upon it; (iii) neither its performance hereunder nor the exercise by the other parties of rights granted by the warranting party hereunder will violate any applicable Legal Requirements, or the legal rights of any Third Parties, or the terms of any other agreement to which the warranting party is or becomes a party; and (iv) it has and will maintain an adequate system of internal controls and procedures for financial reporting. Each party is separately responsible for ensuring that its performance and grant of rights do not constitute any such violation during the Term. Each of the foregoing representations and warranties and any other representations and warranties made throughout this Master Agreement will be deemed provided by the parties on the Effective Date hereof and will be continuous in nature throughout the Term.

1.26       Specific Performance. COMPANY and EVERTEC agree that if an act or omission of one of the Popular Parties or any of their respective Subsidiaries, on the one hand, or EVERTEC, on the other hand, results in a breach of Section 1.5 (Assignment), Section 1.17 (Non-solicitation), Section 1.18 (Prohibition on Publicity), Section 1.31 (EVERTEC Change of Control), Section 2.9 (Non-Circumvention Covenants), Section 2.10 (Non-Compete Covenants), Article Five (Confidentiality, Privacy & Data Protection), Article Six (Security, BPPR Data & Records), Article Eight (Regulatory Compliance, Audit & Service Reviews) or Section 9.5 (Transition Assistance), EVERTEC or the Popular Parties, as applicable, will be irreparably damaged, no adequate remedy at law would exist and damages would be difficult to determine, and that EVERTEC or one of the Popular Parties, as applicable, shall be entitled to an injunction or injunctions to prevent such breach, and to specific performance of the terms of the aforementioned Sections and Articles as the case may be, in addition to any other remedy at law or equity, without having to post bond or any financial undertaking.  By listing the provisions above the Parties are not intending to limit either Party’s right to seek injunctive relief, specific performance or other equitable remedies under applicable Legal Requirements.

1.27       Limitation of Actions. No action, regardless of form, arising out of any claimed breach of this Master Agreement or the Services provided hereunder, may be brought by any party more than two (2) years after such party has obtained actual knowledge of the cause of action or after the statute of limitations prescribed by Puerto Rico law, whichever is less.

-25-

1.28          Release of Existing Claims. Each party hereto, on behalf of itself, its Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Releasing Parties”), hereby generally, completely and irrevocably releases and discharges each other party hereto and all of such other party’s Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Released Parties”), of and from any and all claims, demands, debts, liabilities, contracts, obligations, accounts, suits, torts, causes of action, Disputes, or claims for relief of whatever kind or nature (other than Third Party claims) solely to the extent arising out of facts, circumstances or occurrences which were known or reasonably should have been known to the Releasing Parties, both at law and equity, which the Releasing Parties ever had, now has, or may have (including attorneys’ fees and costs incurred) relating to, resulting from or arising out of the Released Parties’ breach of any representations, warranties or covenants under the September 2010 MSA or the April 2010 MSA; provided, that, this Section 1.28 shall not apply with respect to (i) any rights that cannot be waived under applicable Legal Requirements, (ii) the continuation on or after the Effective Date of any act or omission that commenced prior to the Effective Date, to the extent that such continuation of such act or omission following the Effective Date constitutes a breach of any representations, warranties or covenants under this Master Agreement, or (iii) any act or omission that commenced following the Effective Date which results in a breach of any representations, warranties or covenants under this Master Agreement. The Releasing Parties represent and warrant that they are respectively the sole and lawful owners of, and have not assigned or transferred to any Third Party, all rights, title and interest in and to all released matters referred to in this Section 1.28.

1.29         Additional Assurances. The parties covenant and agree that subsequent to the execution and delivery of this Master Agreement and without any additional consideration, each will execute and deliver any further legal instruments and perform any acts that are or may become necessary to effectuate the purposes of this Master Agreement.

1.30         No BPPR Guarantee. The parties acknowledge and agree that notwithstanding anything to the contrary contained in this Master Agreement, BPPR is party to this Master Agreement only to the extent that it receives Services from EVERTEC, and BPPR shall be liable to EVERTEC only for the performance of its (and its Subsidiaries’) duties, obligations and payments under this Master Agreement. BPPR shall not guarantee or otherwise be liable for the performance of any duties, obligations or payments of any of BPPR’s Affiliates (other than BPPR itself and BPPR’s Subsidiaries) or for the performance of any duties, obligations or payments of COMPANY or COMPANY’s Subsidiaries arising under this Master Agreement.

-26-

1.31          EVERTEC Change of Control.

(a)          EVERTEC Change of Control. COMPANY and BPPR shall have the right, subject to Section 1.31(c), to terminate this Master Agreement up to thirty (30) days following the later of (i) the occurrence of an EVERTEC Change of Control or (ii) the date on which EVERTEC provides COMPANY and BPPR written notice that an EVERTEC Change of Control has occurred or is likely to occur (provided that if EVERTEC has not satisfied its obligations pursuant to Section 1.31(b) and that COMPANY or BPPR asserts such failure prior to the expiration of the thirty (30)-day period then such thirty (30)-day period shall be tolled until EVERTEC satisfies its obligations under Section 1.31(b) and provided further that if an EVERTEC Change of Control occurs, and EVERTEC fails to provide COMPANY and BPPR written notice thereof within thirty (30) days thereof, then COMPANY and BPPR shall have an unqualified right to terminate this Master Agreement), unless (w) the Person or Group of Persons proposing to engage in such proposed EVERTEC Change of Control transaction (the “Control Acquirer”) is identified to COMPANY by EVERTEC at least thirty (30) Business Days prior to such proposed EVERTEC Change of Control; (x) neither the Control Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from Puerto Rico in excess of $50 million unless none of them has a physical presence in Puerto Rico that is used to conduct any such business; (y) EVERTEC (or its successor, as applicable) will be Solvent immediately after and giving effect to such proposed EVERTEC Change of Control; and (z) EVERTEC (or its successor, as applicable), after the proposed EVERTEC Change of Control, will be capable of providing the Services at the level of service that is required under this Master Agreement.

(b)        Cooperation. EVERTEC shall use its Best Efforts to cooperate with COMPANY and BPPR in evaluating whether any proposed EVERTEC Change of Control would be in compliance with the requirements of this Section 1.31 including the ability of EVERTEC (or its successor, as applicable) to comply with the terms of this Master Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed EVERTEC Change of Control other than information that would create any potential liability under Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(c)          Notice of Objection. If EVERTEC provides at least 30 days’ written notice to COMPANY and BPPR prior to an EVERTEC Change of Control, BPPR and/or COMPANY shall notify EVERTEC in writing within 15 Business Days following receipt of EVERTEC’s notice of the proposed EVERTEC Change of Control of any objection to any proposed EVERTEC Change of Control on the basis that it does not satisfy the criteria set forth in clauses (w) through (z) of Section 1.31(a) (unless EVERTEC has failed to satisfy its obligations pursuant to Section 1.31(b) and COMPANY or BPPR asserts such failure prior to the expiration of the 15 Business Day objection period, in which case such 15 Business Day objection period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 1.31(b)). If BPPR or COMPANY fails to timely object to such proposed EVERTEC Change of Control (taking into account any tolling of the 15 Business Day objection period), it shall be deemed to have consented to such proposed EVERTEC Change of Control and waived its right of termination under Section 1.31(a).

ARTICLE TWO– THE SERVICES

2.1          Services.

(a)         EVERTEC will provide to COMPANY, BPPR, and their respective Subsidiaries the Services which are listed in Exhibit B, attached hereto, including the additional descriptions of certain of such Services in the document Rate Matrix and Printing & Distribution included as Schedule 1 to Exhibit B.

-27-

(b)          None of the Services shall be subject to any exclusivity. COMPANY, BPPR, and their respective Subsidiaries may use a Third Party to provide any of the Services and COMPANY, BPPR, and their respective Subsidiaries may perform any of the Services themselves or through their Subsidiaries, irrespective of whether any such Service has been terminated in whole or in part.  To the extent there are exclusivity terms included in a Service Addendum or SOW existing as of the Effective Date, those exclusivity terms shall not apply after the Effective Date.  To the extent there are minimum commitments or termination fees included in a Service Addendum or SOW as of the Effective Date, those termination fees and minimum commitments shall not apply after the Effective Date other than under the Statement of Work for Amazon Connect ACD and IVR Services dated November 3, 2021, as amended.

(c)          If COMPANY or BPPR performs itself, or retains a third party to perform, any services that interface or interact with the Services, or that are or formerly were, part of the Services, EVERTEC will, at COMPANY or BPPR’s cost, cooperate and coordinate with COMPANY and BPPR or such third party as reasonably required for COMPANY and BPPR or the third party to perform such services.  EVERTEC’s cooperation and coordination with COMPANY, BPPR and any such third party will include, as applicable: (i) providing reasonable access to the equipment and software used in providing the Services via API or other reasonable method agreed by the parties (subject to any applicable EVERTEC Security Requirements); (ii) providing such reasonable information regarding the operating environment, system constraints and other operating parameters as a person with reasonable commercial skills and expertise would find reasonably necessary for COMPANY and BPPR or the third party to perform its work; (iii) providing access to BPPR Data stored by EVERTEC; and (iv) reasonably cooperating and participating in meetings to identify the causes of incidents and problems and to agree on action plans to resolve them; provided that EVERTEC shall have sole discretion to deny any party from performing programming services on or accessing the source code of applications owned or licensed by EVERTEC.  COMPANY or BPPR, as applicable, shall (and shall require any such third party engaged by COMPANY or BPPR to) comply with EVERTEC Security Requirements and with the other applicable terms of this Master Agreement when accessing EVERTEC’s systems in connection with this Section 2.1(c).  Subject to Section 4.5, COMPANY or BPPR will reimburse EVERTEC for any Losses incurred by EVERTEC in connection with any unauthorized access or intrusion to EVERTEC’s Systems, or any Disabling Device introduced to EVERTEC’s Systems, as a result of a breach of this Master Agreement, failure to comply with the EVERTEC Security Requirements, gross negligence, fraud or willful misconduct of COMPANY, BPPR or any such third party in connection with its access to EVERTEC’s Systems pursuant to this Section 2.1(c).

(d)          If EVERTEC and the Popular Parties, or any of their respective Subsidiaries, agree from time to time upon terms and prices for certain Services, then EVERTEC, on the one hand, and the Popular Parties or any of their appropriate respective Subsidiaries, on the other hand, will execute a separate addendum (each, a “Service Addendum”) setting forth the mutually agreed upon terms and prices for such Services. Each such Service Addendum will be incorporated and, to the extent not incompatible with the terms of such Service Addendum, will be subject to the terms and conditions of this Master Agreement. Nothing herein will be interpreted as imposing an obligation upon EVERTEC to develop new Services, or upon COMPANY, BPPR, or any of their respective Subsidiaries to acquire any additional Services from EVERTEC. The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, the pricing with respect to any and all Services will be set forth in Exhibit B, which will serve as a master list of the Services and corresponding pricing. The parties agree that Exhibit B will be reviewed and updated on an ongoing basis following the Effective Date hereof. Any changes to Exhibit B shall be agreed to by both parties by executing an amended and restated Exhibit B clearly denoting the date any such changes become effective; provided that EVERTEC may amend Exhibit B upon notice to, but without the consent of, the Popular Parties in order to reflect the price adjustments provided in Section 3.1(b), or any change, modification, enhancement or upgrade of the Services permitted pursuant to Section 2.1(b), but for the avoidance of doubt subject to the consent requirements of Sections 2.6 and 2.7.

-28-

(e)          The Service Addenda set forth in Schedule 2 to Exhibit B are hereby incorporated into this Master Agreement by this reference.

(f)         Each Statement of Work (“SOW”) pursuant to which EVERTEC provides Services(s) to COMPANY, BPPR, and/or their respective Subsidiaries as of the date hereof (except for any SOW that relates to a non-recurring definitive project) is set forth in Schedule 3 to Exhibit B and is hereby incorporated into this Master Agreement.

(g)       Each SOW to be entered into after the date of this Master Agreement, pursuant to which EVERTEC shall provide Services(s) to COMPANY, BPPR, and/or their respective Subsidiaries after the date hereof shall be set forth in Schedule 4 to Exhibit B and shall be incorporated into this Master Agreement.

2.2          Annual Minimums.

(a)         The Popular Parties agree to minimum annual service revenue (the “Annual Minimum”) for all Services under this Master Agreement, payable on a monthly basis in an amount not to exceed the amounts described below (the “Monthly Benchmark”) and subject to adjustment in accordance with this Section 2.2 and pro-ration in the case of any partial months, as follows:

(i)          with respect to the period from the Effective Date through September 30, 2025, the Monthly Benchmark shall be $14,166,667 (for clarity, based on an Annual Minimum equal to $170,000,000);

(ii)        with respect to the period from October 1, 2025 through September 30, 2026, the Monthly Benchmark shall be $13,750,000 (for clarity, based on an Annual Minimum equal to $165,000,000); and

(iii)       with respect to the period from October 1, 2026 through September 30, 2028, the Monthly Benchmark shall be $13,333,333 (for clarity, based on an Annual Minimum equal to $160,000,000).

(b)          Shortfall Payments and Cap.  If Covered Revenue for a particular month during the periods referenced in Section 2.2(a) is less than the applicable Monthly Benchmark, then EVERTEC will include the amount of such shortfall on the invoice for the relevant month (prorated for partial months during the Initial Term) (a “Shortfall Payment”); provided, however, that Shortfall Payments shall be invoiced solely to the extent that they would not result in the sum of (x) Covered Revenue with respect to the period from January 1 of the calendar year in which the invoice was given through the invoice date and (y) aggregate Shortfall Payments previously invoiced during such period exceeding aggregate Monthly Benchmarks with respect to such period.

-29-

(c)          True-Up.  If the sum of (x) the Covered Revenue plus (y) the aggregate Shortfall Payments made for the period beginning January 1 and ending June 30 or the period beginning July 1 and ending December 31 (each a “True-Up Calculation Period”) exceeds the aggregate Monthly Benchmarks for the True-Up Calculation Period, EVERTEC shall refund to the Popular Parties an amount equal to the sum of the amounts referred to in clauses (x) and (y) of this sentence minus the aggregate Monthly Benchmarks for the True-Up Calculation Period (the “Bi-Annual True-Up”); provided, however, that the Bi-Annual True-Up shall be capped at an amount equal to the aggregate Shortfall Payments made for the applicable True-Up Calculation Period; provided, further, that the Shortfall Payments and Bi-Annual True-Up shall be calculated consistently with the illustrative calculation included as Exhibit H hereto.  EVERTEC will deliver its proposed calculation of any Bi-Annual True-Up (including if such amount would equal $0, based on EVERTEC’s proposed calculation) not later than thirty (30) days following the end of each True-Up Calculation Period and will provide the Popular Parties with such supporting information for such calculation as the Popular Parties may reasonably request.  The amount of any Bi-Annual True-Up, as calculated by the Popular Parties in good faith taking into account EVERTEC’s proposed calculation, will be applied as a credit against any amounts due to EVERTEC under this Master Agreement; provided, after June 30, 2028, and following any termination of this Master Agreement, the Popular Parties may elect to receive the Bi-Annual True-Up as a cash payment rather than a credit in which case EVERTEC will make such cash payment within thirty (30) days of a request from the Popular Parties.  The amount of any Bi-Annual True-Up shall be subject to the fee dispute provisions set forth in this Master Agreement.

(d)          Excluded and Imputed Revenue.  “Covered Revenue” means, with respect to any period, the sum of all amounts payable to EVERTEC in connection with the Popular Parties’ receipt of Services or purchases from EVERTEC of other products or services under this Master Agreement; provided, however, that Covered Revenue shall be subject to adjustment as follows:

(i)       The following amounts will be excluded in the calculation of Covered Revenue (i.e., such amounts will be disregarded in determining whether the Monthly Benchmark is met with respect to any particular month and in determining whether the Annual Minimum has been met):

(1) any fees that are part of the ATH Network Agreement or the ISO Agreement, as amended from time to time, that are not chargeable as fees in respect of the Services provided hereunder; and

(2) Covered Revenue shall exclude sales of hardware solely to the extent that such hardware was not purchased by COMPANY or BPPR in connection with the provision or consumption of Services.

-30-

(ii)        The following amounts will be included in the calculation of Covered Revenue (i.e., such amounts will be deemed to have been paid to EVERTEC in determining whether the Monthly Benchmark is met with respect to any particular month):

(1) To the extent that the Popular Parties terminate any Service for cause or any Service is not provided (i) for a period of at least two (2) weeks due to a Force Majeure Event or (ii) any breach of this Master Agreement by EVERTEC, Covered Revenue shall be deemed to include the fees that would otherwise have been payable with respect to such Service; provided, that in the case of any Service with volume-based fees, the amount of such fees for purposes of this sentence shall be determined based on the amount of volume-based fees actually charged during the twelve (12) months preceding the date of termination of such Service.

(2) If EVERTEC is requested to provide, but declines or is unable to provide, any change, modification, enhancement or upgrade of any Service because EVERTEC has a demonstrated lack of capacity or technical expertise to fulfill such request, then Covered Revenue shall be deemed to include any amounts that would have been payable to EVERTEC had EVERTEC agreed to such request, as determined based on (x) the costs and fees payable by COMPANY or BPPR, as applicable, to an independent third party engaged to provide such change, modification, enhancement or upgrade, or (y) if COMPANY or BPPR are unable to engage any such third party, the costs and fees to obtain professional services required to provide such change, modification, enhancement or upgrade (calculated based on programming hours) based on the rates charged by EVERTEC set forth in Exhibit B; provided, that COMPANY or BPPR shall promptly notify EVERTEC of the costs and fees determined in accordance with the foregoing clause (x) or (y), as applicable, and EVERTEC shall have ten (10) days after delivery of such notification to provide COMPANY and BPPR with a written commitment to meet such request (and for the avoidance of doubt, if EVERTEC meets such request, then this paragraph shall not apply and, instead, amounts payable to EVERTEC in respect of such request shall be counted toward Covered Revenue); provided, further, that this paragraph shall not apply in the case of any request that EVERTEC is unable to fulfill on commercially reasonable terms, so long as EVERTEC shall have used Best Efforts to maintain, develop and engage one or more third parties to provide such capacity; provided, further, that this paragraph shall only apply to the extent that (i) the request arises out of the obsolescence of a Service or (ii) the request relates to a Mandatory Enhancement.

-31-

(3) If EVERTEC is requested to provide, but declines or is unable to provide, any new service that is reasonably related to the Services (including transition or conversion services), then Covered Revenue shall be deemed to include any amounts that would been payable to EVERTEC had EVERTEC agreed to such request, as determined based on the methodology described in the foregoing paragraph (2); provided, that in the case of any request by COMPANY or BPPR request for services that are not related to the Services, EVERTEC’s failure to meet such request shall not be a basis for imputing toward Covered Revenue the fees that would have been earned with respect to such services had EVERTEC agreed to such request.

(iii)     The Monthly Benchmarks and the Annual Minimum are exclusive of taxes required to be paid by the Popular Parties in accordance with this Master Agreement.

(iv)       The amount of any Service Level Agreement Credits will not alter the Monthly Benchmark for any month for purposes of the calculations in this Section 2.2.  For the sake of clarity, credits under this Master Agreement, including any ordinary course Service Level Agreement Credits and Bi-Annual True-Ups and the credit delivered at the closing of the transactions contemplated under the Asset Purchase Agreement in accordance with Section 1.7 of the Asset Purchase Agreement, will be counted on a dollar-for-dollar basis toward the Monthly Benchmarks.

2.3          Service Personnel.

(a)          EVERTEC agrees that it will (i) assign qualified, adequately trained, and efficient Personnel to the performance of the Services and (ii) cause such Personnel to use their Best Efforts to discharge EVERTEC’s obligations under this Master Agreement in an efficient and timely manner and to exercise reasonable care in performing the Services, subject to the terms, conditions and prices established in the corresponding Service Addendum or Statement of Work.

(b)          EVERTEC shall provide reasonable access, if requested by the Popular Parties, to the relevant Personnel.

2.4          Service Level Agreement.

(a)          The Services will be rendered in a commercially reasonable manner, in accordance with (i) the performance standards and service levels applicable to the particular Service in question and generally accepted industry practices and procedures used in performing services of a like-kind to the Services, but no less than with the same degree of care and diligence practiced prior to the Effective Date and (ii) unless agreed to otherwise in writing by the parties, the general terms and conditions and performance standards (“Service Levels”) in the Service Level Agreement attached hereto as Exhibit C (together with Schedule 1 to Exhibit C, the “Service Level Agreement”), which is incorporated into this Master Agreement by reference.

(b)          Furthermore, the parties agree that EVERTEC’s performance levels and procedures for Services shall, unless otherwise mutually agreed to by the parties, be no less than the performance levels and procedures prior to the Effective Date or, to the extent any such Services were not provided to COMPANY, BPPR, and their respective Subsidiaries prior to the Effective Date, such Services shall be provided at Service Levels that are at least consistent with then prevailing industry standards.

-32-

(c)          The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, if the Service is subject to Service Levels, such Service Levels will be set forth in Schedule 1 of the Service Level Agreement which will serve as a master list of all Service Levels applicable to the Services COMPANY, BPPR, and their respective Subsidiaries receive hereunder. The parties agree that Schedule 1 will be reviewed and updated on an ongoing basis following the Effective Date. Any changes to the Service Levels set forth in Schedule 1 shall be agreed to by the parties by executing an amended and restated Schedule 1 clearly denoting the date any such changes become effective. The parties agree that they shall negotiate in good faith with respect to any disputes arising from the updating of Schedule 1.

2.5          Reports and Errors.

(a)          COMPANY and BPPR will be responsible for reviewing and reconciling, the reports, statements, files, and any notice, correspondence or communication (collectively, the “Reports”) it or its Subsidiaries receives from EVERTEC and each of COMPANY and BPPR agrees to exercise Best Efforts to do so in a commercially reasonable time period taking into account any deadlines imposed by any Legal Requirements.

(b)          Each of COMPANY and BPPR shall exercise Best Efforts to detect and inform EVERTEC in writing of any errors and/or discrepancies (“Errors”) in the Reports received from EVERTEC within a commercially reasonable time period taking into account any deadlines imposed by any Legal Requirements.

(c)          The notice given by COMPANY or BPPR to EVERTEC shall specify and describe the Errors detected by COMPANY or BPPR, as the case may be, and the parties shall use their respective Best Efforts and cooperate with each other to obtain and/or provide to each other any available information that may be necessary, relevant and/or useful to identify the cause of any Errors and correct and resolve such Errors.

(d)         EVERTEC shall exercise Best Efforts to correct, resolve and/or reprocess the Errors reported to EVERTEC by COMPANY or BPPR within a commercially reasonable time period.

(e)         Any party may require that any controversy related to or arising under the provisions of this Section 2.5 be processed as a Dispute pursuant to Section 1.14, but in such case the Dispute shall be immediately addressed by each party’s Representative negotiating in good faith without having to comply with the Notice of Dispute and time periods set forth in Section 1.14.

2.6          Specifications for Services.

(a)          Based on COMPANY’s and BPPR’s instructions, EVERTEC will establish the processing parameter settings, features and options (collectively, the “Specifications”) for the Services that will apply to COMPANY, BPPR, and their respective Subsidiaries (including all control and verification mechanisms utilized in each processing function related to the Services).

-33-

(b)          The parties agree that unless otherwise agreed to in writing by the parties, the Specifications will be derived from or in compliance with the respective terms and conditions established or documented by the parties using means such as, but not limited to: (i) electronic systems used to register service requests; (ii) operational manuals of COMPANY, BPPR, or their respective Subsidiaries provided to EVERTEC; (iii) SOWs; (iv) service standard forms provided by COMPANY and/or BPPR to EVERTEC; and (v) any other written instructions that may be provided by COMPANY or BPPR to EVERTEC from time to time; provided, that in the event any Specification is documented by the parties pursuant to clauses (i) – (v) in this Section 2.6(b) and such Specification relates to a recurring Service (as opposed to a definitive project), Exhibit B shall be amended to include such Specification and the corresponding fee agreed to by the parties.

(c)          Changes to Specifications:

(i)       To the extent a particular Service is provided solely to COMPANY, BPPR, and their respective Subsidiaries (and not to EVERTEC’s other customers), EVERTEC will disclose to COMPANY, and COMPANY will have a reasonable period of time to approve, all Specifications and modifications thereof before their activation in the production environment.  If the Specifications or modifications are required by Legal Requirements, and COMPANY does not approve or provide alternative Specifications or modifications to EVERTEC, EVERTEC will not be responsible for any failure of such Service to comply with the applicable Legal Requirements.

(ii)         In cases where EVERTEC makes a change to Specifications for Services provided to EVERTEC’s other customers, or in order to comply with this Master Agreement or Legal Requirements applicable to EVERTEC, EVERTEC will provide COMPANY and BPPR with reasonable prior written notice of the change and meet with COMPANY to address any concerns COMPANY may have about the change.

(iii)        EVERTEC will perform system processing and provide the Services in accordance with the Specifications.

(d)         Should the Specifications call for the use of software owned by or under license to EVERTEC, or should EVERTEC be required to procure hardware, software or other items in order to perform the Services in accordance with the Specifications, (i) COMPANY, BPPR, or one of their respective Subsidiaries may subscribe to a separate license agreement for such software; and/or (ii) without limiting EVERTEC’s responsibilities or liabilities under this Master Agreement, EVERTEC will pass through and assign to COMPANY, BPPR, or one of their respective Subsidiaries all warranties provided by the manufacturer(s) and/or licensor(s) of such items; provided, however that all disclaimers and/or limitations of liabilities relating to such software, hardware or other items will be deemed extended to include EVERTEC.

-34-

2.7          Modifications to Services.

(a)          Subject to Section 8.2, EVERTEC reserves the right to change, modify, enhance or upgrade the manner in which it renders the Services, at any time, provided, however, that any change, modification, enhancement or upgrade does not adversely affect the functionality of the Services, the fees for such Service or the agreed upon Service Levels, as applicable, and provided that (i) EVERTEC provides written notice of such modification to COMPANY and BPPR at least forty-five (45) days prior to implementation of any such change, modification, enhancement or upgrade, (ii) such notice describes in reasonable detail the change, modification, enhancement or upgrade to be made by such modification and EVERTEC promptly answers any reasonable inquiries of COMPANY, BPPR, or one of their respective Subsidiaries regarding such change, modification, enhancement or upgrade and (iii) neither COMPANY nor BPPR delivers a written notice to EVERTEC prior to such implementation that it reasonably believes that such change, modification, enhancement or upgrade would be likely to adversely affect its or one of its Subsidiaries’ compliance with applicable Legal Requirements.

(b)          Any change, modification, enhancement or upgrade requested or required by COMPANY or BPPR that is not a Mandatory Enhancement or a Supplemental Mandatory Enhancement (a “Requested Enhancement”) will require written notice to EVERTEC.  Upon receipt of such notice, EVERTEC will exercise Best Efforts to prepare and present to COMPANY or BPPR, as soon as possible, a written estimate of the costs for the Requested Enhancement and any adjustment in fees that may be necessary as a result thereof.  EVERTEC’s Best Efforts will take into consideration the business needs of COMPANY, BPPR, and their respective Subsidiaries and any timeframes for implementation related thereto.  COMPANY, BPPR, and their respective Subsidiaries may decide that the Requested Enhancement will not be developed by EVERTEC and this Master Agreement will continue in full force in effect under the then current terms and conditions, and COMPANY, BPPR, and their respective Subsidiaries shall, notwithstanding anything to the contrary contained in this Master Agreement but subject to the terms and conditions of the Technology Agreement, be permitted to develop such Requested Enhancement themselves or engage a Third Party, in each case at no cost or expense to EVERTEC.  Following the completion of such development, EVERTEC shall, if requested by COMPANY or BPPR, cooperate in good faith and otherwise use its Best Efforts to implement the Requested Enhancement at the then present rates in Exhibit B.  If implementation of the Requested Enhancement results in a material increase in costs to EVERTEC as opposed to the provision of the applicable Service without such Requested Enhancement, (i) EVERTEC will provide COMPANY and BPPR with a reasonably detailed explanation of the incremental costs for implementing and operating such Requested Enhancement and (ii) any adjustments to the fees necessary to address such incremental costs shall be agreed among the parties in good faith.

(c)          Without limiting the terms in Sections 2.7(a) and (b), if EVERTEC intends to replace any product used to provide the Services under this Master Agreement with an alternate product, EVERTEC will provide COMPANY and BPPR with at least 180 days’ notice of the replacement.

-35-

2.8          Mandatory Enhancements.

(a)          Subject to Section 8.2 and the remainder of this Section 2.8, EVERTEC will provide changes, modifications, enhancements or upgrades to the Services to ensure that those Services permit COMPANY, BPPR, or their respective Subsidiaries to comply with mandatory changes in COMPANY’s, BPPR’s, or their respective Subsidiaries’ applicable Legal Requirements, including as requested by COMPANY, BPPR or their respective Subsidiaries (the “Mandatory Enhancements”).

(b)          EVERTEC shall notify COMPANY and BPPR of its intention to implement a Mandatory Enhancement as soon as practicable following EVERTEC’s becoming aware of such Mandatory Enhancement and, in the 30 days following such notice, shall (i) consult with COMPANY and BPPR, as well as other EVERTEC customers affected by the relevant Mandatory Enhancement, regarding the interpretation of the relevant Legal Requirements as well as the strategy for implementation of the Mandatory Enhancement and (ii) provide an initial estimate of the potential applicable costs. If the Mandatory Enhancement is to be funded or used exclusively by or for COMPANY or BPPR or their Affiliates (an “Exclusive Mandatory Enhancement”), the Mandatory Enhancement will reflect COMPANY and BPPR’s interpretation and requirements for the Mandatory Enhancement. If the Mandatory Enhancement is not an Exclusive Mandatory Enhancement, the design and implementation of the Mandatory Enhancement shall be based on EVERTEC’s reasonable interpretation of any relevant Legal Requirement applicable to EVERTEC (taking into account input from COMPANY and BPPR) and its understanding of the Services affected thereby.

(c)          EVERTEC may charge COMPANY or BPPR at the time and material rates set forth in Exhibit B, as applicable, for development hours expended on Mandatory Enhancements for COMPANY, BPPR, or any of their respective Subsidiaries on a prorated basis. The costs will be proportionately allocated among EVERTEC’s affected customers. Any such charges shall be disclosed to COMPANY and BPPR as soon as reasonably possible following the consultations described in Section 2.8(b), including a description of how they are to be calculated and allocated among COMPANY, BPPR, and their appropriate respective Subsidiaries, on the one hand, and EVERTEC’s other affected customers, on the other. If (i) COMPANY, BPPR or any applicable Subsidiary thereof inform EVERTEC in writing that they are not subject to the Legal Requirement that is the subject of a given Mandatory Enhancement within 30 days following EVERTEC’s notice in clause (b) above, or (ii) COMPANY or BPPR elect not to use the Mandatory Enhancement by provision of written notice within 45 days following EVERTEC’s notice in clause (b) above, COMPANY, BPPR, and their appropriate respective Subsidiaries shall not be charged any development fees for such enhancement and EVERTEC may determine, in its sole discretion, to not make such enhancement available to COMPANY, BPPR and their Subsidiaries.

(d)          In the event that COMPANY, BPPR, or any of their respective Subsidiaries requests other changes, modifications, enhancements or upgrades to the Services that are different from or in addition to, but requested in connection with, Mandatory Enhancements (the “Supplemental Mandatory Enhancements”), then, provided EVERTEC agrees to make such changes, modifications, enhancements or upgrades (which agreement shall not be unreasonably delayed, withheld or conditioned), COMPANY, BPPR, or any of their respective Subsidiaries that request a Supplemental Mandatory Enhancement shall be charged a development fee at the time and material rates specified in Exhibit B, as applicable.

-36-

(e)          EVERTEC may charge COMPANY, BPPR, or any of their respective Subsidiaries that request a Supplemental Mandatory Enhancement an ongoing usage fee for any new Service resulting from (i) Mandatory Enhancements (provided that if such Mandatory Enhancements are provided to EVERTEC’s other customers, such charges may be imposed solely to the extent charged to such other customers), or (ii) Supplemental Mandatory Enhancements.

(f)          For the avoidance of doubt, COMPANY, BPPR, or any of their respective Subsidiaries can develop themselves or use a Third Party for any Requested Enhancement, Mandatory Enhancement or a Supplemental Mandatory Enhancement; subject to and in accordance with Section 2.1(c).

2.9          Non-Circumvention Covenants.

(a)          EVERTEC agrees that it shall not, and shall cause its Affiliates not to, directly initiate or procure any negotiations or contacts with any Client of COMPANY, BPPR, or any of their respective Subsidiaries that are designed or intended to:

(i)         induce, cause, or propose to any such Client to terminate any of the accounts and/or any other business relationships such Client may have directly with COMPANY, BPPR, or any of their respective Subsidiaries (including accounts or relationships for which COMPANY, BPPR, or any of their respective Subsidiaries shall have engaged EVERTEC to provide any of the Services), or

(ii)        induce, cause, or propose to any Client of COMPANY, BPPR, or any of their respective Subsidiaries to (A) reduce or curtail the amount or type of services or goods that COMPANY, BPPR, or any of their respective Subsidiaries provides or sells to such Client, (B) reduce the amount of business with, prices paid by, or revenue from, a Client or (C) to seek to transfer such accounts and/or business relationships from COMPANY, BPPR, or their respective Subsidiaries to another Person.

(b)          The Popular Parties agree that they shall not, nor cause any of their respective Subsidiaries to, directly initiate or procure any negotiations or contacts with any of EVERTEC’s clients to which EVERTEC provides services that are substantially similar to the Services provided to the Popular Parties under this Master Agreement or any service providers of EVERTEC identified on Schedule 2.9 with respect to the application(s) listed for each such service provider in Schedule 2.9 that are designed or intended to:

(i)       induce, cause, or propose to any such client or service provider to terminate any of the accounts and/or any other business relationships such client or service provider may have directly with EVERTEC, or

-37-

(ii)       induce, cause, or propose to any such client or service provider of EVERTEC to (A) reduce or curtail the amount or type of services or goods that EVERTEC provides or sells to such client or receives from such service provider, (B) reduce the amount of business with, prices paid to, or revenue from, a client, (C) reduce the amount of business with, or increase the prices paid to a service provider, or (D) seek to transfer such accounts and/or business relationships from EVERTEC to another Person;

(iii)      provided, that the mere fact that COMPANY, BPPR, or one of their respective Subsidiaries shall have engaged EVERTEC to provide any of the Services to its Clients will not cause such Clients to be considered “clients” or “accounts” and/or “business relationships” of EVERTEC for purposes of this Section 2.9.

(c)          Nothing in this Section 2.9 shall be interpreted to preclude or prevent either party from (i) distributing marketing materials on its products and services to the general public; (ii) engaging one or more third parties to provide services to such party in connection with a transition or termination of the Services or services provided under other agreements between the parties; or (iii) responding to requests for products and services from the other party’s respective clients or other Persons, but, in the case of EVERTEC, subject to the limitations imposed under Section 2.10(a). In addition, nothing in paragraphs (a) or (b) of this Section 2.9 shall be interpreted to preclude or prevent EVERTEC from entering into any agreement with a Person in the same industry or a similar industry which offers similar products or services as COMPANY (a “Competitor”) pursuant to which such Competitor will provide to its clients any one or more services similar to the Services; provided, however, that EVERTEC in its dealings with such Competitor shall at all times comply with its confidentiality obligations under this Master Agreement. The provision of services pursuant to the ISO Agreement or pursuant to an exception expressly set forth in the ISO Agreement will not be deemed a breach of this provision.

(d)         Neither party shall instruct or intentionally procure a third party to take actions that would, if taken by such party directly, violate this Section 2.9.

2.10          Non-Compete Covenants.

(a)          Notwithstanding the provisions of Section 2.9, EVERTEC agrees that, without COMPANY’s, or its relevant Subsidiary’s, prior written consent, it shall not offer, provide or market any of the Restricted Payment Processing Services (as defined below) to any of the Strategic Clients (as defined below). With respect to Restricted Payment Processing Services for which COMPANY or its relevant Subsidiaries have provided such written consent, the parties agree that they shall cooperate with each other to provide, offer and market the Restricted Payment Processing Services to Strategic Clients. In the event that BPPR ceases to offer a service included in the definition of “Restricted Payment Processing Services” to a Strategic Client, such service shall no longer be included in the list of Restricted Payment Processing Services with respect to such Strategic Client, and EVERTEC shall be permitted to offer such service to such Strategic Client without any restriction.  In the event that BPPR offers any service not provided by EVERTEC that has features and functionalities that are materially similar to those of any service included in the definition of “Restricted Payment Processing Services” to any of its clients, such service shall no longer be included in the list of Restricted Payment Processing Services and EVERTEC shall be permitted to offer such service without any restriction.

-38-

(b)          For purposes of this Section 2.10(b):

(i)         “Restricted Payment Processing Services” means the payment processing services offered by COMPANY, BPPR, or one of their respective Subsidiaries to Clients as of the Effective Date, and that are listed below:

(1) Multi Merchant Pay

(2) Call Center Pay

(3) Kiosk

(4) Check-Out Payment

(5) PER/PER WEB

(6) Lockbox Retail/Wholesale

(7) Telepago Online

(8) IVRU

(9) Payment Station

(10) Payments on BPPR ATMs

(11) Any other payment or collection services, other than such services for which BPPR receives, or has been offered and refused to receive, (i) Interchange Fees and (ii) MAB Revenue Sharing, P2B Revenue Sharing (as each such term is defined in the ISO Agreement), or any other revenue sharing arrangement that is no less favorable to BPPR than the terms of the MAB Revenue Sharing and P2B Revenue Sharing (as each such term is defined in the ISO Agreement).

(ii)        “Strategic Clients” means the Clients listed in Exhibit D hereto, which shall be subject to the provisions of this Section 2.10 so long as such Clients maintain an account and/or business relationship with COMPANY, BPPR, or one of their respective Subsidiaries. Exhibit D may be amended only with the prior written consent of COMPANY and EVERTEC.

2.11          Equipment and Other Resources.

(a)         EVERTEC will retain all right, title or interest in any EVERTEC equipment supplied to COMPANY, BPPR, or any of their respective Subsidiaries as part of the Services (“EVERTEC Equipment”), and no ownership rights in such EVERTEC Equipment will transfer to COMPANY, BPPR, or any of their respective Subsidiaries. COMPANY, BPPR, and their respective Subsidiaries will, as applicable, provide a suitable and secure environment, free from environmental hazards, and electric power for such EVERTEC Equipment located in premises operated or controlled by COMPANY, BPPR, or one of their respective Subsidiaries, and will keep EVERTEC Equipment free from all liens, charges, and encumbrances. COMPANY, BPPR, and their respective Subsidiaries, as applicable, will bear the risk of loss of or damage to EVERTEC Equipment (ordinary wear and tear excepted) from any cause except to the extent caused by EVERTEC or its suppliers. COMPANY, BPPR, and their respective Subsidiaries agree that they will not remove, relocate, modify, or interfere with EVERTEC Equipment, or attach EVERTEC Equipment to non-EVERTEC equipment without prior written authorization from EVERTEC.

-39-

(b)          Title to and risk of loss of any equipment purchased from EVERTEC will pass to COMPANY, BPPR, or their respective Subsidiaries as of delivery, upon which date EVERTEC will have no further obligations of any kind with respect to such purchased equipment, except as set forth in a document executed by the appropriate parties.

(c)          All ownership or leasehold interest in a party’s facilities, and associated equipment used in connection with the Services, will at all times remain with that party.

(d)          If any equipment, software or other COMPANY Third Party Intellectual Property or other Intellectual Property of COMPANY, BPPR, or any of their respective Subsidiaries (“COMPANY Resources”) is made available by COMPANY or BPPR to EVERTEC under this Master Agreement: (i) COMPANY, BPPR, or their appropriate respective Subsidiaries, hereby grants EVERTEC a non-transferable and non-exclusive license to use such COMPANY Resources solely in the manner necessary to provide the Services under this Master Agreement, subject to any restrictions and other terms in the BPPR Pass Through Licenses or that otherwise may be provided in this Master Agreement or by COMPANY or BPPR to EVERTEC in writing; and (ii) EVERTEC will not use or access the COMPANY Resources for any purpose other than providing the Services under this Master Agreement.

2.12          Import/Export Control.

(a)          The parties acknowledge that equipment, products, software, and technical information (including technical assistance and training) provided under this Master Agreement may be subject to import or export laws, conventions or regulations, and any use or transfer of the equipment, products, software, and technical information must be in compliance with all such laws, conventions and regulations. The parties will not use, distribute, transfer, or transmit the equipment, products, software, or technical information (even if incorporated into other products) except in compliance with such laws, conventions and regulations. If requested by either party, the other party agrees to sign written assurances and other documents as may be required to comply with such laws, conventions and regulations.

(b)          In the event any necessary import or export license cannot be obtained within six (6) months after making an application, no party will have further obligations with respect to providing or purchasing and, if applicable, COMPANY, BPPR, or one of their respective Subsidiaries will return the equipment, products, software, or technical information that is the subject matter of the unsuccessful application.

-40-

2.13          Contingency Planning.

(a)          Each party acknowledges that it is responsible for maintaining in effect at all times during the Term appropriate Business Continuity Plans for their respective Systems, personnel, and operations in compliance with applicable Legal Requirements and Industry Standards.

(b)          EVERTEC represents and warrants that it:

(i)       has, as of the Effective Date, and shall at all times during the Term maintain updated Business Continuity Plans designed to minimize the risks associated with an Event affecting EVERTEC’s ability to continue to provide the Services in compliance with this Master Agreement;

(ii)         will implement its applicable Business Continuity Plans upon the occurrence of an Event; and

(iii)      shall resume the affected Services within the Recovery Time Objectives and Recovery Point Objectives established as of the Effective Date, including those provided in Disaster Recovery Services Addendum or other applicable SOWs and Schedules, or as may subsequently be agreed to between the parties for the Services.

(c)          EVERTEC may continue using its alternate site in Puerto Rico solely for Services covered by that site as of the Effective Date until the parties agree in an SOW to migrate those Services to another site outside of Puerto Rico. EVERTEC will use alternate sites located outside of Puerto Rico for any additional Services added to the Business Continuity Plan.

(d)          The Business Continuity Plans must include a Disaster Recovery Plan and a Disaster Recovery Strategy. Such Business Continuity Plans must address, at a minimum, responsibilities and required skills for Personnel and Third Party service providers; solutions to foreseeable disruptions, including those emanating from cyber threats; escalation thresholds; immediate steps to protect Personnel and customers and minimize damage; prioritization and procedures to recover functions, services, and processes; critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage); logistical arrangements (e.g., housing, transportation, or food) for Personnel at the recovery locations; network equipment, connectivity and communication needs, including entity-owned and personal mobile devices; Personnel at alternate Data Center sites, including arrangements for those permanently located at the alternate Data Center facility; remote access from home; scope and frequency of testing; and resumption of a normalized state for business processes.

(e)          EVERTEC will review and, if necessary to reflect changes in the Services and to remain in compliance with the requirements in this Master Agreement, update its Business Continuity Plans at least once each year. Such updates shall (i) take into account any audits and test results, as well as changes to applicable Legal Requirements and Industry Standards; and (ii) not increase RTO or RPO times without BPPR’s prior written consent.

-41-

(f)          EVERTEC will provide BPPR with a summary of its Business Continuity Plans in effect on the Effective Date and will promptly provide BPPR with an updated summary upon any amendment thereof. Upon request, EVERTEC will also provide BPPR with access to the full Business Continuity Plans for review on-site or via another secure method agreed by the parties. Without BPPR’s prior written consent, EVERTEC will not make any amendments to its Business Continuity Plans that adversely affect BPPR’s rights under this Master Agreement or the Recovery Time Objectives or Recovery Point Objectives agreed to with BPPR.

(g)          EVERTEC will test the operability of its Business Continuity Plans, including all Systems and operations that support the Services, in the main and alternate Data Center sites, as well as the integrity of its applicable backup processes, at least once each year.  Within thirty (30) days after any Business Continuity Plan tests are conducted, EVERTEC will provide a summary of the results to BPPR; provided that (i) provision of such summary by EVERTEC shall be subject to, and limited by, applicable Legal Requirements, (ii) EVERTEC may redact from such results information relating to EVERTEC’s internal business or to EVERTEC’s other customers (to the extent the information does not also relate to COMPANY or BPPR), and (iii) EVERTEC shall not be obligated to provide any information if doing so would reasonably be expected to result in the waiver of any attorney-client or other legal privilege.

(h)          Upon COMPANY’s or BPPR’s reasonable request, EVERTEC shall make available to COMPANY or BPPR one or more Representatives who are knowledgeable about the Business Continuity Plans to respond to questions concerning EVERTEC’s Business Continuity Plans, the manner in which they are tested and the manner in which they would be implemented in an Event. In the event that COMPANY or BPPR determines that applicable Legal Requirements require additional disaster recovery services or modifications to EVERTEC’s existing Business Continuity Plans, EVERTEC agrees to cooperate with COMPANY and BPPR in assuring that its Business Continuity Plans comply with applicable Legal Requirements in accordance with Sections 8.1 and 8.2.

(i)          In addition to its own Business Continuity Plans, EVERTEC shall verify that its Data Subcontractors have documented plans providing appropriate terms for the implementation, maintenance and performance of their own business continuity and disaster recovery efforts related to the portion of the Services they provide and use Best Efforts to ensure that such plans are tested at least annually.

(j)          If the Services or any portion thereof are affected by an Event, EVERTEC will notify BPPR’s designated authorized representative as soon as practicable (and in any event within the timeframe required in the applicable SOW or Schedule or otherwise agreed with BPPR) after the activation of its Business Continuity Plan(s). If an Event gives rise to a business interruption that renders EVERTEC unable to provide the Services, or a critical portion thereof, and such interruption is expected to remain, or remains, unresolved for longer than the applicable RTO for the relevant Service BPPR may, in addition to other remedies provided in this Master Agreement, procure such Service from a Third Party without penalty, and upon request, EVERTEC will provide its cooperation in the transfer of the related activities and databases to another service provider without cost to BPPR for the duration of such business interruption.

2.14          Procedures Manual.

-42-

(a)        Subject to Sections 2.14(b), 2.14(c) and 2.14(d), EVERTEC will prepare and maintain a current set of documents that describe how EVERTEC provides, and COMPANY, BPPR and their Subsidiaries receive, the Services provided under this Master Agreement, and how the Services are integrated with COMPANY’s, BPPR’s and their Subsidiaries’ Systems and processes (including escalation procedures and contacts, applicable processing schedules, operations processes and manuals, user guides, applicable Specifications, equipment and software used and knowledge repositories) (collectively, the “Procedures Manual”).

(b)          To the extent components of the Procedures Manual do not exist as of the Effective Date, EVERTEC will create them either as a project under an SOW or as part of the Transition Assistance provided under Section 9.5, in each case at COMPANY’s or BPPR’s cost.  COMPANY or BPPR may request updates to the Procedures Manual on an annual basis pursuant to an SOW.

(c)          EVERTEC will provide COMPANY and BPPR with the Procedures Manual during any applicable Transition Period and otherwise upon request during the Term.

(d)        With respect to proprietary EVERTEC applications, EVERTEC will provide information about how COMPANY and BPPR use the products and receive the Services (e.g., configurations, integrations, escalation procedures, and rules specific to COMPANY and BPPR) but will not be required to provide Proprietary Application Information.  “Proprietary Application Information” means Confidential Information about EVERTEC’s internal processes and procedures, software code, or other proprietary service delivery materials, in each case as they relate to proprietary EVERTEC applications.

ARTICLE THREE– PAYMENT FOR SERVICES

3.1          Fees.

(a)         In consideration for EVERTEC providing COMPANY, BPPR, and their respective Subsidiaries the Services, each of COMPANY and BPPR agrees to pay, or cause one of its respective Subsidiaries to pay, EVERTEC the corresponding fees set forth in Exhibit B, subject to adjustment as set forth in Section 3.1(b). The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, the pricing relative to any and all Services will be set forth in Exhibit B, which will serve as a master list of the Services and corresponding pricing. The parties agree that Exhibit B will be reviewed and updated on an ongoing basis following the Effective Date hereof. Any changes to the fees set forth in Exhibit B (other than the adjustments described in Section 3.1(b)) shall be agreed to by both parties by executing an amended and restated Exhibit B clearly denoting the date any such changes become effective.

(b)          The fees set forth in Exhibit B shall be adjusted annually as follows:

(i)         on September 30 of each of 2022, 2023, 2024 and 2025, the fees will be adjusted for changes in the CPI in the prior twelve (12) months; provided that the fee adjustment cannot be negative, nor can it exceed one and one half percent (1.5%) per annum; and

-43-

(ii)        on September 30 of any year thereafter, the fees will be adjusted based on the following formula: any changes in the CPI in the prior twelve (12) months less 2%; provided that the fee adjustment cannot be negative, nor can it exceed two percent (2%) on any given year.

(c)          Notwithstanding anything in this Master Agreement to the contrary, (i) fees charged under the ATH Network Agreement shall be subject to CPI adjustments under such agreement and not under Section 3.1(b), it being understood, for clarity, services provided under the ATH Network Agreement shall not be included on Exhibit B, and (ii) no adjustment pursuant to Section 3.1(b) shall apply to fees charged with respect to any Service that has been provided for less than twelve (12) months prior to the applicable annual adjustment under this Master Agreement unless otherwise agreed to in writing.

(d)          All fees set forth in Exhibit B or elsewhere in this Master Agreement or an SOW will be reduced by ten percent (10%) from their then current amounts effective October 1, 2025, unless an applicable SOW executed after the Effective Date specifically states that will not be subject to this adjustment.  For clarification, the reduced fees will remain subject to the adjustments set forth in Section 3.1(b)(ii) above in subsequent years.

3.2          Terms of Payment. EVERTEC will send an invoice directly to COMPANY, on or before the fifteenth (15^th) day of the month following the month in which the Services are rendered, reflecting the fees and other charges to COMPANY, BPPR, and their respective Subsidiaries for the preceding month. COMPANY, BPPR, or one of their respective Subsidiaries, as stated on the invoice, will pay to EVERTEC all undisputed amounts due under this Master Agreement within thirty (30) days from the date of receipt of the invoice, unless otherwise agreed to by the parties for a particular Service in writing. Any undisputed amount due under this Master Agreement that is not paid when due will thereafter bear interest at an annual rate of interest equal to one and a half percent (1.5%), but in no event shall exceed the maximum rate of interest allowed under any Legal Requirement. COMPANY and BPPR agree that, if any properly submitted invoice remains unpaid and undisputed for a period exceeding sixty (60) days, EVERTEC may (i) refuse to provide the Services until such time as all past due amounts are paid in full or (ii) terminate this Master Agreement in accordance with and subject to Section 9.2(a)(ii).

3.3          Services Rendered during Legal Holidays. Unless agreed to otherwise in writing, upon request of COMPANY or BPPR, and provided EVERTEC has available resources to comply therewith, EVERTEC will provide the Services to COMPANY, BPPR, and their respective Subsidiaries during Legal Holidays for the fees set forth in Exhibit B or the corresponding Service Addendum, as applicable.

3.4          Additional Services. If COMPANY, BPPR, or one of their respective Subsidiaries’ fail to perform their respective responsibilities under this Master Agreement, EVERTEC will promptly notify COMPANY and BPPR of the failure.  If COMPANY and BPPR do not remediate the failure after receiving such notice, EVERTEC may charge COMPANY and BPPR for out-of-pocket costs EVERTEC is required to incur to perform services over and above the Services listed in Exhibit B of this Master Agreement as a result of COMPANY and BPPR’s failure (e.g., costs for computer and personnel time, equipment, supplies, and other items). EVERTEC will obtain COMPANY or BPPR written approval prior to incurring any such expenses; provided that until such approval is obtained EVERTEC shall not be responsible for performing any of the affected Services.

-44-

3.5         Out-of-pocket and Third Party Expenses. With COMPANY’s or BPPR’s prior written approval, additional costs related to delivery and/or collection, telecommunications (other than the telecommunication installation and maintenance services set forth in Exhibit B) or other incidental services, as well as necessary and reasonable services to be provided through EVERTEC by Third Parties, for COMPANY, BPPR, or one of their respective Subsidiaries’ benefit, incurred during the Term and that are not contemplated in any of the established fees, costs, or charges, will be paid by COMPANY, BPPR, or one of their respective Subsidiaries, as applicable, when invoices and related documents are duly presented. All such out-of-pocket or Third Party charges and administration costs related to the Services will be billed by EVERTEC to COMPANY, BPPR, or one of their respective Subsidiaries at an amount equal to cost; provided that to the extent COMPANY, BPPR, or one of their respective Subsidiaries sets forth any limitations on such charges and costs, COMPANY, BPPR, and their respective Subsidiaries shall not be billed for amounts in excess of such limitations.

3.6           Taxes. EVERTEC will be solely responsible for the payment of any income tax, gross receipt tax or municipal license tax related to the fees and charges paid by the Popular Parties under this Master Agreement.  If the Popular Parties are required by any Legal Requirements to withhold taxes on the fees and charges paid to EVERTEC, the Popular Parties will deduct such taxes and pay them to the appropriate taxing authority unless EVERTEC provides evidence of an exemption or waiver.  The Popular Parties will provide EVERTEC proof of payment of the taxes attributable to the Services rendered under this Master Agreement as provided by applicable Legal Requirements. Notwithstanding the foregoing, the Popular Parties’ failure to withhold any applicable taxes, in whole or in part, will not relieve EVERTEC of its responsibility to pay any such taxes when due. The Popular Parties will be responsible for the payment of sales and use taxes, value added, and any other tax as provided by applicable law or regulation and related to the fees and charges paid to EVERTEC.  When applicable, EVERTEC will include such sales and use taxes, or any other applicable tax, as a separate line item on all applicable invoices.

3.7          Disputed Charges; Requests for Information.

(a)          Each of COMPANY, BPPR, and their respective Subsidiaries may withhold payment of specific charges within a given invoice that it in good faith disputes or for which it may require additional information from EVERTEC to verify the amounts being charged, provided that COMPANY, BPPR, or such Subsidiary delivers to EVERTEC a written statement on or before the date in which such payment is due, describing in reasonable detail (i) the specific charge or charges being disputed and the basis of the dispute, (ii) if applicable, the supporting documentation that is reasonably required for verification of the charge or charges, and (iii) the amount being withheld.

(b)          A charge will be deemed “undisputed” if COMPANY, BPPR, and their respective Subsidiaries do not deliver the aforementioned written statement within the time period provided in this Section 3.7.

-45-

(c)          Notwithstanding the foregoing, the parties will have the right to review invoices generated hereunder and claim any under charged or over paid amounts. The parties shall make any such claims within one hundred and twenty (120) days following the date of the invoice.

(d)        Any Dispute related to the charges or fees payable under this Master Agreement, if not settled by the parties, shall be resolved in accordance with Section 1.14 hereof.

3.8          Supporting Documentation. EVERTEC will maintain, at its sole cost, supporting documentation for the amounts billable to, and payments made by, COMPANY, BPPR, and their respective Subsidiaries hereunder in accordance with its practices prior to the Effective Date and applicable record retention requirements. COMPANY and BPPR will have the right to request supporting documentation of any invoice submitted, paid or disputed, at any time, and EVERTEC agrees to cooperate by providing such the supporting documentation at no cost.  For the sake of clarity, invoices may only be disputed during the time period provided in Section 3.7.

3.9          No Right to Set-Off. COMPANY, BPPR, and their respective Subsidiaries shall pay to EVERTEC the full amount of undisputed charges and any disputed charges that are resolved in favor of EVERTEC and other amounts required to be paid by COMPANY, BPPR, and their respective Subsidiaries under this Master Agreement and COMPANY, BPPR, and their respective Subsidiaries shall not set-off, counterclaim or otherwise withhold any amount owed or claimed to be owed to EVERTEC under this Master Agreement on account of any obligation owed by EVERTEC or any of its Subsidiaries, whether or not such obligation has been finally adjudicated, settled or otherwise agreed upon in writing.

3.10          Core API Layer SOW

(a)          The parties agree as follows, notwithstanding anything in this Master Agreement to the contrary:

(i)          Twenty percent (20%) of all fees otherwise payable to EVERTEC pursuant to the Core API Layer SOW shall be withheld until EVERTEC has delivered 100% of all Core Banking APIs (as defined in the Core API Layer SOW), has completed all database integrations required under the Core API Layer SOW, and has exposed all APIs required to be exposed on the Amazon Web Services environment as required thereunder, and BPPR has received a certification from a mutually agreed third-party regarding the delivery of 100% of all Core Banking APIs (the “Core API Completion”).  If the Core API Completion has not occurred on or prior to the Core API Deadline, then (A) thirty five percent (35%) of any fees otherwise payable pursuant to the Core API Layer SOW after the Core API Deadline shall be withheld until the Core API Completion.  Any amount withheld by BPPR in accordance with this Section 3.10(a)(i) shall not exceed $500,000 and will be paid by BPPR promptly following the Core API Completion.

-46-

(ii)         Subject to Section 3.10(c), if the Core API Completion has not occurred on or prior to the Core API Deadline, then BPPR shall be entitled to be paid the following amounts from EVERTEC, each of which amounts shall begin accruing with the month immediately following the month in which the Core API Deadline occurs: (x) fifty thousand dollars ($50,000) for each of the first three (3) months; (y) one hundred thousand dollars ($100,000) for each of fourth (4th) through sixth (6th) months; and (z) one hundred fifty thousand dollars ($150,000) for each month thereafter.  Any amount which BPPR is entitled to be paid in accordance with this Section 3.10(a)(ii) will be applied as a credit against any amounts due to EVERTEC under this Master Agreement; provided, that after June 30, 2028, and following any termination of this Master Agreement, BPPR may elect to receive such amount as a cash payment rather than a credit in which case EVERTEC will make such cash payment within thirty (30) days of a request from BPPR.

-47-

(b)          The Popular Parties’ rights under this Section 3.10 are in addition to, and shall in no way limit, the Popular Parties’ termination rights under Section 9.3(d)(i) in connection with a failure to meet the Core API Deadline.  In no event shall the Popular Parties’ exercise of its rights under this this Section 3.10 or Section 9.3(d)(i) diminish or waive in any manner Popular Parties’ rights under the Core API Layer SOW or EVERTEC’s obligations thereunder.

3.11          Phase 2 SOW.  Each party shall use commercially reasonable efforts to complete, execute and deliver the Phase 2 SOW as promptly as practicable after the date hereof and in any case within sixty (60) days after the date hereof.  All out-of-pocket and internal costs incurred by the parties in connection with the Phase 2 SOW shall be borne fifty percent (50%) by the Popular Parties and fifty percent (50%) by EVERTEC.

-48-

ARTICLE FOUR– DISCLAIMER OF WARRANTIES & LIMITED LIABILITY

4.1        DISCLAIMER OF WARRANTIES. EXCEPT AS EXPLICITLY PROVIDED IN THIS MASTER AGREEMENT (INCLUDING IN ANY SERVICE ADDENDUM OR EXHIBIT):

(a) THE SERVICES AND ANY EQUIPMENT PROVIDED UNDER THIS MASTER AGREEMENT ARE PROVIDED ON AN “AS IS”, “AS AVAILABLE” BASIS;

(b) THE PARTIES ACKNOWLEDGE THAT GIVEN THE SERVICES (INCLUDING ANY EQUIPMENT) MAY DEPEND TO SOME EXTENT ON COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES’ OWN COMPUTER SYSTEMS, EVERTEC DOES NOT MAKE ANY WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.

(c) EVERTEC DOES NOT MAKE ANY WARRANTIES OF ANY KIND WITH RESPECT TO LOSS OR CORRUPTION OF DATA, LOSS OR DAMAGE TO EQUIPMENT AND/OR SOFTWARE, SYSTEM RESPONSE TIMES, TELECOMMUNICATION LINES OR OTHER COMMUNICATION DEVICES, QUALITY, AVAILABILITY, RELIABILITY, SECURITY ACCESS DELAYS OR ACCESS INTERRUPTIONS, NOR COMPUTER VIRUSES, BUGS OR ERRORS.

(d) EVERTEC DOES NOT MAKE ANY WARRANTIES THAT THE SERVICES WILL NOT BE INTERRUPTED OR ERROR FREE OR AS TO THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THE SERVICES AND EVERTEC ASSUMES NO RESPONSIBILITY OR LIABILITY IF TELECOMMUNICATION CARRIERS ARE NOT AVAILABLE AT ANY GIVEN TIME.

(e) EVERTEC, ITS AFFILIATES, AND THEIR RESPECTIVE REPRESENTATIVES ARE NOT LIABLE, AND EXPRESSLY DISCLAIM ANY LIABILITY FOR THE CONTENT OF ANY DATA OF COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES THAT IS TRANSFERRED BY COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES TO THE SERVICES PROVIDED BY EVERTEC.

4.2          Reliance on COMPANY Provided Data. In performing the Services, EVERTEC will be entitled to rely upon the data, information, instructions, or Specifications provided by COMPANY, BPPR, and their respective Subsidiaries and, therefore, will not be liable to COMPANY, BPPR, and their respective Subsidiaries in the same accord as set forth herein as a limitation of liability, should EVERTEC perform in accordance with such data, information or instructions received from COMPANY, BPPR, and their respective Subsidiaries. If any error results from incorrect input supplied by COMPANY, BPPR, and their respective Subsidiaries, COMPANY, BPPR, and their appropriate respective Subsidiaries will be responsible for discovering and reporting such error and supplying the data necessary to correct such error to EVERTEC, in which case, EVERTEC will exercise Best Efforts to correct the error at COMPANY, BPPR, and their appropriate respective Subsidiaries’ sole expense.

-49-

4.3          Force Majeure.

(a)        Subject to Section 4.3(b) below, neither party will be liable under this Master Agreement as a result of any delay or failure in the performance of its obligations (except for payment of money) to the extent such performance is prevented, frustrated, hindered or delayed as a result of an extraordinary event that is beyond the party’s reasonable control, including strikes, shortages, riots, fires, floods, storms, hurricanes, epidemics, pandemics, earthquake, acts of God, hostilities or other similar events or disasters, and actions taken by Governmental Authorities in response thereto (including any quarantine, ‘shelter in place,’ ‘stay at home,’ shut down, closure, sequester or similar Legal Requirement); provided, that the non-performing party is without material fault in causing such delay or failure (a “Force Majeure Event”).

(b)          This Section 4.3 exclusion of liability will only apply if, and to the extent, the party experiencing the Force Majeure Event exercises Best Efforts to mitigate and minimize the impact of the event on its obligations and follows its Business Continuity Plan, if applicable. The non-performing party will be excused from performance of the obligations so affected (including any obligations with respect to applicable Service Levels) for as long as such circumstances prevail, and the non-performing party continues to use Best Efforts to recommence performance.

(c)          In the event of an occurrence of a Force Majeure Event, the affected party shall give notice of suspension to the other party’s designated authorized representative as soon as reasonably practicable after the activation of the Business Continuity Plan or of becoming aware of such Force Majeure Event, stating the date and extent of such suspension and the cause thereof, and the affected party shall resume the performance of such obligations as soon as reasonably practicable after the removal of such cause. If a Force Majeure Event lasts more than fourteen (14) days, BPPR shall (i) not be required to pay for Services it does not receive; and (ii) be entitled to seek (at BPPR’s own expense) an alternative service provider on a temporary basis with respect to any Service(s) that EVERTEC is unable to provide. EVERTEC shall support such temporary transition. COMPANY and BPPR may terminate any Service upon notice to EVERTEC if EVERTEC is unable to provide the Service for more than 30 days as a result of a Force Majeure Event.

4.4          Systems and/or Services Not Provided by EVERTEC. To the extent COMPANY, BPPR, or their respective Subsidiaries perform any services themselves or use their own software, hardware, communications devices, Internet services, e-mail systems or other systems or, in the alternative, retain Third Parties to provide such services and systems, the parties acknowledge and agree that terms of this Master Agreement will not be deemed to impose on EVERTEC any obligation to obtain from owners of such systems any licenses or agreements that are necessary in order for EVERTEC to interface the Services with such systems. Nor will EVERTEC have any responsibility or liability in connection with such services or systems not provided by EVERTEC. COMPANY, BPPR, or their respective Subsidiaries will be solely responsible for the installation, operation, maintenance, use, and compatibility of such systems and services. In the event that such systems or services impair COMPANY, BPPR, and their respective Subsidiaries’ use of any Services: (a) COMPANY, BPPR, and their respective Subsidiaries will nonetheless be liable for payment for such Services provided by EVERTEC, and (b) any Specifications generally applicable to the Services will not apply to the extent they are affected by such impairment.

-50-

4.5          LIMITATION OF LIABILITY.

(a)       EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, EVERTEC AND ITS SUBSIDIARIES SHALL NOT BE LIABLE TO COMPANY, BPPR, OR ANY OF THEIR RESPECTIVE AFFILIATES PURSUANT TO THIS MASTER AGREEMENT FOR (1) ANY SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, REMOTE OR SPECULATIVE DAMAGES OR LOSSES, INCLUDING LOSS OF PROFITS OR ANTICIPATED PROFITS, OR ROYALTIES, INCLUDING ANY SUCH DAMAGES OR LOSSES THAT ARISE IN CONNECTION WITH ANY LOST DATA, OR (2) ANY OTHER BUSINESS OR OTHER ECONOMIC LOSS ARISING FROM OR RELATED TO ANY EQUIPMENT OR SOFTWARE OR ANY SERVICES, INCIDENTAL OR OTHERWISE, PROVIDED BY THIRD PARTIES (EXCEPT THOSE SERVICES PROVIDED BY A CONTRACTOR OR A SUBCONTRACTOR OF EVERTEC UNDER SECTION 1.16), OR (3) ANY THIRD PARTY CLAIM (EXCEPT AS OTHERWISE PROVIDED IN ARTICLE SEVEN, ARTICLE TEN, OR ANY OTHER INDEMNIFICATION OBLIGATIONS IN THIS MASTER AGREEMENT), IN EACH CASE (I) WHETHER FOR, AMONG OTHER THINGS, SUCH PARTY’S NEGLIGENCE OR MISCONDUCT, BREACH OF WARRANTY OR ANY OBLIGATION ARISING THEREFROM; (II) WHETHER LIABILITY IS ASSERTED IN, AMONG OTHER THINGS, CONTRACT OR TORT (INCLUDING NEGLIGENCE AND STRICT PRODUCT LIABILITY); (III) WHETHER OR NOT FORESEEABLE; AND (IV) WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE.

(b)      EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES SHALL NOT BE LIABLE TO EVERTEC OR ITS AFFILIATES PURSUANT TO THIS MASTER AGREEMENT FOR (1) ANY SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, REMOTE OR SPECULATIVE DAMAGES OR LOSSES, INCLUDING LOSS OF PROFITS OR ANTICIPATED PROFITS, OR ROYALTIES, INCLUDING ANY SUCH DAMAGES OR LOSSES THAT ARISE IN CONNECTION WITH ANY LOST DATA; (2) ANY OTHER BUSINESS OR OTHER ECONOMIC LOSS, IN EACH CASE, ARISING FROM OR RELATED TO ANY EQUIPMENT OR SOFTWARE NOT PROVIDED BY COMPANY, BPPR, OR THEIR RESPECTIVE SUBSIDIARIES, OR ANY SERVICES, INCIDENTAL OR OTHERWISE, PROVIDED BY THIRD PARTIES (EXCEPT THOSE SERVICES PROVIDED BY A CONTRACTOR OR SUBCONTRACTOR OF COMPANY, BPPR OR THEIR SUBSIDIARIES), OR (3) ANY THIRD PARTY CLAIM (EXCEPT AS OTHERWISE PROVIDED IN ARTICLE TEN OR ANY OTHER INDEMNIFICATION OBLIGATIONS IN THIS MASTER AGREEMENT), IN EACH CASE, (I) WHETHER FOR, AMONG OTHER THINGS, SUCH PARTY’S NEGLIGENCE OR MISCONDUCT, BREACH OF WARRANTY OR ANY OBLIGATION ARISING THEREFROM; (II) WHETHER LIABILITY IS ASSERTED IN, AMONG OTHER THINGS, CONTRACT OR TORT (INCLUDING NEGLIGENCE AND STRICT PRODUCT LIABILITY); (III) WHETHER OR NOT FORESEEABLE; AND (IV) WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE.

-51-

(c)         EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE OR TO THE EXTENT OTHERWISE PROVIDED UNDER ANY APPLICABLE LEGAL REQUIREMENTS, EACH PARTY’S LIMIT OF LIABILITY UNDER THIS MASTER AGREEMENT WILL BE AN AGGREGATE ANNUAL LIMIT EQUAL TO THE AMOUNT OF PAYMENTS MADE TO EVERTEC BY COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES FOR THE SERVICE FOR WHICH THE LIABILITY RELATES DURING THE TWELVE MONTHS PRIOR TO THE ACT, OMISSION OR EVENT THAT GIVES RISE TO THE CLAIM FOR LIABILITY (THE “GENERAL LIABILITY CAP”). NOTWITHSTANDING THE FOREGOING, FOR (X) LOSSES RELATED TO BREACHES OF CONFIDENTIALITY, PRIVACY AND DATA PROTECTION OBLIGATIONS UNDER THIS MASTER AGREEMENT AND THE ATH NETWORK AGREEMENT AND (Y) BPPR DATA BREACH COSTS (AS DEFINED IN THE ISO AGREEMENT), EACH PARTY’S LIMIT OF LIABILITY WILL BE AN AGGREGATE ANNUAL LIMIT EQUAL TO THE GREATER OF (I) THE APPLICABLE GENERAL LIABILITY CAP MULTIPLIED BY FIVE, AND (II) $50,000,000 (AS APPLICABLE, THE “DATA CAP”).

(d)          NOTHING IN THIS MASTER AGREEMENT SHALL EXCLUDE OR LIMIT EITHER PARTY’S LIABILITY: (I) FOR DEATH OR PERSONAL INJURY CAUSED BY SUCH PARTY’S NEGLIGENCE; OR (II) FOR INDEMNIFICATION OBLIGATIONS FOR CLAIMS OF INTELLECTUAL PROPERTY INFRINGEMENT PURSUANT TO ARTICLE SEVEN OF THIS MASTER AGREEMENT EXCEPT TO THE EXTENT SUCH A CLAIM ARISES DUE TO ACTS OR OMISSIONS OF A THIRD PARTY UNDER AN EVERTEC PASS THROUGH LICENSE, IN WHICH CASE EVERTEC’S LIABILITY TO BPPR OR COMPANY OR ANY OF THEIR RESPECTIVE AFFILIATES SHALL NOT EXCEED THE AMOUNTS ALLOCATED TO COMPANY AND BPPR PURSUANT TO SECTION 7.4(C).

(e)          EACH PARTY AGREES THAT (1) AMOUNTS PAID IN CONNECTION WITH THE DEFENSE OF THIRD PARTY CLAIMS, (2) AMOUNTS PAYABLE TO A THIRD PARTY PURSUANT TO COURT ORDER OR A SETTLEMENT ENTERED INTO IN ACCORDANCE WITH THE PROVISIONS OF THIS MASTER AGREEMENT; AND (3) FINES OR PENALTIES PAID TO A GOVERNMENTAL AUTHORITY, IN EACH CASE, IN CONNECTION WITH INDEMNIFICATION OBLIGATIONS WITH RESPECT TO THIRD PARTY CLAIMS UNDER ARTICLES SEVEN AND TEN ARE DEEMED TO BE DIRECT DAMAGES AND ARE NOT SUBJECT TO THE EXCLUSIONS IN SECTIONS 4.5(A) AND 4.5(B).

-52-

(f)          NOTWITHSTANDING ANY OTHER PROVISION OF THIS MASTER AGREEMENT, EVERTEC SHALL BE RESPONSIBLE FOR ALL REASONABLE AND CUSTOMARY OUT OF POCKET COSTS AND EXPENSES INCURRED BY COMPANY AND BPPR AND THEIR RESPECTIVE SUBSIDIARIES ARISING OUT OF OR IN CONNECTION WITH ANY BREACH OF THE CONFIDENTIALITY OR PRIVACY OR DATA PROTECTION PROVISIONS OF THIS MASTER AGREEMENT, OR CAUSED BY EVERTEC’S FRAUD, WILLFUL MISCONDUCT OR GROSS NEGLIGENCE (“REASONABLE AND CUSTOMARY COSTS”); PROVIDED THAT SUCH COSTS SHALL BE SUBJECT TO THE DATA CAP AS SET FORTH IN SECTION 4.5(C) ABOVE.  REASONABLE AND CUSTOMARY COSTS MAY INCLUDE THE FOLLOWING COSTS AND EXPENSES ASSOCIATED WITH ADDRESSING AND RESPONDING TO AN INCIDENT AND EACH SHALL BE TREATED AS DIRECT DAMAGES UNDER THIS SECTION 4.5: (I) PREPARATION AND MAILING OR OTHER TRANSMISSION OF NOTIFICATIONS TO AFFECTED INDIVIDUALS; (II) PREPARATION AND MAILING OR OTHER TRANSMISSION OF ANY OTHER COMMUNICATIONS TO CUSTOMERS, AGENTS, REGULATORS, LAW ENFORCEMENT AGENCIES OR OTHERS; (III) ESTABLISHMENT OF A CALL CENTER OR OTHER COMMUNICATIONS PROCEDURES IN RESPONSE TO SUCH VIOLATION (E.G., CUSTOMER SERVICE FAQS, TALKING POINTS AND TRAINING); (IV) COMMERCIALLY REASONABLE PUBLIC RELATIONS AND OTHER SIMILAR CRISIS MANAGEMENT SERVICES; (V) REASONABLE LEGAL AND ACCOUNTING FEES AND EXPENSES ASSOCIATED WITH INVESTIGATION OF AND RESPONSE TO SUCH EVENT; (VI) COSTS FOR COMMERCIALLY REASONABLE CREDIT REPORTING, CREDIT MONITORING, IDENTITY PROTECTION OR OTHER SIMILAR PRODUCTS AND SERVICES; (VII) CONDUCTING FORENSIC REVIEWS TO IDENTIFY THE CAUSE AND IMPACT OF THE INCIDENT, TO THE EXTENT COMPANY OR BPPR IS PERMITTED TO DO SO UNDER THIS MASTER AGREEMENT; (VIII) ADDITIONAL COMPUTER PROGRAMMING REQUIRED TO IDENTIFY OR PROTECT AFFECTED INDIVIDUALS OR OTHERWISE AS A RESULT OF THE INCIDENT; (IX) REMEDIATION ACTIVITIES REQUIRED BY A GOVERNMENTAL OR REGULATORY AUTHORITY; (X) CHARGES AND FINES ASSESSED OR IMPOSED BY PAYMENT CARD COMPANIES, INCLUDING UPON THE DATA SUBJECTS WHOSE PERSONAL INFORMATION WAS COMPROMISED AS A RESULT OF THE BREACH; (XI) GOVERNMENT FINES OR PENALTIES IMPOSED BY A GOVERNMENTAL OR REGULATORY AUTHORITY.

(g)          Each party hereby waives any claim that this Section 4.5 deprives it of an adequate remedy or cause this Master Agreement to fail of its essential purpose.

ARTICLE FIVE– CONFIDENTIALITY, PRIVACY & DATA PROTECTION

5.1          Confidential Information.

(a)          The parties acknowledge that in the course of their dealings each may receive (the “Receiving Party”) Confidential Information of the other party (the “Disclosing Party”). As such, the parties are willing to share such Confidential Information provided that the Receiving Party protects the Confidential Information of the Disclosing Party pursuant to the terms of this Master Agreement, and the Disclosing Party will remain the proprietor of the Confidential Information and any derivative thereof.

(b)         Confidential Information (other than Intellectual Property and Personal Data, which will always be deemed to be Confidential Information) will not include information that the Receiving Party can reasonably demonstrate:

(1) is or becomes generally available to the public without breach of any obligation of confidentiality under this Master Agreement or any confidentiality agreement that the Receiving Party may have with a Third Party;

-53-

(2) was already known to or was rightfully in the possession of the Receiving Party on a non-confidential basis prior to its disclosure by the Disclosing Party;

(3) becomes available to the Receiving Party from a Third Party, provided that such Third Party is not subject to an obligation of confidentiality with the Disclosing Party;

(4) is independently developed by the Receiving Party without reference to or reliance upon the Confidential Information of the other Party;

(5) is approved in writing by the Disclosing Party for disclosure; or

(6) is required to be disclosed by applicable Legal Requirements or by an applicable Governmental Authority, but only to the extent so required and solely for such purpose, and the Receiving Party shall otherwise remain obligated to treat such information as Confidential Information pursuant to this Article Five.

(c)          In any dispute with respect to these exclusions, the burden of proving that information is not Confidential Information will be on the party making such assertion.

5.2          Protection of Confidential Information.

(a)          The Receiving Party agrees to protect and hold all Confidential Information in strict confidence and protect all Confidential Information from unauthorized and/or inadvertent access, use, destruction or disclosure in full compliance with this Master Agreement and all applicable Legal Requirements and Industry Standards, including by implementing, maintaining and enforcing appropriate data and Systems security.

(b)          Unless in receipt of a specific written exemption from the Disclosing Party or required by applicable Legal Requirements, the Receiving Party will not:

(1) use, reproduce, disseminate, modify, retain, disclose or perform Data Processing of any of the Confidential Information for any purpose other than to perform its obligations under this Master Agreement for which the Confidential Information is being disclosed, or for such Receiving Party’s internal recordkeeping purposes;

(2) reverse engineer, sell or market any Confidential Information;

(3) receive and maintain the Confidential Information without implementing reasonable internal controls and procedures to safeguard the security and confidentiality of such information;

-54-

(4) disclose any of the Confidential Information other than to its Representatives who: (i) have a reasonable need-to-know in order to discharge their obligations under this Master Agreement, (ii) have confidentiality agreements substantially similar to those herein or owe a duty of confidentiality to the Receiving Party that survive the Representatives’ engagement, (iii) have received appropriate notice and training regarding the Confidential Information and the Data Protection Measures, and (iv) have not been indicted and/or convicted of fraud, theft, larceny, embezzlement, any other financial or cybercrime or a crime involving moral turpitude; or

(5) remove any proprietary rights or confidentiality legend from the Confidential Information.

(c)          The prohibition against the disclosure of Confidential Information includes disclosing the substance of the negotiations of this Master Agreement and the existence and/or the terms and conditions thereof, as well as the fact that any similarity exists between the Confidential Information and information independently developed by another Person or entity, and the parties understand that such similarity does not excuse it from abiding by its covenants or other obligations under this Master Agreement.

(d)          The Receiving Party will be fully liable for the acts and omissions of its Representatives to whom it discloses the Confidential Information.

5.3          Security of Personal Data.

(a)         To effect the purposes of this Master Agreement, COMPANY, BPPR, or one of their respective Subsidiaries may from time to time provide EVERTEC with Personal Data in order for EVERTEC to provide the Services. EVERTEC shall comply with all Legal Requirements (including Legal Requirements regarding the protection, privacy and confidentiality of Personal Data) applicable to EVERTEC’s use, storage and other processing (including Data Processing) of Personal Data.

(b)          EVERTEC agrees to take commercially reasonable actions in accordance with applicable Industry Standards to protect the confidentiality, integrity, availability and resilience of its Systems and to ensure that availability of and access to Personal Data can be restored in a timely manner after an Incident.  EVERTEC’s responsibilities in this regard include regularly assessing and evaluating, in accordance with applicable Industry Standards and Legal Requirements, the effectiveness of the technical and organizational measures adopted by it.  In furtherance thereof, EVERTEC shall be responsible for establishing, maintaining and implementing a Data Protection Program.

-55-

(c)          In furtherance, and not in limitation, of its other obligations under this Master Agreement, and to maintain the protection and privacy of the Personal Data, EVERTEC shall: (i) not disclose any Personal Data to any Third Party other than Data Subcontractors appointed pursuant to Section 1.16; (ii) limit access to the Personal Data to its employees, Representatives and Data Subcontractors who have a need‑to‑know such Personal Data after adequately informing such Persons of the confidential nature of the Personal Data and in each case subject to appropriate Role-Based Access Controls (which controls (A) will be based on least privilege access principles; (B) EVERTEC will document and provide to COMPANY; (C) will be subject to COMPANY approval if they relate to access to BPPR Infrastructure; and (D) will give COMPANY approval rights over individual authorizations if they relate to access to BPPR Infrastructure); (iii) use the Personal Data only for purposes of carrying out its obligations hereunder; (iv) give prompt notification to BPPR or COMPANY, as applicable, of any unauthorized or inadvertent actual or reasonably suspected disclosure of Personal Data or of actual or reasonably suspected breaches involving the disclosure of Personal Data, as provided in Section 5.3(e); (v) upon request of COMPANY, BPPR, or one of their respective Subsidiaries promptly return or destroy all Personal Data, including all copies thereof except for copies necessary to comply with applicable Legal Requirements and records retention, including the requirements in Section 6.4 (provided that following completion of such request EVERTEC shall not be required to provide any Services that require the use of such Personal Data); and (vi) implement all reasonable security measures in accordance with applicable Industry Standards designed to (a) ensure the security, integrity and confidentiality of Personal Data, (b) protect against any anticipated threats or hazards to the security or integrity of Personal Data, and (c) protect against unauthorized access to or use of Personal Data.

(d)          Data Protection Program.

(i)       EVERTEC acknowledges that EVERTEC and the Popular Parties are subject to Legal Requirements and other guidelines regarding the implementation of security measures to safeguard the security and privacy of Personal Data.

(ii)        Without limiting Section 5.2, EVERTEC represents and warrants to COMPANY, BPPR, and their respective Subsidiaries that it has in place, and hereby undertakes to, at all times during the Term, maintain and implement the following in accordance with Industry Standards (the “Data Protection Measures”): (A) a Data Protection Program that includes administrative, technical and physical safeguards to protect the security, privacy, confidentiality, availability and integrity of Personal Data in accordance with applicable Legal Requirements and Industry Standards; (B) an Incident Response Program that provides for the Breach Notification Procedures set forth in Section 5.3(e) below; and (C) a vulnerability monitoring and patching program.

(iii)       With respect to all Services that EVERTEC provides within BPPR Infrastructure, such Data Protection Measures shall also satisfy, at a minimum, the Minimum Data Safeguards set forth in Exhibit G. With respect to all Services that EVERTEC provides outside BPPR Infrastructure, such Data Protection Measures shall also satisfy, at a minimum, the EVERTEC Measures.  EVERTEC represents and warrants that it (A) has made available to COMPANY and BPPR via on-site review or other secure means of transmission its Data Protection Program, Incident Response Program and descriptions of its other Data Protection Measures (collectively, the “EVERTEC Measures”); (B) will comply with these programs and measures and (C) will upon request provide the same for review on-site or via other secure method agreed by the parties.

-56-

(iv)      EVERTEC shall not make any changes to its Data Protection Program, Incident Response Program or other Data Protection Measures in any manner that would degrade or weaken the controls thereunder, or that would otherwise have an adverse effect on the protections provided to BPPR Data, without the prior written consent of COMPANY or BPPR.

(e)          Incident Response Program.

(i)         Without limiting Section 5.2(a), EVERTEC represents and warrants to COMPANY and BPPR that it has implemented, and hereby undertakes to maintain and update, a comprehensive response program that includes processes and procedures (including notification procedures to Affected Persons) designed to address incidents of unauthorized access involving Personal Data in accordance with applicable Legal Requirements and Industry Standards.

(ii)        If EVERTEC becomes aware of an Incident, to the extent it is not prohibited by applicable Legal Requirements, EVERTEC agrees to:

(1) notify COMPANY and BPPR as soon as practicable, and in any event within twenty-four (24) hours, following EVERTEC’s becoming aware of an Incident. The initial notification must be made to the BPPR Chief Information Security Officer, and must include based on then-available information: (i) the available facts; (ii) the status and results of the investigation including identifying the sources and underlying causes of the Incident; (iii) the estimated effects on COMPANY, BPPR, BPPR Data and the Services; (iv) the steps already taken to mitigate, remedy and contain the Incident; (v) if applicable, the potential number of affected customers, consumers, and/or employees affected (collectively “Affected Persons”); and (vi) the name and contact information of EVERTEC’s representative who will serve as COMPANY’s and BPPR’s primary contact;

(2) provide COMPANY and BPPR with prompt updates to any information referenced in clause (1) above;

(3) take all reasonable steps, at EVERTEC’s sole cost and expense (unless such Incident was caused by COMPANY, BPPR, any of their subsidiaries or any contractor or subcontractor thereof), in accordance with its Data Protection Program and Incident Response Program to immediately mitigate and/or remedy, at EVERTEC’s expense, such Incident and contain its further occurrence;

(4) if the Incident was caused by EVERTEC’s or its Representative’s breach of this Master Agreement or gross negligence, fraud or willful misconduct, recover and reconstruct BPPR Data lost or compromised in the Incident; provided that costs incurred in connection with such recovery and reconstruction shall be subject to the Data Cap;

-57-

(5) reasonably coordinate and cooperate with COMPANY and BPPR representatives in any required investigation and provide periodic updates regarding the Incident, including: (i) providing access to the affected facilities and affected operations as necessary for the Popular Parties or their auditors to conduct investigations required to be conducted by the Popular Parties by Legal Requirements (provided that subject to Section 4.5 COMPANY or BPPR, as applicable, shall reimburse EVERTEC for any Losses incurred by EVERTEC in connection with any unauthorized access or intrusion to EVERTEC’s Systems, or any Disabling Device introduced to EVERTEC’s Systems, as a result of a breach of this Master Agreement, failure to comply with applicable EVERTEC Security Requirements, gross negligence, fraud or willful misconduct of COMPANY or BPPR in connection with its access to EVERTEC’s Systems pursuant to this Section 5.2(e)(ii)(5); (ii) facilitating interviews with EVERTEC’s Personnel with knowledge of the Incident; and (iii) making available all relevant records, logs, files, data reporting, forensics or audit reports and other materials required by COMPANY or BPPR to allow COMPANY and BPPR to comply with applicable Legal Requirements, provided that EVERTEC will not be required to provide COMPANY or BPPR with information belonging to, or compromising the security of, EVERTEC or its other customers;

(6) provide reasonable cooperation with COMPANY and BPPR in any litigation, Governmental Authority inquiries, or other Third Party action arising out of or resulting from the Incident and deemed necessary by COMPANY or BPPR to protect the BPPR Data and comply with applicable Legal Requirements, at the expense of COMPANY and BPPR unless such Incident was caused by EVERTEC’s or its Representative’s gross negligence, fraud, willful misconduct or breach of this Master Agreement;

(7) except as may be required by applicable Legal Requirements, not communicate with any Third Party other than EVERTEC’s Representatives, including the media, vendors, and Affected Persons, regarding the Incident (as it relates to COMPANY or BPPR) without COMPANY’s or BPPR’s express written consent and approval of the content of the communication. EVERTEC agrees that regarding the impact of the Incident on COMPANY or BPPR, COMPANY and BPPR will have the sole right to determine: (i) whether notice of the Incident is to be provided to any individual, Governmental Authority, law enforcement agency, consumer reporting agencies or others as required by applicable Legal Requirements or otherwise; (ii) the contents of such notice; and (iii) whether any type of remediation may be offered to Affected Persons (including any free credit monitoring service), and the nature and extent of any such remediation;

-58-

(8) report criminal acts as and to the extent required by applicable Legal Requirements and Governmental Authorities and notify COMPANY and BPPR as soon as practicable prior to such reporting; and

(9) maintain and preserve all relevant documents, records, and other data related to any Incident involving BPPR Data for the period required by COMPANY or BPPR.

(f)          Data Processing. The parties acknowledge that for the purposes of applicable Legal Requirements, BPPR is the Controller and EVERTEC is the Processor of Personal Data. Personal Data must be processed by EVERTEC in compliance with BPPR’s documented instructions that are provided in accordance with this Master Agreement or any applicable SOW or Schedule (“BPPR Instructions”) and in accordance with this Master Agreement and applicable Legal Requirements. If EVERTEC reasonably believes, based on the advice of counsel, that any BPPR Instruction violates applicable Legal Requirements, EVERTEC shall so notify BPPR. In accordance with BPPR Instructions, EVERTEC shall promptly notify BPPR if EVERTEC receives a request from any Person to exercise their rights under the applicable Legal Requirements including the right of access, rectification, restriction of Data Processing, erasure (such as the right to be forgotten), data portability, or objection to any Data Processing. EVERTEC shall use Best Efforts to provide assistance to BPPR, at BPPR’s cost, in responding to such requests within the time specified under the applicable Legal Requirements.

(g)         Upon request, EVERTEC shall promptly provide to COMPANY, BPPR, and any internal or external auditor reasonably designated by COMPANY or BPPR, under applicable confidentiality obligations, (i) a copy of the aforementioned Data Protection Measures and (ii) reasonable documentation as to EVERTEC’s compliance with BPPR Instructions.

(h)          For the sake of clarity, the parties acknowledge and agree that to the extent changes to EVERTEC’s Data Protection Measures are required due to changes in Legal Requirements that are applicable to COMPANY, BPPR or their Subsidiaries but not to EVERTEC, such changes shall be considered Mandatory Enhancements pursuant to Section 2.8 and the costs shall be allocated accordingly.

(i)          Without limiting EVERTEC’s other notice obligations under this Master Agreement, EVERTEC will notify the Chief Information Security Officer at COMPANY and BPPR at InfoSecIncident@popular.com with copy to jeff.foltz@popular.com and by phone at 787-722-3492 (or any replacement contact information provided in writing by COMPANY or BPPR to EVERTEC): (A) as soon as possible after determining a computer-security incident (as defined in 12 C.F.R. 225.301) has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, any System for four or more hours or (B) as otherwise required by Legal Requirements.

-59-

5.4          Required Disclosures.

(a)          In the event that the Receiving Party or any Representative of the Receiving Party is requested or required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit, or if the Receiving Party or any Representative of the Receiving Party reasonably believes, upon the advice of counsel, that it is required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit to disclose Confidential Information, the Receiving Party will, to the extent allowable under applicable Legal Requirements, give immediate verbal and written notification of the Legal Requirement or action, proceeding, subpoena, investigation, inquiry or audit to the Disclosing Party and, to the extent allowable under applicable Legal Requirements and at the expense of the Disclosing Party, hold the Confidential Information confidential while the Disclosing Party seeks a protective order.

(b)        In addition to the foregoing, a Receiving Party or its Representatives may provide the Confidential Information to a Governmental Authority with supervisory authority over such Receiving Party or its Affiliates if (i) such information is required under Legal Requirements to be filed with or disclosed to any such Governmental Authority, (ii) such information is requested by such a Governmental Authority or the Receiving Party determines based on advice of counsel (which may be in-house counsel) that it is necessary or appropriate to provide such Confidential Information to a Governmental Authority, (iii) the Receiving Party’s counsel (which may be in-house counsel) advises that such disclosure is required in order to comply with applicable Legal Requirements or (iv) such Governmental Authority is a banking regulator; provided in each case, that the Receiving Party shall have, where applicable, taken such reasonable steps to protect the confidentiality of such information as the Receiving Party takes with respect to the protection of its own comparable confidential information in such circumstances.

5.5          Remedies. The Receiving Party acknowledges and agrees that it would be difficult to fully compensate the Disclosing Party for damages resulting from the breach or threatened breach of the foregoing provisions and, accordingly, that, in addition to any other remedies that may be available, in law, at equity or otherwise, the Disclosing Party will be entitled to seek injunctive relief, including temporary restraining orders, preliminary injunctions and permanent injunctions, to enforce such provisions without the necessity of proving actual damages or posting a bond or any other security. This provision with respect to injunctive relief will not, however, diminish the Disclosing Party’s right to claim and recover damages. Notwithstanding anything in this Master Agreement to the contrary, nothing shall limit or restrict the ability of a Receiving Party to disclose Confidential Information to banking regulators having jurisdiction over such Receiving Party.

5.6          Term of Obligation. Unless otherwise agreed in writing, the parties’ obligations under this Article Five will survive this Master Agreement for a period of three (3) years following termination hereof. Upon termination of this Master Agreement for any reason, the Receiving Party’s rights to possession and use of any Confidential Information in connection with the performance of its obligations hereunder or otherwise will terminate.

-60-

5.7          Destruction. Upon the Disclosing Party’s request, the Receiving Party will promptly destroy in a secure manner following Industry Standards all Confidential Information and all copies thereof, including physical copies and copies embedded in computer files, extracts from computer files and analyses or other material based upon the Confidential Information (provided that following such request the Receiving Party shall not be required to perform any obligations under this Master Agreement that require the use of such Confidential Information). Should the Disclosing Party request evidence of the destruction of any such Confidential Information, the Receiving Party will promptly (and in all cases within thirty (30) days of such request or such other time as agreed to between the parties; provided that EVERTEC shall use Best Efforts to provide within ten (10) days) submit an attestation executed by an authorized officer of the receiving party certifying that any such Confidential Information has been destroyed. If COMPANY or BPPR receives an individual’s request to delete Personal Data, COMPANY or BPPR may direct EVERTEC to delete such information (the “Direction”), in which case, EVERTEC shall delete such information without undue delay and certify to COMPANY or BPPR, as applicable, in writing that it has complied with the Direction (and following completion of such request EVERTEC shall not be required to provide any Services that require the use of such Personal Data). Notwithstanding the foregoing, the Receiving Party may, after informing the Disclosing Party, retain copies of the Confidential Information: (i) to comply with applicable Legal Requirements; or (ii) for purposes of record retention, backup records or audit requirements, including as set forth in Section 6.4); provided, however, that the confidentiality obligations (including destruction and certification) hereunder will survive with respect to any retained Confidential Information.

ARTICLE SIX– SECURITY, BPPR DATA & RECORDS

6.1          Authorized Persons. Each party will designate one or more individuals (hereinafter, “Authorized Persons”) so that as to the specific Service, the Authorized Person can (1) coordinate the Services, Data Processing or other transactions on behalf of such party; (2) receive information from the other party related to the operation of the Service, including any COMPANY-, BPPR- or EVERTEC‑provided access code; and (3) give written instructions or inform the other party about any action or request for action by such party.

6.2          Security Measures.

(a)         The parties warrant that they have adopted, and will assume responsibility for complying with, security measures reasonably required (including under applicable Industry Standards and Legal Requirements) for the protection of access to their Systems and to the Services by their Representatives and Authorized Persons. As such, the parties warrant that they have established a Data Protection Program in accordance with Legal Requirements to minimize the risk of unauthorized access and agree that they will take the necessary measures to maintain the confidentiality of the security procedures and any access codes, passwords, instructions or security equipment.

(b)         EVERTEC will monitor, review and update the Data Protection Measures no less than annually to ensure compliance with this Master Agreement. EVERTEC agrees that, as may be relevant to its Services, the Data Protection Measures will, among other things: (i) take into account audit results, privacy and security risks, threats or changes in applicable Legal Requirements and Industry Standards; and (ii) be timely corrected with respect to any element thereof which could reasonably be expected to pose a threat to the protection of BPPR Data. During the Term, EVERTEC will not modify any component of the Data Protection Measures or discontinue any Data Safeguards, in each case in a manner that would degrade or adversely impact the protections in place with respect to BPPR Data, without COMPANY’s or BPPR’s consent.

-61-

(c)          EVERTEC and its Affiliates (as applicable) shall at all times (x) use Best Efforts to maintain their Systems free from all Disabling Devices that may disrupt, damage or interfere with COMPANY’s, BPPR’s, and their respective Subsidiaries’ (as applicable) network and/or telecommunication facilities and (y) act in accordance with Industry Standards and the provisions of this Agreement to prevent any Incident.  EVERTEC and its Affiliates (as applicable) agree to (1) perform penetration tests annually and as otherwise required by the Data Protection Program of EVERTEC’s or any of its Affiliates’ (as applicable) networks and Systems where BPPR Data is processed, transmitted or stored and (pursuant to the frequency established in the Data Protection Program) web-applications through which BPPR Data is accessed (collectively “Penetration Tests”); and, within thirty (30) days following completion of each Penetration Test, share a summary of any such tests that are relevant to the Popular Parties (provided that (i) disclosure of such results by EVERTEC shall be subject to, and limited by, applicable Legal Requirements; (ii) EVERTEC may redact from such results information relating solely to EVERTEC’s internal business or solely to EVERTEC’s other customers, provided that this clause (ii) shall not give EVERTEC any right to redact any information relating to EVERTEC’s provision of the Services to COMPANY, BPPR, or their respective Subsidiaries; and (iii) if the critical vulnerability is identified during the Penetration Test EVERTEC will notify COMPANY and BPPR of the vulnerability within fifteen (15) days); (2) maintain an alert status regarding the security of their computing Systems, including all vulnerabilities and security patches or corrective actions, by subscribing to an industry-recognized service, such as CERT or CIAC; (3) permit COMPANY and BPPR to review EVERTEC’s patch and vulnerability programs in connection with an Audit under Section 8.4; and (4) provide COMPANY and BPPR with written certification documentation showing the remediation status of any security issues identified in such assessments on a monthly basis for critical and high risk issues and upon request from COMPANY or BPPR for medium and low risk issues. Should EVERTEC’s or any of its Affiliates’ (as applicable) assessment reveal inappropriate or inadequate security of their Systems that are used to store BPPR Data or otherwise provide Services based on the applicable Industry Standard requirements for security, without compensating controls, COMPANY, BPPR, or any of their respective Subsidiaries (as applicable) may, in addition to any other remedies they may have, remove EVERTEC’s or any of its Affiliates’ (as applicable) access to COMPANY’s, BPPR’s, or any of their respective Subsidiaries’ (as applicable) own Systems until EVERTEC or its Affiliates (as applicable) comply with the standards set forth in this Section 6.2(c) and provide reasonable assurance (including reasonably requested evidence) of such compliance.  Additionally, EVERTEC and its Affiliates will permit COMPANY and BPPR or their designated Third Party to conduct Penetration Tests on network components and Systems used exclusively for COMPANY or BPPR and that are located in COMPANY or BPPR’s service network within EVERTEC, subject to the provisions set forth on Schedule 6.2(c).

-62-

(d)          If a network connection is established between any System of COMPANY, BPPR, or one of their respective Subsidiaries, on the one hand, and the Systems of EVERTEC, or one of its Affiliates, on the other hand, COMPANY, BPPR, and their respective Subsidiaries (as applicable) shall at all times (i) use Best Efforts to maintain their computing environment connected to EVERTEC’s or its Affiliates’ (as applicable) Systems free from all Disabling Devices and (ii) act in accordance with this Agreement and Industry Standards to prevent any Incident, in each case, that may disrupt, damage or interfere with EVERTEC’s or its Affiliates’ (as applicable) Systems (including complying with all applicable EVERTEC Security Requirements).  If EVERTEC reasonably suspects that any System of COMPANY, BPPR or their respective Subsidiaries is the source of any Disabling Device, unauthorized access or other Incident that may reasonably be expected to adversely impact EVERTEC or EVERTEC’s other customers in any material respect, EVERTEC shall be entitled to suspend connectivity to such System until the issue has been mitigated; provided that EVERTEC promptly notifies COMPANY and BPPR of the issue in advance and provides a reasonable opportunity for them to remediate the issue unless EVERTEC reasonably determines that immediate suspension is required in order to prevent material harm to EVERTEC or its other customers.  EVERTEC shall not be responsible for the performance of Services to the extent they are impacted by any such suspension permitted under this Section 6.2(d).

(e)          Each party’s and their respective Affiliates’ Authorized Persons agree to comply with all of the other party’s requirements in relation to the security of their respective computing environments and Authorized Locations, including any subsequently agreed security plan or information processing requirements that may be embodied in any Service Addendum. Each party and their appropriate respective Affiliates will execute all documents generally required by the other party for access to such other party’s computing environment and Authorized Locations. Further, if any Authorized Person of any party or their respective Affiliates, at any time during the Term, is granted remote access or connection to the other party’s network, or is telecommuting in any capacity, then such person will be subject to such other party’s applicable additional data security requirements.

(f)          Should the Services require access codes or other identification methods to gain access, each party will immediately notify the appropriate other party or parties in writing of any change of Authorized Person or the scope of his/her authority. Until such notification is received, each party may accept, without further inquiry, all declarations, instructions or representations made or issued by the Authorized Person. Furthermore, the parties will not assume responsibility, explicitly or implicitly, for questioning or verifying with the other parties whether the Person who uses or has access to the Service is in fact the Authorized Person or if he/she is acting in accordance with another party’s internal policies and procedures.

(g)          Data Centers

(i)        EVERTEC will perform the Services at all times during the Term from the Data Center locations and with the hosting or collocation Data Subcontractors that have been disclosed to COMPANY and BPPR as of the Effective Date, in accordance with Section 1.16, or in an applicable subsequent Service Addendum.

(ii)      EVERTEC may not change Data Center locations or any hosting or collocation Subcontractor without providing notice to COMPANY and BPPR in accordance with Section 1.16.

-63-

(iii)       Notwithstanding anything to the contrary in this Master Agreement, EVERTEC may not host or otherwise store BPPR Data at any Data Center outside the United States.

(iv)      EVERTEC shall bear the cost of any incremental expenses incurred as a result of a change in Data Center location or Subcontractor that has not been requested by COMPANY or BPPR.

(h)          If any software licensed by COMPANY, BPPR or their Subsidiaries that EVERTEC is required to host or operate as part of the Services is no longer supported and EVERTEC reasonably determines that continuing to host or operate such software poses a material security risk to any System of EVERTEC, EVERTEC shall promptly notify the Popular Parties of the same and the parties will work together in good faith to develop and execute a plan to remediate the security risk (which may include upgrading the software, segregating Systems or removing the affected Services from the scope of this Master Agreement).

6.3          Ownership of BPPR Data.

(a)          Each of COMPANY, BPPR, and their respective Subsidiaries will remain the sole and exclusive owner of all BPPR Data, regardless of whether such data is maintained in physical, electronic or digital format or any other format, storage or processing device. All BPPR Data will, however, be subject to regulation and examination by the appropriate auditors and Governmental Authorities at the Authorized Locations to the same extent as if such information were on COMPANY, BPPR, or their respective Subsidiaries’ premises. EVERTEC will notify COMPANY, BPPR, and their respective Subsidiaries as soon as reasonably possible of any formal request by any Governmental Authority to examine such information maintained by EVERTEC. COMPANY, BPPR, and their respective Subsidiaries agree that EVERTEC is authorized to provide all such information when properly required to do so by a Governmental Authority, subject to the provisions of Section 5.3(a). EVERTEC acknowledges that it will not have or acquire any rights in or to any BPPR Data or Confidential Information upon termination of this Master Agreement.

(b)         EVERTEC will, subject to its internal control and security procedures, permit each of COMPANY, BPPR, and their respective Subsidiaries to have or obtain (by physical, electronic, digital or other means) access to its BPPR Data, including where appropriate, access through COMPANY, BPPR, or their respective Subsidiaries’ computer terminals and equipment. EVERTEC will furnish COMPANY, BPPR, and their respective Subsidiaries with such written instructions, manuals or other documentation as will be necessary to such operation and access by COMPANY, BPPR, and their respective Subsidiaries.

6.4          Records Retention.

(a)          Each party will maintain its respective records related to the Services in a proper, complete and accurate fashion, and in compliance with all Legal Requirements applicable to each of them and in the case of EVERTEC with the requirements provided in Section 6.4(b).

-64-

(b)          EVERTEC will retain all BPPR Data, transactions data and records for the duration of the retention periods in accordance with the longer of (i) the retention periods in effect in practice as of the Effective Date; (ii) relevant Statement of Work or (iii) as established by COMPANY or BPPR following the date of this Master Agreement by written notice to EVERTEC.

(c)          COMPANY and BPPR acknowledge that any new retention periods or changes in existing retention periods requested by COMPANY or BPPR after the Effective Date may result in commercially reasonable additional charges and/or increases in the Service fees as provided under Section 2.7(b).

6.5          Data Backup.  Except as may be specifically provided in a Service Addendum or Statement of Work, EVERTEC:

(a)         subject to EVERTEC’s obligations under Section 5.7, EVERTEC will maintain a backup of BPPR Data that is in a production environment in accordance with the backup practices used as of the Effective Date, which at a minimum must support the Recovery Point Objectives for the applicable Service (in physical or other electronic or digital media), from which lost or damaged items or data can be reconstructed within the Recovery Point Objectives established for the Services;

(b)          shall periodically identify all facilities and Data Centers where BPPR Data will be at rest or backed-up or where Data Processing will take place, and

(c)          shall, at its own cost and expense (subject to the Data Cap), reconstruct any BPPR Data or reports destroyed, lost or otherwise rendered unusable due to any breach of this Master Agreement or gross negligence or willful misconduct by EVERTEC or its Representatives.

ARTICLE SEVEN – INTELLECTUAL PROPERTY

7.1          Title. To the extent EVERTEC uses its own Intellectual Property to provide the Services under this Master Agreement, EVERTEC warrants that it is the owner of all right, title, and interest in and to such Intellectual Property, and neither such Intellectual Property nor the authorized use thereof, to EVERTEC’s best knowledge, infringes any Intellectual Property right, or other proprietary right, of any other Person. As such, the parties agree that, subject to the applicable Legal Requirements and to existing agreements with Third Parties, or except as otherwise expressly agreed to between the parties in writing, EVERTEC is and will remain the owner of its Intellectual Property and all derivative works based thereon (which, for the avoidance of doubt, shall not include any Intellectual Property that is transferred pursuant to the Asset Purchase Agreement) or derivative works based thereon developed by or on behalf of BPPR or its Subsidiaries) and that no title to or ownership of EVERTEC’s Intellectual Property or any part thereof is hereby granted to COMPANY, BPPR, or their respective Subsidiaries. Should EVERTEC use Third Party Intellectual Property to provide the Services, then EVERTEC warrants that it is duly licensed or otherwise has the right to use such Third Party Intellectual Property to provide the Services.  The parties agree that, subject to the applicable Legal Requirements and to existing agreements with Third Parties, or except as otherwise expressly agreed to among the parties in writing, each of COMPANY, BPPR, and their respective Subsidiaries is and shall remain as the owner of its Intellectual Property, and all derivative works based thereon.

-65-

7.2          General. Each party acknowledges that (a) in providing the Services to COMPANY, BPPR, and their respective Subsidiaries, EVERTEC is not transferring any right, title or interest in EVERTEC’s Intellectual Property, or any part or component thereof, to COMPANY, BPPR, or their respective Subsidiaries, provided that, for clarity, the foregoing will not limit anything to the contrary in the Asset Purchase Agreement; and (b) in receiving the Services, COMPANY, BPPR, and their respective Subsidiaries are not granting any right, title or interest in their respective Intellectual Property, or any part or component thereof, to EVERTEC or its Subsidiaries.

7.3          Developments.

(a)        Except as otherwise agreed to in writing, any services, technology, processes, methods, software and/or enhancements to EVERTEC Intellectual Property or any EVERTEC Third Party Intellectual Property used or developed for purposes of delivering the Services (collectively, the “IP Developments”), whether developed solely by EVERTEC or jointly by EVERTEC and any other party, including any IP Developments requested or suggested by COMPANY, BPPR, or their respective Subsidiaries or a Client, will be the sole property of EVERTEC and will not be considered “works-made-for-hire”; provided, however, that the foregoing shall not constitute a grant in, to or under any right, title or interest any Intellectual Property, or any part or component thereof, of the COMPANY, BPPR, or their respective Subsidiaries, to EVERTEC or any other party. Except as otherwise agreed to in writing, COMPANY, BPPR, and their respective Subsidiaries will not acquire any ownership right, Intellectual Property right, claim or interest in EVERTEC’s Intellectual Property, including as to any IP Developments. To the extent COMPANY or BPPR or one of their respective Subsidiaries does nevertheless acquire such ownership right, Intellectual Property right, claim or interest, each of COMPANY and BPPR hereby assign (and shall cause its applicable Subsidiaries to assign) all of its right, title and interest in and to the IP Developments to EVERTEC.

(b)          The parties agree that any enhancements or other modifications to or derivative works of COMPANY Intellectual Property or COMPANY Third Party Intellectual Property, whether developed solely by EVERTEC or jointly by EVERTEC and any other party in connection with the provision of the Services or otherwise will be the sole property of COMPANY, BPPR, or one of their respective Subsidiaries and will be considered “works-made-for hire”. Except as otherwise agreed to in writing, EVERTEC will not acquire any ownership right, Intellectual Property right, claim or interest in COMPANY Intellectual Property or COMPANY Third Party Intellectual Property.  To the extent EVERTEC acquires any ownership right, Intellectual Property right, claim or interest in any enhancements to COMPANY Intellectual Property or COMPANY Third Party Intellectual Property, EVERTEC hereby assigns (and shall cause its applicable Subcontractors to assign) all of its right, title and interest in and to such enhancements and other materials to COMPANY, BPPR, or one of their respective Subsidiaries, as applicable.

(c)          Except as otherwise agreed to in writing, any Intellectual Property created or developed by EVERTEC as an independent product will be EVERTEC Intellectual Property and the sole property of EVERTEC and will not be considered a “work-made-for-hire”.

-66-

(d)          EVERTEC hereby grants to COMPANY, BPPR, and their respective Subsidiaries, a perpetual, irrevocable, non-exclusive, sublicensable, worldwide, paid-up right and license to access, use, copy, maintain, modify, enhance, perform, display, distribute and create derivative works of any EVERTEC Intellectual Property and EVERTEC Third Party Intellectual Property that EVERTEC includes in (i) the Procedures Manual or (ii) in any enhancements or modifications to or derivative works of the COMPANY Intellectual Property or COMPANY Third Party Intellectual Property.

(e)         “EVERTEC Third Party Intellectual Property” means Third Party Intellectual Property that is licensed and made available under this Master Agreement by EVERTEC.  “COMPANY Third Party Intellectual Property” means Third Party Intellectual Property that is licensed and made available under this Master Agreement by COMPANY or BPPR or any of their respective Subsidiaries.

7.4          Intellectual Property Infringement.

(a)          Subject to Section 7.4(d), EVERTEC agrees to defend, indemnify and hold harmless COMPANY, BPPR, and their Affiliates and Subsidiaries and their respective Representatives, Third Party information providers, Subcontractors and permitted assigns and successors in interest (“IP Indemnified Parties”) from and against all Losses incurred or suffered by, or asserted against, such IP Indemnified Party directly or indirectly in relation to or arising from any claim, action or other proceeding from a Third Parties alleging that any of the Services or EVERTEC’s or its Affiliates’ Systems or Intellectual Property, or the use thereof by or on behalf of the IP Indemnified Party, infringes or misappropriates any Intellectual Property right of a Third Party.

(b)         If EVERTEC receives notice of an infringement claim or otherwise concludes that the Services or its or its Affiliates’ Intellectual Property, or the use thereof by or on behalf of the COMPANY, BPPR, and their respective Subsidiaries, may infringe the proprietary rights (including Intellectual Property rights) of a Third Party, EVERTEC may in its sole discretion (i) procure the right for COMPANY, BPPR, and their respective Subsidiaries to continue using the affected Service or Intellectual Property; (ii) modify the affected Service or Intellectual Property to make it non-infringing; or (iii) replace the affected Service or Intellectual Property with a functional equivalent without substantial degradation in functionality, utility or performance.

(c)          If EVERTEC receives notice of an infringement claim against an IP Indemnified Party related to an EVERTEC Pass Through License, if requested by BPPR or COMPANY, EVERTEC shall use Best Efforts to pursue its rights, if any, for indemnification or other monetary remedies against the applicable Third Party licensor in accordance with the terms set forth in the EVERTEC Pass Through License.  Monetary awards actually received by EVERTEC, less the amount of all fees, claims, costs and expenses (including attorneys’ fees) incurred by EVERTEC in connection with pursuing such claim against a Third Party provider for infringement, shall be allocated between EVERTEC and its other customers, on the one hand, and the COMPANY, BPPR and their respective Subsidiaries, on the other, in proportion to the damages and costs sustained by such party due to the EVERTEC Pass Through License.

-67-

(d)          EVERTEC will have no liability for any claim of infringement and thus no obligation to defend and indemnify COMPANY, BPPR, and their respective Subsidiaries under this Section 7.4 if such infringement claim is based on (i) COMPANY, BPPR, and their respective Subsidiaries’ use of a superseded or altered (other than alterations by or on behalf of, or with the written authorization or instruction of EVERTEC) release of the affected Service or Intellectual Property or any portion thereof, including COMPANY, BPPR, and their respective Subsidiaries’ failure to use updates or new releases made available by EVERTEC but only to the extent that such claim would have been avoided but for such failure; (ii) any modification by COMPANY, BPPR, and their respective Subsidiaries or a Third Party to the affected Service or Intellectual Property, but only to the extent that such claim would have been avoided, but for such modification; (iii) COMPANY, BPPR, and their respective Subsidiaries’ use of the affected Service or Intellectual Property in violation of this Master Agreement; (iv) COMPANY, BPPR, and their respective Subsidiaries’ use, operation or combination of the affected Service or Intellectual Property with information, software, specifications, instructions, data, materials or items not supplied or approved by EVERTEC, but only to the extent that such claim would have been avoided but for such combined use; or (v) use of the affected Service or Intellectual Property in a manner in violation of, or not as intended by, the accompanying and provided documentation.

(e)          Furthermore, EVERTEC’s obligation to defend COMPANY, BPPR, and their respective Subsidiaries under this Section 7.4 is subject to all of the following conditions: (i) COMPANY, BPPR, or their respective Subsidiaries must notify EVERTEC promptly in writing after the claim is asserted or threatened (provided the failure of COMPANY, BPPR or a Subsidiary to so notify EVERTEC will relieve EVERTEC of its obligations under this Section 7.4 only to the extent that EVERTEC can demonstrate damages attributable to such failure); (ii) COMPANY, BPPR, or their respective Subsidiaries must give EVERTEC sole control over its defense or settlement; and (iii) COMPANY, BPPR, and their respective Subsidiaries do not formally and publicly take a legal position that is adverse to EVERTEC’s defense of such claim. COMPANY, BPPR, or their respective Subsidiaries must provide EVERTEC with reasonable assistance in defending the claim for which EVERTEC will reimburse COMPANY, BPPR, and their respective Subsidiaries for any reasonable out-of-pocket expenses that COMPANY, BPPR, or their respective Subsidiaries incur in providing such assistance.

(f)         COMPANY and BPPR agree to notify EVERTEC promptly in writing if any other type of Third Party claim is brought against COMPANY, BPPR, or their respective Subsidiaries regarding EVERTEC’s Intellectual Property. EVERTEC may, at its option, choose to treat these claims as being covered by this Section 7.4.

(g)          This Section 7.4 states EVERTEC’s entire liability and COMPANY’s and BPPR’s exclusive remedies with respect to any Third Party infringement and trade secret misappropriation claims with respect to the Services; provided, however, that the foregoing shall not limit any right of the COMPANY or BPPR, or their respective Affiliates, pursuant to the Asset Purchase Agreement or any ancillary agreement thereto (excluding this Master Agreement).

ARTICLE EIGHT– REGULATORY COMPLIANCE, AUDIT & SERVICE REVIEWS

8.1          Compliance.

-68-

(a)        EVERTEC acknowledges that EVERTEC will be solely responsible for monitoring and interpreting (and for complying with) Legal Requirements applicable to EVERTEC, and as such, hereby warrants that EVERTEC will comply with applicable Legal Requirements, present and future, relating to the conduct and operation of its business.

(b)          COMPANY and BPPR acknowledge that each of COMPANY and BPPR will be solely responsible for monitoring and interpreting (and for complying with, to the extent such compliance requires no action by EVERTEC) Legal Requirements applicable to COMPANY and its Subsidiaries and BPPR and its Subsidiaries, as applicable, and as such, hereby warrants that it and its Subsidiaries will comply with all applicable Legal Requirements, present and future, relating to the conduct and operation of its or such Subsidiaries’ business.

(c)         EVERTEC represents that it has, and at all times during the Term will, at its own expense, maintain any and all licenses, permits, approvals, certificates, endorsements and authorizations required by any professional association or the applicable Governmental Authorities that are required for it to provide the Services for the benefit of COMPANY and BPPR. Upon thirty (30) days prior written notification to EVERTEC, COMPANY and BPPR shall have the right to inspect copies of all such licenses, permits, approvals, certificates, endorsements or authorizations.

8.2          Legal Requirements.

(a)          COMPANY and BPPR shall be responsible for monitoring and interpreting (and for complying with, to the extent such compliance requires no action required to be undertaken by EVERTEC pursuant to this Master Agreement) the Legal Requirements applicable to them. COMPANY and BPPR may, as part of the instructions used to establish the Specifications, include requirements that they deem necessary in order to comply with applicable Legal Requirements, and EVERTEC will select the technical parameters within EVERTEC’s Systems that will apply to COMPANY, BPPR, and their respective Subsidiaries. EVERTEC shall be responsible for determining that such selections are consistent with COMPANY’s or BPPR’s instructions, as applicable. COMPANY and BPPR, as applicable, shall be responsible for determining that the instructions provided to EVERTEC are consistent with the Legal Requirements and with the terms and conditions of any agreements between COMPANY, BPPR, and their respective Subsidiaries and its Clients.

(b)          Subject to Sections 8.1 and 8.2(a), at the expense of COMPANY and BPPR, EVERTEC shall work with COMPANY and BPPR in developing Systems and implementing Specifications for the Services to enable COMPANY, BPPR, and their respective Subsidiaries to comply with Legal Requirements applicable to the Services being provided by EVERTEC to COMPANY, BPPR, and their respective Subsidiaries.

(c)          The parties acknowledge and agree that the performance of the Services may be subject to regulation by Governmental Authorities.

(d)          Upon the request and expense of COMPANY and BPPR, EVERTEC will take all commercially reasonable steps to cooperate in good faith with COMPANY and BPPR in any investigations, reports (including, any suspicious activity reports), filings or other documents or actions COMPANY or BPPR may take or complete to comply with applicable federal anti-money laundering and bank secrecy laws and regulations.

-69-

8.3         BSA/AML/OFAC. EVERTEC represents and warrants that it (a) is in compliance with the Office of Foreign Assets Control sanctions and regulations promulgated under the authority granted by the Trading with the Enemy Act, 12 U.S.C. § 95 (a) et seq., the International Emergency Economic Powers Act, 50 U.S.C. § 1701, et seq.; and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, as each may be amended from time to time and all rules and regulations promulgated thereunder applicable to EVERTEC and (b) is not: (i) listed in the Annex to, or otherwise subject to the provisions of, that certain Executive Order No. 13224 on Terrorist Financing, effective September 24, 2001, and relating to Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten to Commit or Support Terrorism; and/or (ii) named as a “specifically designated national (SDN)” on the most current list published by the U.S. Treasury Department Office of Foreign Assets Control. EVERTEC further represents that it will not act directly or indirectly, in contravention of any applicable anticorruption or anti-money laundering law.

8.4          Audit.

(a)          Each of the parties agrees that it will keep current and accurate books of accounts and records, in accordance with its standard operating procedures, with respect to the transactions effected pursuant to this Master Agreement.  During the Term, each party shall permit the other party’s designated auditors and Governmental Authorities to review its books and records with respect to such transactions, upon prior written notice, during normal business hours.

(b)       EVERTEC, COMPANY, and BPPR acknowledge and agree that the performance of the Services may be subject to regulation by Governmental Authorities.  EVERTEC agrees to use Best Efforts to cooperate with any audit or examination of the Services or COMPANY, BPPR, or their respective Subsidiaries, whether by a Governmental Authority or internal or external auditors of COMPANY, BPPR, or their respective Subsidiaries (“Audit”).  Except for Audits required to be conducted by a Governmental Authority or by Legal Requirement, and for Audits conducted to verify remediation of a material breach of any provision of this Master Agreement uncovered in a previous Audit (a “For Cause Audit”), no more than one Audit shall be conducted in any twelve-month period.  Furthermore, EVERTEC agrees to provide any information or material lawfully and reasonably requested during an Audit, and permit such auditing parties to inspect or audit EVERTEC with respect to its provision of the Services; provided, however, that (i) each of COMPANY and BPPR agrees to reimburse EVERTEC for all reasonable costs incurred by EVERTEC to fulfill Audit requests from COMPANY, BPPR or its Subsidiaries under this Section 8.4b) (other than For Cause Audits); (ii) prior to reviewing any such information or material provided by EVERTEC, any Third Party (other than a Governmental Authority) shall execute a customary confidentiality agreement with EVERTEC; and (iii) nothing in this Section 8.4 shall require EVERTEC to provide information that would be expected to result in the waiver of any attorney-client or other legal privilege or disclosure of the confidential information of EVERTEC’s other customers that is not related to COMPANY or BPPR or their Subsidiaries.  COMPANY or BPPR requests for detail to support invoices or copies of any policies, procedures, summaries, audit reports or other information or access that EVERTEC is required to provide under this Master Agreement (including under Section 9.3) will not be considered “Audits” for purposes of the frequency limitation and cost reimbursement provisions above.

-70-

(c)       In connection with each Audit, EVERTEC will provide COMPANY, BPPR, and their respective Subsidiaries and auditors, upon COMPANY’s or BPPR’s written request, at a time, frequency and place reasonably agreed to between the parties, with access to Personnel and information relating to the Services to permit COMPANY, BPPR, and their respective Subsidiaries and auditors to (w) review EVERTEC’s performance of Services; (x) validate EVERTEC’s compliance with this Master Agreement; (y) comply with applicable Legal Requirements; and (z) conduct third party management and oversight discussions with management and personnel of EVERTEC concerning the status and conduct of Services and work being performed under this Master Agreement. EVERTEC’s obligation in this regard will include providing to COMPANY and BPPR the following reports (each, an “Audit Report”) on an annual basis:

(i)          Service Center Review reports (as further described in Section 8.7);

(ii)        Business Continuity Plan and business resumption test results (as further described in Section 2.13);

(iii)       Data Protection Program documentation (as further described in Section 5.3(f);

(iv)       Penetration Tests (as further described in Section 6.2(c));

(v)         vulnerability and patch management implementation reports; and

(vi)       responses to vendor questionnaires and other standardized information gathering requests.

(d)        To the extent directed by a Governmental Authority or required by a Legal Requirement, EVERTEC and its Affiliates will provide COMPANY and BPPR or their respective Subsidiaries or auditors with access to their facilities and Systems and related Personnel to address the request from the Governmental Authority or comply with the Legal Requirement.

(e)          To the extent an Audit reveals areas of material concern to COMPANY or BPPR, the parties will agree on a plan to address the deficiency in an adequate and timely manner, it being agreed that the costs of implementing any aspect of such plan shall be borne by EVERTEC to the extent that the deficiency is attributable to actions or omissions on the part of EVERTEC or any Subcontractor. EVERTEC will promptly execute any such plan and track and report on its activities and results obtained under the plan until the parties agree the area of concern has been remediated.

8.5          IT Infrastructure Network Diagram. Upon COMPANY’s or BPPR’s written request, EVERTEC will provide a network diagram that outlines EVERTEC’s information technology network infrastructure and all equipment used in relation to the fulfillment of its obligations under this Master Agreement.

-71-

8.6          Data Flow Diagram. Upon COMPANY’s or BPPR’s written request, EVERTEC will provide a graphical representation of the flow of electronic BPPR Data within and between network segments and information systems as well as across an institution’s perimeter up to Third Parties, if applicable (“DFD”). A DFD must capture the main components of an information system, how data moves in and out of the system, protection layers (encryption) applied to data in its different states, user interaction points and their functions, and external and internal network dependencies such as Third Party or fourth party connections or services.

8.7          Service Center Reviews.

(a)         On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct an examination of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with applicable Industry Standards and applicable Legal Requirements. In addition to IT operations and application controls, the Firm should complete an examination of EVERTEC’s controls related to security, availability, processing integrity, confidentiality or privacy. The aforesaid examinations shall be conducted for the relevant System and organization controls (“SOC 1” and “SOC 2”) criteria in accordance with Statement on Standards for Attestation Engagements no. 18 (“SSAE 18”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”).

(i)          The SOC 1 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of nine (9) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR on or before December 15 of such year. EVERTEC management will provide a bridge letter for the remaining period of the calendar year that is not covered by the SOC 1 Type II report no later than January 31^st of the following year.

(ii)         The SOC 2 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of twelve (12) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR by February 15 of the following year.

(iii)      All such Service Center Reviews shall be deemed to be EVERTEC's Confidential Information hereunder, provided that EVERTEC shall promptly share such Service Center Reviews with BPPR upon request.  EVERTEC may redact information from any Service Center Reviews shared with BPPR if and solely to the extent necessary to protect the confidential information of other customers of EVERTEC or the information of EVERTEC that is not related to either BPPR or EVERTEC’s provision of Services to BPPR.

(iv)       Additionally, EVERTEC will use its Best Efforts to obtain and provide to COMPANY and BPPR SOC 1 and 2 Type II reports or other equivalent control reports for each Data Subcontractor that stores, transfers or processes Personal Data. If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.

-72-

(b)         EVERTEC will review the scope of the Service Center Review to be conducted by the Firm on an annual basis with BPPR and incorporate reasonable input and additional requirements reasonably requested by BPPR. If BPPR requires additional scope in a Service Center Review that is (i) incremental to the scope in EVERTEC’s standard Service Center Review; and (ii) solely attributable to BPPR (and not to be shared with any other EVERTEC customers) (“Incremental BPPR Requirements”), BPPR will reimburse EVERTEC for any additional amounts payable by EVERTEC to the Firm to include the Incremental BPPR Requirements.

(c)          If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all reasonable actions necessary to comply with such recommendations on a timeline that will take into account the nature and materiality of the recommendations. Upon request, EVERTEC will advise COMPANY and BPPR on its progress in completing such actions.

(d)          If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.

(e)          For all other requests by COMPANY or BPPR to review all or a portion of the Services and EVERTEC’s operation controls relating thereto, outside the scope of an Audit or SSAE 18, the parties will agree in writing to the terms and conditions applicable to such review, including the scope of the review and any expenses related thereto. If, at any time, whether or not in connection with the Service Center Review, EVERTEC becomes aware of a significant issue of concern related to the operational and application controls operating at EVERTEC for the Services provided to the COMPANY, BPPR, or any of its respective subsidiaries, EVERTEC shall promptly notify and subsequently meet with COMPANY or BPPR in an effort to address such concern.

ARTICLE NINE– TERM & TERMINATION

9.1         Term. This Master Agreement will commence on the Effective Date and will end on September 30, 2028 (the “Initial Term”), unless earlier terminated in accordance with the provisions of this Master Agreement.

-73-

9.2            Termination for Cause.

(a)          This Master Agreement or any of the Services, individually or collectively, may be terminated by either the Popular Parties, on the one hand, or EVERTEC, on the other, if the other party or parties (as applicable):

(i)        commits a Material Breach of this Master Agreement (or series of breaches that together constitute a Material Breach), which breach is not cured within thirty (30) days following receipt of notice specifying the nature and extent of such breach; provided, however, that if such breach is not reasonably susceptible of cure within such thirty (30) day period, such period will be extended and the party will not be in default hereunder so long as it commences such cure within such thirty (30) day period and diligently pursues such cure and such failure is cured within ninety (90) days following the receipt of such notice;

(ii)       fails to pay any properly submitted invoice providing for material amounts in the aggregate that are undisputed for a period exceeding sixty (60) days following COMPANY and BPPR’s receipt of notice from EVERTEC of such non-payment; or

(iii)        makes any assignment of this Master Agreement, except as expressly provided herein.

(b)          For purposes of this Section 9.2 and notwithstanding anything in this Master Agreement to the contrary:

(i)          “Material Breach” means a breach, or series of breaches, of a party’s duties or obligations (other than a failure to make a payment pursuant to this Master Agreement) that if left uncured for ninety (90) days following receipt of notice from COMPANY or BPPR detailing the relevant deficiency or failure, (A) would result in a Material Adverse Effect on such notifying party and its Subsidiaries (taken as a whole) or BPPR and its Subsidiaries (taken as a whole), as applicable, or (B) would reasonably be expected to have an adverse effect on the notifying party that is material, individually or in the aggregate, measured on a scale relative to the notifying party’s rights and privileges and reasonably expected benefits under this Master Agreement, provided that this clause (B) shall apply solely after September 30, 2025 and solely in the case of termination by COMPANY or BPPR.

(ii)       “Material Adverse Effect” means, with respect to any Person, any fact, event, change, effect, development, condition or occurrence that has a materially adverse effect on or with respect to any business, assets, liabilities, financial condition, or results of operations of such Person.

(c)          Notwithstanding anything in this Master Agreement to the contrary, any breach or default under a particular Service Addendum will give the non-breaching party or parties the right to terminate that particular Service Addendum, subject to the cure periods set forth under Section 9.2(a)(i), and will not automatically operate as a default under any other Service Addendum.

-74-

9.3          Termination without Cause.

(a)          Except as provided in a Service Addendum or SOW signed after the Effective Date, the Popular Parties may terminate any of the Services, Service Addendums or SOW in whole or in part at any time at their sole discretion with one hundred eighty (180) days prior written notice.

(b)          If COMPANY or BPPR terminate a component of the Services, and that component does not have a discrete service code, unit rate or other charging methodology applicable to it: (i) the parties will discuss in good faith whether a corresponding reduction to the charges is appropriate, but (ii) EVERTEC will not be required to reduce the charges as a result of such termination unless the parties agree to a reduction in writing.  Notwithstanding the preceding sentence, the Parties shall negotiate in good faith to agree on discrete service codes for each component of the Services following the date hereof.

(c)          EVERTEC may terminate any Services, Service Addendums or SOWs that have been unused or unconsumed by any Popular Party for longer than ninety (90) days by providing sixty (60) days prior written notice (an “EVERTEC Cancellation Notice”), provided such ninety (90) day period will not apply with respect to (i) Services that are used on a seasonal basis (e.g., annual processing functions) or (ii) Services that are scheduled for use on a later date following implementation or other circumstances. The termination will not be effective if the applicable Popular Party sends written notice to EVERTEC within thirty (30) days after receipt of an EVERTEC Cancellation Notice with reasons as to why the relevant Service, Service Addendum or SOW should not be terminated notwithstanding lack of usage or consumption.

(d)          In connection with the Core API Layer SOW, subject to Section 3.10(c), the Popular Parties shall have the right to terminate this Master Agreement effective as of September 30, 2025, in whole or in part (including, for the avoidance of doubt, the Popular Parties’ obligations with respect to Section 2.2), in the event that:

(i)         if the Core API Deadline is on or before June 30, 2023 (the “Base Date”), the Core API Completion does not occur within eighteen (18) months of the Core API Deadline (the “Core API Delay Window”);

(ii)          if the Core API Deadline is after the Base Date, the Core API Completion does not occur within the Core API Delay Window less the number of months between the Base Date and the Core API Deadline; provided, that the Core API Delay Window shall in no event be reduced to less than twelve (12) months after the Core API Deadline; and

(iii)          notwithstanding anything to the contrary in clause (i) and (ii) above, if the Core API Deadline is June 30, 2025 as a result of the failure of Virtusa Corporation to complete the Virtusa Work Order, as contemplated by Section 3.10(a), the Core API Completion does not occur within eighteen (18) months of the Core API Deadline.

(e)          The termination of any or all Services, Service Addendums or SOWs under this Section 9.3 shall not result in the automatic termination of this Master Agreement or the Popular Parties’ obligations to pay Annual Minimums under Section 2.2 (except as provided otherwise in Section 2.2 or Section 9.3(d)).

-75-

9.4          Effect upon Termination.

(a)          Unless indicated otherwise in the written termination notice, upon the termination of any Service, all remaining Services will continue in full force and effect; provided, however, that should this Master Agreement be terminated, all Services in effect as of the date of termination will also terminate.

(b)          Except as otherwise provided in this Master Agreement, upon termination, all further obligations of the parties pursuant to this Master Agreement or the particular Service that was terminated, whichever the case may be, will terminate (except the obligation of COMPANY, BPPR, and their appropriate respective Subsidiaries to make a payment for any unpaid and properly invoiced amounts, in accordance with Section 3.2 and the obligation of EVERTEC to provide Transition Assistance) without further liability of any party to the others; provided, however, that termination will not release the party that terminates from any liability which at the time of termination had already accrued to the non-terminating party or parties, including EVERTEC’s obligation to continue to provide the Services during the Transition Period, if so requested by COMPANY or BPPR, and the parties’ obligations to comply with the provisions of this Master Agreement related to any Services being provided during the Transition Period.

(c)          No party shall be liable to the others for damages of any kind solely as a result of terminating this Master Agreement in accordance with its provisions.

(d)          Furthermore, any such termination will be without prejudice to any rights or remedies any party may have arising out of any breach of any material representation, warranty, covenant or condition by any other party hereto.

9.5          Transition Assistance.

(a)          “Termination Notice Date” means, as applicable for each Affected Service, the earliest of (i) twelve (12) months prior to expiration of the Initial Term, (ii) the date of any termination of this Master Agreement and all Services hereunder pursuant to Section 9.2 hereof, (iii) the date of notice of termination or non-renewal of any individual Service or Services under this Master Agreement with or without the termination of this Master Agreement, including terminations under Section 9.3 and any reductions or removal of portions or volumes of Services, and (iv) the date of a Release Event pursuant to Section 3.1 of the Technology Agreement.

(b)          “Affected Services” means any Services that are not renewed or that are terminated pursuant to a particular notice of non-renewal or termination, as applicable.

(c)          For each Affected Service, a “Transition Period” commences on the applicable Termination Notice Date and continues until the earlier of (i) the 18-month anniversary of the effective date of termination or expiration of the Affected Services and (ii) the date on which all Affected Services have been completely transitioned to COMPANY, BPPR, or another third-party provider designated by COMPANY or BPPR (a “Successor Supplier”), subject to any extension of the Transition Period as described in Section 9.5(e).

-76-

(d)          During each Transition Period, EVERTEC will (i) provide COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers transition support and assistance including providing COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers (x) information and cooperation necessary to effect the transition, with business continuity, of the applicable Affected Services and (y) the support and assistance described in Schedule 9.5 and (ii) continue to provide the applicable Affected Services to COMPANY or BPPR, their respective Subsidiaries, subject to the terms and conditions (including payment terms) that are in effect as of the applicable Termination Notice Date ((i) and (ii) collectively, “Transition Assistance”).  During the Transition Period, COMPANY, BPPR, and their respective Subsidiaries and EVERTEC shall use their Best Efforts to completely transition each Affected Service requested by the COMPANY, BPPR, and their respective Subsidiaries to COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers prior to the end of the Transition Period.

(e)          If COMPANY or BPPR, or their respective Subsidiaries or Successor Suppliers, as applicable, have used and continue to use Best Efforts to completely transition the applicable Affected Services and reasonably continue to need such Transition Assistance following the 18-month anniversary of the effective date of termination or expiration of the Affected Services, the Transition Period shall be extended until such Service or Services shall be completely transitioned to COMPANY or BPPR or their respective Subsidiaries or Successor Suppliers (the “Extended Transition Period”), subject to the parties’ agreement on an updated fee arrangement if the Extended Transition Period extends beyond March 31, 2030.

(f)          On September 30, 2028, hourly rates for any programming/development necessary to provide the Transition Assistance described in Section 9.5(d)(i) requested by COMPANY or BPPR will be adjusted by the lesser of (i) the aggregate change in CPI for the period from September 30, 2022 through September 29, 2028 (not to exceed 25%); and (ii) the difference between the sum of the change in annual CPIs (not to exceed 5%) during each one-year period commencing on September 30, 2022 and ending on September 29, 2028 less the sum of CPI adjustment actually applied during those years pursuant to Section 3.1(b) herein; provided that the fee adjustment cannot be negative.

(g)          In furtherance of and as a part of such Transition Assistance and as further described in Schedule 9.5, EVERTEC shall assist COMPANY, BPPR, and their respective Subsidiaries to develop a plan for the complete transition of all Services requested by the COMPANY, BPPR, or their respective Subsidiaries from EVERTEC to COMPANY, BPPR, and their respective Subsidiaries or a Successor Supplier, on a reasonable schedule, which shall give consideration to COMPANY, BPPR, and their respective Subsidiaries’ need for the orderly continuation of such Services.

(h)          Prior to providing any Transition Assistance, EVERTEC shall deliver to COMPANY, BPPR, and their respective Subsidiaries a good faith estimate of all projected expenses and charges payable for the Transition Assistance; provided that:

-77-

(i)         to the extent the Transition Assistance consists of Services that were provided pursuant to this Master Agreement, the expenses and charges for such Services shall be the price for such Services under this Master Agreement), which expenses and charges shall be paid by COMPANY, BPPR, or their appropriate respective Subsidiaries in accordance with the provisions of this Master Agreement; and

(ii)        to the extent the Transition Assistance consists of additional programming, development or other assistance that is incremental to the Services that were provided pursuant to this Master Agreement, the expenses and charges for personnel resources will be determined using the programming/development time and materials rates then in effect under this Master Agreement; provided, if COMPANY or BPPR requests assistance that requires specialized skills that (A) EVERTEC does not make available to COMPANY or BPPR under this Master Agreement; (B) are only available from third parties at a higher cost than the costs EVERTEC incurs to engage third parties for other skills under this Master Agreement and (C) COMPANY or BPPR, as applicable, determines not to engage a third party or parties directly, EVERTEC may increase the time and materials rates to reflect the incremental costs EVERTEC must incur to procure the specialized skills requested by COMPANY or BPPR.

(i)          The quality of the Services provided by EVERTEC, and EVERTEC’s performance of the Services, will not be materially degraded during the period EVERTEC is providing Transition Assistance. EVERTEC shall not make any changes to the EVERTEC Personnel that are critical to providing Services in accordance with this Master Agreement during the Transition Period or reassign any such critical EVERTEC Personnel away from performing Services under this Master Agreement during the Transition Period except as mutually agreed to by the parties in writing.

(j)          EVERTEC will, to the extent requested by COMPANY, BPPR, or their respective Subsidiaries: (i) assign to COMPANY, BPPR, their respective Subsidiaries and/or the Successor Supplier leases for some or all of the EVERTEC leased equipment that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, including applicable maintenance agreements that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, and COMPANY, BPPR, their respective Subsidiaries and the Successor Supplier shall assume the obligations under such leases that relate to periods after such date (to the extent EVERTEC is able to obtain any required consents for such assignments); and (ii) sell to COMPANY, BPPR, their respective Subsidiaries or the Successor Supplier, at EVERTEC’s then current book value, some or all of the equipment owned by EVERTEC or its Affiliates that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, including applicable maintenance agreements.  EVERTEC will also provide all user and other documentation relevant to such Equipment in EVERTEC’s possession.  COMPANY, BPPR, their respective Subsidiaries or the Successor Supplier (as applicable).  EVERTEC will be operationally responsible for obtaining any consents from Third Parties necessary to obtain any licenses or transfer any Equipment to COMPANY, BPPR, their respective Subsidiaries or Successor Supplier; provided that COMPANY or BPPR, as applicable, shall be responsible for any out-of-pocket costs incurred by EVERTEC in connection therewith.

-78-

(k)          The provisions of this Master Agreement shall apply with respect to all Services (including Transition Assistance) provided during the Transition Period. Nothing contained herein shall obligate COMPANY, BPPR, or their respective Subsidiaries to receive Transition Assistance from EVERTEC.

(l)          Notwithstanding anything to the contrary in this Master Agreement, the provisions of this Section 9.5, including Schedule 9.5, shall survive the expiration or termination of this Master Agreement (or any portion thereof) for any reason.

(m)          As and when reasonably requested by COMPANY, BPPR, and their respective Subsidiaries during the Term, EVERTEC will provide to COMPANY, BPPR, and their respective Subsidiaries such information and other cooperation regarding the performance of the Services and the manner in which the Services are integrated with COMPANY’s, BPPR’s and their Subsidiaries’ Systems and processes as would be reasonably necessary to enable COMPANY, BPPR, and their respective Subsidiaries or potential third-party providers to conduct due diligence and prepare an informed plan to obtain such services from a third party provider.  The Popular Parties and their respective Subsidiaries may disclose such information and other information about the Services to such third parties, provided such third parties may use it solely for the purposes described in this Section 9.5(m) and will be subject to confidentiality obligations substantially similar to those in this Master Agreement.  This Section 9.5(m) will not, however, require EVERTEC to provide Proprietary Application Information.

ARTICLE TEN– INSURANCE AND INDEMNIFICATION

10.1          Insurance.

(a)          EVERTEC agrees to maintain adequate insurance coverage from reputable providers in amounts as set forth below.  All such insurance policies will be carried at EVERTEC’s own expense.  Except as EVERTEC, COMPANY and BPPR may otherwise agree, EVERTEC will maintain in full force and effect during the Term insurance as follows:

(1)          Statutory Workers’ Compensation Insurance or a workers’ compensation and employers’ liability insurance, as applicable under the applicable state statutory law of the relevant jurisdiction, covering all its employees and including occupational disease coverage.

(2)         Commercial General Liability Insurance covering against claims for bodily injury, death, property damage, personal injury, advertising injury and products/completed operations with limits in an amount of not less than one million dollars ($1,000,000) per occurrence.  The annual aggregate limit shall not be less than two million dollars ($2,000,000).  For this policy, the Insurance Services Office Inc. (“ISO”) Commercial General Liability occurrence coverage form CG 00 01 or its equivalent will be used.

-79-

(3)          Automobile Liability Insurance with limits not less than 1 million dollars ($1,000,000) each occurrence combined single limit of liability.  This insurance shall include Third Party bodily injury and property damage liability including owned and not owned and hired automobile coverage. For this policy, the ISO form number CA 00 or its equivalent will be used.

(4)         Umbrella Insurance with limits not less than five million dollars ($5,000,000) covering excess of loss over primary liability insurance policies, including Comprehensive General Liability, Comprehensive Automobile Liability and Employers Liability insurance policies, where applicable under state Legal Requirements.

(5)          Fidelity and Crime insurance with limits not less than fifteen million dollars ($15,000,000) each occurrence and annual aggregate including Electronic & Computer Crime, Unauthorized Computer Access coverage, and employee dishonesty coverage which shall be extended to loss of Third Parties.

(6)         Technology professional liability and cyber insurance (Errors and Omissions) with limits not less than fifteen million dollars ($15,000,000) each occurrence and annual aggregate covering any damages caused by an error, omission or any negligent acts related to the services to be provided under this Master Agreement by EVERTEC and/or its Subcontractors, agents, officers or employees and including coverage for computer programming and electronic data processing services, network security liability, content injury, privacy injury, regulatory proceedings, dependent loss and Third Party custodian. This insurance shall include coverage for Third Party claims and for losses, unauthorized disclosures, access or use of BPPR Data in any format, including coverage for accidental loss, theft, unauthorized disclosure access or use of BPPR Data.

(7)        Employment Practices Liability Insurance with limits not less than one million dollars ($1,000,000) per claim and in general aggregate providing protection against inappropriate workplace conduct, including: wrongful termination, discrimination, harassment, retaliation, defamation, invasion of privacy, failure to promote, deprivation of a career opportunity, and negligent evaluation.

(b)          Certificates of Insurance. Certificates of insurance (“COI”) evidencing all coverage described in this Section 10.1(b) shall be furnished to COMPANY or BPPR (i) upon execution of this Master Agreement; (ii) annually, within forty-five (45) days following the insurance policy renewal; (iii) whenever the insurer or the insurance coverage changes; or (iv) upon COMPANY’s or BPPR's request and will include the following:

(1)       The COI will require thirty (30) days’ advance written notice to COMPANY and BPPR before cancellation of, material change to, potential exhaustion of aggregate limits of, or non-renewal of the required insurance coverage(s).

-80-

(2)       The COI will state that the respective EVERTEC insurance will respond on a primary basis without contribution from any other insurance of COMPANY, BPPR, or their respective Subsidiaries.

(c)          EVERTEC shall maintain the coverages required in this Section 10.1(c) from insurance carriers that have an AM Best rating of A- VII or better for risks insured in Puerto Rico and an AM Best rating of A VIII for risks insured outside Puerto Rico; provided that if an insurance carrier’s rating changes to a rating below A- VII or A VIII (as applicable), EVERTEC shall use Best Efforts to promptly replace such insurance carrier to one that has a AM Best rating of A- VII or A VIII (as applicable) and in all cases shall replace it prior to the next annual renewal of the applicable coverage.

(d)          Insurance deductibles or retentions shall not exceed three million dollars ($3,000,000) per insurance policy unless approved in writing by COMPANY and BPPR.

(e)        All liability insurance, except for Crime, Employment Practices Liability, Workers’ Compensation, Professional Liability and Cyber Liability required under this Master Agreement must include an additional insured endorsement, without containing any special limitations on the scope of the endorsement, specifying COMPANY and BPPR and their officers, employees and agents as additional insureds, including additional insured status with respect to liability arising out of ongoing operations and completed operations, but only with respect to EVERTEC's activities to be performed under this Master Agreement.

(f)          EVERTEC shall waive rights of subrogation which EVERTEC or any insurer of EVERTEC may acquire against COMPANY or BPPR by virtue of the payment of any Loss; and EVERTEC will obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not COMPANY or BPPR has received a waiver of subrogation endorsement from EVERTEC or EVERTEC’s insurer(s); provided, however, that (x) any such waivers shall not be extended to cover losses caused by acts of any COMPANY and BPPR or their affiliates, subsidiaries or parent companies and their agents or employees, which are not connected with the operations being conducted by EVERTEC or any third-party hired by EVERTEC and their principals so stipulated and then only, in so far as is necessary to meet the requirements of this Master Agreement; and (y) any such endorsements shall not extend, modify, increase limits of, or otherwise alter the coverage provided by any policy applicable within this Master Agreement.

(g)        If any of the required insurance is on a claims made basis and does not include an extended reporting period of at least 36 months, EVERTEC shall maintain either tail coverage or continuous claims made liability coverage, for a minimum of 36 months following the termination of this Master Agreement.

-81-

(h)          If EVERTEC outsources to any Third Party (including a Subcontractor) any part of the services it renders or the products it supplies to COMPANY or BPPR, then EVERTEC's required insurance policies must be endorsed to provide coverage for liabilities that may arise through such Third Party or Subcontractor to the same extent as if the work were performed, or the goods provided, by EVERTEC.  In the alternative, EVERTEC must submit to COMPANY and BPPR proof of the Third Party's or Subcontractor's insurance under the same coverage and limits as required from EVERTEC.  Any claims arising from the work or product provided by the Third Party or Subcontractor will be paid first through EVERTEC's insurance and, to the extent not covered, then by such Third Party's or Subcontractor's insurance.

(i)          The insolvency, bankruptcy or failure of any insurance company providing coverage as required herein shall not relieve either party of its obligations to maintain adequate insurance as provided in this Section 10.1.

10.2          Indemnity. Each party (the “Indemnifying Party”) hereby agrees to indemnify, defend, protect and hold harmless the other parties, their Affiliates and their respective Representatives, suppliers, Third Party information providers, Subcontractors and permitted assigns and successors in interest (collectively, the “Indemnified Party”) from and against any Losses incurred or suffered by, or asserted against, such Indemnified Party directly or indirectly in relation to or arising from:

(a)          subject to Section 2.3 of Exhibit C hereof with respect to any failure by EVERTEC to meet its Service Levels, any breach of this Master Agreement, including any breach of representation or warranty, by the Indemnifying Party;

(b)            any claim brought by any Third Party against an Indemnified Party based on the Indemnifying Party’s use or provision of the Services;

(c)            the Indemnified Party’s compliance with the Indemnifying Party’s Specifications or instructions;

(d)           acts or omissions of the Indemnifying Party and its Representatives in connection with the installation, maintenance, presence, use or removal of equipment or software not provided by the Indemnified Party;

(e)            with respect to the COMPANY or BPPR as the Indemnifying Party, claims by Third Parties that EVERTEC’s use of Intellectual Property provided by COMPANY or BPPR infringe the Third Party’s Intellectual Property rights, except to the extent the infringement claim is based on (i) use of the Intellectual Property for any purpose not permitted in this Master Agreement; or (ii) enhancements or other modifications made by EVERTEC to the Intellectual Property, other than at the specific written direction of COMPANY, BPPR or any of their respective Subsidiaries or Affiliates;

(g)          with respect to the EVERTEC as the Indemnifying Party, a Data Breach occurring due to a breach of this Master Agreement, gross negligence, fraud or willful misconduct by EVERTEC or its Representatives; provided that EVERTEC’s indemnification obligation under this Section 10.2(g) with respect to Data Breaches shall be subject to the Data Cap;

(h)            the Indemnified Party’s use or provision of the Services or data supplied by the Indemnifying Party; and

-82-

(i)             claims against the Indemnified Party for damage to, or loss of use of property of Third Parties and/or injury or death of any person to the extent that such damage, injury or death is caused by the negligent act or omission of the Indemnifying Party.

Notwithstanding anything in this Section 10.2 to the contrary, (i) with respect to EVERTEC as the Indemnifying Party, this Article Ten shall not apply to claims relating to infringement of any Intellectual Property right of a Third Party, which claims shall be exclusively the subject of Section 7.4, (ii) with respect to COMPANY and BPPR as the Indemnifying Party, (A) any claims related to infringement of any Intellectual Property right of a Third Party shall be exclusively the subject of Section 10.2(e); and (B) BPPR’s indemnification obligation and liability with regard to infringement claims related to a BPPR Pass Through License shall be subject to and limited solely to the following: (x) if COMPANY or BPPR receives notice of an infringement claim against an EVERTEC Indemnified Party related to a BPPR Pass Through License, if requested by EVERTEC, COMPANY or BPPR shall use Best Efforts to pursue its rights, if any, for indemnification or other monetary remedies against the applicable Third Party licensor in accordance with the terms set forth in the BPPR Pass Through License; and (y) monetary awards actually received by COMPANY or BPPR, less the amount of all fees, claims, costs and expenses (including attorneys’ fees) incurred by COMPANY or BPPR in connection with pursuing such claim against a Third Party provider for infringement, shall be allocated between COMPANY and BPPR and its respective Affiliates, on the one hand, and EVERTEC, on the other, in proportion to the damages and costs sustained by such party due to the BPPR Pass Through License.

10.3          Indemnification Procedures. With respect to claims covered by Section 10.2 above, the following procedures will apply:

(a)         Notice. Promptly after receipt by an Indemnified Party of notice of the commencement or threatened commencement of any civil, criminal, administrative or investigative action or proceeding involving a claim in respect of which the Indemnified Party will seek indemnification pursuant to this Article Ten, the Indemnified Party will notify the Indemnifying Party of such claim in writing. The failure of Indemnified Party to so notify an Indemnifying Party will relieve Indemnifying Party of its obligations under this Section 10.3 to the extent that Indemnifying Party can demonstrate damages attributable to such failure. Within fifteen (15) days following receipt of written notice from the Indemnified Party relating to any claim, but no later than fifteen (15) days before the date on which any response to a complaint or summons is due, the Indemnifying Party will notify the Indemnified Party in writing if the Indemnifying Party elects to assume control of the defense and settlement of that claim (a “Notice of Election”).

(b)          Procedure Following Notice of Election. If the Indemnifying Party delivers a Notice of Election relating to any claim within the required notice period, the Indemnifying Party will be entitled to have sole control over the defense and settlement of such claim; provided that (i) the Indemnified Party will be entitled to participate in the defense of such claim and to employ counsel at its own expense to assist in the handling of such claim; and (ii) the Indemnifying Party will notify the Indemnified Party before ceasing to defend against such claim, and will not compromise or settle such claim without the Indemnified Party’s prior written consent if such compromise or settlement would impose a penalty or limitation upon the Indemnified Party, including, an injunction or other equitable relief, or such compromise or settlement does not include the release of the Indemnified Party from all liability arising from or relating to such claim. After the Indemnifying Party has delivered a Notice of Election relating to any claim, the Indemnifying Party will not be liable to the Indemnified Party for any legal expenses incurred by the Indemnified Party in connection with the defense of that claim. In addition, the Indemnifying Party will not be required to indemnify the Indemnified Party for any amount paid or payable by the Indemnified Party in the settlement of any claim for which the Indemnifying Party has delivered a timely Notice of Election if such amount was agreed to without the written consent of the Indemnifying Party.

-83-

(c)          Procedure Where No Notice of Election Is Delivered. If the party which is the Indemnifying Party does not deliver a Notice of Election relating to any claim within the required notice period, the Indemnified Party will have the right to defend the claim in such manner as it may deem appropriate, and the failure of the Indemnifying Party to deliver such Notice of Election will not affect the indemnification obligations of such party under this Master Agreement.

(d)          Cooperation. When seeking indemnification, the Indemnified Party will at all times reasonably cooperate with the Indemnifying Party in the defense or settlement of any claim which is subject to this Article Ten.

(e)          Entitlement to Payment. In the event an Indemnifying Party elects not to assume control of the defense and settlement of that claim, the Indemnified Party will be entitled to payment by the Indemnifying Party upon the Indemnified Party’s settlement of the claim or the adjudication of liability, whichever first occurs.

ARTICLE ELEVEN– SERVICES FOR CLIENTS

11.1        Scope of Services. EVERTEC acknowledges that the Services are intended to enable COMPANY, BPPR, and their respective Subsidiaries to manage effectively certain of:

(a)          COMPANY, BPPR, and their respective Subsidiaries’ internal operations, and

(b)          COMPANY, BPPR, and their respective Subsidiaries’ performance and delivery of services and products for COMPANY, BPPR, and their respective Subsidiaries’ respective Clients (hereinafter collectively referred to as the “Popular Services and Products”).

Provided EVERTEC is given the opportunity to (i) coordinate with COMPANY and BPPR and approve the Specifications for the Services, COMPANY, BPPR, or one of their respective Subsidiaries proposes to offer under a written agreement between COMPANY, BPPR, or one of their respective Subsidiaries and a Client that includes the provision of such Services (“Client Agreements”); and (ii) review and accept changes to any applicable operating manuals of COMPANY, BPPR, or their respective Subsidiaries that impact EVERTEC with respect to its provision of the Services, EVERTEC shall use Best Efforts to ensure that the Services are provided in a manner that allows COMPANY, BPPR, and their respective Subsidiaries to act in accordance with the corresponding Client Agreements and operating manuals for each of the Popular Services and Products. In the event that COMPANY, BPPR, or their respective Subsidiaries make any change to any Popular Service and Product that requires a change or modification to the Services, such change shall be processed and implemented pursuant to this Master Agreement.

-84-

11.2          Special Representations Regarding EVERTEC’s Performance of Services under Service Agreements with Governmental Agencies.  In connection with any Client Agreement wherein the Client is a Governmental Authority of the Commonwealth of Puerto Rico, EVERTEC shall comply with all applicable Legal Requirements relating to government procurement and contracting.

11.3          Client Agreements.

(a)        EVERTEC will have no liability or obligation under any Client Agreement, whether through an outsourcing arrangement or through reselling of the Services; provided, however, that EVERTEC shall be responsible to COMPANY, BPPR, and their respective Subsidiaries for any Losses caused by a breach of any of its obligations under this Master Agreement. COMPANY, BPPR, and their respective Subsidiaries will have no authority to bind EVERTEC to any terms or conditions of the Service in connection with or as part of any Client Agreement, except as otherwise provided by the parties in writing.

(b)         EVERTEC agrees to assist COMPANY, BPPR, and their respective Subsidiaries with the investigation of any claims arising under a Client Agreement. Furthermore, EVERTEC will refer to COMPANY, BPPR, and their respective Subsidiaries any complaint that is received by EVERTEC, in which case, EVERTEC will be notified of the results of any investigation performed by COMPANY, BPPR, or their respective Subsidiaries within five (5) days following the receipt of the referral for investigation.

(c)        COMPANY, BPPR, and their respective Subsidiaries are responsible for any acts or omissions by Clients that, if performed by COMPANY, BPPR, or their respective Subsidiaries, would constitute a breach of this Master Agreement. COMPANY, BPPR, and their respective Subsidiaries are responsible for all fees and expenses that are payable to EVERTEC under this Master Agreement regardless of whether COMPANY, BPPR, and their respective Subsidiaries receive payment from the Client for the Services provided. Any charge-back or credit arrangements between COMPANY, BPPR, and their respective Subsidiaries and a Client are the responsibility of COMPANY, BPPR, and their respective Subsidiaries, and do not affect COMPANY, BPPR, and their respective Subsidiaries’ liability for the payment of such fees and expenses.

(d)          Notwithstanding any limit of liability herein, COMPANY hereby agrees to indemnify, defend, protect and hold harmless EVERTEC, its Affiliates and their respective Representatives, suppliers, Third Party information providers, Subcontractors and permitted assigns and successors in interest (collectively, the “EVERTEC Indemnitee”) from and against any Losses incurred or suffered by, or asserted against, any EVERTEC Indemnitee directly or indirectly in relation to or arising from any claim brought by any Third Party against an EVERTEC Indemnitee based on (i) a Client’s use of the Services in a manner inconsistent with this Master Agreement and (ii) any breach of a Client Agreement by COMPANY, BPPR, or their respective Subsidiaries or a Client to the extent such breach is not attributable to a breach of this Master Agreement by EVERTEC.

[Signature page follows.]

-85-

IN WITNESS WHEREOF, the parties hereto have caused this Master Agreement to be executed by their duly authorized Representatives as of the date first written above.

Popular, Inc.		Evertec Group, LLC
By:	/s/ Félix Fernandez	By:	/s/ Luis A. Rodriguez
Name: Félix Fernández		Name:   Luis A. Rodriguez
Title:  Senior Vice President		Title:    Executive Vice President, Chief Legal and Corporate Development Officer

Banco Popular de Puerto Rico
By:	/s/ Félix Fernandez
Name: Félix Fernández
Title:   Authorized Officer

EX-10.2

Exhibit 10.2

EXECUTION VERISON

SECOND AMENDED AND RESTATED

INDEPENDENT SALES ORGANIZATION

SPONSORSHIP AND SERVICES AGREEMENT

BETWEEN

EVERTEC GROUP, LLC

AND

BANCO POPULAR DE PUERTO RICO,

dated as of July 1, 2022

TABLE OF CONTENTS

			Page
ARTICLE I DEFINITIONS AND INTERPRETATIONAL PROVISIONS			2
	Section 1.1	Certain Definitions	2
	Section 1.2	Interpretational Provisions	20
ARTICLE II EVERTEC RESPONSIBILITIES			20
	Section 2.1	EVERTEC Responsibilities – General	20
	Section 2.2	Merchant Transaction and Fee Settlement	24
	Section 2.3	Merchant Chargeback Responsibilities	24
	Section 2.4	Merchant Acquiring Improvement Team	24
	Section 2.5	Merchant Agreements	25
	Section 2.6	Telecommunications Links	26
	Section 2.7	Reports to BPPR	27
	Section 2.8	Notices; Legal Proceedings	27
	Section 2.9	[Omitted]	27
	Section 2.10	FFIEC/PCI Compliance	27
	Section 2.11	Hold Account	28
	Section 2.12	Merchant Reserve Account	28
	Section 2.13	Security Interest in Accounts	28
	Section 2.14	Subcontractors; Third-Party Vendors	29
	Section 2.15	Business Continuity Plan	29
	Section 2.16	Merchant Referral	30
ARTICLE III BPPR RESPONSIBILITIES			30
	Section 3.1	BPPR Responsibilities – General	30
	Section 3.2	Merchant Referral and Assistance	32
	Section 3.3	Settlement Responsibilities	33
	Section 3.4	[Omitted]	35
	Section 3.5	Servicing and Monitoring of Merchant Card Accounts	35
	Section 3.6	Compliance with Legal Requirements	36
	Section 3.7	Settlement Risk	36
	Section 3.8	Notices; Legal Proceedings	36
ARTICLE IV EXCLUSIVITY			36
	Section 4.1	BPPR as Acquiring Member	36
	Section 4.2	EVERTEC Obligations	37
	Section 4.3	General	37
ARTICLE V CONFIDENTIALITY, PRIVACY & DATA PROTECTION			38
	Section 5.1	Confidential Information	38

i

	Section 5.2	Protection of Confidential Information	39
	Section 5.3	Incident Response Program.	40
	Section 5.4	Required Disclosures	41
	Section 5.5	Remedies	42
	Section 5.6	Term of Obligation	42
	Section 5.7	Destruction	42
	Section 5.8	Confidentiality Regarding Customer and Cardholder Information.	43
	Section 5.9	Access to Systems and Facilities	43
ARTICLE VI FEES AND CHARGES			44
	Section 6.1	Merchant Transaction Processing Fees and Other Charges	44
	Section 6.2	Changes in Merchant Transaction Processing Fees and Other Charges	44
	Section 6.3	EVERTEC Compensation	45
	Section 6.4	BPPR Compensation	45
	Section 6.5	Information Rights and Validation Procedures	46
ARTICLE VII REGISTRATION COMPLIANCE			46
	Section 7.1	VISA/MCI/Discover Requirements	46
ARTICLE VIII REPRESENTATIONS AND WARRANTIES			47
	Section 8.1	Representations and Warranties of EVERTEC	47
	Section 8.2	Representations and Warranties of BPPR	49
ARTICLE IX TERM, TERMINATION, DEFAULT, INSURANCE, INDEMNIFICATION			50
	Section 9.1	Term and Contracts Split	50
	Section 9.2	Termination	52
	Section 9.3	Effect of Termination, Transition/Conversion of Merchants	53
	Section 9.4	Insurance	54
	Section 9.5	Indemnification	55
ARTICLE X NAMES AND TRADEMARKS			57
	Section 10.1	BPPR Name	57
	Section 10.2	Association and Card Trademarks	57
ARTICLE XI MISCELLANEOUS			58
	Section 11.1	Assignment	58
	Section 11.2	Force Majeure	60
	Section 11.3	Notices	60
	Section 11.4	Amendment; Waiver	61
	Section 11.5	Entire Agreement	61

ii

Section 11.6	Governing Law; Dispute Resolution; Waiver of Trial by Jury	61
Section 11.7	Counterparts	62
Section 11.8	Construction	62
Section 11.9	Severability	63
Section 11.10	Independent Contractors	63
Section 11.11	Effect on Prior ISO Agreement	63
Section 11.12	Release of Existing Claims	63
Section 11.13	EVERTEC Change of Control	64
Section 11.14	Specific Performance	65

Exhibit A Government-Merchant Agreements	A-1
Exhibit B Merchant Application Approval Policy	B-1
Exhibit C BINs with the Associations	C-1
Exhibit D Approved Audit Firms	D-1
Exhibit E MAB Adjusted Revenue and P2B Adjusted Revenue	E-1
Exhibit F Trademark Licensing Terms	F-1
Exhibit G Merchant Acquiring Improvement Team	G-1
Exhibit H Merchant Program Procedures
Exhibit I Form of Merchant Agreement

iii

SECOND AMENDED AND RESTATED

INDEPENDENT SALES ORGANIZATION

SPONSORSHIP AND SERVICES AGREEMENT

This Second Amended and Restated Independent Sales Organization Sponsorship and Services Agreement (this “Agreement”), effective as of July 1, 2022 (the “Effective Date”), is entered into by and between Evertec Group, LLC, a limited liability company organized under the laws of the Commonwealth of Puerto Rico (“EVERTEC”) and Banco Popular de Puerto Rico, a bank organized under the laws of the Commonwealth of Puerto Rico (“BPPR”).

RECITALS

WHEREAS, BPPR is a member in good standing of VISA U.S.A., Inc. and VISA International, Inc. (collectively, “VISA”), Discover Financial Services, LLC (“Discover”), MasterCard International, Inc. (“MCI”) and other Associations (as hereinafter defined), and BPPR is qualified to provide sponsorship of non-member agents into the Associations;

WHEREAS, EVERTEC wishes to continue engaging in the business of marketing Merchant Services (as defined herein) to Merchants (as defined herein) and potential Merchants with respect to each Association;

WHEREAS, in order to provide the Merchant Services with respect to an Association, EVERTEC must be sponsored by a member of such Association, and BPPR, as a member of the Associations, wishes to continue to sponsor EVERTEC on the terms set forth herein;

WHEREAS, in addition to BPPR’s agreement to continue sponsoring EVERTEC into the Associations as set forth herein, BPPR also agrees to continue providing access to the ATH Network through which Merchants and Government-Merchants may accept Transactions;

WHEREAS, the Associations have each adopted rules and regulations relating to the provision of Merchant Services by third-party agents to which BPPR, as a result of its membership in the Associations, and EVERTEC, as a result of BPPR’s sponsorship pursuant to this Agreement, are subject;

WHEREAS, BPPR, Popular, Inc., a corporation organized under the laws of the Commonwealth of Puerto Rico (“Popular”), and EVERTEC have entered into that certain Asset Purchase Agreement, dated as of February 24, 2022 (the “Asset Purchase Agreement”), pursuant to which BPPR is, contemporaneously with entering into this Agreement, acquiring a portion of the business of Evertec, Inc., a corporation organized under the laws of the Commonwealth of Puerto Rico and the ultimate parent entity of EVERTEC (“EVERTEC Parent”); and

WHEREAS, BPPR and EVERTEC have previously entered into an Independent Sales Organization Sponsorship and Services Agreement on June 30, 2010, as subsequently amended on September 30, 2010 (the “Prior ISO Agreement”), and BPPR and EVERTEC desire to amend and restate the Prior ISO Agreement in order to provide for certain changes and additions to such services and revisions to the terms of the Prior ISO Agreement.

THE AGREEMENT

NOW, THEREFORE, in consideration of the premises, the mutual agreements contained in this Agreement and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties agree as follows:

ARTICLE I

DEFINITIONS AND INTERPRETATIONAL PROVISIONS

Section 1.1          Certain Definitions.  As used in this Agreement, the following terms have the meanings set forth below:

“Access” has the meaning set forth in Section 5.9(a).

“ACH” means the Automated Clearing House payment system.

“ACH File” means the daily file created by EVERTEC and provided to BPPR in the prescribed ACH format by a financial institution participating in the ACH that contains (i) a list of the ACH Transactions to debit or credit Merchants and/or Government-Merchants, as applicable, for the sum of Sales Records, Credit Records and Merchant Chargebacks received by EVERTEC and (ii) Merchant Transaction Processing Fees calculated by EVERTEC.

“ACH Returns” means ACH Transactions that cannot be posted to a Merchant’s or a Government-Merchant’s bank account due to erroneous information, insufficient funds, closed accounts or other reasons and that are returned through the Federal Reserve to the originating financial institution.

“ACH Transaction” means an Electronic Record of amounts to be deposited or debited to a bank account at a financial institution participating in the ACH.

“Acquiring Member” means a licensee or member of an Association that is authorized by the Association to enter Transactions into or receive Transactions from the Association’s settlement and authorization systems.

“Affected Persons” has the meaning set forth in Section 5.3(b)(i).

“Affiliate” means, with respect to any Person, any other Person, directly or indirectly, through one or more intermediaries, Controlling, Controlled by, or under common Control with, such Person.  Notwithstanding the foregoing, with respect to Popular (to the extent that at the time of determination it is engaged in a private equity or similar business), the term “Affiliate” shall not include portfolio companies of Popular or its Controlled Affiliates.

“Agreement” has the meaning set forth in the Preamble.

“Alleged Breaching Party” has the meaning set forth in Section 9.2(b).

“Approved Audit Firm” means the audit firms listed in Exhibit D.

2

“Assessments” means those fees paid by Acquiring Members, other than Interchange Fees and Association Dues, for participation in the programs offered by each Association, as the due dates and amounts of such fees may be changed from time to time by each respective Association.

“Asset Acquirer” has the meaning set forth in Section 11.1(c).

“Asset Purchase Agreement” has the meaning set forth in the Recitals.

“Assignee Sub” has the meaning set forth in Section 11.1(b).

“Association Dues” means any fees and rebates imposed by any of the Associations pursuant to such Association’s regulations for use of such Association’s equipment, settlement and authorization systems, automated retrieval systems, BIN licensing, arbitration filings, fines for non-compliance with such regulations and such other charges as such Association may from time to time impose, excluding the Interchange Fees and Assessments.

“Associations” means VISA, Discover, MCI, the ATH Network and any other credit and/or debit card companies (private label or otherwise) of which BPPR is a member in good standing or with respect to which BPPR is otherwise authorized to provide sponsorship of non-member agents.

“ATH Movil Business Help-Desk Costs” means $0.01 per-transaction, which is intended to cover costs associated with running the ATH Movil Business help-desk, which include the applicable fully loaded costs of employees and equipment expense.

“ATH Network” means the interbank network connecting the ATMs, POS systems or any other Channel (as defined in the ATH Network Agreement) of various financial institutions in the Region, and includes the debit card network for ATH-linked ATM cards.

“ATH Network Agreement” means the Second Amended and Restated ATH Network Participation Agreement, dated as of July 1, 2022, by and between BPPR and EVERTEC.

“Authorization Center” means the service desk to be established and maintained by EVERTEC to be contacted by a Merchant to obtain authorization codes and other instructions with respect to handling Cards according to the Merchant Program Procedures.

“beneficially owned,” “beneficial ownership” and similar phrases have the same meanings as such terms have under Rule 13d-3 (or any successor rule then in effect) under the Exchange Act, except that in calculating the beneficial ownership of any Person, such Person shall be deemed to have beneficial ownership of all securities that such Person has the right to acquire, whether such right is currently exercisable or is exercisable upon the occurrence of a subsequent event.  Notwithstanding the foregoing, no Person shall be deemed to beneficially own any securities beneficially owned by another Person who is not an Affiliate of such Person.

“Best Efforts” means the efforts that a prudent Person desirous of achieving a result would use in similar circumstances to ensure that such result is achieved in the time period expressly contemplated or, in the absence of an expressly contemplated time period, within a commercially reasonable time period.

3

“BIN” means a unique bank identification number assigned and licensed by VISA or Discover, or an interbank card association number assigned and licensed by MCI, to an Acquiring Member for such Acquiring Member’s use in issuing Cards (if applicable) and entering Transactions into or receiving Transactions from such Association’s settlement and authorization systems.

“BPPR” has the meaning set forth in the Preamble.

“BPPR Core Banking Systems” means BPPR’s main banking systems that manage the deposit accounts, transactions and balances of BPPR’s individual or commercial customers.

“BPPR Data” means data, records and information provided, or otherwise made available, to EVERTEC in connection with this Agreement by or on behalf of BPPR, or one of its Subsidiaries, including all NPPI and all data and information derived from or works of any of the foregoing.

“BPPR MAB Team Employees” has the meaning set forth in Exhibit G.

“BPPR Merchant Split Percentage” has the meaning set forth in Section 9.1(b)(iii).

“BPPR Post-Termination Merchants” has the meaning set forth in Section 9.1(b)(i).

“BPPR Sponsorship Fees” means $1,000 per year.

“BSA” has the meaning set forth in Section 3.6.

“Business Continuity Plan” means the documented processes, preventive arrangements, and measures taken by a party to be able to respond, recover, resume or restore to a predefined level of operation following an Event in order to be able to continue performing its obligations under this Agreement or to prevent or mitigate the adverse effects of an Event.  A Business Continuity Plan must include specific elements, such as incident response, disaster recovery and crisis management.

“Business Day” will be each day from Monday through Friday, except for Legal Holidays.

“Card” means a card bearing the Trademark of an Association, or any other card, including debit cards and credit cards, that may be used by a Cardholder to authorize and charge purchases to such Cardholder’s Cardholder Account as part of Transactions completed upon the Cardholder’s presentment of the card and signing of a Sales Record or by mail, Internet or telephone order, in each case in accordance with the applicable Rules.

“Cardholder” means a Person who has a Cardholder Account with an Issuing Member, or a Person who has a card that can be used to obtain cash through the ATH Network.

“Cardholder Account” means an arrangement between a Person and an Issuing Member whereby such Person may use one or more Cards issued by such Issuing Member to conduct Transactions or obtain a Cash Disbursement.

4

“Cash Disbursement” means the use of a Card to obtain cash from a financial institution in accordance with the applicable Rules of such financial institution.

“Confidential Information” means any and all confidential and/or proprietary non-public information or material, whether in electronic or hard copy format, that is generated, collected or utilized in BPPR’s (or any of its Subsidiary’s) or EVERTEC’s business or operations.  Confidential Information includes:

(i)          information received from or concerning any third party (such as Merchants, Government-Merchants, customers or suppliers);

(ii)        product or services information concerning any of BPPR’s (or one of its Subsidiary’s) or EVERTEC’s research, or products or services being provided or developed, algorithms, supplier or vendor information, plans, ideas, drawings, specifications, documentation, quality guidelines, and analyses of strengths or weaknesses of each product or service;

(iii)      trade secrets, source code and object code, other confidential Intellectual Property, technical and technological information, including designs, processes, methods, technical specifications, drawings, prototypes, troubleshooting guidelines, formulas, data, files, performance characteristics, computer software information and related documentation, databases, programs, systems engineering, research and development plans, disks and other storage media, drawings, notes, proposals, reports, photographs, hardware, card files and recordings;

(iv)      financial information, such as overhead costs, profit margins, banking and financing data, budgeting data and reports, and pricing policies;

(v)        organizational information, information concerning the utilization of facilities, merger, acquisition and expansion information, equipment utilization information;

(vi)       marketing and sales information, such as marketing and sales techniques and data, identification and authorizing source, account status and ability to pay, product development and delivery schedules, transportation and logistical requirements, market research and forecasts, strategic planning, and marketing and advertising plans, techniques and budgets;

(vii)      BPPR’s (or one of its Subsidiary’s) or EVERTEC’s overall strategies, the specific programs and strategies utilized by BPPR (or one of its Subsidiaries) or EVERTEC; and the success or lack of success of those programs and strategies; and

(viii)      NPPI.

5

For the avoidance of doubt, Confidential Information includes, with respect to each party to this Agreement, such party’s Data Protection Program (including the Data Safeguards established pursuant to such Data Protection Program), its Business Continuity Plan, proprietary non-public materials with respect to EVERTEC’s physical security systems, access control systems, recovery equipment and techniques and all reports and information regarding the Merchant Services other than reports and information that are specifically designated as public.  For the avoidance of doubt, BPPR’s Confidential Information includes all BPPR Data.  EVERTEC’s Confidential Information shall not include any (1) Intellectual Property, books and records or other information or materials acquired pursuant to the Asset Purchase Agreement (except to the extent that any books and records are designated as confidential information of EVERTEC pursuant to the Asset Purchase Agreement), or (2) modifications, enhancements or derivative works based on such Intellectual Property in the immediately preceding clause (1).

“Control,” and its correlative meanings, “Controlling” and “Controlled,” means the possession, direct or indirect, or the power to direct or cause the direction of the management and policies of a Person, whether through the ownership of voting securities, by contract or otherwise.

“Control Acquirer” has the meaning set forth in Section 11.13(a).

“CPI” means the All Items Consumer Price Index All Urban Consumers, U.S. City Average (1982-84 – 100), which is published by the U.S. Department of Labor, Bureau of Labor Statistics.

“Credit Records” means all documents, or the Electronic Record of such documents, used to evidence any refund or price adjustment to be credited to a Cardholder Account relating to the sale of Products.

“Data Processing” means any operation or set of operations which is performed on BPPR Data, Cardholder information, or other NPPI or information whether or not by automated means, physical or virtual, on premises or in the cloud, such as access, collection, recording, storing, organization, structuring, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Data Protection Program” means a written program that complies with applicable Legal Requirements, establishing the policies, procedures, controls and Data Safeguards reasonably designed and implemented in accordance with applicable Industry Standards to protect the confidentiality, privacy, security, integrity or availability of BPPR Data, the proper Data Processing of BPPR Data, and the security and reliability of the related infrastructure in order to prevent, detect and respond to any threats or hazards or intentional or accidental unauthorized access, use, disclosure, alteration, loss, destruction, or disposal.

“Data Safeguards” means reasonable administrative, technical and physical data protection processes, procedures and controls designed and implemented in accordance with Industry Standards.

“DDA” means a direct deposit account.

“Default Notice” has the meaning set forth in Section 9.2(b).

“Designated Merchant” has the meaning set forth in Section 2.5(a).

6

“Direction” has the meaning set forth in Section 5.7.

“Disabling Device” means any program, mechanism, programming device, malware or other computer code: (i) designed to disrupt, disable, harm, or otherwise impede in any manner the operation of any software program or code, or any computer system or network (commonly referred to as “malware”, “spyware”, “viruses” or “worms”); (ii) that would disable or impair the operation thereof or of any software, computer system or network in any way based on the elapsing of a period of time or the advancement to a particular date or other numeral (referred to as “time bombs”, “time locks”, or “drop dead” devices); (iii) designed to or that could reasonably be used to permit any Person to gain unauthorized or unintended access any computer system or network (referred to as “trojans”, “traps”, “access codes” or “trap door” devices); or (iv) designed to or that could reasonably be used to permit any unauthorized Person to track, monitor or otherwise report the operation and use of any software program or any computer system or network by any Person.

“Disclosing Party” has the meaning set forth in Section 5.1(a).

“Discover” has the meaning set forth in the Recitals.

“Dispute” has the meaning set forth in Section 11.6(c).

“Effective Date” has the meaning set forth in the Preamble.

“Electronic Record” means data that is transcribed in a form that is suitable for electronic processing.

“Encumbrances” means any direct or indirect encumbrances, lien, pledge, security interest, claim, charges, option, right of first refusal or offer, mortgage, deed of trust, easement, or any other restriction or third-party right, including restrictions on the right to vote equity interests.

“Event” means any event, occurrence or circumstance that has resulted in, or could reasonably result in any impairment or disruption of a Person’s normal business and operations and its ability to provide services.

“Event of Default” means the occurrence of any of the following:

(i)          either party fails to pay any undisputed, material amounts due to the other party under this Agreement and such failure(s) continue(s) for a period of sixty (60) days after notice has been sent to the non-paying party;

(ii)      either party (A) files for bankruptcy, receivership, reorganization, liquidation or any similar proceedings applicable to banks or corporations, as applicable, or (B) has such a proceeding instituted against it and such proceeding is not dismissed within sixty (60) days;

(iii)       a party fails to observe any material obligation specified in this Agreement that results in a Material Breach, and such failure is not cured within thirty (30) days (or in the event such breach can be cured but cannot be reasonably cured within thirty (30) days, within such longer period of time (not to exceed ninety (90) days) as is required to cure the same; provided, that the breaching party diligently pursues remedial action to completion) of a notice specifying the breach;

7

(iv)        either party makes an assignment of this Agreement, except as expressly provided herein; or

(v)         the assignment of any material portion of the Merchant Agreements to a third party (other than a third party that is a successor in interest to substantially all of EVERTEC’s business (including by assuming all of EVERTEC’s obligations under this Agreement)).

“EVERTEC” has the meaning set forth in the Preamble.

“EVERTEC Change of Control” means, with respect to EVERTEC, any:

(i)          merger, consolidation or other business combination of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries that results in the stockholders of EVERTEC (or such Subsidiary or Subsidiaries) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries or the surviving entity thereof, as applicable, immediately before the consummation of such transaction or a series of related transactions, holding, directly or indirectly, less than 50% of the voting power of EVERTEC (or such Subsidiary or Subsidiaries) or any such successor, other entity or surviving entity, as applicable, immediately following the consummation of such transaction or series of related transactions; provided that this clause (i) shall not be deemed applicable to any merger, consolidation or other business combination, if, as a result of any such merger, consolidation or other business combination, no Person or Group of Persons that had not had “control” of EVERTEC immediately prior to such transaction, as such term is defined under the Bank Holding Company Act of 1956, as amended, shall have obtained such “control”;

(ii)        Transfer (other than in the form of a pledge, hypothecation or similar grant of a security interest only and which shall not involve the grant of a proxy or other right with respect to the voting of such equity), in one or a series of related transactions, of equity representing 50% or more of the voting power of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries to a Person or Group of Persons;

(iii)       transaction in which a majority of the board of directors or equivalent governing body of EVERTEC (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) immediately following or as a proximate cause of such transaction is comprised of persons who were not members of the board of directors or equivalent governing body of EVERTEC (or such successor or other entity) immediately prior to such transaction; or

8

(iv)        sale or other disposition in one or a series of related transactions of all or substantially all of the assets of EVERTEC and its Subsidiaries (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) to a Person who is not an Affiliate of EVERTEC at such time.

“EVERTEC Covered Persons” has the meaning set forth in Section 9.5(b).

“EVERTEC MAB Team Employees” has the meaning set forth in Exhibit G.

“EVERTEC Parent” has the meaning set forth in the Recitals.

“EVERTEC Post-Termination Merchants” has the meaning set forth in Section 9.1(b)(i).

“Exchange Act” means the Securities Exchange Act of 1934, as amended.

“Existing Credit Agreement” means the credit agreement, dated as of November 27, 2018, among EVERTEC Parent, EVERTEC, the several lenders parties thereto, and Bank of America, N.A., as Administrative Agent, Collateral Agent, Swingline Lender and L/C Issuer.

“Federal Reserve” means the Federal Reserve Bank of New York.

“FFIEC” means the Federal Financial Institutions Examination Council.

“Force Majeure Event” has the meaning set forth in Section 11.2(a).

“Governmental Authority” means the government or any agency or court thereof, of any nation or country (including the European Union, if applicable), state, commonwealth (including the Commonwealth of Puerto Rico), city, municipality or political subdivision thereof, any entity exercising executive, legislative, judicial, regulatory or administrative functions of or pertaining to any such government that have regulatory, supervisory, and/or examination authority with respect to BPPR or one of its Subsidiaries and/or of EVERTEC with respect to the matters covered by this Agreement or their respective operations or financial condition, any quasi-governmental entity or arbitral body, any SRO and any applicable stock exchange.

“Government-Merchant” means each of the various municipalities, government agencies, public corporations and other governmental entities in the Commonwealth of Puerto Rico, which are set forth in Exhibit A; provided, that if a Person that is a Government-Merchant enters into a Merchant Agreement with EVERTEC after the Effective Date, such Person shall no longer be considered a Government-Merchant for purposes of this Agreement and will then be considered a Merchant for purposes of this Agreement.

“Government-Merchant Agreements” means the agreements which are set forth in Exhibit A and are in effect as of the Effective Date between BPPR and the Government-Merchants (or any successor or new agreement that may be entered into solely between BPPR and Government-Merchants) for services rendered by BPPR to enable such Government-Merchants to accept and process payment of goods and services from their customers by means of Cards or other transaction media.

9

“Government-Merchant Fees” has the meaning set forth in Section 6.3(b).

“Group of Persons” means a group of Persons that would constitute a “group” as determined pursuant to Section 13(d) of the Exchange Act and the rules and regulations promulgated thereunder.

“Hold Account” has the meaning set forth in Section 2.11.

“Incident” means the actual or reasonably suspected occurrence of an intentional or accidental unauthorized event that could reasonably pose a threat to the confidentiality, privacy, security, integrity or availability of BPPR Data, Cardholder information, or other NPPI, including: (1) unauthorized access or disclosure of BPPR Data, Cardholder information, or other NPPI; (2) unauthorized access or intrusion to information Systems; (3) loss/theft of an electronic or storage device containing BPPR Data, Cardholder information, or other NPPI; (4) loss/theft of printed materials containing BPPR Data, Cardholder information, or other NPPI; and (5) unauthorized Disabling Devices.  For the avoidance of doubt, an Incident will not be deemed to exist solely as a result of EVERTEC’s receipt of an automated system alert or a ping or scan of EVERTEC’s Systems, unless and until such time as EVERTEC reasonably believes that an Incident has occurred or has reasonable grounds to suspect that an Incident has occurred (provided, that EVERTEC has appropriate systems and procedures for the establishment and use of such automated systems).

“Incident Response Program” means a written program that complies with applicable Legal Requirements establishing policies, procedures, activities and internal controls reasonably designed and implemented in accordance with applicable Industry Standards to prevent, detect, identify, mitigate, address and notify relevant Persons of Incidents.

“Indebtedness” means, with respect to any Person, (a) all indebtedness of such Person, whether or not contingent, for borrowed money, and (b) all obligations of such Person evidenced by notes, bonds, debentures or other similar debt instruments.

“Independent Sales Organization” or “ISO” means any organization that (i) is not a member of VISA, Discover or MCI (or any other Association), (ii) is registered with and sponsored by a VISA, Discover or MCI (or any other Association) member and (iii) provides services to a VISA, Discover or MCI (or any other Association) member in connection with the member’s merchant or Card issuing program.

“Industry Standards” means the conduct of business, including procedural and technical rules, generally followed by members of an industry, which for purposes of this Agreement is the merchant acquiring industry, in the applicable portion of the Region and in the United States, as they may be adopted from time to time including the Rules and PCI DSS.

“Initial Term” shall have the meaning set forth in Section 9.1(a).

“Intellectual Property” means all world-wide know-how, ideas, concepts, techniques, designs, materials, formulae, computer programs and related documentation, writings, works of authorship, trade secrets, Confidential Information (as defined herein), proprietary information, research, developments, registered and unregistered copyrights, copyrightable materials, derivatives, Trademarks, mask works, moral rights, design rights, industrial property rights, discoveries, inventions, rights in and to inventions, improvements, patent rights, patent applications, patents and any other intellectual property rights in any jurisdiction in the world including modifications and other applications using or based upon the resulting technology or required for the use of such technology.

10

“Interchange Fee” means the fee that is established by the Association and that is paid on each Transaction by an Acquiring Member to the Issuing Member.  The fee is collected by the Association and passed on to the Issuing Member through the daily settlement process with each institution.

“Issuing Member” means a licensee or member of an Association that is authorized by such Association to issue Cards.

“Legal Holiday” means Saturday, Sunday or any federal and/or local legal holiday in the Commonwealth of Puerto Rico, except as otherwise agreed to in writing between the parties.

“Legal Requirements” means any applicable federal, state, Puerto Rico, local, municipal, foreign, international, multinational, or other administrative order, constitution, law, ordinance, principle of law, regulation, statute, rule, regulation, guidance or treaty, and any policy statement or interpretation that has the force of law, issued by a Governmental Authority, and any standards or guidance issued by the FFIEC.

“MAB Adjusted Revenue” means, with respect to any period, the Merchant Transaction Processing Fees received by EVERTEC or its Affiliates (“MAB Gross Revenue”), less the following items, in each case to the extent such items are charged with respect to Merchants (to the extent related to their activities that generate MAB Gross Revenue) or transactions that generate MAB Gross Revenue (and without duplication of any items deducted from the calculation of P2B Adjusted Revenue): (1) Interchange Fees, (2) Network Assessment Fees, (3) Processing Fees, (4) Partnership Program Fees, (5) POS Terminal Expenses, (6) ACH settlement fees and (7) Merchant Losses (provided, that (i) items (4), (6) and (7) shall be deducted solely to the extent any such amount is actually paid by EVERTEC or its Affiliates to a third party and not subsequently recovered or otherwise subject to reimbursement or offset in favor of EVERTEC or its Affiliates and (ii) item (2) (except in the case of ATH Network fees, which shall be deducted from MAB Gross Revenue to the extent specified in the definition of “Network Assessment Fees”) shall be deducted solely to the extent any such amount is actually paid by EVERTEC or its Affiliates to a third party Association and not subsequently recovered or otherwise subject to reimbursement or offset in favor of EVERTEC or its Affiliates); provided, that each of items (1) through (7) shall be deducted solely to the extent consistent with the calculation methodology and components of such item as set forth on Exhibit E.

“MAB Gross Revenue” has the meaning set forth in the definition of “MAB Adjusted Revenue”.

“MAB Revenue Sharing” has the meaning set forth in Section 6.4(b).

11

“Material Adverse Effect” means, with respect to any Person, any fact, event, change, effect, development, condition or occurrence that has a materially adverse effect on or with respect to any business, assets, liabilities, financial condition, or operations of such Person.

“Material Breach” means (i) a breach, or series of breaches, of a party’s obligations under this Agreement (other than a failure to make a payment pursuant to this Agreement) that if left uncured for ninety (90) days following receipt of notice from the other party (the “Non-breaching Party”) detailing the breach, (a) would result in a Material Adverse Effect on the Non-breaching Party, or (b) would reasonably be expected to have an adverse effect on the Non-breaching Party that is material, individually or in the aggregate, measured on a scale relative to the Non-breaching Party’s rights and privileges and reasonably expected benefits under this Agreement, provided, that this clause (b) shall apply solely after September 30, 2025 and solely for purposes of BPPR’s right to terminate this Agreement.

“MCI” has the meaning set forth in the Recitals.

“Merchant” means any Person, other than BPPR and EVERTEC, who is or becomes a party to a Merchant Agreement; provided, however, that the term shall not include a Government-Merchant which is a party to a Government-Merchant Agreement.

“Merchant Acquiring Business” means the business engaged in by EVERTEC (and, if applicable, any of its Affiliates) to provide Merchant Services hereunder as an ISO for BPPR as Acquiring Member, enabling Merchants and Government-Merchants to accept and process payment of goods and services from their customers by means of Cards or other transaction media, including the signing up and underwriting of such Merchants and Government-Merchants for accepting such means of payment, providing card-based transaction processing services and electronic payment and settlement services (including PIN and signature debit transaction authorization, settlement and exception processing, gift, private label, stored value and prepaid card processing, e-commerce and certain payments-related reselling services) and the sale of products and services related thereto, including terminal deployment services, payment gateway(s) and other value-added services.

“Merchant Acquiring Improvement Team” has the meaning set forth in Exhibit G.

“Merchant Agreement” means the written agreement pursuant to which Merchant Services are provided to a Person and such Person is permitted to participate in the Merchant Program (for the avoidance of doubt, including any such agreement between a Person and either or both of BPPR and EVERTEC); provided, however, that, as used herein, the term “Merchant Agreement” shall not include any existing Government-Merchant Agreement set forth in Exhibit A (or any successor or new agreement that may be entered solely between BPPR and a Government-Merchant, each of which shall be treated as a Government-Merchant Agreement) but shall include any successor agreement to an existing Government-Merchant Agreement that may be entered into by and among BPPR, EVERTEC and the applicable Government-Merchant after the Effective Date.  For the avoidance of doubt, Merchant Agreements do not include agreements with any Person for whom BPPR does not act as the Acquiring Member.

“Merchant Agreement Split Report” has the meaning set forth in Section 9.1(b).

12

“Merchant Application” means an application whereby a potential Merchant applies to participate in the Merchant Program.

“Merchant Application Approval Policy” means the written policy set forth in Exhibit B regarding acceptance of Merchants, as such policy may be amended in accordance with Section 2.5(c).

“Merchant by Transaction Processing List” has the meaning set forth in Section 9.1(b)(i).

“Merchant Chargeback” means a Transaction or other item involving a Merchant or Government-Merchant denied or returned by an Issuing Member after such Transaction was entered into the appropriate settlement network for payment in accordance with applicable Rules, or for which payment to a Merchant or a Government-Merchant has been refused or reversed in accordance with applicable Rules.

“Merchant Demand Deposit Account” or “Merchant DDA” means a deposit account owned by a Merchant or Government-Merchant and established at BPPR to receive the daily deposit of paper Transaction records and/or the electronic settlement of electronic Transactions, and the withdrawal of Merchant Transaction Processing Fees and other amounts pursuant to such Merchant’s Merchant Agreement (or, in the case of a Government-Merchant, under such Government-Merchant’s Government-Merchant Agreement).

“Merchant Loss(es)” means any loss or extraordinary expense (including reasonable legal fees related to such loss or extraordinary expense) for any reason attributable to a Merchant or a Government-Merchant, including any loss due to a Merchant Chargeback, uncollectible Merchant Transaction Processing Fees (provided, that for purposes of calculating MAB Adjusted Revenue, BPPR shall be entitled to a true-up to the extent that any Merchant Transaction Processing Fees that are initially deemed uncollectible are subsequently collected by EVERTEC and/or the rights of collection are transferred for value by EVERTEC to a third party), Merchant business failure or any fraudulent or illegal, or allegedly fraudulent or illegal, practice of such Merchant or Government-Merchant, except in the event such Merchant Loss was caused by the fraud or misconduct of BPPR.

“Merchant Program” means the package of Merchant acquiring services provided by EVERTEC or BPPR, in each case, to any Person enabling such Person to make sales to Cardholders and permitting such Person to present Sales Records to EVERTEC or BPPR for payment and processing of debit and credit card transactions, together with the services and functionalities provided by EVERTEC and its Affiliates as part of the P2B Program, including (i) transaction authorization, (ii) transaction settlement, (iii) customer authorization, (iv) gift card services, (v) POS terminal equipment and other electronic POS, (vi) Merchant and Government-Merchant application underwriting, (vii) Merchant and Government-Merchant customer service, (viii) chargeback processing, (ix) risk management, and (x) data or other processing services and related services.

13

“Merchant Program Procedures” means the procedures set forth in Exhibit H, as such procedures may be amended from time to time by EVERTEC; provided, that, such procedures may not be amended without BPPR’s prior written consent if such amendments would conflict with this Agreement or would affect BPPR’s rights and obligations under the Merchant Agreements or Government-Merchant Agreements or otherwise would be reasonably likely to have an adverse effect on BPPR (whether economic or otherwise) unless such amendments are necessary to comply with applicable Legal Requirements; provided, that the procedures shall conform with the Rules, applicable Legal Requirements and Industry Standards; provided, further, that the Rules shall govern in the event of any conflict with such procedures.

“Merchant Reserve Account” has the meaning set forth in Section 2.12.

“Merchant Services” means products and services of the type that EVERTEC provides to Merchants and Government-Merchants pursuant to the Merchant Program.

“Merchant Transaction Processing Fees” means the fees charged by EVERTEC to a Merchant (or, in the case of Government-Merchants, the fees charged by BPPR) (i) for processing Sales Records and Merchant Chargebacks, (ii) for supplying card authorization services, monthly statements, equipment and other supplies and services as identified in or authorized under the Merchant Application, Merchant Agreement (or, in the case of Government-Merchants, under the Government-Merchant Agreement) or any other ancillary materials and/or (iii) for otherwise participating in the Merchant Program.

“MSA” means the Amended and Restated Master Service Agreement, dated as of the date hereof, among Popular, BPPR, and EVERTEC.

“Network Assessment Fees” means fees charged by the Associations (net of any rebates) for the merchant acquiring processing sales volume or transactions, as described in the Associations rules and in the detailed Associations’ invoices; provided, that ATH Network fees shall be counted as Network Assessment Fees for purposes of calculating MAB Adjusted Revenue and P2B Adjusted Revenue solely if such fees are equally assessed with respect to all acquirers of ATH Network transactions and only to the extent such fees do not exceed the lower of the Network Assessment Fees imposed by Visa and MasterCard for comparable transactions.  These fees may be charged daily, weekly, monthly and/or quarterly.

“Non-breaching Party” has the meaning set forth in the definition of “Material Breach”.

“Non-Renewal Notice” has the meaning set forth in Section 9.1(a).

“Notice of Dispute” has the meaning set forth in Section 11.6(c).

“NPPI” means non-public personally identifiable information received by EVERTEC in connection with the performance of EVERTEC’s obligations pursuant to this Agreement (a) from which an individual may be identified (whether from the information itself or by combining the information with information from other sources), (b) concerning an individual that would be considered “nonpublic personal information” within the meaning of Title V of the Gramm-Leach Bliley Act of 1999 and the regulations promulgated thereunder, (c) concerning an individual that would be considered “nonpublic personal information” within the meaning of 16 C.F.R. § 313.3(n) or (d) regarding BPPR’s past, present or prospective customers, claimants, beneficiaries, employees or agents, including (i) any individual’s name, business or home address, e-mail address, computer IP address, telephone number, social security number, passport number or other identification number issued by a Governmental Authority, (ii) the fact that an individual has a relationship with BPPR or any of its Affiliates, (iii) any information regarding an individual’s bank accounts, securities accounts and other similar accounts, (iv) any information regarding an individual’s transaction records, credit history, income and other financial information, medical or health-related information, medical history or treatment, or application, loan or claim information, (v) any sensitive information, including non-public information regarding an individual’s human race, religion, family status, legal domicile, medical history or treatment, or criminal record, (vi) any information regarding the ability to repay indebtedness, and (vii) any other information of or relating to an individual that is protected from unauthorized disclosure by applicable privacy laws.

14

“Operating Account” means a deposit account maintained at BPPR and owned by EVERTEC for the purpose of debiting and crediting Merchant DDAs with respect to amounts due and payable to EVERTEC under the Merchant Agreements and to facilitate certain other transfers of monies provided for in this Agreement.

“Original Paper” means the Merchant’s or Government-Merchant’s copy of a Sales Record or Credit Record transcribed in writing on a paper form, or recorded in a digital form.

“P2B Adjusted Revenue” means, with respect to any period, gross revenue derived by EVERTEC or its Affiliates from the P2B Program (for the avoidance of doubt, including revenue attributable to fees charged to P2B Program participants that are of the type described in the definition of “Merchant Transaction Processing Fees”) (“P2B Gross Revenue”), less the following items, in each case, to the extent such items are charged with respect to P2B Program participants (to the extent related to their activities that generate P2B Gross Revenue) or transactions that generate P2B Gross Revenue (and without duplication of any items deducted from the calculation of MAB Adjusted Revenue): (1) Interchange Fees, (2) Network Assessment Fees, (3) Processing Fees, (4) Partnership Program Fees, (5) ATH Movil Business Help-Desk Costs, (6) ACH settlement fees, (7) P2B Losses and (8) P2B Special Support (provided, that (i) items (4), (6) and (7) shall be deducted solely to the extent any such amount is actually paid by EVERTEC or its Affiliates to a third party and not subsequently recovered or otherwise subject to reimbursement or offset in favor of EVERTEC or its Affiliates and (ii) item (2) (except in the case of ATH Network fees, which shall be deducted from P2B Gross Revenue to the extent specified in the definition of “Network Assessment Fees”) shall be deducted solely to the extent any such amount is actually paid by EVERTEC or its Affiliates to a third party Association and not subsequently recovered or otherwise subject to reimbursement or offset in favor of EVERTEC or its Affiliates); provided, that each of items (1) through (7) shall be deducted solely to the extent consistent with the calculation methodology and components of such item as set forth on Exhibit E.

“P2B Gross Revenue” has the meaning set forth in the definition of “P2B Adjusted Revenue”.

“P2B Loss(es)” means any loss or extraordinary expense (including reasonable legal fees related to such loss or extraordinary expense) for any reason attributable to a P2B user under the P2B Program, including any loss due to a chargebacks, uncollectible Processing Fees (provided, that for purposes of calculating P2B Adjusted Revenue, BPPR shall be entitled to a true-up to the extent that any amounts that are initially deemed uncollectible are subsequently collected by EVERTEC and/or the rights of collection are transferred for value by EVERTEC to a third party), P2B business failure or any fraudulent or illegal, or allegedly fraudulent or illegal, practice of such P2B user, except in the event such P2B Loss was caused by the fraud or misconduct of BPPR.

15

“P2B Program” means the person-to-business card payment or card processing transaction functionalities or services provided by EVERTEC or its Affiliates to any Person that has a deposit account with BPPR and uses such account to subscribe to such functionality or service and make deposits relating to such functionality or service.

“P2B Revenue Sharing” has the meaning set forth in Section 6.4(c).

“P2B Special Support” means the non-recurring, reasonable out-of-pocket expenses incurred by EVERTEC in order to provide extraordinary support, outside the ordinary course of business, for a new P2B functionality launched for BPPR customers, but only to the extent such expenses are consistent with past practice and such support is specifically notified to BPPR  and BPPR is provided with reasonable opportunity to review any such expenses proposed to be incurred by EVERTEC; provided, that during each calendar year, if EVERTEC has incurred $250,000 of P2B Special Support expenses, any additional P2B Special Support expenses during that calendar year will require BPPR’s prior written consent.

“Partnership Program” means a program between EVERTEC and a third party (typically an independent software vendor, value-added reseller or third-party processor) pursuant to which EVERTEC would pay fees or financial incentives to such partner for ensuring a Merchant or a P2B user processes its transactions with EVERTEC.

“Partnership Program Fees” means commercially reasonable fees, in line with Industry Standards, that are paid by EVERTEC to a third party in connection with the Partnership Programs, but solely to the extent that such fees serve to compensate such third party for their contributions to the Merchant Program or the P2B Program, as applicable; provided, that, no fees shall be included in the definition of Partnership Program Fees if such third party receives any payments from Merchants that are shared with EVERTEC or otherwise provides EVERTEC with any service, product or other benefit that does not directly support the Merchant Program or the P2B Program (unless such service, product or other benefit is charged to EVERTEC, separately from the Partnership Program Fees, on arm’s length, market terms).

“Payment Card Industry Data Security Standards” or “PCI DSS” means the set of comprehensive requirements for enhancing payment account data security developed by the founding payment brands of the PCI Security Standards Council, as may be amended from time to time.

“Person” shall be construed broadly and shall include, without limitation, an individual, a partnership, a limited liability company, a corporation, an association, a joint stock company, a trust, a joint venture, an unincorporated organization and a Governmental Authority or any department, agency or political subdivision thereof.

“Personnel” means the employees, Subcontractors or other agents of a party.

16

“PIN” means a personal identification number and the security regulations associated therewith that is assigned by or on behalf of certain Associations to Cardholders to enhance the security of Transactions.

“Popular” means Popular, Inc., a corporation organized under the laws of the Commonwealth of Puerto Rico.

“Popular Covered Persons” has the meaning set forth in Section 9.5(a).

“Popular Trademarks” has the meaning set forth in Section 10.1(a).

“POS” means point-of-sale.

“POS Terminal Expenses” means the expenses incurred by the Merchant Acquiring Business to be able to provide POS terminals to Merchants and Government-Merchants, to the extent included within the following categories: “Rent” (i.e., POS rental cost, POS delivery, and communication costs); “Help Desk” (i.e., POS service desk expenses); and “Daily Servicing” (i.e., installation and training expenses, repair of POS terminals, replacement of unreturned POS terminals and other related costs).  POS Terminal Expenses will be charged on a monthly basis, based on the balance of POS terminals determined as of the end of the month, at per-terminal rates in accordance with the table set forth on Schedule 1.1.  In the event that EVERTEC introduces any new type of POS terminal that is not reflected in the table below, EVERTEC shall establish reasonable per-terminal pricing, provided, that any such pricing shall be (i) reasonably based upon the per-terminal costs actually incurred by EVERTEC’S POS Processing/ATH Network division in order to provide such POS terminal and (ii) calculated in a manner reasonably consistent with the per-terminal pricing as reflected in the table below.  POS Terminal Expenses may be paid by MAB to EVERTEC’S POS Processing/ATH Network division or to third parties which provides such services.

“Prior ISO Agreement” has the meaning set forth in the Recitals.

“Processing Fees” means the fees incurred by the Merchant Acquiring Business or the P2B Program, as applicable, on each attempt to authorize a credit or debit card transaction or other similar transaction type whether paid to EVERTEC’s POS Processing Division or to a third party.  For purposes of calculating MAB Adjusted Revenue and P2B Adjusted Revenue, any such Processing Fees, if paid to EVERTEC’s POS Processing Division, shall not exceed $0.06 for switch fees and $0.00125 for risk monitoring fees (in each case, on a per–transaction basis); provided that such maximum amounts may be increased annually on October 1, with prior notice to BPPR and such supporting documentation as BPPR may reasonably request, to reflect annual increases in CPI, but solely to the extent such annual increase does not exceed two and one half percent (2.5%).

“Products” means goods or services sold or rendered by any Person.

“Project IP” has the meaning set forth in Exhibit G.

“Receiving Party” has the meaning set forth in Section 5.1(a).

17

“Region” has the meaning set forth in Section 2.16.

“Released Parties” has the meaning set forth in Section 11.12.

“Releasing Parties” has the meaning set forth in Section 11.12.

“Renewal Term” has the meaning set forth in Section 9.1(a).

“Representative” means, with respect to a particular Person, any director, officer, partner, member, employee, agent, subcontractor, consultant, advisor or other representative of such Person, including legal counsel, accountants and financial advisors.

“Requirements” has the meaning set forth in Section 5.9(a)(i).

“Resolution Forum” has the meaning set forth in Section 11.6(c).

“Retrieval” means the production of the original, or an acceptable facsimile of, a Sales Record, Credit Record or other supporting documentation by the Merchant or Government-Merchant at the request of BPPR or an Issuing Member.

“Retrieval Request” means a written or electronic request by an Issuing Member to BPPR and/or EVERTEC, in the manner permitted by the corresponding Association, for the Retrieval of a Sales Record or Credit Record, either in the form of microfilm, Original Paper, Electronic Record or facsimile previously delivered in Electronic Record form to EVERTEC.

“Rules” means, as applicable, the written rules and regulations, system manuals and procedures and service levels, standards and requirements issued by an Association, and any interpretations thereof by such Association, as the same may be amended from time to time.

“Sales Records” means all documents, or the Electronic Record of such documents, used to evidence transactions effected through the use of Cards.

“Settlement Account” means a deposit account owned by BPPR and established at BPPR or any other bank selected by BPPR to receive the net funds wired daily by the respective Associations in payment for Sales Records entered into their respective settlement networks offset by Association Dues, Assessments, Interchange Fees, Merchant Chargebacks and other amounts pursuant to the Rules.

“Solvent” with regard to any Person, means that (i) the sum of the assets of such Person, both at a fair valuation and at a present fair salable value, exceeds its liabilities, including contingent, subordinated, unmatured, unliquidated, and disputed liabilities; (ii) such Person has sufficient capital with which to conduct its business; and (iii) such Person has not incurred debts beyond its ability to pay such debts as they mature.  For purposes of this definition, “debt” means any liability on a claim, and “claim” means (x) a right to payment, whether or not such right is reduced to judgment, liquidated, unliquidated, fixed, contingent, matured, unmatured, disputed, undisputed, legal, equitable, secured or unsecured or (y) a right to an equitable remedy for breach of performance to the extent such breach gives rise to a payment, whether or not such right to an equitable remedy is reduced to judgment, fixed, contingent, matured, unmatured, disputed, undisputed, secured or unsecured.  With respect to any such contingent liabilities, such liabilities shall be computed at the amount which, in light of all the facts and circumstances existing at the time, represents the amount which can reasonably be expected to become an actual or matured liability.

18

“SRO” means any domestic or foreign securities, broker-dealer, investment adviser or insurance industry self-regulatory organization.

“Subcontractor” has the meaning set forth in Section 2.14(a).

“Subsidiary” means, with respect to any Person, any corporation, association, partnership, limited liability company or other business entity of which 50% or more of the total voting power or equity interests (including partnership interests) entitled (without regard to the occurrence of any contingency) to vote in the election of directors, managers, representatives or trustees thereof is at the time owned or Controlled, directly or indirectly, by (a) such Person, (b) such Person and one or more Subsidiaries of such Person, or (c) one or more Subsidiaries of such Person.

“System” means any hardware, software, technology, applications, network infrastructure and/or combination thereof used to provide or use the services under this Agreement.

“Trademark” means any trademark, service mark, Internet domain name, trade dress, trade, corporate or business name, whether or not registered, and all applications and registrations for the foregoing in the U.S. Patent and Trademark Office, the Puerto Rico Department of State, or any applicable domestic or foreign Governmental Authority, including all renewals and extensions of same, and all goodwill associated therewith and symbolized thereby.

“Transaction” means the consummation of a sale of Products or the initiation of a credit to a Cardholder by a Merchant or a Government-Merchant or any other Person by means of a Sales Record or Credit Record.

“Transfer” means any direct or indirect sale, assignment, transfer, conveyance, gift, bequest by will or under intestacy laws, pledge, hypothecation or other Encumbrance, or any other disposition, of the stated security (or any interest therein or right thereto, including the issuance of any total return swap or other derivative whose economic value is primarily based upon the value of the stated security) or of all or part of the voting power (other than the granting of a revocable proxy) associated with the stated security (or any interest therein) whatsoever, or any other transfer of beneficial ownership of the stated security, with or without consideration and whether voluntarily or involuntarily (including by operation of law).

“Transmittal” means the process whereby Sales Records and Credit Records are electronically transferred in the form of Electronic Records.

“U.S. Mainland Merchants” has the meaning set forth in Section 3.1(b).

“VISA” has the meaning set forth in the Recitals.

19

Section 1.2          Interpretational Provisions.

(a)       Exhibits and Schedules referenced in this Agreement are deemed to be incorporated herein by reference, in each case as such Exhibits and Schedules may be amended from time to time in accordance with the provisions contained herein.

(b)         In the event of a conflict between the general terms and conditions of this Agreement and the terms of any Exhibit or Schedule hereto, then the terms of the Schedules and Exhibits will prevail and control the interpretation of the Agreement with respect to the subject matter of the applicable Exhibits and/or Schedules.

(c)       Subject to Section 7.1(a), in the event of any conflict or inconsistency between this Agreement and any other document referenced herein, regarding the interpretation of the terms of this Agreement, this Agreement together with its Exhibits and Schedules will prevail and control.

(d)        Wherever the word “include,” “includes” or “including” is used in this Agreement, it shall be deemed to be followed by the words “without limitation.”

(e)        The words “hereof,” “herein” and “hereunder” and words of similar import, when used in this Agreement, shall refer to this Agreement as a whole and not to any particular provision of this Agreement.

(f)          The terms defined in the singular have a comparable meaning when used in the plural, and vice versa.

(g)          The terms “dollars” and “$” mean U.S. Dollars.

(h)          The term “parties” means the parties to this Agreement, except where the context denotes otherwise.

(i)          References herein to the Preamble or the Recitals, or a specific Article, Section, Schedule or Exhibit shall refer, respectively, to the Preamble or the Recitals or to Articles, Sections, Schedules or Exhibits of this Agreement.

ARTICLE II

EVERTEC RESPONSIBILITIES

Section 2.1          EVERTEC Responsibilities – General.

(a)          ISO Registration.  EVERTEC shall register or maintain its registration with, and shall obtain such approvals from and file such forms with, each of the Associations as may be required under such Association’s Rules in order to provide the Merchant Services hereunder as an ISO for BPPR as Acquiring Member.

(b)          Marketing Activities.  EVERTEC shall market the Merchant Program consistent with Industry Standards, including, by:

(i)          marketing the Merchant Program to potential Merchants and encouraging them to become Merchants;

20

(ii)        (A) assisting potential Merchants in completing all documents required by BPPR to apply to the Merchant Program in accordance with the Merchant Application Approval Policy and (B) forwarding to BPPR, in electronic format, any Merchant Application that is received by EVERTEC and reasonably requested by BPPR, as promptly as reasonably practicable;

(iii)      producing and paying for the materials used by EVERTEC in marketing the Merchant Program, which materials will comply in all material respects with the Rules and shall be approved in advance of their use by BPPR, in BPPR’s reasonable discretion; and

(iv)        monitoring and supervising the performance of its Personnel and marketing Representatives involved in the Merchant Program to ensure compliance with Merchant Program Procedures, the Merchant Application Approval Policy and all applicable Rules.

(c)          Equipment and Materials.

(i)          EVERTEC will sell or make arrangements for the sale to, or the finance, lease or rental by Merchants of all POS and other terminals and equipment necessary for each Merchant (and will assist BPPR in making such arrangements with Government-Merchants) to participate in the Merchant Program.  EVERTEC will install and, if requested by the Merchant (or if requested by the Government-Merchant to BPPR), maintain the terminals and equipment at no expense to BPPR.  Neither EVERTEC nor any Merchant (nor any Government-Merchant) will be required to purchase terminals and equipment from BPPR.  EVERTEC may, at its option, provide the services set forth in this Section 2.1(c)(i) itself or through one or more Subcontractors (subject to the provisions of Section 2.14).

(ii)        EVERTEC will (A) provide Merchants with training materials and will use reasonable efforts to train Merchants to operate the terminals and equipment to enable Merchants to fulfill their obligations under the Merchant Program, and (B) assist BPPR in providing such materials and trainings to Government-Merchants.

(iii)       As between BPPR and EVERTEC, EVERTEC will be responsible for the distribution, delivery and expense of all supplies reasonably necessary for the Merchants and Government-Merchants to perform their duties under the Merchant Program, including Sales Records, Transmittals, deposit envelopes, printer paper and ribbons.

(iv)        EVERTEC will use commercially reasonable efforts to enhance the general functionality and technology of POS and other terminals and equipment used by Merchants and potential Merchants to participate in the Merchant Program and otherwise maintain the competitiveness of the offering of products and services.

(d)          Merchant Accounts.

(i)          EVERTEC will input such data for each approved Merchant (and assist BPPR in managing the corresponding data for the Government-Merchants) into the applicable database(s) as is necessary for such Merchant or Government-Merchant to participate in the Merchant Program.  EVERTEC will maintain the data files in a manner reasonably designed to assure that all Merchant and Government-Merchant charges are input promptly.

21

(ii)        EVERTEC will input all necessary new account information into EVERTEC’s information system in a manner reasonably designed to render all exception reports turned on and available.

(iii)       EVERTEC will monitor all Transactions daily in accordance with the Rules and applicable Legal Requirements to attempt to minimize Merchant Losses and upon BPPR’s request shall provide BPPR with summary reports thereof in a form reasonably agreed between BPPR and EVERTEC.  In furtherance of the foregoing and to the extent consistent with applicable Legal Requirements and expressly permitted under the agreement(s) with the specific Merchant, EVERTEC will be permitted to access information regarding the relevant Merchant DDAs through an interface developed by EVERTEC and implemented with BPPR’s prior approval, not to be unreasonably withheld.  If such interface cannot be developed on commercially reasonable terms, then the parties will in good faith discuss and seek to agree on an alternate method for BPPR to provide EVERTEC with such information regarding the relevant Merchant DDAs.  EVERTEC shall bear all expenses arising out of the development, implementation and use of such interface (or other means of providing EVERTEC with access to such information, if applicable) and shall hold BPPR and its Affiliates harmless from any losses, charges, damages, liabilities, penalties, increased taxes (excluding taxes based on BPPR’s net income), costs, fees, or expenses, including court costs and reasonable attorneys’ fees, resulting from EVERTEC’s violation of BPPR’s terms of access to such interface, or negligence, fraud or willful misconduct in connection with such access.  The DDAs for Government-Merchants shall be monitored by BPPR.

(e)         EVERTEC will (i) respond to inquiries from Merchants concerning the Merchant Program in a manner consistent with Industry Standards, and (ii) direct to, and coordinate with BPPR in addressing, any inquiries from Government-Merchants.

(f)          Merchant Services.  EVERTEC, at its expense and at all times in a manner reasonably acceptable to BPPR and otherwise in a manner consistent with Industry Standards, will provide all necessary functions for the Merchant Program through qualified industry vendors (subject to the provisions of Section 2.14) or, at its discretion, will provide and develop internally any necessary systems and capabilities, consistent with Industry Standards, including:

(i)          maintaining electronic authorization and draft capture applications and network;

(ii)         maintaining an Authorization Center for voice authorization, referrals and Merchant instructions;

(iii)        maintaining Merchant accounting and clearing systems;

(iv)        creating and transmitting to BPPR daily ACH Files for Merchant payments;

(v)         rendering monthly Merchant statements;

22

(vi)        processing Merchant Chargebacks and Retrieval Requests in accordance with the Rules;

(vii)       providing customer service to Merchants;

(viii)     facilitating BPPR’s review of any forms of Merchant Agreements, Electronic Records, Original Paper, Sales Records, Credit Records, and Merchant Applications used in connection with the Merchant Acquiring Business; provided, that BPPR’s prior approval of such forms shall be required to the extent that any such proposed form would conflict with this Agreement, would affect BPPR’s rights and obligations under the Merchant Agreements or Government-Merchant Agreements or would be reasonably likely to have an adverse effect on BPPR (whether economic or otherwise);

(ix)      if requested, supplying Merchants and potential Merchants with forms of Merchant Agreements, Electronic Records, Original Paper, Sales Records, Credit Records, and Merchant Applications, in each case, for the purpose of facilitating their application to or continued participation in the Merchant Program;

(x)         assisting BPPR in performing the services listed in (i) through (ix) above for Government-Merchants; and

(xi)        providing BPPR with copies of all reports with respect to EVERTEC’s obligations under this Agreement reasonably necessary for BPPR to fulfill its obligations hereunder.

(g)       EVERTEC will, in a manner consistent with Industry Standards, promptly resolve rejected Transactions identified by EVERTEC, including rejected Transactions funded to the Merchant (“edit rejects”) and rejected Transactions not funded to the Merchant (“Transmittal rejects”).  If necessary, EVERTEC will use commercially reasonable efforts to recover funds directly from the Merchants for all rejected Transactions that are not curable.  BPPR will, in a manner consistent with its past practices, promptly resolve rejected Transactions of Government-Merchants, including edit rejects and Transmittal rejects.  If necessary, BPPR will use commercially reasonable efforts to recover funds directly from the Government-Merchants for all rejected Transactions of such Government-Merchants that are not curable.  Notwithstanding anything to the contrary herein, BPPR shall have the right to reject any Transactions, Merchant Chargebacks or Merchant Transaction Processing Fees (i) due to insufficiency of funds in a Merchant’s account or on the basis that the Transaction is unauthorized, anomalous or erroneous, (ii) if the Transaction fails or would fail to comply with the Rules or (iii) EVERTEC has failed to comply with its obligations under this Agreement with respect to such Transaction.  For the avoidance of doubt, EVERTEC shall not purposely take any action to overdraft any Merchant accounts or take any actions to facilitate an overdraft through BPPR’s or EVERTEC’s system as a result of any uncollectible Transactions, Merchant Chargebacks or Merchant Transaction Processing Fees.

23

(h)        EVERTEC will, in a manner consistent with Industry Standards, promptly identify the reason(s) for any ACH credit or debit being rejected, correct system data as necessary and, thereafter, either credit the Merchant (or remit to BPPR for credit to the Government-Merchant) for the funds through an ACH Transaction or pursue all commercially reasonable efforts to collect the funds due from the Merchant (or assist BPPR to collect the funds due from the Government-Merchant), as appropriate.  EVERTEC hereby represents and warrants that it is now, and covenants that it shall remain during the Initial Term and any Renewal Term, compliant with the Rules, including the Payment Card Industry Data Security Standards.

(i)          EVERTEC will be responsible for “front line” customer claim receipt services.

(j)        Roadmap.  EVERTEC will deliver to BPPR, at least annually, a written report (and if requested by BPPR, conduct an annual review and discussion with BPPR of EVERTEC’s planned roadmap) setting forth (A) the steps EVERTEC has taken during the preceding year to keep the Merchant Acquiring Business current with enhancements, trends and advancements in the financial services sector in which BPPR operates, (B) an analysis of market trends and competitive offerings, (C) a schedule of all services and products offered or provided through the Merchant Acquiring Business and, where applicable, a description, including proposed timelines, of EVERTEC’s future planned advancements with respect to each such service or product, including with respect to fraud enhancements and related services and (D) such other information as the parties may agree upon from time to time.

Section 2.2          Merchant Transaction and Fee Settlement.

(a)       All settlement funds with respect to Merchant Transaction Processing Fees and Association Dues shall be processed through the Operating Account.

(b)      As between BPPR and EVERTEC, EVERTEC shall be responsible for collecting from Merchants all fees, fines and charges relating to Transactions or the Merchant’s acceptance of Cards in payment for Products; provided, that with respect to the Government-Merchant Agreements, BPPR shall be responsible for collecting all fees and other payments payable to BPPR under the Government-Merchant Agreements, unless otherwise agreed by the parties.

Section 2.3        Merchant Chargeback Responsibilities.  EVERTEC will, in a manner consistent with Industry Standards, respond to an Issuing Member’s request for information in accordance with the Rules in the event a Merchant or Issuing Member initiates a Merchant Chargeback, and shall assist BPPR in responding to an Issuing Member’s request for information in accordance with the Rules in the event a Government-Merchant initiates a Merchant Chargeback.

Section 2.4         Merchant Acquiring Improvement Team.  Exhibit G sets forth certain undertakings of the parties with respect to the establishment and operation of the Merchant Acquiring Improvement Team (as that term is defined in Exhibit G) and other agreements relating thereto.

24

Section 2.5          Merchant Agreements.

(a)         EVERTEC shall contract with potential Merchants accepted for participation in the Merchant Program using the form of Merchant Agreement set forth on Exhibit I; provided, that Exhibit I may be amended or updated from time to time by EVERTEC; provided, further, that EVERTEC shall have the exclusive authority to establish fees and charges applicable to each Merchant for such participation subject to applicable Legal Requirements and the Rules; provided, further, that EVERTEC must obtain BPPR’s prior written consent for changes to Exhibit I that would conflict with this Agreement or would affect BPPR’s rights and obligations under the Merchant Agreements or Government-Merchant Agreements or would be reasonably likely to have an adverse effect on BPPR (whether economic or otherwise), unless such amendments are necessary to comply with applicable Legal Requirements.  To the extent that any outstanding Merchant Agreement or Government-Merchant Agreement contains terms that would reasonably be expected to frustrate the performance of a party’s obligations under this Agreement or enjoyment of a party’s rights under this Agreement, EVERTEC shall cause such Merchant Agreement or Government-Merchant Agreement to be amended promptly following the Effective Date so as to eliminate such term or terms.  EVERTEC shall be the sole owner of all economic rights and benefits of, under and relating to Merchant Agreements (and to the amounts payable to EVERTEC by BPPR, subject to and as provided in Section 6.3(b) with respect to Government-Merchant Agreements); provided, that this sentence shall not limit BPPR’s right to indemnity under the terms of each such Merchant Agreement (if any) or other rights of BPPR expressly set forth in this Agreement (including, for the avoidance of doubt, the revenue sharing compensation fee provided in Section 6.4 and the security interests referred to in Section 2.13); provided, further, that EVERTEC shall not have the right to sell, assign, transfer or encumber such rights without the prior written consent of BPPR, which consent may be granted or denied at BPPR’s sole discretion, except that this sentence shall not limit the ability to enter into and comply with the terms of customary financing arrangements with a maximum term that expires no later than December 31, 2034, and EVERTEC may, encumber or assign its rights (including, for the avoidance of doubt, any of its economic rights) and benefits of, under and relating to Merchant Agreements in connection with such financing arrangements and in order to grant a security interest or to accomplish a financing strategy so long as such financing agreements by their terms do not limit EVERTEC’s ability to comply with any provision of this Agreement; provided, further, that that this Agreement shall not limit any encumbrance or assignment arising under or in connection with the Existing Credit Agreement, as amended or modified from time to time pursuant to its terms or any other secured financing arrangement (other than a securitization) that by its terms does not limit EVERTEC’s ability to comply with any provision of this Agreement, so long as any such encumbrance of a Merchant Agreement expires by its terms by no later than December 31, 2034; provided, further, that, in the event BPPR requests that EVERTEC provide the Merchant Services at reduced fees or charges to certain Merchants designated by BPPR (the “Designated Merchants”), then BPPR shall pay EVERTEC on a monthly basis the difference between (x) EVERTEC’s standard fees and charges and (y) the reduced fees and charges mutually agreed to by the parties hereto for the Merchant Services provided to such Designated Merchants.

(b)          EVERTEC shall follow the normal and customary underwriting and approval processes to evaluate potential Merchants for Merchant Services in accordance with the Merchant Application Approval Policy and all applicable Rules.  EVERTEC will not enter into a Merchant Agreement with any potential Merchant that does not, in EVERTEC’s reasonable judgment, meet the standards set forth in the Merchant Application Approval Policy without the prior written consent of BPPR; provided, that all Merchants party to a Merchant Agreement and all Government-Merchants party to a Government-Merchant Agreement shall be deemed to satisfy the Merchant Application Approval Policy.

25

(c)          The Merchant Application Approval Policy may be amended from time to time as follows:

(i)        EVERTEC may amend the Merchant Application Approval Policy in a manner consistent with Industry Standards and with commercially reasonable underwriting and approval standards; provided, that any such amendment not be effective in connection with the Merchant Program without BPPR’s prior written consent if the amendment would (i) reasonably be expected to result in the approval of applications by potential Merchants who are or would be “Prohibited or Restricted Merchants” (as defined in the Merchant Application Approval Policy then in effect), (ii) modify the underwriting policies and procedures and requirements applicable to applications by potential Merchants who are or would be “High Risk Merchants” (as defined in the Merchant Application Approval Policy then in effect), (iii) increase the risk of a potential Merchant that is or would be a “High Risk Merchant” or “Prohibited or Restricted Merchant” erroneously not being identified as such, or (iv) conflict with this Agreement, affect BPPR’s rights and obligations under the Merchant Agreements or Government-Merchant Agreements and/or be reasonably likely to have an adverse effect on BPPR (whether economic or otherwise); provided that BPPR’s consent shall not be required to the extent an amendment is necessary to comply with the Rules or applicable Legal Requirements.  Notwithstanding anything to the contrary herein, in no event shall BPPR be required to open or maintain an account for, or accept any Transaction from, any Merchant or potential Merchant that (i) is or would be a “Prohibited or Restricted Merchant” (as defined in the Merchant Application Approval Policy then in effect) or (ii) is or would be a “High Risk Merchant” but has not been approved in accordance with all applicable underwriting requirements (as set forth in the Merchant Application Approval Policy then in effect).

(ii)        BPPR may provide to EVERTEC a categorization or identification of, and description of BPPR’s policies and procedures with respect to, “High-Risk Merchants” and “Prohibited or Restricted Merchants”, which EVERTEC agrees it must abide by notwithstanding anything to the contrary in its Merchant Application Approval Policy.

(iii)       EVERTEC agrees to review periodically with BPPR the Merchant Application Approval Policy in order to eliminate changes that might unnecessarily result in a reduction of the economic benefits EVERTEC and BPPR reasonably should expect to achieve under this Agreement.

(d)         Each party may terminate any Merchant Agreement in accordance with the terms thereof.  Parties shall notify each other in any case where such party reasonably suspects fraud, security breaches or a default by any Merchant, subject to any applicable restrictions under applicable Legal Requirements.

Section 2.6          Telecommunications Links.  EVERTEC will be responsible for arranging for and overseeing the installation and maintenance of a direct communications link between EVERTEC and each Merchant (and, if applicable, between BPPR and a Government-Merchant) and, as between BPPR and EVERTEC, EVERTEC will assume all costs associated therewith.

26

Section 2.7          Reports to BPPR.  Without limitation of any other information rights that BPPR may have under this Agreement or otherwise, including BPPR’s audit rights under Section 6.5, EVERTEC will provide BPPR, upon BPPR’s written request, at a time, frequency and place reasonably agreed to between the parties, with: (i) reports of a type, scope and level of detail that are consistent in all material respects with past practice; (ii) any incremental reports that BPPR may reasonably request from time to time, in each case for the purpose of providing BPPR with visibility of, and the ability to conduct monitoring or audits with respect to potential fraud, compliance with anticorruption and anti-money laundering laws, and/or service levels to Merchants; and (iii) a report, delivered not less than annually and with the first such report delivered by no later than thirty (30) days after the date hereof, listing (i) each Merchant’s share of aggregate Merchant Transaction Processing Fees and (ii) a profitability report with respect to each Merchant relationship and, and to the extent not set forth in the profitability report, an estimated allocation of each component of MAB Adjusted Revenue to each Merchant over the last twelve (12) months, together with such supporting information as BPPR may reasonably request.

Section 2.8          Notices; Legal Proceedings.  EVERTEC will give BPPR prompt written notice whenever:

(i)         EVERTEC receives notice from any Governmental Authority of any alleged non-compliance by EVERTEC or any of its Representatives with any Legal Requirements applicable to the Merchant Program;

(ii)       the Internal Revenue Service or any other taxing authority alleges any default by EVERTEC in the payment of any material taxes or threatens to make a material assessment against EVERTEC relating to the Merchant Program; or

(iii)       any litigation or proceeding relating to the Merchant Program is brought against EVERTEC or BPPR or names EVERTEC or BPPR as a party.

Section 2.9          [Omitted].

Section 2.10        FFIEC/PCI Compliance. EVERTEC will remain in compliance with PCI DSS and applicable guidelines of the FFIEC during the term of this Agreement and shall provide BPPR with EVERTEC’s PCI DSS certification annually.  EVERTEC will bear any costs, penalties or damages arising from any noncompliance with PCI DSS and applicable guidelines of the FFIEC.  EVERTEC will provide prompt notice to BPPR upon becoming aware of any data breach or other similar compromise of data security or control of any Merchant that exposes or would be reasonably expected to expose such Merchant’s sensitive data (such as tax identification numbers, bank account numbers and passwords) and could otherwise lead to an account takeover or fraud losses.

27

Section 2.11       Hold Account.  EVERTEC shall open and maintain a non-interest-bearing deposit account at BPPR for diversion of Merchant funds in suspected cases of fraudulent Transactions or serious violation(s) of applicable Rules by such Merchant (the “Hold Account”).  EVERTEC will monitor daily Merchant activity and if, in its sole judgment, certain Merchants or certain Transactions are likely fraudulent or otherwise not in compliance with applicable Rules, EVERTEC will cause such Merchant funds to be deposited into the Hold Account.  If EVERTEC cannot cause such Merchant funds to be deposited into the Hold Account, EVERTEC will immediately notify BPPR of such activity.  Subject to BPPR’s receipt of such notification and any reasonably requested supporting documentation, BPPR will promptly execute a hold on such Merchant’s DDA and BPPR will transfer the Merchant funds from the Merchant’s DDA to the Hold Account, in each case, subject to the terms and conditions of the applicable agreement(s) with the Merchant; provided, for the avoidance of doubt, that BPPR will have no obligation to transfer any funds to the Hold Account in the absence of a specific instruction by EVERTEC to do so.  EVERTEC will thereupon promptly investigate each such suspicious incident and promptly notify BPPR of the result of each such investigation. EVERTEC will, on a monthly basis, notify BPPR of all cumulative Merchant Losses so discovered and verified.  EVERTEC shall transfer an equivalent amount of funds from the Hold Account or any Merchant Reserve Account to the Operating Account and shall reasonably promptly provide BPPR with a written report reconciling the balance of the Hold Account with the amount of such Merchant Losses. If in any case EVERTEC’s investigation determines that no violation of applicable Rules and no Merchant Losses have occurred, EVERTEC will promptly release to the Merchant’s DDAs any funds transferred to the Hold Account on the basis of the suspected violation to the Merchant’s DDA.  EVERTEC shall have full access to the Hold Account and shall have the ability to withdraw funds therefrom for the purpose of releasing funds to Merchant DDAs in accordance with this Section 2.11.

Section 2.12        Merchant Reserve Account.  EVERTEC may require, as a term of each Merchant Agreement, that a Merchant provide funds to a deposit account, which in all cases must be maintained at BPPR, for the deposit of funds received from Merchants pursuant to their respective Merchant Agreements as collateral against losses (i.e., reserves) (the “Merchant Reserve Account”).  Funds received from multiple Merchants may be deposited and commingled within a single Merchant Reserve Account solely to the extent permitted by the relevant Merchant Agreements.  EVERTEC shall maintain and implement Industry Standard controls with respect to any commingling of funds received from multiple Merchants, including by ensuring that the Merchant Reserve Account is adequately funded and controlling the disbursements of funds to Merchants.  The parties agree that all right, title and interest with respect to the Merchant Reserve Account(s) shall be owned by EVERTEC, subject to such rights relative to repayment of certain amounts held in the Merchant Reserve Account(s) as are granted, if any, pursuant to the terms of the relevant Merchant Agreement, and subject to BPPR’s right to indemnity under the terms of each such Merchant Agreement (if any) and Section 2.13.  For the avoidance of doubt, the parties hereby agree that EVERTEC shall have full access to any Merchant Reserve Account, including the ability to withdraw funds therefrom.  EVERTEC may require that such funds held as collateral by EVERTEC pursuant to their respective Merchant Agreements can be deposited in the Operating Account or Hold Account.

Section 2.13       Security Interest in Accounts.  In order to secure EVERTEC’s obligations under this Agreement and BPPR’s rights to indemnity and reimbursement pursuant to Section 9.5, and solely for such purposes, EVERTEC hereby grants to BPPR a contractual possessory security interest in, and hereby pledges to BPPR, all of EVERTEC’s right, title and interest, of whatever nature, whether now owned or existing or hereafter created, acquired or arising, in and to (i) the Operating Account, the Hold Account and, to the extent set forth in Section 2.12, above, the Merchant Reserve Account(s), (ii) all funds in and proceeds of such accounts and (iii) all writings evidencing such accounts.  EVERTEC agrees to take all actions as may be reasonably required from time to time to establish and maintain such security interests as set forth hereinabove.  EVERTEC has executed and shall maintain all documents necessary to grant and perfect a security interest in favor of BPPR under Puerto Rico law.

28

Section 2.14        Subcontractors; Third-Party Vendors.

(a)       EVERTEC agrees that, in the event it outsources, delegates or subcontracts the performance of any part of its obligations pursuant to this Agreement to a separate Affiliate or third-party vendor (a “Subcontractor”), (i) such assignment to a Subcontractor will be in accordance with its most current outsourcing policies and procedures; and (ii) such assignment to a Subcontractor shall comply with the regulatory requirements set forth in the FFIEC’s Outsourcing Technology Services Booklet, dated July 15, 2004, including any amendment, successor or supplementation thereof or other applicable Legal Requirement relating to the outsourcing of services.

(b)         EVERTEC shall monitor its Subcontractors’ performance to ensure such performance is consistent and fully compliant with all the requirements of this Agreement.  EVERTEC acknowledges that it will remain primarily liable and continue to be responsible to BPPR and the Merchants with respect to any Subcontractor to the same extent as if EVERTEC were performing such services itself.  BPPR will not be responsible for the payment of fees and expenses payable to a Subcontractor.

(c)         EVERTEC represents that it has vendor risk management policies and procedures in place that include the exercise of commercially reasonable audit rights with respect to its Subcontractors and vendors.

(d)         EVERTEC will provide BPPR with a list of any Subcontractors that process, store, or transmit BPPR Data, Cardholder information or other NPPI upon request during the term of the Agreement.

Section 2.15        Business Continuity Plan.

(a)         EVERTEC acknowledges that it is responsible for maintaining in effect at all times during the term of this Agreement an appropriate Business Continuity Plan.

(b)          EVERTEC represents, warrants and covenants as follows:

(i)         EVERTEC has, as of the Effective Date, and shall at all times maintain the necessary resources and capabilities to perform its obligations under this Agreement, including during the implementation of its Business Continuity Plan; (ii) EVERTEC has a Business Continuity Plan that addresses the continuation of its obligations under this Agreement in cases of an Event, including the backing up of information and maintaining disaster recovery and contingency plans; (iii) EVERTEC will maintain its Business Continuity Plan in compliance with applicable Legal Requirements; and (iv) EVERTEC shall exercise Best Efforts to resume the affected obligations under this Agreement within the recovery time requested by BPPR.  Any terms and conditions for a particular obligation that the parties desire to include in EVERTEC’s Business Continuity Plan will be agreed to by the parties.

29

(ii)        EVERTEC will (i) periodically update and test its Business Continuity Plan’s operability; (ii) provide BPPR with a copy of the Business Continuity Plan as of the Effective Date and promptly provide BPPR with updated copies upon any amendment thereof; (iii) implement the Business Continuity Plan upon the occurrence of an Event; and (iv) consult with BPPR regarding services priority during pendency of an Event.

(iii)       Upon BPPR’s reasonable request, EVERTEC shall make available to BPPR one or more Representatives who are knowledgeable about the Business Continuity Plan to respond to questions concerning EVERTEC’s Business Continuity Plan, the manner in which it is tested, the results of any tests and the manner in which it would be implemented in an Event.  In the event that BPPR determines that applicable Legal Requirements necessitate additional disaster recovery services and/or modifications to EVERTEC’s existing Business Continuity Plan, EVERTEC agrees to cooperate with BPPR in assuring that its Business Continuity Plan complies with applicable Legal Requirements with mutually agreeable terms and conditions.

Section 2.16       Merchant Referral.  EVERTEC agrees to refer exclusively to BPPR all Merchants and potential Merchants doing business in Puerto Rico, the U.S. Virgin Islands or the British Virgin Islands (collectively, the “Region”) that inquire about, request, or otherwise evidence an interest, to EVERTEC’s knowledge, in banking services and products.  All such referrals shall be communicated to BPPR by EVERTEC in a reasonably agreed upon manner.  BPPR may provide EVERTEC with promotional and informational materials and supplies relating to BPPR’s banking services and products, at BPPR’s expense.

ARTICLE III

BPPR RESPONSIBILITIES

Section 3.1          BPPR Responsibilities – General.

(a)        BPPR shall provide all commercially reasonable assistance as is requested by EVERTEC to obtain the approvals and file the registrations required by any Association in order for EVERTEC to provide the Merchant Services hereunder as an ISO for BPPR as Acquiring Member.  BPPR shall (i) take all commercially reasonable action necessary to remain an Acquiring Member of the Associations through the Initial Term and any Renewal Term and (ii) maintain the minimum liquidity, assets, capital and earnings required by each Association so as to sponsor EVERTEC in a manner consistent with the Merchant Acquiring Business and in a manner reasonably designed to support the Merchant Acquiring Business during the Initial Term and any Renewal Term, as reasonably agreed by the parties hereto.

(b)         BPPR shall act as the Acquiring Member for Merchant Agreements; provided, that EVERTEC may enter into Merchant Agreements from time to time to provide Merchant Services to Merchants in the United States outside of the Region only to the extent that such Merchants are included by EVERTEC as part of the MAB Adjusted Revenue calculation (“U.S. Mainland Merchants”) and only if such U.S. Mainland Merchants are initially serviced by EVERTEC and BPPR pursuant to a Merchant Agreement entered into with such Merchant with respect to its operations within the Region.  For the avoidance of doubt, any U.S. Mainland Merchants that EVERTEC proposes to onboard to the Merchant Program shall be subject to Merchant Program policies and procedures not less stringent than those applicable to other Merchants, and BPPR shall be entitled to evaluate any such proposal on a case-by-case basis and receive from EVERTEC reasonably requested diligence information regarding the U.S. Mainland Merchant.

30

(c)          BPPR shall provide (i) all services to the Merchants and Government-Merchants hereunder in accordance with the applicable Rules and (ii) shall continue to provide its functions described in any three-party agreement among BPPR, EVERTEC and any third party, consistent with Industry Standards, including following the normal and customary underwriting and approval processes as reasonably agreed by BPPR and EVERTEC to evaluate potential Merchants for Merchant Services, or customers of any third party under any such agreement, in accordance with the Merchant Application Approval Policy and all applicable Rules.

(d)         BPPR will (i) use commercially reasonable efforts to obtain copies and maintain electronic access for EVERTEC of any Association’s manuals and publications that are available to Acquiring Members that are otherwise not available to EVERTEC, (ii) forward to EVERTEC all material information routinely provided by each Association that is otherwise not available to EVERTEC that would be reasonably necessary or appropriate for EVERTEC’s fulfillment of its obligations under this Agreement, including by using commercially reasonable efforts to ensure EVERTEC has access to reasonable reports from the online systems of such Association related to this Agreement and the obligations set forth herein (but in the case of this clause (ii) solely to the extent permitted under the Rules and applicable Legal Requirements and only if an Association’s reporting system supports the separate reporting of acquirer-side data and issuer-side data).  EVERTEC will reimburse BPPR for all costs reasonably incurred pursuant to this Section 3.1(d), if any.

(e)       BPPR will maintain a Business Continuity Plan as may be required by any applicable Legal Requirements.  BPPR shall be responsible for complying with all Legal Requirements applicable to it related to screening, customer identification and know your customer, including the BSA, the USA PATRIOT Act and the applicable requirements and regulations promulgated and issued by the U.S. Department of the Treasury’s Office of Foreign Assets Control and the Financial Crimes Enforcement Network.  Each of BPPR and EVERTEC shall use commercially reasonable efforts to monitor Merchants pursuant to such Legal Requirements for ongoing compliance with any anti-money laundering and BSA requirements.

(f)          BPPR will notify EVERTEC as soon as practicable following BPPR’s receipt of written notice from any Association regarding a change in such Association’s Assessments to the extent that information regarding such changes is otherwise not available to EVERTEC.

(g)        BPPR will notify EVERTEC as soon as practicable following BPPR’s receipt of written notice from any Association regarding changes in the basis for calculation of Interchange Fees by such Association to the extent that information regarding such changes is otherwise not available to EVERTEC.

(h)        BPPR is now, and shall remain during the Initial Term and any Renewal Term, compliant with the Rules, including the Payment Card Industry Data Security Standards.

31

(i)       During the Initial Term and any Renewal Term, (i) BPPR shall use its reasonable Best Efforts to ensure that each Government-Merchant Agreement remains in full force and effect and (ii) BPPR shall not act, or fail to act, in any manner that would give a Government-Merchant under any Government-Merchant Agreement the right to terminate, modify or accelerate such Government-Merchant Agreement.

(j)          Upon the expiration of each Government-Merchant Agreement, BPPR and EVERTEC shall use their respective reasonable Best Efforts to cause the applicable municipality, government agency, public corporation or other governmental entity to enter into a Merchant Agreement with BPPR and EVERTEC.

(k)         BPPR shall, on a monthly basis, account to EVERTEC for all fees, revenue and other payments that are paid to BPPR by Government-Merchants and the amounts that BPPR pays to EVERTEC in connection with the Government-Merchant Agreements pursuant to Section 6.3.  EVERTEC may reasonably request from BPPR workpapers that support the accounting provided to EVERTEC and BPPR shall provide such workpapers within three (3) Business Days of receiving any such request.  Upon its receipt of the workpapers, EVERTEC shall have twenty (20) Business Days to dispute any accounting provided by BPPR and, in the event of a dispute, the parties shall negotiate in good faith to resolve such dispute.  Any dispute, if not settled by the parties, shall be resolved in accordance with the dispute resolution mechanism set forth in Section 9.2(b), except that a dispute solely under this section shall not be considered an Event of Default.  Any amounts owed to EVERTEC upon the resolution of a dispute shall be paid to EVERTEC within three (3) Business Days of such resolution.

(l)          In the event that (i) BPPR terminates a Merchant DDA or (ii) a Merchant or Government-Merchant terminates its Merchant DDA, in each case, for any reason, BPPR shall promptly provide notice to EVERTEC of such termination, so that EVERTEC may, among other things, (i) terminate the applicable Merchant Agreement, (ii) recover any rented POS terminals, (iii) collect any chargebacks, past due fees or early termination fees applicable to the Merchant and (iv) effect final settlement of all Transactions to such Merchant DDA.  Notwithstanding anything to the contrary herein, any such actions by EVERTEC shall be conducted at EVERTEC’s sole cost and expense.

Section 3.2          Merchant Referral and Assistance.

(a)        BPPR agrees to refer exclusively to EVERTEC potential Merchants, including those who express interest in digital card payment acceptance services and any business client that is seeking card acceptance or processing services (including, through ATH Movil Business or any other EVERTEC solution for Merchants that provides Merchants with digital card payment acceptance services) in the Region (including any Government-Merchants) that inquire about, request or otherwise evidence an interest, to BPPR’s knowledge, in Merchant Services or the P2B Program with respect to such business.  All such referrals shall be communicated to EVERTEC by BPPR in a reasonably agreed upon manner.  Each of EVERTEC and BPPR further agree that any prior written or unwritten compensation arrangement(s) in connection with Merchant referrals will be deemed terminated as of the Effective Date.

32

(b)         In accordance with EVERTEC’s procedures and instructions for referrals, BPPR will actively cooperate with EVERTEC within the Region, on an exclusive basis and at EVERTEC’s expense (such expense to be agreed by the parties in advance), in marketing EVERTEC’s Merchant Services and P2B Program and in locating, investigating and referring potential Merchants to EVERTEC, and provide marketing assistance to EVERTEC for the purpose of retaining and signing new Merchants; provided, that BPPR shall make no representations or warranties regarding EVERTEC’s Merchant Services or P2B Program.  With respect to any such potential Merchants, BPPR shall, subject in each case to applicable contractual obligations and Legal Requirements, (x) take the following actions, to the extent involving information already within BPPR’s possession, and (y) use commercially reasonable efforts to take the following actions, to the extent involving any information not already within BPPR’s possession:

(i)       provide EVERTEC with such information and assistance as EVERTEC may reasonably request and BPPR may legally provide in connection with EVERTEC’s review of any corresponding Merchant Application for Merchant Services, and/or EVERTEC’s administration or collection efforts regarding any current or former Merchant or Government-Merchant (whether referred or not referred by BPPR);

(ii)     provide EVERTEC with such information, including corporate resolutions, corporate bylaws, beneficial ownership information, signatories, financial statements and/or tax documents, provided by Merchants or Government-Merchants to BPPR which EVERTEC may reasonably request and BPPR may legally provide in order for EVERTEC to provide Merchant Services; and

(iii)       establish a Merchant DDA for each Merchant or Government-Merchant for the deposit of paper Transaction records and/or the electronic settlement of electronic Transactions, and, if applicable, remit paper Transaction records to EVERTEC in accordance with EVERTEC’s procedures.

(c)        EVERTEC shall provide BPPR with promotional and informational materials and supplies relating to the Merchant Services, at EVERTEC’s expense.

(d)       For the avoidance of doubt, BPPR’s obligations under this Section 3.2 shall not extend to (i) providing referrals to, marketing or otherwise supporting in any manner any business units or commercial activities other than those that generate MAB Gross Revenue or P2B Gross Revenue, (ii) bill payment services (including invoice presentment and acceptance of payments from merchant’s payees) or (iii) any ancillary service that facilitates any payment (other than (A) the acquiring of debit and credit card transactions or (B) the component services offered as part of the Merchant Program or P2B Program).

Section 3.3          Settlement Responsibilities.

(a)          BPPR is authorized to, and shall be responsible for remitting to Merchants and Government-Merchants, all funds held in the Settlement Account and/or received in settlement of Merchant Transactions.

33

(b)        BPPR shall maintain the Merchant and Government-Merchant files and BINs with the Associations as are listed on Exhibit C hereto and such additional Merchant and Government-Merchant files and BINs as may be reasonably requested by EVERTEC from time to time for EVERTEC’s use for the purpose of providing Merchant Services.  EVERTEC agrees to pay the costs charged by the Associations for all BINs required for the Merchants and Government-Merchants.  BPPR will, at EVERTEC’s request and expense during the Initial Term or any Renewal Term, procure one or more dedicated BIN(s) from the Association to facilitate the Merchant Program.

(c)        BPPR will use its commercially reasonable efforts to establish and maintain a separate Settlement Account at BPPR for BINs relating to the Merchant Acquiring Business.  BPPR will direct the daily net funds wired by the Associations to be deposited into the corresponding Settlement Account.

(d)         In a manner consistent with past practices, EVERTEC will provide BPPR with daily ACH Files with respect to the net settlement of Merchant and Government-Merchant Transactions and BPPR will edit and format such ACH Files as necessary and transmit them to the BPPR Core Banking System or to the corresponding clearing system for debit or credit to the Merchants and Government-Merchants.  To the extent reasonably practicable under the circumstances, BPPR will notify EVERTEC of any changes to the ACH Files.  Any losses or liabilities arising from such debits or credits will be borne by EVERTEC, except to the extent resulting from negligence on the part of BPPR.  The total of the Merchants and Government-Merchants net settlement payment (total ACH File) will be debited to the applicable Settlement Account.  BPPR will use its Best Efforts to settle with Merchants and Government-Merchants on a same-day or next-day basis in a manner consistent with past practice; provided, however, that, BPPR shall have discretion to settle with any Merchant or Government-Merchant only after receiving, by wire from the Associations, the daily net funds related to such settlement, based on BPPR’s determination that such delayed settlement would be appropriate in light of safety and soundness considerations (e.g., if there is a significant increase in the cost to BPPR of advancing any funds to such Merchant or Government-Merchant, or based on BPPR’s assessment of the counterparty risk of the applicable Merchant or Government-Merchant, Association or EVERTEC).  If BPPR determines there are safety and soundness considerations or Legal Requirements that warrant a delay in settlement, BPPR will notify EVERTEC, to the extent such notification is feasible from a safety and soundness perspective and is permissible under applicable Legal Requirements, at least ten (10) Business Days prior to implementing any changes and the parties will work in good faith to identify solutions that would limit the impact or potential impact to the Merchant Program and/or the Merchants or Government-Merchants.  If the parties cannot reach a mutually agreeable solution within a period of thirty (30) days and EVERTEC decides that it is not in the best interest of the Merchant Program to delay settlements for Merchant or Government-Merchant, EVERTEC may continue to advance funds at EVERTEC’s cost to the extent not resulting in incremental legal or regulatory compliance risk to BPPR, but any reasonable, incremental out-of-pocket cost or expense (including financing cost) incurred by EVERTEC will be deducted from BPPR’s portion of MAB Adjusted Revenue unless BPPR’s determination to delay settlement was based on BPPR’s reasonable belief that there is counterparty credit risk to an Association, or applicable Legal Requirements.

(e)      BPPR may provide view-only access to EVERTEC to review balances and daily activity in all Settlement Accounts to facilitate daily reconcilement, as well as access to information regarding Merchant and Government-Merchant DDAs subject to the terms and conditions of Section 2.1(d)(iii).

34

(f)         BPPR agrees to assign a sufficient number of qualified staff members to reasonably assist EVERTEC in the resolution of settlement and Merchant Chargeback problems.

(g)         BPPR will submit as required all statistical information requested by Associations including quarterly statements and will provide copies of all non-confidential information and statements to EVERTEC to the extent permitted by any applicable Rules or Legal Requirements.  EVERTEC will provide, at its own expense, such information as may be requested by the Association and any other reasonable information to BPPR to assist BPPR with compliance with any such requests.

(h)       BPPR will debit the Operating Account for all Assessment and Association Dues as incurred that apply to Merchants and/or Government-Merchants, as well as all Merchant Losses incurred by BPPR, and will provide documentation to EVERTEC that substantiates such debits, including copies of all Association invoices and reports.  Before the Settlement Account has been divided to separate Association settlement activity from acquiring activity and the Settlement Account relates solely to acquiring activity, BPPR will use commercially reasonable efforts to provide EVERTEC such documentation at least two (2) Business Days prior to debiting the Operating Account.

(i)          BPPR, as the Acquiring Member, agrees to represent EVERTEC’s interest in disputes that might arise from time to time with an Association over compliance with Rules and Association Dues; provided, that EVERTEC shall pay any Association Dues relating to the Merchant Program and any and all costs reasonably incurred by BPPR in disputing the same, including reasonable associated legal fees.

Section 3.4          [Omitted].

Section 3.5          Servicing and Monitoring of Merchant Card Accounts.  The parties hereto agree that all Card accounts of Merchants shall be serviced as follows:

(a)         Each Merchant shall open and maintain a designated deposit account or accounts at BPPR.  BPPR shall be permitted access to any funds in such account to the extent funds are needed to fund fees, Assessments, Merchant Chargebacks, returned items or any other obligations of a Merchant to EVERTEC, BPPR, the Associations or any Card issuing bank or account holder.

(b)        BPPR shall comply with all reasonable requests of EVERTEC to conduct investigations, supply information or perform any other act or thing relating to investigating Merchant activities and condition.  Notwithstanding the foregoing, nothing in this Section 3.5(b) shall be construed to require BPPR to take any action that is in violation of applicable Legal Requirements or regulation, the Rules or BPPR’s deposit agreement with any Merchant.  EVERTEC shall be responsible for all reasonable expenses incurred by BPPR in connection with compliance with a request by EVERTEC pursuant to this Section 3.5(b).

35

Section 3.6          Compliance with Legal Requirements.  BPPR shall be responsible for complying with all Legal Requirements applicable to it related to screening, customer identification and know your customer, including the Bank Secrecy Act (the “BSA”), the USA PATRIOT Act and the applicable requirements and regulations promulgated and issued by the Office of Foreign Assets Control and the Financial Crimes Enforcement Network.  EVERTEC shall use reasonable Best Efforts to cooperate with, and assist, BPPR in monitoring Merchants pursuant to such Legal Requirements for ongoing compliance with any money laundering and bank secrecy requirements, it being understood and agreed that EVERTEC shall maintain BSA and other anti-money laundering policies and procedures in accordance with applicable Legal Requirements, and EVERTEC shall accordingly monitor Merchants and Government-Merchants.  Each party shall be responsible for making any and all filings with any Governmental Authority that may be required to be made by such party under such Legal Requirements; provided, that each party shall cooperate and provide information to the other party, to the maximum extent permitted by Legal Requirements, as needed for such filings, other than information that would create any potential liability under applicable Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

Section 3.7         Settlement Risk.  BPPR shall not be responsible for the systemic risk of loss of the Associations or the failure of the Associations to effect settlement of Transactions or to perform its obligations hereunder in the event of such failure; provided, that this Section 3.7 shall not relieve BPPR of its obligations in the settlement process once the funds or information is received from the Associations.

Section 3.8          Notices; Legal Proceedings.  BPPR will give EVERTEC prompt written notice whenever:

(i)          BPPR receives notice from any Governmental Authority of any alleged non-compliance by BPPR or any of its subsidiaries, Affiliates or Representatives with any Legal Requirements applicable to the Merchant Program;

(ii)         the Internal Revenue Service or any other taxing authority alleges any default by BPPR in the payment of any material taxes or threatens to make a material assessment against BPPR relating to the Merchant Program; or

(iii)        any litigation or proceeding relating to the Merchant Program is brought against EVERTEC or BPPR or names EVERTEC or BPPR as a party.

ARTICLE IV

EXCLUSIVITY

Section 4.1          BPPR as Acquiring Member.

(a)         Throughout the Initial Term and any Renewal Term, BPPR shall be the exclusive Acquiring Member for the Merchant Services in the Region; provided, however, if BPPR is unable (for any reason other than a Person’s refusal to enter into a Merchant Agreement with BPPR through no fault of BPPR) or unwilling to act as the Acquiring Member for any Person at any time during the Initial Term or any Renewal Term, EVERTEC may enter into an agreement with another financial institution which shall be the sponsoring bank for such Person so long as EVERTEC makes a good-faith determination (and provides prompt written notice to BPPR of such determination) that the provision of such services to such Person does not pose an unreasonable financial, reputational or regulatory risk to EVERTEC and/or BPPR; provided, further, that any such determination by EVERTEC with respect to a regulatory risk to BPPR shall be made in consultation with BPPR.  BPPR shall advise EVERTEC of BPPR’s decision to not act as the Acquiring Member for any Person within three (3) Business Days of its receipt of EVERTEC’s notice that it wishes to provide services to such Person which would be Merchant Services if such Person were a Merchant; provided, further, that prior to entering into an agreement with another financial institution which shall be the sponsoring bank for such Person in the Region, EVERTEC shall provide BPPR with written notice at least five (5) Business Days prior to entering into such agreement and BPPR may elect to act as the Acquiring Member for such Person pursuant to the terms of this Agreement upon notice to EVERTEC during such five-Business Day period.

36

(b)         In addition to its obligation under Section 3.2, throughout the Initial Term and any Renewal Term, BPPR shall use EVERTEC as its exclusive ISO for any Acquiring Member business conducted by BPPR in the Region, and BPPR shall not sponsor any Person into the Associations, or into any other card scheme such as American Express Travel Related Services, as an ISO in the Region, other than EVERTEC; provided, however, if EVERTEC is unable or unwilling to act as the ISO for any Association, or to act as the ISO for providing merchant acquiring business to any other card scheme for which BPPR serves as the sponsoring bank (for any reason other than such card scheme’s refusal to allow EVERTEC to act as the ISO for its business with BPPR), BPPR may enter into an ISO agreement with another provider which shall act as the ISO for the merchant acquiring business for the corresponding Association or card scheme; provided, further, that prior to entering into an ISO agreement with another provider, BPPR shall provide EVERTEC with written notice at least five (5) Business Days prior to entering into such ISO agreement and EVERTEC may elect to provide such services pursuant to the terms of this Agreement upon notice to BPPR during such five-Business Day period.

Section 4.2          EVERTEC Obligations.  EVERTEC agrees that it shall not, and shall cause its Affiliates not to, directly induce, cause, or propose to any Merchant to transfer any of the accounts and/or any other business relationships such Merchant has directly with BPPR (including accounts or relationships for which BPPR or any of its Affiliates shall have engaged EVERTEC as the ISO) to any other Person other than BPPR.

Section 4.3          General

(a)        Nothing in this Article IV shall be interpreted to preclude or prevent either party from, subject to the other provisions of this Agreement, (x) distributing marketing materials on its products or services to the general public; or (y) responding to requests for products or services from the other party’s respective clients (including any Merchants or prospective Merchants) or other Persons.

(b)        In addition and for the avoidance of doubt, nothing in this Article IV shall preclude or prevent EVERTEC from entering into agreements to provide merchant acquiring services to financial institutions in support of such financial institutions’ merchant programs in the Region so long as (i) EVERTEC does not sell any services of such other merchant program to any merchant; provided that, provision of sales support, including providing information of a technical or operational nature, customer support services and technical orientation, when conducted consistently with past practices, shall not be deemed to be a violation of this clause (i), (ii) EVERTEC does not otherwise market to or solicit any merchant on behalf of such other merchant program, and (iii) EVERTEC does not discuss pricing with any merchant and does not set or establish the price charged to the merchant by such other merchant program; provided, that, simply setting the price of services that EVERTEC provides to a financial institution is not a violation of this clause (iii).

37

ARTICLE V

CONFIDENTIALITY, PRIVACY & DATA PROTECTION

Section 5.1          Confidential Information.

(a)          The parties acknowledge that in the course of their dealings each may receive (the “Receiving Party”) Confidential Information of the other party (the “Disclosing Party”).  As such, the parties are willing to share such Confidential Information provided that the Receiving Party protects the Confidential Information of the Disclosing Party pursuant to the terms of this Agreement, and the Disclosing Party will remain the proprietor of the Confidential Information and any derivative thereof.

(b)        Confidential Information (other than Intellectual Property and NPPI, which will always be deemed to be Confidential Information) will not include information that the Receiving Party can reasonably demonstrate:

(i)       is or becomes generally available to the public without breach of any obligation of confidentiality under this Agreement or any confidentiality agreement that the Receiving Party may have with a third party;

(ii)        was already known to or was rightfully in the possession of the Receiving Party on a non-confidential basis prior to its disclosure by the Disclosing Party;

(iii)     becomes available to the Receiving Party from a third party, provided that such third party is not subject to an obligation of confidentiality with the Disclosing Party;

(iv)        is independently developed by the Receiving Party without reference to or reliance upon the Confidential Information of the other party;

(v)         is approved in writing by the Disclosing Party for disclosure; or

(vi)        is required to be disclosed by applicable Legal Requirements or by an applicable Governmental Authority or Association, but only to the extent so required and solely for such purpose, and the Receiving Party shall otherwise remain obligated to treat such information as Confidential Information pursuant to this Article V.

(c)        In any dispute with respect to these exclusions, the burden of proving that information is not Confidential Information will be on the party making such assertion.

38

Section 5.2          Protection of Confidential Information.

(a)        The Receiving Party agrees to protect and hold all Confidential Information in strict confidence and protect all Confidential Information from unauthorized and/or inadvertent access, use, destruction or disclosure in full compliance with this Agreement and all applicable Legal Requirements and Industry Standards, including by implementing, maintaining and enforcing appropriate data and Systems security.

(b)        Unless in receipt of a specific written exemption from the Disclosing Party or required by applicable Legal Requirements, the Receiving Party will not:

(i)          use, reproduce, disseminate, modify, retain, disclose or perform Data Processing of any of the Confidential Information for any purpose other than to perform its obligations under this Agreement for which the Confidential Information is being disclosed, or for such Receiving Party’s internal recordkeeping purposes;

(ii)         reverse engineer, sell or market any Confidential Information;

(iii)      receive and maintain the Confidential Information without implementing reasonable internal controls and procedures to safeguard the security and confidentiality of such information;

(iv)      disclose any of the Confidential Information other than to its Representatives who: (i) have a reasonable need-to-know in order to discharge their obligations under this Agreement, (ii) have confidentiality agreements substantially similar to those herein or owe a duty of confidentiality to the Receiving Party that survive the Representatives’ engagement, (iii) have received appropriate notice and training regarding the Confidential Information, and (iv) have not been indicted and/or convicted of fraud, theft, larceny, embezzlement, any other financial or cybercrime or a crime involving moral turpitude; or

(v)         remove any proprietary rights or confidentiality legend from the Confidential Information.

(c)          The prohibition against the disclosure of Confidential Information includes disclosing the substance of the negotiations of the Agreement and the existence and/or the terms and conditions thereof, as well as the fact that any similarity exists between the Confidential Information and information independently developed by another Person or entity, and the parties understand that such similarity does not excuse it from abiding by its covenants or other obligations under this Agreement.

(d)          The Receiving Party will be fully liable for the acts and omissions of its Representatives to whom it discloses the Confidential Information.

39

 Section 5.3          Incident Response Program.

(a)         EVERTEC represents and warrants to BPPR that it has implemented, and hereby undertakes to maintain and update, a comprehensive response program that includes processes and procedures (including notification procedures to Affected Persons) designed to address incidents of unauthorized access involving BPPR Data or Cardholder information in accordance with applicable Legal Requirements and Industry Standards.

(b)          If EVERTEC becomes aware of an Incident, to the extent it is not prohibited by applicable Legal Requirements, EVERTEC agrees to:

(i)        notify BPPR as soon as practicable, and in any event within twenty-four (24) hours, following EVERTEC’s becoming aware of an Incident. The initial notification must be made to the BPPR Chief Information Security Officer, and must include based on then-available information: (i) the available facts; (ii) the status and results of the investigation including identifying the sources and underlying causes of the Incident; (iii) the estimated effects on BPPR, BPPR Data or Cardholder information and the ability of EVERTEC to perform its obligations under this Agreement; (iv) the steps already taken to mitigate, remedy and contain the Incident; (v) if applicable, the potential number of affected Merchants, Government-Merchants, customers, consumers, and/or employees affected (collectively “Affected Persons”); and (vi) the name and contact information of EVERTEC’s representative who will serve as BPPR’s primary contact;

(ii)         provide BPPR with prompt updates to any information referenced in clause (i) above;

(iii)       take all reasonable steps, at EVERTEC’s sole cost and expense (unless such Incident was caused by BPPR or any of its subsidiaries or any contractor or subcontractor thereof), in accordance with its Data Protection Program and Incident Response Program to immediately mitigate and/or remedy, at EVERTEC’s expense, such Incident and contain its further occurrence;

(iv)        reasonably coordinate and cooperate with BPPR representatives in any required investigation and provide periodic updates regarding the Incident, including: (i) providing access to the affected facilities and affected operations as necessary for the BPPR or its auditors to conduct investigations required to be conducted by BPPR by Legal Requirements and applicable Rules (provided that BPPR shall reimburse EVERTEC for any losses incurred by EVERTEC in connection with any unauthorized access or intrusion to EVERTEC’s Systems, or any Disabling Device introduced to EVERTEC’s Systems, as a result of a breach of this Agreement, failure to comply with reasonable security policies and procedures that are provided in writing to BPPR with reasonable advance notice by EVERTEC, gross negligence, fraud or willful misconduct of BPPR in connection with its access to EVERTEC’s Systems pursuant to this Section 5.3); (ii) facilitating interviews with EVERTEC’s Personnel with knowledge of the Incident; and (iii) making available all relevant records, logs, files, data reporting, forensics or audit reports and other materials required by BPPR to allow BPPR to comply with applicable Legal Requirements and Rules, provided that EVERTEC will not be required to provide BPPR with information belonging to, or compromising the security of, EVERTEC or its other customers;

40

(v)        provide reasonable cooperation to BPPR in any litigation, Association or Governmental Authority inquiries, or other third party action arising out of or resulting from the Incident and deemed necessary by BPPR to protect the BPPR Data or Cardholder information and comply with applicable Legal Requirements and Rules, at the expense of BPPR unless such Incident (A) was caused by EVERTEC’s or its Representatives’ gross negligence, fraud, willful misconduct or breach of this Agreement; or (B) involves NPPI obtained by or on behalf of EVERTEC from Merchants, transaction data, or Cardholder information;

(vi)       except as may be required by applicable Legal Requirements or Rules, not communicate with any third party other than EVERTEC’s Representatives, including the media, vendors, and Affected Persons, regarding the Incident (as it relates to BPPR) without BPPR’s consent and approval of the content of the communication. EVERTEC agrees that regarding the impact of the Incident on BPPR, EVERTEC will use Best Efforts to consult and coordinate with BPPR with respect to the following matters: (i) whether notice of the Incident is to be provided to any individual, Governmental Authority, law enforcement agency, consumer reporting agencies or others as required by applicable Legal Requirements or otherwise; (ii) the contents of such notice; and (iii) whether any type of remediation may be offered to Affected Persons (including any free credit monitoring service), and the nature and extent of any such remediation;

(vii)      report criminal acts as and to the extent required by applicable Legal Requirements and Governmental Authorities and notify BPPR as soon as practicable prior to such reporting; and

(viii)      maintain and preserve all relevant documents, records, and other data related to BPPR Data or Cardholder information.

Section 5.4          Required Disclosures.

(a)        In the event that the Receiving Party or any Representative of the Receiving Party is requested or required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit, or if the Receiving Party or any Representative of the Receiving Party reasonably believes, upon the advice of counsel, that it is required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit to disclose Confidential Information, the Receiving Party will, to the extent allowable under applicable Legal Requirements, give immediate verbal and written notification of the Legal Requirement or action, proceeding, subpoena, investigation, inquiry or audit to the Disclosing Party and, to the extent allowable under applicable Legal Requirements and at the expense of the Disclosing Party, hold the Confidential Information confidential while the Disclosing Party seeks a protective order.

(b)         In addition to the foregoing, a Receiving Party or its Representatives may provide the Confidential Information to a Governmental Authority or Association with supervisory authority over such Receiving Party or its Affiliates if (i) such information is required under Legal Requirements or Rules to be filed with or disclosed to any such Governmental Authority or Association, (ii) such information is requested by such a Governmental Authority or Association or the Receiving Party determines based on advice of counsel (which may be in-house counsel) that it is necessary or appropriate to provide such Confidential Information to a Governmental Authority or Association, (iii) the Receiving Party’s counsel (which may be in-house counsel) advises that such disclosure is required in order to comply with applicable Legal Requirements or Rules or (iv) such Governmental Authority is a banking regulator; provided in each case, that the Receiving Party shall have, where applicable, taken such reasonable steps to protect the confidentiality of such information as the Receiving Party takes with respect to the protection of its own comparable confidential information in such circumstances.

41

Section 5.5         Remedies.  The Receiving Party acknowledges and agrees that it would be difficult to fully compensate the Disclosing Party for damages resulting from the breach or threatened breach of the foregoing provisions and, accordingly, that, in addition to any other remedies that may be available, in law, at equity or otherwise, the Disclosing Party will be entitled to seek injunctive relief, including temporary restraining orders, preliminary injunctions and permanent injunctions, to enforce such provisions without the necessity of proving actual damages or posting a bond or any other security. This provision with respect to injunctive relief will not, however, diminish the Disclosing Party’s right to claim and recover damages. Notwithstanding anything in this Agreement to the contrary, nothing shall limit or restrict the ability of a Receiving Party to disclose Confidential Information to banking regulators or Associations having jurisdiction over such Receiving Party.

Section 5.6          Term of Obligation.  Unless indicated otherwise in writing, the parties’ obligations under this Article V will survive this Agreement for a period of three (3) years following termination hereof. Upon termination of this Agreement for any reason, the Receiving Party’s rights to possession and use of any Confidential Information in connection with the performance of its obligations hereunder or otherwise will terminate.

Section 5.7        Destruction.  Upon the Disclosing Party’s request, the Receiving Party will promptly destroy in a secure manner following Industry Standards all Confidential Information and all copies thereof, including physical copies and copies embedded in computer files, extracts from computer files and analyses or other material based upon the Confidential Information (provided that following such request the Receiving Party shall not be required to perform any obligations under this Agreement that require the use of such Confidential Information).  Should the Disclosing Party request evidence of the destruction of any such Confidential Information, the Receiving Party will promptly (and in all cases within thirty (30) days of such request or such other time as agreed to between the parties; provided that EVERTEC shall use Best Efforts to provide within ten (10) days) submit an attestation executed by an authorized officer of the receiving party certifying that any such Confidential Information has been destroyed.  If BPPR receives an individual’s request to delete NPPI, BPPR may direct EVERTEC to delete such information (the “Direction”), in which case, EVERTEC shall delete such information without undue delay and certify to BPPR in writing that it has complied with the Direction (and following completion of such request EVERTEC shall not be required to provide any services that require the use of such NPPI).  Notwithstanding the foregoing, the Receiving Party may, after informing the Disclosing Party, retain copies of the Confidential Information: (i) to comply with applicable Legal Requirements; or (ii) for purposes of record retention, backup records or audit requirements, including as set forth in Section 6.5); provided, however, that the confidentiality obligations (including destruction and certification) hereunder will survive with respect to any retained Confidential Information.

42

 Section 5.8          Confidentiality Regarding Customer and Cardholder Information.

(a)         EVERTEC acknowledges that customers of BPPR have an expectation of privacy with respect to their financial transactions and personal data and that such information is subject to protections under applicable Legal Requirements, and hereby agrees that any and all such information EVERTEC may acquire with respect to said customers during the term of this Agreement shall be treated by EVERTEC as Confidential Information in accordance with the provisions of Section 5.1(a) and otherwise in a manner that complies with Legal Requirements applicable to the protection of NPPI.

(b)         EVERTEC will maintain all Cardholder information under its control or possession in a safe and secure manner, in compliance with the Rules and data security standards and requirements established by each applicable Association, including Payment Card Industry Data Security Standards, and report to BPPR upon request with respect to EVERTEC’s internal policies and procedures relating thereto.

(c)         BPPR will maintain all Cardholder information under its control or possession in a safe and secure manner, in compliance with the Rules and data security standards and requirements established by each applicable Association and Payment Card Industry Data Security Standards, and report to Associations as required by the Rules and to EVERTEC if so requested by the Association relating to internal policies and procedures related to Cardholder information security.

Section 5.9          Access to Systems and Facilities.

(a)         If BPPR in its sole and absolute discretion determines at any time that, as part of the provision of EVERTEC’s services to BPPR, EVERTEC or its Personnel will have physical access to controlled areas (collectively, “Access”), EVERTEC agrees to the following:

(i)         EVERTEC Personnel will follow BPPR-provided policies and procedures (“Requirements”) in the course of such Access.  EVERTEC will share the Requirements with such EVERTEC Personnel and, in the event that BPPR provides prior written notice to EVERTEC of any changes to the Requirements, EVERTEC will use commercially reasonable efforts to keep EVERTEC Personnel updated and trained regarding such changes.

(ii)        EVERTEC will not permit its Personnel Access without BPPR’s express written authorization, and any such actual or attempted access will be consistent with any such authorization.

(iii)     Subject to Section 9.5(e), EVERTEC expressly assumes any liability for a breach or violation by EVERTEC Personnel of the Requirements or the foregoing requirement to not exceed BPPR-authorized Access.  EVERTEC shall inform BPPR promptly of any changes in EVERTEC Personnel (additions or releases) that may affect any EVERTEC Personnel’s authorization hereunder.

(b)        If any EVERTEC Personnel will have access to BPPR’s Systems, BPPR may impose reasonable security policies and procedures provided in writing with reasonable advance notice as a condition to granting access to such BPPR Data and its Systems to such EVERTEC Personnel.  In addition to the foregoing, if any EVERTEC Personnel will have access to BPPR Data or BPPR’s Systems, the following additional terms shall apply:

43

(i)        EVERTEC shall comply with all Legal Requirements (including Legal Requirements regarding the protection, privacy and confidentiality of NPPI) applicable to EVERTEC’s use, storage and other processing BPPR Data.

(ii)      EVERTEC agrees to take commercially reasonable actions in accordance with applicable Industry Standards to protect the confidentiality, integrity, availability and resilience of its Systems.  EVERTEC’s responsibilities in this regard include regularly assessing and evaluating, in accordance with applicable Industry Standards and Legal Requirements, the effectiveness of the technical and organizational measures adopted by it.  In furtherance thereof, EVERTEC shall be responsible for establishing, maintaining and implementing a Data Protection Program.

(iii)       In furtherance, and not in limitation, of its other obligations under this Agreement, and to maintain the protection and privacy of the BPPR Data, EVERTEC shall: (i) not disclose any BPPR Data to any third party; (ii) limit access to the BPPR Data to its employees, Representatives and Subcontractors who have a need‑to‑know such BPPR Data after adequately informing such Persons of the confidential nature of the BPPR Data and in each case subject to appropriate role-based access rules (based on least privileged access principles); (iii) use the BPPR Data only for purposes of carrying out its obligations hereunder; (iv) give prompt notification to BPPR of any unauthorized or inadvertent actual or reasonably suspected disclosure of BPPR Data or of actual or reasonably suspected breaches involving the disclosure of BPPR Data, as provided in Section 5.3; (v) upon request of BPPR, promptly return or destroy all BPPR Data, including all copies thereof except for copies necessary to comply with applicable Legal Requirements and records retention (provided that following the completion of such request EVERTEC shall not be required to provide any services to BPPR under this Agreement that require the use of such BPPR Data); and (vi) implement all reasonable security measures in accordance with applicable Industry Standards designed to (a) ensure the security, integrity and confidentiality of BPPR Data, (b) protect against any anticipated threats or hazards to the security or integrity of BPPR Data and (c) protect against unauthorized access to or use of BPPR Data.

ARTICLE VI

FEES AND CHARGES

Section 6.1         Merchant Transaction Processing Fees and Other Charges.  The Merchant Transaction Processing Fees and other charges must comply with applicable Rules and Legal Requirements.

Section 6.2         Changes in Merchant Transaction Processing Fees and Other Charges.  EVERTEC may amend the Merchant Transaction Processing Fees and monthly charges as often and in such amounts as it desires, except where such amendment is prohibited by the Rules (and except, for the avoidance of doubt, with respect to the Government-Merchant Agreements).

44

Section 6.3          EVERTEC Compensation.

(a)        All Merchant Transaction Processing Fees (and, subject to and to the extent provided in Section 6.3(b), an amount equal to those arising and payable to BPPR under the Government-Merchant Agreements) will accrue to the benefit of EVERTEC.  EVERTEC will collect the corresponding Merchant Transaction Processing Fees from Merchants through ACH debits to the applicable Merchant DDA on a daily or monthly basis, as appropriate pursuant to the Merchant Agreement for credit to the Operating Account.  Monthly settlements by ACH shall occur on the first day of each calendar month for all Transactions posted in the immediately preceding calendar month.  Merchant Transaction Processing Fees charged to Government-Merchants by BPPR shall be collected by BPPR in the manner agreed to with the corresponding Government-Merchants.

(b)         In full consideration for the support services to be provided by EVERTEC to BPPR hereunder with respect to the services provided by BPPR to the Government-Merchants, all revenue, fees and other payments payable to BPPR solely for Merchant Services provided by BPPR under the Government-Merchant Agreements (the “Government-Merchant Fees”) will accrue to the benefit of EVERTEC, and BPPR will deposit into the Operating Account an amount equal to the Government-Merchant Fees, when and as the Government-Merchant Fees are received by BPPR to be settled in accordance with Section 6.3(a).  During the term of each Government-Merchant Agreement, BPPR shall not, without the prior written consent of EVERTEC, change or otherwise modify the Government-Merchant Fee that BPPR is entitled to receive under such Government-Merchant Agreement as of the Effective Date.

Section 6.4          BPPR Compensation.

(a)         BPPR shall be entitled to the BPPR Sponsorship Fees no later than January 15 of each year (or such other date as may be agreed in writing by BPPR and EVERTEC).

(b)         Commencing on the first full month after the Effective Date, EVERTEC will pay BPPR, within twenty (20) Business Days after the end of any month, a monthly revenue sharing compensation fee (the “MAB Revenue Sharing”) calculated by multiplying the MAB Adjusted Revenue by the applicable percentage set forth on Schedule 6.4.

(c)         Commencing on the first full month after the Effective Date, EVERTEC will pay BPPR, within twenty (20) Business Days after the end of any month, a monthly revenue sharing compensation fee (the “P2B Revenue Sharing”) calculated by multiplying P2B Adjusted Revenue by the applicable percentage set forth on Schedule 6.4.

(d)        Illustrative calculations of MAB Adjusted Revenue and P2B Adjusted Revenue, in each case for the 12-month period ended on December 31, 2020 and for the 9-month period ended on September 30, 2021, are set forth in Exhibit E.

(e)        EVERTEC will not incentivize (whether economically or otherwise) commercial customers, including Merchants or potential Merchants, or EVERTEC’s Personnel to migrate any P2B transaction traffic to other financial institutions or other Channels (as defined in the ATH Network Agreement) in which BPPR does not have P2B Revenue Sharing (as defined in the ATH Network Agreement) or MAB Revenue Sharing or promote such other financial institutions or other Channels in a manner that is targeted to negatively impact BPPR’s P2B Revenue Sharing or MAB Revenue Sharing or designed to promote such alternatives to the detriment of BPPR.

45

Section 6.5          Information Rights and Validation Procedures.

(a)         No later than the twentieth (20th) day of each month, EVERTEC will provide BPPR with reasonably detailed reports containing the calculation of the MAB Adjusted Revenue and P2B Adjusted Revenue for the prior month.  In addition, BPPR may initiate an audit of (1) the MAB Revenue Sharing and P2B Revenue Sharing and (2) the MAB Adjusted Revenue and P2B Adjusted Revenue, no more than one time per calendar year, at BPPR’s cost, by an Approved Audit Firm chosen by BPPR and engaged jointly by EVERTEC and BPPR.

(b)         At BPPR’s reasonable request, EVERTEC will promptly, and in any event within thirty (30) days of EVERTEC’s receipt of such request, provide reasonable access to a Person knowledgeable of any reports delivered pursuant to Section 6.5(a), any material information referred to in, or relevant to the generation of, such reports, the calculation of the MAB Revenue Sharing and P2B Revenue Sharing and any decreases in the MAB Revenue Sharing and P2B Revenue Sharing from time to time, including the source of any data used to perform such calculations.

(c)        EVERTEC will maintain supporting documentation for the amounts billable to, and payments made by, BPPR hereunder in accordance with Industry Standards and applicable record retention requirements.

ARTICLE VII

REGISTRATION COMPLIANCE

Section 7.1          VISA/MCI/Discover Requirements.

(a)        Both parties hereto shall abide by the Rules at all times.  EVERTEC further agrees to provide each of its marketing Representatives with materials and information provided to EVERTEC by BPPR or any Association pertaining to the Rules.  EVERTEC shall, in a manner consistent with Industry Standards, ensure that all Representatives are familiar with, and will comply with, the Rules.  BPPR and EVERTEC agree that, in the event of any inconsistency between this Agreement and the Rules, the Rules will govern.

(b)          EVERTEC agrees to conduct the Merchant Program in a manner consistent with Industry Standards, and to refrain from engaging in conduct that creates a risk of injury to the Association or that may adversely affect the integrity of the Association.

(c)        EVERTEC will disclose all Merchant Transaction Processing Fees clearly and conspicuously to Merchants in writing in accordance with the Rules, prior to any payment or the execution of any Merchant Agreement by a potential Merchant.

(d)        The parties hereto will comply with all terms of the Merchant Agreements as are applicable to EVERTEC as an ISO and the provider of the Merchant Services for Merchants, on the one hand, and to BPPR, on the other hand, as the Acquiring Member.

46

(e)          Subject to Article V, upon request of BPPR for any purpose reasonably related to the provision of Merchant Services under this Agreement or the request of any Association or any Governmental Authority, EVERTEC will provide records containing Merchant information or Government-Merchant information, as applicable, to BPPR, any Association or any Governmental Authority, as soon as possible but no later than five (5) Business Days from EVERTEC’s receipt of a request for such information.

(f)        No action of, or filing with, any Governmental Authority is required by EVERTEC to consummate the transactions contemplated under this Agreement other than (i) as provided under the Asset Purchase Agreement or (ii) any such action or filing the failure of which to obtain or make would not, individually or in the aggregate, materially impair or delay the ability of EVERTEC to perform its obligations under this Agreement.

(g)        At any reasonable time, BPPR, any Association or banking regulatory agency may conduct, at such party’s expense, financial and procedural audits of EVERTEC as reasonably necessary to confirm compliance with this Agreement and the Rules; provided that BPPR may only conduct one (1) such audit in every twelve (12) month period except as required by applicable Legal Requirements or as requested by one of BPPR’s regulators or the Rules of an Association.  Except in circumstances where BPPR reasonably believes a financial loss or liability might otherwise occur, BPPR will give EVERTEC reasonable prior notice of any such audit by BPPR.  EVERTEC will promptly supply such auditors with information and access to relevant Personnel, systems, documents or physical premises requested by them but only as it relates to the Merchant Program.  EVERTEC will provide BPPR with a copy of any audits performed by any such third party or banking regulatory agency, but in the case of audits by regulatory agencies, only if, and to the extent, allowed by said banking regulatory agency.

ARTICLE VIII

REPRESENTATIONS AND WARRANTIES

Section 8.1          Representations and Warranties of EVERTEC.  EVERTEC hereby represents and warrants to BPPR that:

(a)         EVERTEC has been duly organized, is validly existing as a corporation in good standing under the laws of the Commonwealth of Puerto Rico and has all power and authority (corporate or other) necessary to conduct its business substantially in the manner in which such business is currently conducted.

(b)        EVERTEC has the power and authority to enter into, deliver and perform its obligations under this Agreement.  The execution, delivery and performance of this Agreement and the consummation by EVERTEC of the transactions contemplated hereby have been duly and validly approved by all requisite corporate action on the part of EVERTEC, and when executed and delivered by EVERTEC and BPPR, this Agreement will constitute a valid and binding obligation of EVERTEC enforceable in accordance with its terms.

47

(c)         The execution, delivery and performance by EVERTEC of this Agreement and the consummation of the transactions contemplated hereby by EVERTEC will not (i) conflict with or result in a breach or violation of any of the terms or provisions of, or constitute a default under, or result in the creation or imposition of any Encumbrance upon any property or assets of EVERTEC pursuant to any indenture, mortgage, deed of trust, loan agreement or other agreement or instrument to which EVERTEC is a party, by which EVERTEC is bound or to which any of EVERTEC’s property or assets is subject, (ii) result in any violation of the provisions of EVERTEC’s charter, by-laws or similar organizational documents or (iii) result in the violation of any law or statute or any judgment, order, rule or regulation of any Governmental Authority, other than as would not, individually or in the aggregate, materially impair or delay the ability of EVERTEC to perform its obligations under this Agreement.

(d)         EVERTEC owns all right, title and interest in and to any software or Intellectual Property used to provide the services hereunder or provided to BPPR or the Merchants as part of the services hereunder, or otherwise has the right to sell, rent, lease or license the same, including without limitation all copyrights, patents, trademarks, trade secrets and other proprietary rights therein or thereto.

(e)          EVERTEC’s services and obligations under this Agreement will be performed in accordance with Industry Standards and in full compliance with applicable Legal Requirements.

(f)        EVERTEC has maintained, and at all times during the term will, at its own expense, maintain all licenses, permits, approvals, certificates, or endorsements (jointly referred to in this clause as “licenses”) by any professional association or government agency that are required for it to provide the services or products to and/or for the benefit of BPPR and the Merchants.

(g)         EVERTEC is in compliance with the Office of Foreign Assets Control sanctions and regulations promulgated under the authority granted by the Trading with the Enemy Act, 12 U.S.C. § 95 (a) et seq., the International Emergency Economic Powers Act, 50 U.S.C. § 1701, et seq.; and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, as each may be amended from time to time and all rules and regulations promulgated thereunder applicable to EVERTEC, and EVERTEC is not: (a) listed in the Annex to, or otherwise subject to the provisions of, that certain Executive Order No. 13224 on Terrorist Financing, effective September 24, 2001, and relating to Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten to Commit or Support Terrorism; and/or (b) named as a “specifically designated national (SDN)” on the most current list published by the U.S. Treasury Department Office of Foreign Assets Control.  EVERTEC further represents that it will not act, directly or indirectly, in contravention of any anticorruption or anti-money laundering Legal Requirements.

(h)         EVERTEC represents that it is bound by and complies with its Code of Ethics available at https://s1.q4cdn.com/250184606/files/doc_downloads/governance_doc/2020/03/Code-of-Ethics-Annual-Review-2020.pdf.

(i)          Each of EVERTEC’s representations and warranties in this Section 8.1 and otherwise in this Agreement will be deemed provided on the Effective Date and will be continuous in nature throughout the term of this Agreement.

48

Section 8.2          Representations and Warranties of BPPR.  BPPR hereby represents and warrants to EVERTEC that:

(a)         BPPR has been duly organized, is validly existing as a commercial bank in good standing under the laws of the Commonwealth of Puerto Rico and has all power and authority (corporate or other) necessary to conduct its business substantially in the manner in which such business is currently conducted.

(b)         BPPR has the power and authority to enter into, deliver and perform its obligations under this Agreement.  BPPR is an Acquiring Member of the Associations.  The execution, delivery and performance of this Agreement and the consummation by BPPR of the transactions contemplated hereby have been duly and validly approved by all requisite regulatory and corporate action on the part of BPPR, and when executed and delivered by BPPR and EVERTEC, this Agreement will constitute valid and binding obligation of BPPR enforceable in accordance with its terms.

(c)         The execution, delivery and performance by BPPR of this Agreement and the consummation of the transactions contemplated hereby by BPPR will not (i) conflict with or result in a breach or violation of any of the terms or provisions of, or constitute a default under, or result in the creation or imposition of any Encumbrance upon any property or assets of BPPR pursuant to any indenture, mortgage, deed of trust, loan agreement or other agreement or instrument to which BPPR is a party, by which BPPR is bound or to which any of BPPR’s property or assets is subject, (ii) result in any violation of the provisions of BPPR’s charter, by-laws or similar organizational documents or (iii) result in the violation of any law or statute or any judgment, order, rule or regulation of any Governmental Authority, other than as would not, individually or in the aggregate, materially impair or delay the ability of BPPR to perform its obligations under this Agreement.

(d)       No action of, or filing with, any Governmental Authority is required by BPPR to consummate the transactions contemplated under this Agreement other than any such action or filing the failure of which to obtain or make would not, individually or in the aggregate, materially impair or delay the ability of BPPR to perform its obligations under this Agreement.

(e)         Exhibit A contains a true, complete and accurate list of all the Government-Merchant Agreements in effect on this date pursuant to which BPPR provides merchant and electronic payment services to the Government-Merchants.  Each Government-Merchant Agreement set forth in Exhibit A (i) is valid, binding, enforceable and in full force and effect and (ii) will continue to be valid, binding, enforceable and in full force and effect on identical terms following the execution and delivery of this Agreement.  Neither BPPR nor, to BPPR’s knowledge, any other party to a Government-Merchant Agreement is in breach or default and no event has occurred which with notice or lapse of time or both would constitute a breach or default by BPPR or, to BPPR’s knowledge, any Government-Merchant, or permit termination, modification or acceleration by BPPR or any Government-Merchant under any Government-Merchant Agreement.  BPPR has not received any notice that a Government-Merchant that is a party to any Government-Merchant Agreement intends to exercise any termination rights, or where applicable not renew, any such Government-Merchant Agreement.

49

(f)        BPPR represents, warrants and covenants that it is, and during the Initial Term and any Renewal Term of this Agreement it will remain, in compliance with the Payment Card Industry Data Security Standard developed by MCI and VISA, VISA’s Cardholder Information Security Program, Discover Information Security & Compliance Program and MasterCard Site Data Protection Program, as each may be amended from time to time, at its expense.

(g)        Each of BPPR’s representations and warranties in this Section 8.2 and otherwise in this Agreement will be deemed provided on the Effective Date and will be continuous in nature throughout the term of this Agreement.

ARTICLE IX

TERM, TERMINATION, DEFAULT, INSURANCE, INDEMNIFICATION

Section 9.1          Term and Contracts Split.

(a)       Term.  This Agreement will become effective on the Effective Date and, unless terminated earlier in accordance with the provisions of this Agreement, shall remain in effect until December 31, 2035 (“Initial Term”) and shall automatically renew for successive three (3)-year periods (each, a “Renewal Term”) unless either party provides the other with written notice of termination (the “Non-Renewal Notice”) at least one (1) year prior to the end of the Initial Term or any Renewal Term.

(b)         Contracts Split Upon Termination.

(i)         In the event that a party provides a Non-Renewal Notice or a termination notice to the other party, EVERTEC will, within thirty (30) days of its delivery or receipt, as applicable, of such notice, provide to BPPR the following materials (collectively the “Merchant Agreement Split Report”): (i) a list of Merchants, ordered based on Transaction Processing Fees over the last twelve (12) months (or such shorter period as may be available for such Merchant) in order of greatest share to smallest share, with Merchants under common Control to be deemed to constitute a single Merchant (the “Merchant by Transaction Processing List”); (ii) estimated allocation of MAB Adjusted Revenue across each Merchant, which estimated allocation will include a breakdown of each calculation component across each Merchant and (iii) the most recent analysis of Merchant profitability generated by EVERTEC in the ordinary course; provided, that, within thirty (30) days of receipt of such Merchant Agreement Split Report, BPPR may, at its expense, engage an independent firm selected from a list of five (5) nationally recognized audit firms in the United States provided by EVERTEC to conduct an audit with respect to the Merchant by Transaction Processing List, and the parties will work together in good faith in order to, as promptly as practicable, facilitate the conduct and completion of such audit and develop a modified Merchant by Transaction Processing List that resolves any discrepancies identified by such independent firm.  Following BPPR’s confirmation that the Merchant by Transaction Processing List provided by EVERTEC (subject to such adjustments, if any, as may result from the above-referenced audit process) is acceptable, the parties shall work together in good faith for 180 days to divide the Merchants between them in such a way that the Merchants allocated to BPPR will collectively represent, as nearly as mathematically possible, the BPPR Merchant Split Percentage of total MAB Adjusted Revenue with respect to the period to which the Merchant by Transaction Processing List relates (such Merchants allocated to BPPR, the “BPPR Post-Termination Merchants”; and all other Merchants, the “EVERTEC Post-Termination Merchants”).

50

(ii)        If the parties have not so divided the Merchants after the 180-day period referred to in the preceding paragraph (i) and do not mutually agree to further extend their negotiations, then the EVERTEC Post-Termination Merchants shall be the Merchants in either the odd-numbered positions or the even-numbered positions (determined at random) on the Merchant by Transaction Processing List, and the BPPR Post-Termination Merchants shall be all other Merchants; provided, however, that the final allocation of Merchants to BPPR will in any event collectively represent, as nearly as mathematically possible, the BPPR Merchant Split Percentage of the total MAB Adjusted Revenue for all Merchants, and Merchants will be re-allocated as between the parties to the extent necessary to achieve such outcome, beginning with the Merchant at the end of the Merchant by Transaction Processing List.

(iii)       The “BPPR Merchant Split Percentage” shall equal (x) 50%, in the event that a party delivers a Non-Renewal Notice or a termination notice to the other party, other than a termination notice based on the other party’s Material Breach or Event of Default; and (y) in the case of a termination notice based on either party’s Material Breach or Event of Default under Section 9.2(a) or Section 9.2(b), a percentage determined in accordance with the following table:

Period during which the Material Breach or Event of Default occurs	BPPR Merchant Split Percentage if BPPR is the breaching or defaulting party	BPPR Merchant Split Percentage if EVERTEC is the breaching or defaulting party
Prior to January 1, 2031	0%	0%
2031	0%	25%
2032	0%	25%
2033	25%	50%
2034	25%	50%
2035 or any year thereafter	50%	50%

(iv)        Each party acknowledges and agrees that the provisions in respect of the split of the Merchant Agreement contemplated by this Article IX are an essential part of this Agreement, and that such provisions are a specific and material inducement to such party to enter into this Agreement.

51

Section 9.2          Termination.

(a)        Termination of Extension.  After December 31, 2025, this Agreement may be terminated by either party if the other party commits a Material Breach (or series of breaches that together constitute a Material Breach of this Agreement) of any representation, warranty or covenant under this Agreement made by the other party, which breach is not cured within sixty (60) days following the breaching party’s receipt of written notice of such breach; provided, that if such breach is not reasonably susceptible to cure within such sixty (60) day period and the breaching party commences its cure of such breach within sixty (60) days of receiving notice thereof, then the breaching party shall have a period of up to one hundred eighty (180) days to cure such breach, but only for so long as the breaching party is diligently pursuing such cure and provides any evidence of its efforts and progress in connection with such cure as may be reasonably requested by the non-breaching party.  For the avoidance of doubt, any right to terminate this Agreement pursuant to this Section 9.2(a) shall be in addition to, and shall not be construed to limit, any party’s rights to terminate this Agreement under any other provision of this Section 9.2.

(b)         Termination Generally.  At any time, whether before or after December 31, 2025, if an Event of Default occurs, in addition to all other recourse and remedies available to the non-defaulting party and without limitation of a party’s right to terminate pursuant to Section 9.2(a) (if applicable), the non-defaulting party will have the right to terminate this Agreement in accordance with the provisions set forth in the applicable default section; provided, that if a party claims that an Event of Default described in clause (i) or (iii) of the definition thereof has occurred the following dispute mechanism shall apply (and the non-defaulting party will not have the right to terminate this Agreement while such dispute is pending as set forth below).  The party claiming that an Event of Default described in clause (i) or (iii) of the definition thereof has occurred shall deliver written notice to the other party (the “Alleged Breaching Party”) that includes a reasonable description of the circumstances giving rise to the alleged Event of Default (the “Default Notice”).  The Alleged Breaching Party may dispute such claim pursuant to Section 11.6(c).

(c)       This Agreement shall automatically terminate with respect to one or more Associations upon EVERTEC’s loss of its registration in such Association due to revocation or non-renewal of such registration by such Association after any cure period available to EVERTEC under the Rules has expired.

(d)         If (i) an Association prohibits EVERTEC from providing, or prohibits BPPR from allowing EVERTEC to provide, the services set forth in this Agreement or (ii) an Association notifies BPPR that its status as an Acquiring Member shall terminate, this Agreement will, after the expiration of any notice and/or cure period, terminate with respect to the applicable Association.  In addition, either party may terminate this Agreement immediately upon notice to the other party, in the event BPPR becomes subject to any change in Legal Requirements that would prohibit BPPR from continuing the business described in this Agreement.  Notwithstanding the foregoing, if any Association prohibits BPPR from allowing EVERTEC to provide the services set forth in this Agreement, (x) EVERTEC may, in its sole discretion, enter into any other sponsorship agreements with other financial institutions so as not be precluded from conducting the merchant services business and (y) BPPR may, in its sole discretion, enter into any other sponsorship agreements with other ISOs so as not to be precluded from conducting the merchant services business.  EVERTEC shall not be in violation of the provisions of Article IV (Exclusivity) by virtue of its entering into an agreement with another sponsor bank for the reasons set forth in this Section 9.2(d).  BPPR shall not be in violation of the provisions of Article IV (Exclusivity) by virtue of its entering into an agreement with another ISO for the reasons set forth in this Section 9.2(d).

52

(e)         Notwithstanding anything herein to the contrary, BPPR or EVERTEC, as applicable, may elect to terminate this Agreement upon any Material Breach by the other party of the provisions contained in Article IV (Exclusivity); provided, that any dispute that arises in connection with Article IV (Exclusivity), shall be resolved pursuant to the dispute resolution mechanism set forth in Section 9.2(b), but in such case the dispute shall be immediately addressed by each party’s representative in the Resolution Forum.

Section 9.3          Effect of Termination, Transition/Conversion of Merchants.

(a)       Expiration or the earlier termination of this Agreement for any reason shall not terminate either party’s obligations described in Article V (Confidentiality), Article IX (Term, Termination, Default, Insurance, Indemnification), Article X (Names and Trademarks) or Article XI (Miscellaneous), including (1) EVERTEC’s obligation to continue to provide the services until the termination date (or later in accordance with Section 9.3(c)) and, if so reasonably requested by BPPR and in accordance with the other terms of this Agreement, to promptly deliver to BPPR any deliverables that are in process or in final form as of the termination date, and (2) the obligation of either party to pay any due and undisputed amounts for services rendered hereunder that arise prior to or upon such expiration or termination, all of which survive the expiration or termination of this Agreement; provided, that BPPR understands and agrees that EVERTEC’s obligation to pay compensation to BPPR under Section 6.4 shall terminate on the termination of this Agreement.

(b)         EVERTEC Post-Termination Merchants. Upon the expiration or termination for any reason of this Agreement, BPPR shall transfer and assign the Merchant Agreements of the EVERTEC Post-Termination Merchants and all of its rights, title, interests, duties and obligations in the Merchant Program under this Agreement (including the related Merchant accounts and Merchant Reserve Account balances) related to such transferred Merchant Agreements to a VISA, MCI, Discover or ATH Network member designated by EVERTEC in EVERTEC’s written notice to BPPR and BPPR shall assist EVERTEC and such designated member in the conversion of the applicable Merchants to said member or designated processor.  The parties hereto understand and agree that EVERTEC is entitled to sole and complete ownership and portability of the EVERTEC Post-Termination Merchants as permitted by the Rules and has the sole and absolute right to have the applicable Merchant Agreement assigned, transferred and conveyed upon the expiration or termination of this Agreement as set forth herein.  EVERTEC shall pay all reasonable and documented costs actually incurred by BPPR in connection with such deconversion and/or assignment upon expiration or termination of this Agreement, except that no costs shall be paid in the event EVERTEC terminates this Agreement due to an Event of Default or Material Breach by BPPR.  Once the transition and deconversion is completed:

(i)          First, all amounts owed by EVERTEC to BPPR pursuant to the terms of this Agreement shall become due and payable; and

(ii)         Second, all amounts owed by BPPR to EVERTEC pursuant to the terms of this Agreement shall become due and payable.

53

(c)          BPPR Post-Termination Merchants.

(i)         Upon the expiration or termination for any reason of this Agreement, EVERTEC shall transfer and assign the Merchant Agreements of the BPPR Post-Termination Merchants (if any) and all of its rights, title, interests, duties and obligations in the Merchant Program under this Agreement related to such transferred Merchant Agreements to BPPR, or only to the extent that EVERTEC is unable to assign such Merchant Agreement due to an Encumbrance or assignment of rights contemplated by Section 9.3(b), work with the relevant Merchants and BPPR to enter into replacement Merchant Agreements with BPPR and not EVERTEC as counterparty having terms that are the same as those of the existing Merchant Agreements, but for the elimination of EVERTEC as a counterparty, other than such differences as BPPR may accept in its discretion.  The parties hereto understand and agree that BPPR is entitled to sole and complete ownership and portability of the BPPR Post-Termination Merchants as permitted by the Rules and has the sole and absolute right to have the applicable Merchant Agreement assigned, transferred and conveyed or replaced upon the expiration or termination of this Agreement as set forth herein.  BPPR shall pay all reasonable and documented costs actually incurred by EVERTEC in connection with such deconversion and/or assignment upon expiration or termination of this Agreement, except that no costs shall be paid in the event BPPR terminates this Agreement due to an Event of Default or Material Breach by EVERTEC.  Once the transition and deconversion is completed:

A. First, all amounts owed by BPPR to EVERTEC pursuant to the terms of this Agreement shall become due and payable; and

B. Second, all amounts owed by EVERTEC to BPPR pursuant to the terms of this Agreement shall become due and payable.

(ii)        In furtherance of the orderly transition to BPPR of all BPPR Post-Termination Merchants and the continued provision of services to such Merchants after the termination of this Agreement, EVERTEC shall reasonably assist BPPR in completing the transition as promptly as practicable and in a manner that minimizes disruption to the business of, and provision of services to, the BPPR Post-Termination Merchants.  EVERTEC shall, to the extent requested by BPPR, continue to provide transaction processing to BPPR Post-Termination Merchants and shall be entitled to the MAB Revenue Sharing as set forth on Schedule 6.4 until the date that is nine (9) months after the termination of this Agreement, subject to an extension of two (2) months if reasonably requested by BPPR in order to minimize disruption to the business of, and provision of services to, the BPPR Post-Termination Merchants, so long as BPPR continues to use commercially reasonable efforts to complete the transition of Merchants, but such transition has not been completed in all material respects.

Section 9.4          Insurance.

(a)         Coverage.  EVERTEC will maintain at a minimum, at all times during the term of this Agreement, adequate insurance coverage from reputable providers in amounts complying with Industry Standards for EVERTEC’s operations and the performance of its obligations under this Agreement, including cyber liability insurance.  All such insurance policies will be carried at EVERTEC’s own expense.  Any limitation of liability set forth in this Agreement shall not preclude BPPR from placing claims directly against the applicable insurance policies.

54

Section 9.5          Indemnification.

(a)         EVERTEC Indemnification.  EVERTEC will indemnify, defend and hold BPPR and its Affiliates and their respective present and future officers, directors, employees, agents, successors, assigns and shareholders (collectively with BPPR, “Popular Covered Persons”) harmless from and against any and all losses, charges, damages, liabilities, penalties, costs, fees, or expenses, including court costs and reasonable attorneys’ fees, related to or arising out of: (i) any Material Breach of any covenant, duty or obligation of EVERTEC or its Representatives under this Agreement, (ii) any Material Breach of any representation or warranty of EVERTEC under this Agreement, (iii) any Merchant Losses incurred by BPPR for any reason other than gross negligence, willful misconduct or fraud of BPPR, (iv) the violation by EVERTEC (or any of its Personnel) of any applicable Legal Requirements pertaining to EVERTEC’s rendering of services hereunder (including any violations pertaining to unfair, deceptive or abusive acts and practices) and/or (v) any infringement, misappropriation or violation of any Intellectual Property rights of any third party arising out of the receipt by BPPR or its Affiliates of the services provided by EVERTEC hereunder in accordance with this Agreement.

(b)        BPPR Indemnification.  BPPR will indemnify, defend and hold EVERTEC and its Affiliates and their respective present and future officers, directors, employees, agents, successors, assigns and shareholders (collectively with EVERTEC, “EVERTEC Covered Persons”) harmless from and against any and all losses, charges, damages, liabilities, penalties, increased taxes (excluding taxes based on BPPR’s net income), costs, fees, or expenses, including court costs and reasonable attorneys’ fees, related to or arising out of: (i) any Material Breach of any covenant, duty or obligation of BPPR or its Representatives under this Agreement, (ii) any Material Breach of any representation or warranty of BPPR under this Agreement, (iii) any breach of any of its obligations to any Merchant as set forth in this Agreement or in any Merchant Agreement, (iv) the violation by BPPR (or any of its Personnel) of any applicable Legal Requirements pertaining to BPPR’s rendering of services hereunder and/or (v) any infringement, misappropriation or violation of any Intellectual Property rights of any third party arising out of (x) the receipt by EVERTEC or its Affiliates of the services provided by BPPR hereunder or (y) EVERTEC’s use or display of Popular Trademarks, in each case in accordance with this Agreement (including Exhibit F).

(c)         Reimbursement of BPPR.  Except where a different treatment is expressly provided in this Agreement, EVERTEC hereby agrees to indemnify and reimburse BPPR for and against any and all costs, whether incurred prior to or after the expiration or earlier termination of this Agreement, of the following nature incurred by BPPR under the Merchant Program on and after the Effective Date: charges imposed on BPPR by third parties relating to processing Merchant Transactions, including (i) Interchange Fees, (ii) application fees, (iii) Merchant Chargeback fees, except to the extent such Merchant Chargeback arises as a result of the gross negligence, willful misconduct or fraud by BPPR, (iv) ACH reject fees, (v) ISO registration fees, (vi) Association fines, assessments and charges resulting from actions or omissions of EVERTEC, (vii) high-risk registration fees for Merchants and (viii) similar third-party charges related to the Merchant Program.  It is expressly understood and agreed that, except as otherwise provided herein, EVERTEC will not be liable for any of BPPR’s internal costs relating to the Merchant Program, including BPPR’s costs for labor and benefits, and BPPR’s ordinary business operating costs (e.g., rent, utilities, etc.).

55

(d)         Debiting of EVERTEC Accounts.  EVERTEC agrees that, in the event any Popular Covered Person incurs any expense, loss, damage, liability or other cost that BPPR in good faith believes is covered by EVERTEC’s obligations pursuant to this Section 9.5, BPPR may reimburse the applicable Popular Covered Person therefor by immediately debiting any or all of the EVERTEC Hold Account and the applicable Merchant Reserve Account balances, in such order as BPPR may in its sole judgment deem appropriate.  BPPR will promptly provide EVERTEC with documentation that substantiates such debits; provided, with respect to any exceptional debits (i.e., debits occurring outside the course of normal daily settlement items), BPPR will notify EVERTEC within one Business Day.  Any amounts thereof disputed by EVERTEC or with respect to which BPPR (or the applicable Popular Covered Person) has not yet sustained an actual loss shall be placed in escrow, in a money market account at BPPR, pending resolution of such dispute.  BPPR will pay EVERTEC from the escrow account, any amounts finally resolved as not to be owed to BPPR (or the applicable Popular Covered Person) hereunder.  After BPPR (or the applicable Popular Covered Person) has been fully reimbursed for a Merchant Loss pursuant to Section 9.4(a), at the request of EVERTEC, BPPR will assign to EVERTEC any and all of BPPR’s subrogation rights under or related to the Merchant Agreement (including any guarantees, security or otherwise) related to the indebtedness of such Merchant.

(e)          Limitations on Liability.  Except in the case of gross negligence, willful misconduct or fraud by a party, for which there shall be no limitation on liability, neither party will be liable to the other party or any of its Affiliates pursuant to this Agreement for any indirect, incidental, special, consequential, remote, speculative or punitive damages or losses.  In no event shall BPPR or any Popular Covered Persons be liable to EVERTEC, or EVERTEC or any EVERTEC Covered Persons be liable to BPPR, including for any indemnification hereunder, for any damages for loss of profits, revenue, business, royalties, savings, whether in an action in contract or tort, regardless of whether such damages are foreseeable or whether such party has been advised of the possibility of any such loss or damage.  Nothing in this Agreement shall exclude or limit any party’s liability: (i) to the extent that such limitation or exclusion is not permitted by applicable Legal Requirements; (ii) for death or personal injury caused by such party’s negligence, or (iii) for losses related to breaches of Confidential Information obligations under Article V of this Agreement.  Each party agrees that (1) amounts paid in connection with the defense of third party claims, (2) amounts payable to a third party pursuant to court order or a settlement entered into in accordance with the provisions of this Agreement; and (3) fines or penalties paid to a Governmental Authority, in each case, in connection with indemnification obligations with respect to third party claims under Sections 9.5(a) and (b) are deemed to be direct damages and are not subject to the exclusions set forth in this Section 9.5(e).

56

(f)        Notwithstanding Section 9.5(e), EVERTEC’s liability for BPPR Data Breach Costs under Section 9.5(e)(iii) shall be subject to an aggregate annual limit equal to the greater of (i) $10,000,000 and (ii) 10% of the sum of the MAB Adjusted Revenue plus the P2B Adjusted Revenue in the twelve (12) months prior to the date of the Incident that gives rise to the BPPR Data Breach Costs occurs (the “BPPR Data Breach Cap”).  In addition to the foregoing, for so long as the MSA is in effect, for losses related to (x) breaches of confidentiality, privacy and data protection obligations under the MSA and the ATH Network Agreement and (y) BPPR Data Breach Costs, each party’s limit of liability will be an aggregate annual limit equal to the Data Cap (as defined in the MSA).  For purposes hereof, “BPPR Data Breach Costs” means losses and other liability that arises from or in connection with the theft, loss, or unauthorized access or disclosure of BPPR Data under this Agreement; provided, EVERTEC’s liability for the following remains unlimited and does not count toward the BPPR Data Breach Cap: (1) Merchant Losses; (2) reimbursement obligations under Section 9.5(c); (3) any claims, indemnification obligations, or other liability relating to an Incident involving NPPI obtained by or on behalf of EVERTEC from Merchants, Transaction data, or Cardholder information; and (4) any claims, indemnification obligations or other liability to or from Card Associations or Card issuers.

ARTICLE X

NAMES AND TRADEMARKS

Section 10.1        BPPR Name.

(a)        Except as set forth in this Section 10.1 or Exhibit F, neither EVERTEC nor any of its Representatives may use or display any Trademarks, including the Trademarks listed on Exhibit F, that are owned and used in commerce by BPPR or any of its Affiliates or Subsidiaries (including POPULAR, BANCO POPULAR, and POPULAR MERCHANT) (collectively, the “Popular Trademarks”), or any marks confusingly similar thereto, in any manner, including in any correspondence, promotional, marketing, solicitation or other materials, or promote BPPR’s services or products in any way without BPPR’s prior written consent.  EVERTEC will obtain BPPR’s written consent before EVERTEC or any third party, at EVERTEC’s direction or in its control or with its consent, produces or distributes any materials relating or referring to the Merchant Program or any other program that uses or displays any Popular Trademarks.  All approved correspondence, materials and/or oral solicitations directed by EVERTEC or its marketing Representatives to potential Merchants, or produced by any third party, concerning BPPR’s services or products must prominently identify BPPR by its name (i.e., BANCO POPULAR DE PUERTO RICO) and strictly adhere to all other guidelines set forth on Exhibit F by BPPR (including Schedule 1 to Exhibit F).  Exhibit F may be amended or updated from time to time by BPPR, and shall be binding sixty (60) Business Days after written notice thereof is provided by BPPR to EVERTEC.

(b)        EVERTEC shall comply, and require its Representatives to comply, with the directions of BPPR regarding the form and manner of the use or display of any Popular Trademark, including the directions and other terms and conditions included in the Trademark licensing terms, attached hereto as Exhibit F. Exhibit F and the attached Popular Merchant Brand Guide (attached as Schedule 1 to Exhibit F) may be amended or updated from time to time by BPPR, and shall be binding thirty (30) Business Days after written notice thereof is provided by BPPR to EVERTEC.

Section 10.2        Association and Card Trademarks.  EVERTEC acknowledges that the Associations are the sole owners of their respective Trademarks.  EVERTEC will not contest the ownership of such marks, and any Association may at any time and immediately without advance notice prohibit EVERTEC from using its marks for any reason.  Subject to each Association’s Rules and any agreement between EVERTEC and such Association, EVERTEC will have no right or authority under this Agreement to use or to permit use of the Trademarks owned by any Association by any of its own Representatives.  Solicitation material used by EVERTEC must clearly disclose that any transaction processing agreement will be between the Merchant (or potential Merchant) and BPPR.

57

ARTICLE XI

MISCELLANEOUS

Section 11.1        Assignment.

(a)          Assignment.  Other than as permitted pursuant to this Section 11.1, this Agreement may not be assigned by either party without the prior written consent of the other party; provided, that either party may assign its rights, duties and obligations under this Agreement to its financing sources solely in connection with the granting of a security interest and the enforcement of all rights and remedies that the assigning party has against the other party under this Agreement, subject to the claims, defenses and rights, including rights of set off, that such other party may have against the assigning party.

(b)        Assignment to Subsidiaries.  EVERTEC may assign any of its rights, duties or obligations to a direct or indirect wholly owned Subsidiary of EVERTEC (an “Assignee Sub”) if (i) such Assignee Sub is identified by EVERTEC to BPPR at least twenty (20) Business Days prior to the consummation of the proposed assignment; (ii) (A) such proposed assignment is legally required in order for EVERTEC to perform its obligations under this Agreement, in the country, state, territory or other jurisdiction in which the Assignee Sub is organized, the specific obligations required to be performed pursuant to the assignment of this Agreement, and only (x) to the extent of such legal requirement and (y) if EVERTEC provides a written opinion of qualified counsel that opines that such legal requirement is applicable and is based upon reasonable assumptions with respect to such legal requirement or (B) BPPR has provided its prior written consent, such consent not to be unreasonably delayed, withheld or conditioned; (iii) such Assignee Sub will be Solvent immediately after and giving effect to such proposed assignment and BPPR is reasonably satisfied with the terms and conditions of the proposed assignment; (iv) BPPR is a third-party beneficiary to the assignment agreement, which is in form and substance that is reasonably satisfactory to BPPR, and which provides that the Assignee Sub’s rights under the assignment agreement will be terminated if the Assignee Sub ceases to be a wholly owned Subsidiary, directly or indirectly, of EVERTEC; and (v) EVERTEC remains fully liable with respect to the performance of all its obligations under this Agreement and EVERTEC guarantees the performance of all of the obligations of EVERTEC to BPPR assumed by Assignee Sub under this Agreement, which guarantee provides that, for the avoidance of doubt, after any termination of the proposed assignment, EVERTEC shall continue to be obligated with respect to any obligation undertaken by Assignee Sub prior to such termination.

58

(c)         Assignment to Third Parties.  EVERTEC may assign all of its rights, duties and obligations (or those rights, duties and obligations arising after the effectiveness of the assignment) in a transaction with a third-party assignee (an “Asset Acquirer”) if (i) such Asset Acquirer is identified by EVERTEC to BPPR at least thirty (30) Business Days prior to the consummation of the proposed assignment; (ii) such Asset Acquirer (A) acquires at least 90% of the consolidated gross assets (excluding cash) of EVERTEC and its Subsidiaries and (B) assumes at least 90% of the consolidated gross liabilities (excluding Indebtedness) of EVERTEC and its Subsidiaries (including the assignment and assumption of all commercial agreements between EVERTEC or any of its Subsidiaries, on the one hand, and Popular, BPPR or any of their respective Subsidiaries, on the other hand) through one legal entity; (iii) neither the Asset Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from the Commonwealth of Puerto Rico in excess of $50 million unless none of them has a physical presence in the Commonwealth of Puerto Rico that is used to conduct any such business; (iv) the Asset Acquirer will be Solvent immediately after and giving effect to such proposed assignment; and (v) EVERTEC reasonably believes that the Asset Acquirer, after completion of the proposed purchase and assumption transaction, will be capable of performing the obligations and duties of EVERTEC under this Agreement.

(d)       Cooperation.  EVERTEC shall use its Best Efforts to cooperate with BPPR in evaluating whether any proposed assignment pursuant to this Section 11.1 would be in compliance with the requirements of the provisions contained in this Section 11.1, including the ability of Assignee Sub or Asset Acquirer, as applicable, to comply with the terms of this Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed assignment other than information that would create any potential liability under applicable Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(e)         Notice of Objection.  BPPR shall notify EVERTEC in writing within fifteen (15) Business Days following receipt of EVERTEC’s notice of the proposed assignment of any objection to any proposed assignment to an Assignee Sub or Asset Acquirer unless EVERTEC has failed to satisfy its obligations pursuant to Section 11.1(d) and BPPR asserts such failure prior to the expiration of the fifteen (15) Business Day objection period, in which case such fifteen (15) Business Day period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 11.1(d).  If BPPR fails to timely object to such proposed assignment (taking into account any tolling of the fifteen (15) Business Day objection period), it shall be deemed to have consented to such proposed assignment.

(f)         Invalidity of Impermissible Assignments.  Any attempted or purported assignment in violation of this Section 11.1 hereof shall be null and void and the assignee’s rights assigned pursuant to any assignment made in compliance with this Section 11.1 will terminate in the event and to the extent of the termination of this Agreement.

(g)         BPPR Asset Transfer.  If BPPR or any of its Subsidiaries transfers, in a single transaction or series of related transactions (including in a merger, business combination, reorganization, or similar transaction (including by operation of law)) 50% or more of BPPR’s consolidated assets in the Region as of the time of transfer, or assets that generate 50% or more of BPPR’s consolidated revenues in the Region for the full twelve (12)-month period ending at the time of transfer, to any Person, then BPPR shall assign (or cause its applicable Subsidiaries to assign) to such Person its rights, duties and obligations under this Agreement and shall cause such Person to assume its liabilities under this Agreement.  For the avoidance of doubt, no such assignment shall relieve BPPR or any of its Subsidiaries of their obligations under this Agreement to the extent BPPR or any of its Subsidiaries survive any such sale of assets, merger, business combination, reorganization, or similar transaction.

59

Section 11.2        Force Majeure.

(a)         Subject to Section 11.2(b), below, neither party will be liable under this Agreement as a result of any delay or failure in the performance of its obligations (except for payment of money) to the extent such performance is prevented, frustrated, hindered or delayed as a result of an extraordinary event that is beyond the party’s reasonable control, including strikes, shortages, riots, fires, floods, storms, hurricanes, epidemics, pandemics, earthquake, acts of God, hostilities or other similar events or disasters, and actions taken by Governmental Authorities in response thereto (including any quarantine, ‘shelter in place,’ ‘stay at home,’ shut down, closure, sequester or similar Legal Requirement); provided, that the non-performing party is without material fault in causing such delay or failure (a “Force Majeure Event”).

(b)        This Section 11.2 exclusion of liability will only apply if, and to the extent, the party experiencing the Force Majeure Event exercises Best Efforts to mitigate and minimize the impact of the event on its obligations and follows its Business Continuity Plan, if applicable.  The non-performing party will be excused from performance of the obligations so affected for as long as such circumstances prevail, and the non-performing party continues to use Best Efforts to recommence performance.

(c)       In the event of an occurrence of a Force Majeure Event, the affected party shall give notice of suspension to the other party’s designated authorized representative as soon as reasonably practicable after the activation of the Business Continuity Plan or of becoming aware of such Force Majeure Event, stating the date and extent of such suspension and the cause thereof, and the affected party shall resume the performance of such obligations as soon as reasonably practicable after the removal of such cause.

Section 11.3       Notices All notices, requests, demands, consents and other communications given or required to be given under this Agreement and under the related documents will be in writing and may be given in any manner described below to the address or number set out below, and shall be deemed effective as follows: (a) if delivered personally to the Person designated below, (b) when the same is actually received, if sent by express overnight courier service, with charges prepaid and return receipt requested, or (c) if sent by email, if notice of nondelivery is not received, (i) at or prior to 5:00 pm local time of the recipient on a Business Day, on that Business Day or (ii) later than 5:00 pm local time of the recipient, on the next succeeding Business Day; provided notices of default, non-renewal or termination must be delivered personally or by courier as provided in Sections 11.3(a) or (b); provided further that all such notices, requests, demands, consents and other communications shall be accompanied by an email notification.

To EVERTEC:

Evertec, Inc.

Cupey Center Building, Road 176, Kilometer 1.3

San Juan, Puerto Rico 00926

Facsimile:  787-766-4585

Email:  luis.rodriguez@evertecinc.com

Attention:  Luis A. Rodríguez, General Counsel and Executive Vice President of Corporate Development

60

To BPPR:

Popular, Inc.

PO Box 362708

San Juan, Puerto Rico 00936-2708

Email:  legaldivision@popular.com

Attention:  Jose R Coleman Tio, Executive Vice President and Chief Legal Officer

Any party hereto may change its address or contact details from time to time by giving notice to that effect as provided in this Agreement.

Section 11.4      Amendment; Waiver.  Any provision of this Agreement may be amended or waived if, and only if, such amendment or waiver is in writing and signed, in the case of an amendment, by each party, or in the case of a waiver, by the party or parties against whom the waiver is to be effective.  No failure or delay by any party in exercising any right, power or privilege hereunder shall operate as a waiver thereof nor shall any single or partial exercise preclude any other or further exercise thereof or the exercise of any other right, power or privilege.

Section 11.5       Entire Agreement.  This Agreement, including any Schedules, Addenda, Exhibits and Riders hereto, contains the entire understanding among the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings, oral or written, with respect to such matters.

Section 11.6        Governing Law; Dispute Resolution; Waiver of Trial by Jury.

(a)         This Agreement will be governed by and interpreted in accordance with the laws of the Commonwealth of Puerto Rico applicable to contracts made and entirely to be performed therein, without regard to the place of performance hereunder.

(b)         The parties hereby mutually agree that no party, nor any permitted assignee, successor, heir or Representative thereof, will seek a jury trial in any lawsuit, proceeding, counterclaim, or any other litigation procedure based upon or arising out of this Agreement, or any related agreement or instrument among the parties. None of the parties will seek to consolidate any such action, in which a jury trial has been waived, with any other action in which a jury trial has not been waived. The provisions of this Section 11.6(b) have been fully negotiated by the parties. The waiver contained herein is irrevocable, constitutes a knowing and voluntary waiver, and will be subject to no exceptions.

61

(c)         Any dispute, controversy or claim between EVERTEC, on the one hand, and BPPR or its Subsidiaries, on the other, or against any Representative of one of the parties, related to this Agreement, and any dispute or claim related to the relationship or duties contemplated hereunder, including the validity of this Section 11.6(c) (a “Dispute”) will be resolved in accordance with this Section 11.6(c). Each party will give written notice (a “Notice of Dispute”) to the others of any Dispute claimed by it within thirty (30) days of learning of the cause of such a Dispute. The Notice of Dispute will include a reasonable description of the basis of the Dispute, including, (i) the specific charge or charges being disputed, (ii) if available and/or applicable, the supporting documentation that is reasonably required for verification of the charge or charges, and (iii) any amounts being withheld. Following delivery of a Notice of Dispute, a Representative of each party will meet and will attempt in good faith to resolve the Dispute. Any Dispute that remains unresolved for more than twenty (20) days after the receipt of a Notice of Dispute shall be referred to designated representatives of the parties hereto who shall negotiate in good faith to resolve such dispute (the “Resolution Forum”). If a Dispute is not resolved in the Resolution Forum, the Dispute shall be submitted to the consideration of a representative from the senior management of EVERTEC who shall be identified in a written notice delivered to BPPR from time to time, and the Chief Operating Officer, the Chief Financial Officer or the Chief Information Officer of BPPR. Any Disputes that may remain unresolved for more than ninety (90) days following the receipt of a Notice of Dispute may be referred to binding arbitration at the request of any party upon written notice to the other. Such arbitration proceeding will be administered by the American Arbitration Association in accordance with the then-current Commercial Arbitration Rules and will be aired in the Commonwealth of Puerto Rico. The arbitration will be governed by the United States Arbitration Act, 9 U.S.C. §§ 1-16 to the exclusion of any provision of state law inconsistent therewith or which would produce a different result. A panel of three neutral arbitrators will determine the Dispute of the parties and render a final award in accordance with the applicable substantive law. Each of EVERTEC and BPPR shall select one neutral arbitrator and, unless those parties agree on a third neutral arbitrator, such two arbitrators shall select the third arbitrator (subject to such limitations, if any, mutually agreed by those parties). Strict confidentiality will govern the arbitration proceedings, including all information submitted to the arbitrators and the decision or award entered by the arbitrators. Any court having jurisdiction may enter judgment upon the award rendered by the arbitrators. The terms hereof will not limit any obligation of a party to defend, indemnify or hold harmless another party against court proceedings or other Losses. The procedures specified in this Section 11.6(c) will be the sole and exclusive procedures for the resolution of Disputes among the parties arising out of or relating to this Agreement; provided, however, that a party may request temporary remedies in a court of law to maintain the status quo or to protect goods or property until the arbitration has initiated and the selected arbitrators have had the opportunity to resolve the request for temporary relief. Each party is required to continue to perform its obligations under this Agreement pending final resolution of any Dispute arising out of or relating to this Agreement, unless to do so would be impossible or impracticable under the circumstances.

Section 11.7        Counterparts.  This Agreement may be executed in counterparts, each of which when so executed shall be deemed to be an original and all of which when taken together shall constitute one and the same instrument. Any signature to this Agreement may be delivered by facsimile, electronic mail (including pdf) or any electronic signature complying with the U.S. federal ESIGN Act of 2000 or the New York Electronic Signature and Records Act or other transmission method and any counterpart so delivered shall be deemed to have been duly and validly delivered and be valid and effective for all purposes to the fullest extent permitted by applicable Legal Requirements. For the avoidance of doubt, the foregoing also applies to any amendment, extension or renewal of this Agreement and any Addenda, Schedule or other document to be executed by the parties pursuant hereto or thereto.

Section 11.8        Construction.  The heading references herein are inserted for purposes of convenience of reference only and shall not limit or define the meaning of any provisions of this Agreement.  The language used will be deemed to be the language chosen by the parties to express their mutual intent, and no rule of strict construction will be applied against any party.

62

Section 11.9       Severability.  The provisions of this Agreement shall be deemed severable and the invalidity or unenforceability of any provision shall not affect the validity or enforceability of the other provisions hereof.  If any provision of this Agreement, or the application thereof to any person or any circumstance, is invalid or unenforceable, as held by a court of competent jurisdiction, (i) a suitable and equitable provision shall be substituted therefor in order to carry out, so far as may be valid and enforceable, the intent and purpose of such invalid or unenforceable provision and (ii) the remainder of this Agreement and the application of such provision to other persons or circumstances shall not be affected by such invalidity or unenforceability, nor shall such invalidity or unenforceability affect the validity or enforceability of such provision, or the application thereof, in any other jurisdiction.  Upon a determination that any term or other provision is invalid, illegal, or unenforceable, the parties hereto shall negotiate in good faith to modify this Agreement so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that this Agreement be consummated as originally contemplated to the greatest extent possible.

Section 11.10     Independent Contractors.  EVERTEC shall be an independent contractor of BPPR, and nothing contained herein shall be construed to imply the existence of a partnership, affiliation, joint venture, express or implied agency relationship or other form of business association between EVERTEC and BPPR, nor to make EVERTEC an agent of BPPR or BPPR an agent of EVERTEC.  EVERTEC shall not, under any circumstances or conditions, or for any purpose or reason whatsoever, claim to be or imply that EVERTEC or any of its employees are agents, officers, directors or employees of BPPR.  Neither party hereby shall have, nor represent itself as having, any right, power or authority to act on behalf of or create any obligations, express or implied, on behalf of or binding on the other party.

Section 11.11    Effect on Prior ISO Agreement.  This Agreement amends and restates the Prior ISO Agreement, and upon the Effective Date, the provisions of this Agreement shall supersede the provisions of the Prior ISO Agreement, which shall no longer be in effect, other than any accrued ordinary course obligations that are outstanding as of the Effective Date.

Section 11.12   Release of Existing Claims. Each party hereto, on behalf of itself, its Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Releasing Parties”), hereby generally, completely and irrevocably releases and discharges each other party hereto and all of such other party’s Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Released Parties”), of and from any and all claims, demands, debts, liabilities, contracts, obligations, accounts, suits, torts, causes of action, Disputes, or claims for relief of whatever kind or nature (other than third party claims) solely to the extent arising out of facts, circumstances or occurrences which were known or reasonably should have been known to the Releasing Parties, both at law and equity, which the Releasing Parties ever had, now has, or may have (including attorneys’ fees and costs incurred) relating to, resulting from or arising out of the Released Parties’ breach of any representations, warranties or covenants under the Prior ISO Agreement; provided, that, this Section 11.12 shall not apply with respect to (i) any rights that cannot be waived under applicable Legal Requirements, (ii) the continuation on or after the Effective Date of any act or omission that commenced prior to the Effective Date, to the extent that such continuation of such act or omission following the Effective Date constitutes a breach of any representations, warranties or covenants under this Agreement, or (iii) any act or omission that commenced following the Effective Date which results in a breach of any representations, warranties or covenants under this Agreement.  The Releasing Parties represent and warrant that they are respectively the sole and lawful owners of, and have not assigned or transferred to any third party, all rights, title and interest in and to all released matters referred to in this Section 11.12.

63

Section 11.13      EVERTEC Change of Control.

(a)        EVERTEC Change of Control.  BPPR shall have the right, subject to Section 11.13(c), to terminate this Agreement up to thirty (30) days following the later of (i) the occurrence of an EVERTEC Change of Control or (ii) the date on which EVERTEC provides BPPR written notice that an EVERTEC Change of Control has occurred or is likely to occur (provided, that if EVERTEC has not satisfied its obligations pursuant to Section 11.13(b) and that BPPR asserts such failure prior to the expiration of the thirty (30)-day period then such thirty (30)-day period shall be tolled until EVERTEC satisfies its obligations under Section 11.13(b) and provided, further, that if an EVERTEC Change of Control occurs, and EVERTEC fails to provide BPPR written notice thereof within thirty (30) days thereof, then BPPR shall have an unqualified right to terminate this Agreement), unless (w) the Person or Group of Persons proposing to engage in such proposed EVERTEC Change of Control transaction (the “Control Acquirer”) is identified to BPPR by EVERTEC at least thirty (30) Business Days prior to such proposed EVERTEC Change of Control; (x) neither the Control Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from the Commonwealth of Puerto Rico in excess of $50 million unless none of them has a physical presence in the Commonwealth of Puerto Rico that is used to conduct any such business; (y) EVERTEC (or its successor, as applicable) will be Solvent immediately after and giving effect to such proposed EVERTEC Change of Control; and (z) EVERTEC (or its successor, as applicable), after the proposed EVERTEC Change of Control, will be capable of performing all of the obligations and duties of EVERTEC under this Agreement.

(b)        Cooperation.  EVERTEC shall use its Best Efforts to cooperate with BPPR in evaluating whether any proposed EVERTEC Change of Control would be in compliance with the requirements of this Section 11.13 including the ability of Assignee Sub or Asset Acquirer, as applicable, to comply with the terms of this Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed EVERTEC Change of Control other than information that would create any potential liability under applicable Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(c)        Notice of Objection.  If EVERTEC provides at least thirty (30) days’ written notice to BPPR prior to an EVERTEC Change of Control, BPPR shall notify EVERTEC in writing within fifteen (15) Business Days following receipt of EVERTEC’s notice of the proposed EVERTEC Change of Control of any objection to any proposed EVERTEC Change of Control on the basis that it does not satisfy the criteria set forth in clauses (w) through (z) of Section 11.13(a) (unless EVERTEC has failed to satisfy its obligations pursuant to Section 11.13(b) and BPPR asserts such failure prior to the expiration of the fifteen (15) Business Day objection period, in which case such fifteen (15) Business Day objection period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 11.13(b)).  If BPPR fails to timely object to such proposed EVERTEC Change of Control (taking into account any tolling of the fifteen (15) Business Day objection period), it shall be deemed to have consented to such proposed EVERTEC Change of Control and waived its right of termination under Section 11.13(a).

64

Section 11.14      Specific Performance.  The parties agree that if an act or omission of BPPR, on the one hand, or EVERTEC, on the other hand, results in a breach of Section 2.4 (Merchant Acquiring Improvement Team), Section 2.5(a) (Merchant Agreements), Section 3.2 (Merchant Referral and Assistance), Section 6.5 (Information Rights and Validation Procedures), Section 11.1 (Assignment), Article IV (Exclusivity), Article V (Confidentiality), Section 7.1(g), Section 9.1(b) (Contracts Split Upon Termination) or Article X (Names and Trademarks), BPPR or EVERTEC, as applicable, will be irreparably damaged, no adequate remedy at law would exist and damages would be difficult to determine, and that BPPR or EVERTEC, as applicable, shall be entitled to an injunction or injunctions to prevent such breach, and to specific performance of the terms of Section 11.1(g) in addition to any other remedy at law or equity, without having to post bond or any financial undertaking.

(Signatures begin on the following page)

65

IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of the Effective Date.

BANCO POPULAR DE PUERTO RICO
By:	/s/ Félix Fernandez
	Name: Félix Fernández
	Title: Authorized Officer

[Signature Page to Second Amended and Restated ISO Agreement]

EVERTEC GROUP, LLC
By:	/s/ Luis A. Rodriguez
	Name: Luis A. Rodriguez
	Title: Executive Vice President, Chief Legal and Corporate Development Officer

[Signature Page to Second Amended and Restated ISO Agreement]

EX-99.1

Exhibit 99.1

EVERTEC CLOSES POPULAR TRANSACTION AND BBR ACQUISITION

SAN JUAN, PUERTO RICO - July 1, 2022 -EVERTEC, Inc. (NYSE: EVTC) (“Evertec” or the “Company”) today announced that the Company has closed the previously announced Popular Transaction and the BBR, SpA ("BBR") acquisition.

As part of the Popular Transaction, the Company modified and extended the main commercial agreements with Banco Popular of Puerto Rico (“BPPR”) and its parent, Popular, Inc. (NASDAQ: BPOP) (“Popular”). As previously disclosed, the new agreement includes a 10-year extension of the Merchant Acquiring Independent Sales Organization Agreement (the “ISO Agreement”), a 5-year extension of the ATH Network Participation Agreement and a 3-year extension of the Master Services Agreement ("MSA"). The ISO Agreement, which sets the terms of the merchant acquiring relationship with Popular, will now include a revenue sharing provision with Popular. Modifications to the MSA include the elimination of the exclusivity requirement, the inclusion of annual MSA minimums through 2028, a 10% discount on certain MSA services beginning in October 2025, and adjustments to the previous CPI pricing escalator clause. The agreement also calls for the sale to Popular of certain assets in exchange for approximately 4.6 million shares of Popular owned Evertec stock. In addition, subsequent to the closing of the Popular transaction, Popular has agreed to take certain actions to ensure that Evertec is no longer deemed a “subsidiary” of Popular for purposes of the Bank Holding Company Act, including reducing Popular's voting interest in Evertec to 4.5% over the next three months through either the sale of shares or conversion to non-voting preferred shares.

Goldman Sachs & Co. LLC served as lead financial advisor to Evertec. Evercore also served as financial advisor to Evertec.

The Company has also completed the acquisition of 100% of the outstanding shares of BBR for an aggregate purchase price of CLP 48,600 million, approximately USD$53 million. Based in Santiago, Chile, BBR is a payment solutions and business technology company with operations in Chile and Peru.

Mac Schuessler, President and Chief Executive Officer stated, “We are pleased to complete both of these transactions. The Popular Transaction extends our relationship with our largest customer while the BBR acquisition continues to expand our footprint in Latin America, two important steps in continuing to execute on our long-term growth strategy."

About Evertec

EVERTEC, Inc. (NYSE: EVTC) is a leading full-service transaction processing business in Puerto Rico, the Caribbean and Latin America, providing a broad range of merchant acquiring, payment services and business process management services. Evertec owns and operates the ATH® network, one of the leading personal identification number (“PIN”) debit networks in Latin America. In addition, the Company manages a system of electronic payment networks and offers a comprehensive suite of services for core banking, cash processing and fulfillment in Puerto Rico, that process over three billion transactions annually. The Company also offers technology outsourcing in all the regions it serves. Based in Puerto Rico, the Company operates in 26 Latin American countries and serves a diversified customer base of leading financial institutions, merchants, corporations and government agencies with “mission-critical” technology solutions. For more information, visit www.evertecinc.com.

Forward Looking Statements

Certain statements in this press release constitute “forward-looking statements” within the meaning of, and subject to the protection of, the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve known and unknown risks, uncertainties, and other factors that may cause the actual results, performance or achievements of EVERTEC to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. Statements preceded by, followed by, or that otherwise include the words “believes,” “expects,” “anticipates,” “intends,” “projects,” “estimates,” and “plans” and similar expressions of future or conditional verbs such as “will,” “should,” “would,” “may,” and “could” are generally forward-looking in nature and not historical facts. Any statements that refer to expectations or other characterizations of future events, circumstances or results are forward-looking statements.

Various factors that could cause actual future results and other future events to differ materially from those estimated by management include, but are not limited to: the Company’s reliance on its relationship with Popular, Inc. (“Popular”) for a significant portion of its revenues pursuant to the Company’s Master Services Agreement ("MSA") with them, and to grow the Company’s merchant acquiring business; as a regulated institution, the likelihood that the Company will be required to obtain regulatory approval before engaging in certain new activities or businesses, whether organically or by acquisition, and its potential inability to obtain such approval on a timely basis or at all, which may make transactions more expensive or impossible to complete, or make us less attractive to potential sellers; the Company’s ability to renew its client contracts on terms favorable to the Company, including the contract with Popular, and any significant concessions the Company may grant to Popular with respect to pricing or other key terms arising out of any disputes or in anticipation of the negotiation of the extension of the MSA, both in respect of the current term and any extension of the MSA; the Company’s dependence on its processing systems, technology infrastructure, security systems and fraudulent payment detection systems, as well as on the Company’s personnel and certain third parties with whom it does business, and the risks to the Company’s business if its systems are hacked or otherwise compromised; the Company’s ability to develop, install and adopt new software, technology and computing systems; a decreased client base due to consolidations and failures in the financial services industry; the credit risk of the Company’s merchant clients, for which it may also be liable; the continuing market position of the ATH network; a reduction in consumer confidence, whether as a result of a global economic downturn or otherwise, which leads to a decrease in consumer spending; the Company’s dependence on credit card associations, including any adverse changes in credit card association or network rules or fees; changes in the regulatory environment and changes in international, legal, tax, political, administrative or economic conditions; the geographical concentration of the Company’s business in Puerto Rico, including its business with the government of Puerto Rico and its instrumentalities, which are facing severe political and fiscal challenges; additional adverse changes in the general economic conditions in Puerto Rico, whether as a result of the government’s debt crisis or otherwise, including the continued migration of Puerto Ricans to the U.S. mainland, which could negatively affect the Company’s customer base, general consumer spending, the Company’s cost of operations and the Company’s ability to hire and retain qualified employees; operating an international business in Latin America and the Caribbean, in jurisdictions with potential political and economic instability; the Company’s ability to protect its intellectual property rights against infringement and to defend itself against claims of infringement brought by third parties; the Company’s ability to comply with U.S. federal, state, local and foreign regulatory requirements; evolving industry standards and adverse changes in global economic, political and other conditions; the Company’s level of indebtedness and restrictions contained in the Company’s debt agreements, including the secured credit facilities, as well as debt that could be incurred in the future; the Company’s ability to prevent a cybersecurity attack or breach to its information security; the possibility that the Company could lose its preferential tax rate in Puerto Rico; the possibility of future catastrophic hurricanes, earthquakes and other potential natural disasters affecting the Company’s main markets in Latin America and the Caribbean; uncertainty related to the effect of the discontinuation of the London Interbank Offered Rate at the end of 2021; and the continued impact of the COVID-19 pandemic and measures taken in response to the outbreak, on the Company’s resources, net income and liquidity due to current and future disruptions in operations as well as the macroeconomic instability caused by the pandemic.

Consideration should be given to the areas of risk described above, as well as those risks set forth under the headings “Forward-Looking Statements” and “Risk Factors” in the reports we file with the SEC from time to time, in connection with considering any forward-looking statements that may be made by us and our businesses generally. We undertake no obligation to release publicly any revisions to any forward-looking statements, to report events or to report the occurrence of unanticipated events unless we are required to do so by law.

Investor Contact

(787) 773-5442

IR@evertecinc.com

XML

Document and Entity Information	Jul. 01, 2022
Cover [Abstract]
Document Type	8-K
Amendment Flag	false
Document Period End Date	Jul. 01, 2022
Entity Registrant Name	EVERTEC, Inc.
Entity Incorporation, State or Country Code	PR
Entity File Number	001-35872
Entity Tax Identification Number	66-0783622
Entity Address, Address Line One	Cupey Center Building
Entity Address, Address Line Two	Road 176, Kilometer 1.3,
Entity Address, City or Town	San Juan
Entity Address, Country	PR
Entity Address, Postal Zip Code	00926
City Area Code	787
Local Phone Number	759-9999
Written Communications	false
Soliciting Material	false
Pre-commencement Tender Offer	false
Pre-commencement Issuer Tender Offer	false
Entity Emerging Growth Company	false
Entity Central Index Key	0001559865
Title of 12(b) Security	Common Stock, $0.01 par value per share
Trading Symbol	EVTC
Security Exchange Name	NYSE