EX-10.9

Exhibit 10.9

Certain information contained in this exhibit, marked by [***], has been excluded from this exhibit because the registrant has determined that it is both not material and is the type that the registrant treats as private or confidential.

Exhibits A-F to this exhibit have been omitted pursuant to Item 601(a)(5) of Regulation S-K.

PROGRAM MANAGEMENT AGREEMENT

This PROGRAM MANAGEMENT AGREEMENT (together with all Program Schedules, exhibits, schedules and addenda, including as amended, restated, supplemented or otherwise modified from time to time, the “Agreement”), dated as of June 30, 2026 (the “Effective Date”), is made by and between COLUMN NATIONAL ASSOCIATION, a national banking association (“Bank”), and OPORTUN, INC., a Delaware corporation (“Company”).

RECITALS

WHEREAS, Company facilitates the origination of consumer loans by lenders on a nationwide basis;

WHEREAS, Bank is in the business of providing various banking services, including the maintenance of deposit accounts, card offerings and services, and other financial services and products customarily provided by an insured depository institution (“Services”); and

WHEREAS, the Parties desire to establish one or more programs under which the Parties will cooperate to offer customers various banking services through the Platform, as set forth herein;

NOW, THEREFORE, in consideration of the foregoing and the terms, conditions and mutual covenants and agreements herein contained, and for good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Bank and Company mutually agree as follows:

Article 1

DEFINITIONS AND RULES OF CONSTRUCTION

1.1Definitions. Unless otherwise defined, capitalized terms used in the Agreement and in the applicable Program Schedules shall have the meanings ascribed as follows:

“Account” means, as applicable, (i) a deposit account issued to an Accountholder; (ii) a sub-account of any omnibus account established and maintained by Bank and allocated to a specific Accountholder; (iii) a Consumer Credit Product originated by Bank; or (iv) such other accounts issued to Accountholders for the receipt of Services in connection with a Program.

“Account Agreement” means (i) the agreement between Bank and an Accountholder containing the terms and conditions governing the Account, including all disclosures required by Applicable Law and Bank’s privacy notice or (ii) a Loan Agreement.

“Account Application” means an application (including through the use of an electronic, paper, or verbal application) for an Account made by an Applicant through the Platform or other approved channels.

“Accountholder” means (i) a Person to whom Bank issues an Account or that otherwise receives Services in connection with a Program or (ii) a Borrower.

“Accountholder Data” means all data or information pertaining to Accountholders, including information (i) provided by an Applicant or Accountholder to obtain an Account or Services; (ii) about an Accountholder resulting from any transaction involving a Program, Account or Service; or (iii) otherwise obtained or generated by a Party or their subcontractors in the course of their activities in connection with this Agreement, a Program, or a Service. “Accountholder Data” includes, but is not limited to, “Cardholder Data” as defined under PCI-DSS and nonpublic personal information as defined under the Gramm-Leach-Bliley Act of 1999 and implementing regulations that is subject to protection from publication under Applicable Law; provided Accountholder Data shall not include aggregate data that does not identify any specific Applicant or Accountholder.

“Accountholder File” means the information and documentation collected by and relied on by Company in verifying the identity of an Applicant or Accountholder, and any and all information and documentation collected as part of Company’s customer due diligence and enhanced due diligence processes in accordance with Company’s policies and procedures approved by Bank. The Accountholder File includes, but is not limited to, the information and documentation set forth in Exhibit Eof this Agreement.

“ACH” means the Automated Clearinghouse.

“Affiliate” means, with respect to a Party, a Person who directly or indirectly controls, is controlled by or is under common control with the Party. For the purpose of this definition, the term “control” (including with correlative meanings, the terms controlling, controlled by and under common control with) means the power to direct the management or policies of such Person, directly or indirectly, through the ownership of fifty percent (50%) or more of the voting securities of such Person, by contract or otherwise.

“Affiliated Critical Service Provider” has the meaning set forth in Section 3.10.3.

“Anti-Corruption Laws” means all Applicable Law concerning or relating to bribery or corruption.

“Anti-Money Laundering Laws” means all Applicable Law relating to anti-money laundering, and including, the Bank Secrecy Act, 31 U.S.C. § 5311 et seq., and Regulation X promulgated thereunder, the applicable sections of the Patriot Act, and implementing regulations related to Know-Your-Customer and Customer Identification Programs.

“Applicable Law” means all federal, state and local laws, statutes, regulations and orders applicable to a Party or relating to or affecting any aspect of any Program, including the Accounts and the Program promotional and Marketing Materials, all requirements of any Regulatory Authority having jurisdiction over a Party, and Network Rules, as any such laws, statutes, regulations, orders and requirements may be amended and in effect from time to time during the Term.

“Applicant” means a Person who has completed an Account Application.

“BIN” means a bank identification number or similar identifier assigned to Bank by a Network for the purposes of identifying and routing electronic payment transactions.

“Borrower” means, with respect to any Consumer Credit Product, each Person who is a borrower under such Consumer Credit Product, and each other obligor (including any co-signor or guarantor) of the payment obligation for such Consumer Credit Product.

“Brand Guidelines” means Bank’s policies and requirements for Company’s use of Bank’s Marks in connection with a Program, which may be updated from time to time upon written notice to Company.

“Business Day” means any day, other than (i) a Saturday or Sunday or (ii) a day on which banking institutions in the State of California are authorized or obligated by law or executive order to be closed.

“Change of Control” means a reorganization, merger, consolidation, sale of all or substantially all of the assets of, or other corporate transaction involving, a Party (a “Transaction”), in each case, with respect to which those stockholders of the Party immediately prior to such Transaction do not, immediately after the Transaction, own more than fifty percent (50%) of the combined voting power of the Party or the other corporation resulting from such Transaction.

“Closed-End Consumer Credit Product” means any closed-end consumer credit products that may hereafter be offered under a Program from time to time upon written agreement of the Parties.

“Company Customer Information” means any data or information pertaining to any customer of Company that is provided by Company to Bank as required under a Program.

“[***]” [***].

“Confidential Information” means the terms and conditions of this Agreement and any confidential, proprietary or non-public information related to an Account, of an Accountholder, or of a Party, including a Party’s proprietary marketing plans and objectives, that is furnished to the other Party, either directly or indirectly, in writing, orally or by inspection of intangible objects (including, documents), in connection with this Agreement. Confidential Information includes (i) the Program Policies; (ii) business information (including products and services, employee information, business models, know-how, strategies, designs, reports, data, research, financial information, pricing information, corporate client information, market definitions and information, and business inventions and ideas), and (iii) technical information including software, source code, documentation, algorithms, models, developments, inventions, processes, ideas, designs, drawings, hardware configuration, and technical specifications, including computer terminal specifications and the source code developed from such specifications.

“Consumer Credit Product” means each Closed-End Consumer Credit Product and each Open-End Consumer Credit Product originated by Bank pursuant to a Program.

“Consumer Product” means an Account issued by Bank and other Consumer Credit Product originated by Bank pursuant to a Program.

“Control Person” means, with respect to Company, (i) any officer, director, manager, shareholder or member of Company, (ii) any Person participating in the Control of Company’s business, and (iii) any Person having the power to direct the management or policies of Company.

“Critical Service Provider” means any Service Provider that (i) has access to, stores, transmits, or processes Accountholder Data; (ii) interacts directly with, or has a significant impact on, Applicants and Accountholders in connection with a Program; (iii) involves significant Bank functions or other activities that could cause Bank to face significant risk if such Critical Service Provider fails to meet expectations; (iv) requires significant Bank investment or resources to implement such service or manage the risk, or (v) has otherwise been determined by Bank, in its sole, good faith, and reasonable discretion, to be a Critical Service Provider, provided, however, that Bank may in its sole discretion determine and communicate in writing that a Service Provider that otherwise meets this definition of Critical Service Provider will not be treated as a Critical Service Provider under this Agreement or will not be subject to certain requirements otherwise applicable to a Critical Service Provider under this Agreement.

“FDIC” means the Federal Deposit Insurance Corporation.

“Fee Commencement Date” means the earlier of the (x) the date the first loan is originated by Bank under the Program, or (y) July 1, 2026.

“Financial Covenant” means, [***].

“GAAP” means United States generally accepted accounting principles.

“Government List” means (i) the Annex to Presidential Executive Order 13224 (Sept. 23, 2001), (ii) OFAC’s most current list of “Specifically Designated National and Blocked Persons” (which list may be published from time to time in various mediums including the OFAC website, http://www.treasury.gov/ofac/ downloads/t11sdn.pdf or any successor website or webpage), and (iii) any other list of terrorists, terrorist organizations or narcotics traffickers maintained by a Regulatory Authority that Bank notifies Company in writing is now included in “Government List.”

“Inquiry” means any inquiry, investigation, or proceeding (whether verbal or written, formal or informal) by any state attorney general, Regulatory Authority, governmental figure (including a state or federal legislator), Network, or the Better Business Bureau or similar organization that relates to the Program, other than routine communications. For the avoidance of doubt, routine communications exclude communications that are reasonably expected to adversely affect the Program.

“Insolvent” means, with respect to any specified Person, the failure of such Person to pay debts in the ordinary course of business, the inability of such Person to pay its debts as they come due or the condition whereby the sum of such Person’s debts is greater than the sum of its assets.

“Intellectual Property” means, with respect to the applicable materials, all right, title and interest in all intellectual property rights, including but not limited to, Marks, rights in patents, trade secrets, copyrights, trademarks, trade dress and service marks, and including but not limited to the right to distribute, sell, modify, reproduce, publish, display, perform, prepare derivative works, and all other intellectual property rights relating thereto.

“Interagency Guidance on Third-Party Relationships” means the Interagency Guidance on Third-Party Relationships: Risk Management (88 Fed. Reg 37920, June 6, 2023) jointly issued by The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency, or such successor or replacement guidance as may be in effect from Bank’s Regulatory Authorities from time to time.

“Loan” means a consumer loan in connection with Closed-End Consumer Credit Products made by Bank to a Borrower under a Program.

“Loan Advance” means, with respect to any Open-End Consumer Credit Product, an extension of credit made by Bank to a Borrower under a Program pursuant to an Account.

“Loan Agreement” means the agreement between Bank and a Borrower containing the terms and conditions governing the Consumer Credit Product, including all disclosures required by Applicable Law and Bank’s privacy notice.

“Losses” means all claims, actions, liability, losses, judgments, damages, settlements, orders, offsets, fines, penalties and costs and expenses of any nature, including reasonable attorneys’ fees, [***].

“Marketing Materials” means any advertisements, brochures, applications, promotional materials, telemarketing scripts and any other marketing materials or Accountholder-facing communications (whether oral, in print, on the internet, over the phone or in any other medium) relating to a Program, including all marketing and advertising in paper, video, radio, or electronic or other

formats, electronic web pages, electronic web links and any other type of promotional materials related to a Program, and any such materials sent to, or the scripts or templates used in connection with oral communications with an Accountholder or potential Applicant.

“Marks” means a Party’s trademarks, trade names, service marks, logos, brands, corporate names, trade dress, domain names, social media usernames, and other source identifiers or indicia of goods or services, whether registered or unregistered, and all registrations and applications for registration of the foregoing, and all issuances, extensions, and renewals of such registrations and applications, and all goodwill associated with any of the foregoing.

“Material Adverse Effect” means, with respect to a Party, an event, change, or occurrence that individually or together with any other event, change, or occurrence, has a material adverse impact on the ability of such Party to perform its obligations under this Agreement or any Program Schedule, including where such inability to perform is caused by the financial position, business, or results of operations of the Company.

“NACHA” means the National Automated Clearinghouse Association.

“Network” means, individually and collectively, NACHA, the payment card networks (Visa, Mastercard, etc.), and any other applicable payments network.

“Network Rules” means the by-laws and operating rules of any Network as in effect on the date hereof and as the Network may amend from time to time, including PCI DSS.

“Open-End Consumer Credit Product” means any open-end consumer credit products that may hereafter be offered under a Program from time to time upon written agreement of the Parties.

“Party” means either Company or Bank, as applicable, and “Parties” means Company and Bank.

“Patriot Act” means the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT ACT) of 2001, as the same may be amended from time to time, and corresponding provisions of future laws.

“PCI DSS” means the Payment Card Industry Data Security Standards promulgated by the Payment Card Industry Security Standards Council.

“Person” means any individual or legal entity, including a corporation, limited liability company, partnership, joint venture, association, joint-stock company, trust, unincorporated organization, governmental entity or other entity of similar nature.

“Platform” means the computer software, proprietary system information, and related technology and documentation, developed and owned by, or licensed by third parties to, Company relating to its facilitation of deposit or credit products, including the facilitation of the origination of consumer loans by lenders on a nationwide basis, including any mobile application or website operated by Company, and all Intellectual Property rights therein owned by Company or licensed by third parties to Company; provided that the Platform does not include any Intellectual Property rights owned by Bank or licensed by third parties to Bank.

“Privacy Laws” means all federal, state, and local laws and regulations related to privacy, all as they may be amended, supplemented or interpreted in writing from time to time by any applicable Regulatory Authority.

“Processor” means a Critical Service Provider engaged by Company to process transactions and maintain a system of records associated with a Program and Accounts.

“Product Documents” means any Account Agreement and Account Application (which may be in the form of digital field indicators), and any other individualized documents provided to Accountholders.

“Product Launch” means the date on which the Parties first make a particular Program available to prospective Applicants, but shall not include any alpha or beta testing of such Program. For the avoidance of doubt, any alpha or beta testing of the Program shall not be considered the “Product Launch.”

“Program” means a program as contemplated by any Program Schedule. The Parties acknowledge that multiple Programs may exist under this Agreement based on meaningful differences, including but not limited to, Bank product terms and functionality, distribution locations, and Accountholder characteristics. All Programs shall be subject to the terms hereof and, prior to Product Launch, the prior written approval of Bank. For the avoidance of doubt, (i) Program does not include any product or service provided by Company or a third party to Persons that are unrelated to a Program or are otherwise not provided by Company or its Affiliates pursuant to this Agreement, and (ii) any credit or other financial service or product originated or issued by Company or its Affiliates or any other third party (except any such product originated, issued, or refinanced by Bank) is not considered part of the Program.

“Program Documents” means this Agreement, all Program Schedules, and all Servicing Agreements and Purchase Agreements.

“Program Guidelines” means the written guidelines for the Bank’s administration of a Program, including but not limited to any risk and compliance program requirements, which have been delivered to Company by Bank and which may be updated from time to time in its sole discretion. Any change or modification to the Program Guidelines that would result in the Bank changing or modifying the Program shall be subject to Section 2.1.3.

“Program Policies” means the policies developed by Company in accordance with Applicable Law and this Agreement and approved in advance by Bank, in its sole discretion, to govern the compliance and operation of each Program as set forth in Exhibit A.

“Purchase Agreement” means any agreement pursuant to which Bank agrees to sell an Account or Receivables to a Purchaser, as the same may be amended, restated, supplemented or otherwise modified from time to time.

“Purchaser” means Oportun, Inc., a Delaware corporation, or such other entity as may be disclosed pursuant to the terms of a Program Document.

“Receivable” means, with respect to any Loan Advance, the right to any and all payments from or on behalf of the Borrower in respect of such Loan Advance, including the right to payment of any existing or future interest charges associated with such Loan Advance, and includes all rights of Bank to payment under the Account Agreement with respect to such Loan Advance.

“Regulatory Authority” means any federal, state or local regulatory agency or other governmental agency or authority having jurisdiction over or exercising regulatory oversight with respect to a Party, including, but not limited to, the Office of the Comptroller of the Currency, the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Consumer Financial Protection Bureau (except that nothing herein shall be deemed to constitute an acknowledgement by Bank that any Regulatory Authority other than the Office of the Comptroller of the Currency has jurisdiction over or exercises regulatory oversight with respect to Bank).

“Reserve Account” has the meaning set forth in Section 10.6.2.

“Sanctioned Person” means, at any time, (a) any Person listed in any Sanctions-related list of designated Persons maintained by OFAC, the U.S. Department of State, the United Nations Security Council, the European Union or any EU member state, or His Majesty’s Treasury of the United Kingdom, (b) any Person operating, organized or resident in a Sanctioned Country or (c) any Person controlled by any such Person.

“Sanctions” means economic or financial sanctions or trade embargoes imposed, administered or enforced from time to time by (a) the U.S. government, including those administered by the OFAC or the U.S. Department of State, or (b) the United Nations Security Council, the European Union or any EU member state, or His Majesty’s Treasury of the United Kingdom.

“Service Provider” means any vendor, service provider or subcontractor retained, directly or indirectly, by Company that fulfills any or all of Company’s obligations under this Agreement or any Program Schedule. The term “Service Provider” includes a Critical Service Provider.

“Servicer” means Oportun, Inc., a Delaware corporation or such other entity as may be disclosed pursuant to the terms of a Program Document.

“Services” has the meaning set forth in the Preamble.

“Servicing Agreement” means that certain Servicing Agreement, dated as of the date hereof, by and between Bank and Servicer, as the same may be amended, restated, supplemented or otherwise modified from time to time, relating to the servicing of Accounts.

“[***]” [***].

1.2Rules of Interpretation.

1.2.1As used in this Agreement and each Program Schedule and unless otherwise stated, the fact that Bank has provided approval or consent shall not mean or otherwise be construed to mean that: [***].

1.2.2All references to “include,” “includes,” or “including” shall be deemed to be followed by the words “without limitation.”

1.2.3The word “or” means both “and” and “or,” except where the context clearly indicates that the Parties intend “or” to designate alternatives only, including when the word “either” or similar words or phrases are used.

1.2.4The words “herein,” “hereof,” “hereby,” “hereto” and “hereunder” refer to this Agreement as a whole.

1.2.5References to any law or regulation refer to that law or regulation as amended from time to time and include any successor law or regulation.

1.2.6References to another agreement, instrument or other document means such agreement, instrument or other document as the same may be amended, supplemented or otherwise modified from time to time in accordance with the terms thereof.

1.2.7References to “dollars” or “$” shall be to United States dollars unless otherwise specified herein.

1.2.8Unless otherwise specified, all references to days, months or years shall be deemed to be preceded by the word “calendar.”

1.2.9All references to “quarter” shall be deemed to mean calendar quarter.

1.2.10Unless otherwise specified, all references to an article, section, subsection, exhibit or schedule shall be deemed to refer to, respectively, an article, section, subsection, exhibit or schedule of or to this Agreement, except that such references in a Program Schedule shall be deemed to refer to, respectively, an article, section, subsection, exhibit or schedule of or to such Program Schedule.

1.2.11Unless the context otherwise clearly indicates, words used in the singular include the plural and words in the plural include the singular.

1.2.12In connection with the computation of any time period, the word “from” means “from and including” and the words “to” and “until” each means “to but excluding.”

1.3Parties’ Responsibilities Not Waived. Except as expressly set forth in any written waiver or consent, neither the giving of any consent or approval by a Party to the other Party, nor a Party’s failure to maintain adequate controls or oversight, shall relieve the other Party of any obligation under this Agreement.

1.4Conflict Among Documents. To the extent practicable, this Agreement and all Program Schedules shall be interpreted to give effect to all terms herein and therein, and to avoid any conflict of terms. In the event of a conflict, the terms of the Program Schedule shall prevail over any inconsistent term in this Agreement, solely with respect to the Program that is the subject of such Program Schedule.

Article 2

PROGRAMS AND SERVICES

2.1Establishment of Programs.

2.1.1General. The Parties agree to establish and offer to Persons through the Platform one or more programs under which Bank shall issue Accounts and for which Company shall act as Bank’s service provider and program manager. This Agreement sets forth the understanding between Bank and Company with respect to the Programs and Accounts generated thereunder, and the performance by Bank and Company of various services relating to such Programs and Accounts as the Parties may mutually agree to offer as part of a Program.

2.1.2Program Schedules. Each Program shall be documented by a schedule that will be attached to this Agreement in numbered, sequential order (each, a “Program Schedule”). Pursuant to Section 2.4, Company may request to establish a new Program by submitting a business case to Bank with such information as Bank may require for its approval in its sole discretion. If approved by Bank, in its sole discretion, the Parties shall mutually agree on the terms governing such new Program, including the fees applicable thereto, and attach those terms hereto as a new Program Schedule.

2.1.3Program Modification. Bank may require amendments, modifications or changes to any aspect of a Program, including Company’s Platform, terms of services, or any disclosures related to a Program, [***].

2.2Program Manager. Subject to the terms and conditions of this Agreement, Bank hereby appoints Company as Bank’s exclusive service provider and program manager for the limited purposes of (i) developing and marketing the Programs; (ii) providing Accountholders access to the Accounts through the Platform; and (iii) performing any other services required of Company pursuant to this Agreement. In connection with this appointment, Company acknowledges and agrees that:

2.2.1All Accounts and Services offered to Accountholders through the Program(s) are services of Bank and, notwithstanding any other relationship with Company, Accountholders are Bank customers, including for purposes of Applicable Law;

2.2.2Bank has ultimate control and continued oversight over the Programs subject to the terms of this Agreement and any modifications hereunder, including the right to (i) monitor and review Company’s activities in connection with the Programs; (ii) require modifications to Programs; and (iii) determine the terms and conditions of any Account and Product Documents offered to Accountholders or potential Accountholders under a Program;

2.2.3Bank’s Regulatory Authorities have the authority, to the extent provided by Applicable Law, to regulate, examine and take supervisory or enforcement action against Company with respect to its activities as a service provider to Bank;

2.2.4As Bank’s service provider and program manager, Company’s compliance activities in connection with each Program shall ensure the Programs achieve and remain in compliance with Applicable Law, including as applicable to Bank;

2.2.5All Marketing Materials will appropriately identify Bank as the issuer of the Accounts, the originator of any Consumer Credit Products and the provider of Services;

2.2.6Bank shall have no obligation to honor any transaction instruction, entry, file, payment order, or other request from Company or an Accountholder that Bank reasonably believes (i) exceeds the available balance in the relevant Account (as applicable to Open-End Consumer Credit Products); (ii) would violate Applicable Law, applicable Network Rules, the Program Policies, or Bank’s applicable policies and procedures; (iii) may not have been duly authorized or represents a fraudulent transaction; or (iv) may involve funds subject to a hold, dispute, restriction, or legal process; and

2.2.7To the extent there is a dispute between Bank and Company with respect to interpretation of provisions of Applicable Law, such dispute shall be resolved in the manner set forth in Section 13.18.

2.3Product Launch. Prior to each Product Launch, Company shall have: (i) accomplished technical integration with Bank’s systems and/or any other required systems, including pre-implementation validation and testing, (ii) completed all necessary contracts required for Company to perform under this Agreement and the particular Program Schedule, including engaging Critical Service Providers; (iii) obtained Bank’s approval of all Program Policies; and (iv) accomplished any other condition specified by Bank in its sole, good faith, and reasonable discretion, including as may be detailed in any Program or Program Schedule. Bank, in its sole, good faith, and reasonable discretion, shall determine whether the conditions for the Product Launch have been satisfied.

2.4[***].

2.4.1[***]. [***]

2.4.2[***].[***]

2.4.3[***]. [***].

Article 3

COMPANY OBLIGATIONS

3.1General. Company shall establish and maintain a risk management program designed to ensure compliance with Applicable Law and any other Bank requirements in the performance of Company’s

obligations under this Agreement, including any obligations set forth in a Program Schedule or Program Documents (“Risk Management Program”), which shall be subject to Bank’s review and approval prior to Product Launch. As part of Company’s Risk Management Program, Company shall be responsible for developing, implementing, maintaining, and complying with Program Policies and related procedures in accordance with Applicable Law, this Agreement, and any Program Documents. Prior to making a material change to the Risk Management Program, Company will submit the material change to Bank for review and approval in its sole discretion, which approval shall not be unreasonably withheld, conditioned, or delayed. Company acknowledges that Bank retains the authority, in its sole discretion, to require Company to revise the Program Policies, or, as necessary, implement new policies and procedures. Company shall comply with the Program Policies and Applicable Law with respect to the Programs.

3.2Compliance Management System. In connection with Company’s Risk Management Program, Company shall establish and maintain a compliance management system that is reasonably designed to (i) ensure compliance with all Applicable Law, (ii) ensure compliance with the examination manual of each Regulatory Authority, (iii) be consistent with Bank’s achievement of at least a “satisfactory” rating under the FFIEC consumer compliance rating system, and (iv) meet the Bank’s policies and procedures provided to Company from time to time (the “Compliance Management System” or “CMS”). In connection with the CMS, Company shall:

3.2.1Develop and implement the CMS to provide an internal control process for Company’s business functions and processes, the elements of which shall include (i) an overall policy statement governing the CMS; (ii) specific procedures for approvals of additions or changes to the CMS, including a description of items subject to the CMS, a process for internal review and approval by Company and its legal counsel, and a process for internal review and approval by Bank (and, if applicable, its legal counsel) of material changes to the CMS; (iii) a compliance training program for all relevant officers, directors, employees, and agents that will support the Programs; (iv) appointment of a compliance officer who shall oversee reviews of Company’s compliance with Applicable Law, provided that although the compliance officer remains ultimately responsible for such reviews, the compliance officer may delegate reviews to subject matter experts; and (v) appropriate oversight by Company’s board of directors and senior management.

3.2.2Provide to Bank in writing a report by the compliance officer, or their delegate, of the results of any audits or reviews of any Program conducted by Company, promptly following the completion of any such audit or review, and identify significant issues to be addressed (if any), as well as Company’s resolutions of such issues (if applicable).

3.3AML Obligations. In connection with Company’s Risk Management Program:

3.3.1Company shall comply and, as applicable, cause each of its Affiliates and Critical Service Providers to take action reasonably designed to enable Bank to comply with all applicable Anti-Money Laundering Laws, Anti-Corruption Laws, and Sanctions, and shall implement customer identification, anti-money laundering, transaction screening, incident reporting, and Office of Foreign Assets Control (“OFAC”) programs approved by Bank designed specifically to address the Anti-Money Laundering Laws and Sanctions, and associated risks with the Programs. Without limiting the generality of the foregoing, Company shall develop, administer, and maintain (i) an anti-money laundering (“AML”) program consistent with the requirements of the federal Bank Secrecy Act (“BSA”), and its implementing rules as interpreted and enforced by the Financial Crimes Enforcement Network, as applicable to banking institutions (31 C.F.R. Part 1020); and (ii) procedures for complying with U.S. sanctions laws and other requirements enforced by OFAC (collectively, the “AML Program”). The AML Program must, at a minimum, provide for (i) a designated AML and sanctions compliance officer responsible for managing Company’s compliance with the AML Program; (ii) appropriate and ongoing training for relevant Company personnel; (iii) policies and procedures for (A) verifying the identity of each Applicant and Accountholder at Account opening or Consumer Credit Product origination, as applicable, and on an on-going basis; (B) screening each Applicant and Accountholder at Account opening or Consumer Credit Product origination,

as applicable, and on an on-going basis against OFAC’s list of Specially-Designated Nationals and Blocked Persons List and any other such list used by OFAC or other Regulatory Authority, notifying Bank of any matches, and cooperating with Bank to take any necessary actions; (C) performing customer due diligence and enhanced due diligence; (D) monitoring and reporting suspicious activity to Bank; (E) annual independent audits of the AML Program with the results thereof provided to Bank; and (F) retaining AML-related records, including all information relied on as part of Company’s customer identification procedures, for at least five (5) years after an Account is closed.

3.3.2[***]

3.3.3Unless a shorter time is otherwise required under this Section 3.3, Company shall provide to Bank electronic copies of any information retained pursuant to this Section 3.3 as requested by Bank, [***] following receipt of the request, or within a shorter period of time if required by a Regulatory Authority or Applicable Law, and cooperate with Bank in responding to any request for information from government or law enforcement entities. Except in the case of Bank’s request for information required by a Regulatory Authority or Applicable Law, Company may request approval from Bank to extend such timeline [***] if Company determines in its reasonable discretion that it requires a longer time frame, which approval Bank shall not unreasonably withhold, condition or delay.

3.3.4Company shall provide notice to Bank, within [***] of receipt, of any written notice of any Anti-Money Laundering Law, Anti-Corruption Law or Sanctions violation or action involving Company or any of its Affiliates.

3.3.5Company shall provide information and documentation responsive to Bank’s requests in accordance with Sections 3.3.2 through 3.3.4 of this Agreement and to Bank’s reasonable satisfaction. [***]. For the avoidance of doubt, where Bank issues a single request under Sections 3.3.2 through 3.3.4 and Company’s response is deficient with respect to multiple items or issues within that request, such failure shall constitute a single occurrence for purposes of this Section 3.3.5.

3.3.6Company’s AML Program shall include policies and procedures requiring an annual independent audit of Company’s AML Program, as set forth in Section 3.3.1, and Company shall conduct such an audit at Company’s sole expense. Company shall provide Bank with the results of its AML audit within five (5) days of Company’s receipt of the audit report. Company shall maintain at all times during the Term a current AML audit, the scope of which shall be consistent with the Bank’s requirements as set forth in this Agreement, and “current” means that such audit was conducted within the [***] period (“Current AML Audit”). If Company has a Current AML Audit as of the Effective Date, Company shall have provided such report to Bank during the due diligence process or within [***] of the Effective Date, at the latest. If Company does not have a Current AML Audit as of the Effective Date, Company’s first annual audit shall be conducted, completed, and provided to Bank within [***] of the Effective Date and, subsequently, every [***] thereafter. If Company’s AML audit produces results that are not satisfactory to Bank, in Bank’s sole discretion, Bank may require additional AML audits in such [***] period at Company’s sole expense. For the avoidance of doubt, Company’s obligations under this Section 3.3.6 shall be considered a material obligation under this Agreement.

3.3.7Company acknowledges that, to the extent any of its Affiliates are involved in a Program, its responsibilities under this Section 3.3 shall also apply to such Affiliates and those Affiliates’ personnel.

3.4UDAP/UDAAP Policies. The Compliance Management System shall include Company’s policies and procedures to prevent engaging in any unfair, deceptive, acts, or abusive acts or practices in connection with a Program (“UDAP/UDAAP Policy”).

3.5Information Security.

3.5.1The Risk Management Program shall include an information security program that is designed to (i) ensure the security and confidentiality of Accountholder Data held on behalf of Bank; (ii) protect against any anticipated and emergent threats or hazards to security or integrity of such information held on behalf of Bank; (iii) protect against unauthorized access to or use of such information held on behalf of Bank that could result in substantial harm or inconvenience to any Applicant or Accountholder; and (iv) ensure the proper disposal of Applicant or Accountholder information (such program, the “Information Security Program”). The Information Security Program must be designed to comply with the applicable requirements set forth in 12 C.F.R. Part 1016 (Privacy of Consumer Financial Information), and 12 C.F.R. Part 30 (including the Interagency Guidelines Establishing Information Security Standards found at Appendix B to Part 30). Bank has in place and shall maintain throughout the Term of this Agreement an information security program that is designed to (a) ensure the security and confidentiality of Accountholder Data held by Bank; (b) protect against any anticipated and emergent threats or hazards to security or integrity of such information held by Bank; (c) protect against unauthorized access to or use of such information held by Bank that could result in substantial harm or inconvenience to any Applicant or Accountholder; and (d) ensure the proper disposal of Applicant or Accountholder information. Such information security program of Bank must be designed to comply with the applicable requirements set forth in 12 C.F.R. Part 1016 (Privacy of Consumer Financial Information), and 12 C.F.R. Part 30 (including the Interagency Guidelines Establishing Information Security Standards found at Appendix B to Part 30).

3.5.2Prior to the initial Product Launch, Company will establish the Information Security Program so that it addresses Accountholder Data held directly by Company, as well as information held or accessible by its Affiliates and Service Providers, which data shall be accessible to Bank during any transition or wind-down. Bank will work with Company in good faith to determine whether vendors onboarded after initial Product Launch satisfy the requirements of this Section 3.5.2. Further, with certain exceptions as identified in Exhibit B, Company shall ensure that any Critical Service Providers are contractually obligated to maintain security measures and response programs consistent in all material respects with the requirements of this Agreement. Company agrees that it will not make any changes to its Information Security Program which would materially reduce the security of its operations or materially reduce the confidentiality of any databases and information maintained with respect to Bank, Applicants, and Accountholders without the prior written consent of the Bank. Notwithstanding any review or approval by Bank, the Information Security Program and the efficacy thereof is Company’s responsibility and Bank shall have no liability therefor.

3.5.3The Information Security Program shall be reviewed and tested by Company at least annually, at Company’s own expense, in order to demonstrate compliance with all Applicable Law, including documented policies and procedures, an audit and quality assurance program, and independent testing of its Information Security Program, which testing shall include vulnerability scans (or, with the consent of Bank, not to be unreasonably withheld, an independent, internal test by Company). Subject to the terms of the agreement between the Company and such Critical Service Provider, the schedule of such testing, audits, and quality reviews shall be provided to Bank at least annually upon reasonable request by Bank and a summary of the results from each such test, audit, or review shall be promptly provided to Bank in writing in accordance with the schedule or upon the request of Bank. Company shall report to Bank on the remediation or other actions taken in response to the findings of such testing, subject to any confidentiality obligations.

3.5.4Company agrees that, in the event there is a breach of its or of any of its Critical Service Providers’ systems, networks, applications, databases or other property or premises resulting in actual or suspected unauthorized access to or use or disclosure of Accountholder Data or Bank’s Confidential Information (“Company Security Breach”), Company will, [***].

3.5.5Bank agrees that, in the event there is a breach of its, or its subcontractors’, systems, networks, applications, databases or other property or premises resulting in actual or suspected

unauthorized access to or use or disclosure of Accountholder Data or Company’s Confidential Information (“Bank Security Breach”), Bank will [***].

3.6Disaster Recovery and Business Continuity. The Risk Management Program shall include a disaster recovery and business continuity program and related policies reasonably acceptable to Bank (collectively, the “Business Continuity Plan”) appropriate for the nature and scope of the activities of, and the obligations to be performed by, Company and any Critical Service Provider. Company shall ensure the Business Continuity Plan is designed to permit Company and any Critical Service Provider to promptly resume the performance of its obligations hereunder in the event of a natural disaster, destruction of facilities or operations, utility or communication failures, cyber incidents, system degradations, or similar or unplanned interruption in operations and shall be designed to permit that all Accountholder Data is backed up in a manner sufficient to survive any disaster or business interruption. Company agrees that the Business Continuity Plan shall be at least consistent with industry standards for the banking industry and in compliance with all Applicable Law. The Business Continuity Plan must include, without limitation, reasonable time frames to resume activities and recover data in the event Company’s ability to perform its obligations is impaired, and controls such as those to protect and store programs, back up data, and address cybersecurity issues. At the request of Bank, Company shall provide a current copy of the Business Continuity Plan, as well as operating procedures to be carried out in the event the Business Continuity Plan is implemented. Company shall not amend the Business Continuity Plan in a manner that materially increases the risks of disruptions and delays of its services without the consent of Bank. Reinstating the services contemplated under this Agreement shall receive as high a priority as reinstating the similar services provided to Company’s Affiliates and other customers. Company shall test its Business Continuity Plan at least once annually, at Company’s cost and expense, and shall provide Bank a copy of the report of such test promptly following Bank’s request. In addition, Bank, in its reasonable discretion, may require joint testing of the Business Continuity Plan by Bank and Company, which shall be conducted simultaneously with Company’s annual testing of its Business Continuity Plan, unless an incident triggers a need, in Bank’s reasonable discretion, to engage in joint testing of the Business Continuity Plan more frequently than annually. The Parties agree that Company shall be solely responsible for the costs and expenses of the annual audit and testing of the Business Continuity Plan. In the event of a disaster or any other disruption event that prevents or impairs the Company from performing its obligations under this Agreement, Company will notify Bank and implement its Business Continuity Plan (on the timing set forth in such Business Continuity Plan) to restore and continue to perform its obligations under this Agreement. Upon cessation of the disaster or disruption event, Company will as soon as reasonably practicable, provide Bank with an incident report detailing the reason for the disaster or disruption and all actions taken by Company to resolve the disaster or disruption.

3.7Complaint Management.

3.7.1Complaint Management Program. The Risk Management Program shall include a complaint management program to address and resolve all complaints received by Company regarding any aspect of a Program (“Complaint Management Program”). The Complaint Management Program shall provide for root cause analysis and mitigation steps, and shall require Company to provide monthly complaint reports to Bank. Company shall use commercially reasonable efforts to promptly resolve all complaints. Company shall cooperate in good faith and provide such assistance, at Bank’s request, to permit Bank to promptly resolve or address any investigation, proceeding or complaint not resolved by Company. Company acknowledges and agrees that a violation of the Complaint Management Program will be deemed a breach of this Agreement.

3.7.2Regulatory and Network Inquiries. If either Party receives any Inquiry, such Party shall advise the other Party in writing of the Inquiry within five (5) Business Days of receipt and share relevant portions of any written documentation, or for oral communications, provide a detailed summary in writing, in each case to the extent not specifically prohibited by Applicable Law, a Regulatory Authority, or a Network. Following receipt of such Inquiry, the Parties shall in good faith consult as to the appropriate action to be taken to address such Inquiry. Company shall take all actions within its reasonable control to

address the Inquiry in the manner and time period reasonably specified by Bank and Bank shall have final approval over the form and content of all responses provided to an Inquiry, provided, however, if the Inquiry is from a Regulatory Authority with authority over Company but not over the Bank, the Parties shall in good faith consult (where permitted) as to the appropriate action to be taken to address such Inquiry, and Company shall have final approval over whatever components of the Inquiry are responsive to Company’s Regulatory Authority.

3.7.3Accountholder Complaints and Resolution. All complaints received by Company from an Accountholder relating to an Account or its use (each, an “Accountholder Complaint”) shall be promptly addressed and resolved by Company in accordance with Applicable Law and Company’s Complaint Management Program. Company shall catalog and maintain copies of all Accountholder Complaints, and responses thereto, for the period required by Applicable Law or such longer period as specified by Bank in a written notice to Company. Company shall analyze, at least monthly, all Accountholder Complaints, including a trend analysis, and report such analysis to Company’s board of directors or a Company committee approved by Bank at the next regularly scheduled meeting of the board or such committee. Additionally, Company shall provide to Bank, by the [***] after the end of each month, a report, in a form and manner reasonably acceptable to Bank (such approval not to be unreasonably withheld, conditioned, or delayed), containing all Accountholder Complaints, for the preceding month along with the disposition of each and other criteria required by the Company’s Complaints Management Program. Bank may, in its sole discretion, reasonably request Company to provide additional details or supporting documentation within Company’s control regarding any and all Accountholder Complaints. Company shall provide such requested details and documentation as promptly as reasonably possible.

3.7.4Legal Actions and Requests. Unless prohibited by Applicable Law, each Party shall promptly notify the other Party of any legal action brought by a third party that may have a material effect on the Program. Unless prohibited by Applicable Law, a Regulatory Authority (or any of its regulations or guidance), or a court order, each Party shall further provide the other Party with prompt notice and copies of all documents, subpoenas, or other legal requests received by the Party that require the assistance of the other Party in order to provide an accurate response, or that would otherwise have a material effect on the Program, whether from a Regulatory Authority, private attorney, court, or otherwise, relating to an Accountholder, an Account, the Program or this Agreement, or pursuant to a civil investigative demand, National Security Letter, or similar process relating to the Program (“Legal Documents”). Each Party shall provide any assistance reasonably requested by the other in order to timely meet the response deadline of any Legal Document, and in no event later than [***] prior to the response deadline of the Legal Document in order for the filing party to timely meet such response deadline. Notwithstanding the foregoing, nothing in this paragraph shall require either Party to act in a way that violates Applicable Law or waives otherwise applicable privilege (such as attorney-client privilege).

3.8Customer Service.

3.8.1Company shall be responsible for (i) establishing and maintaining an internet website and mobile application that performs customer service functions required by Applicable Law and as otherwise mutually agreed by the Parties; (ii) administering and maintaining live agent customer service with availability to be agreed by the Parties; and (iii) providing Accountholders with access to Account information regarding their Accounts as required by Applicable Law. At a minimum, Company shall maintain or cause to be maintained web or app access that shall be available twenty-four (24) hours per day, seven (7) days per week (excluding scheduled downtimes or emergency or unplanned outages) for Accountholders who have a lost or stolen card (if applicable) or who have detected fraud on their Account.

3.8.2Company shall address and resolve all Applicant and Accountholder issues and inquiries related to Programs in accordance with a customer service policy reviewed and approved by Bank and in compliance with Applicable Law (the “Customer Service Policy”). Without limiting the foregoing, the Customer Service Policy must address inquiries related to, as applicable, (i) Account opening and eligibility decisions; (ii) Consumer Credit Product eligibility decisions (iii) error resolution, unauthorized

transactions, chargebacks, ACH returns, and similar issues; (iv) Account closing or termination; and (v) lost or stolen payment cards, among others. Company shall ensure that all Company employees handling Program-related inquiries are trained in accordance with Company’s established customer service procedures and Applicable Law. Company will provide a commercially reasonable level of training to Company customer service representatives regarding the Programs. Company shall ensure that customer service activities are conducted by trained personnel in accordance with the Customer Service Policy using a standard of care and service levels that are commercially reasonable consistent with industry best practices and in accordance with Applicable Law. Without limiting the generality of the foregoing, Company shall also ensure that customer service representatives and relevant Company staff are knowledgeable regarding substantive terms of the Programs including, without limitation, any fees. Company will additionally make available to Applicants and Accountholders mutually agreed general information and help documentation regarding the Programs. Additional customer service responsibilities may be assigned in a Program Schedule. Company may utilize a Service Provider to provide some or all of the customer service activities described in this Section 3.8.2.

3.8.3As applicable, Company will receive, investigate, process, log, and resolve all disputes, chargebacks, reversals, unauthorized transactions claims, and similar issues from Accountholders on a timely basis and in accordance with Applicable Law and Network Rules. Without limiting the foregoing, Company shall submit its relevant policies and procedures (“Error Resolution Policy”) for Bank’s prior review and approval.

3.9Account Application Process; Account Opening Requirements.

3.9.1Account Application Process. The Parties agree that the sole channel through which Persons may apply for an Account is by completing and submitting an Account Application through the Platform and other approved channels.

3.9.2Account Opening Requirements. As part of each Program Schedule, the Parties shall establish the eligibility criteria for Applicants to be approved for an Account, the form of Account Application to be used for the Program, and the Account Application approval process (the “Account Opening Requirements”). Following a Product Launch, Company shall make available to each Person who desires to open a related Account an Account Application. Bank shall have the right to amend or modify the Account Opening Requirements from time to time in its sole discretion with input from Company (which such input Bank will review and consider in good faith); provided that any such amendments or modifications that would have, or would be reasonably expected to have, a material adverse impact on the Program or Company shall be subject to Section 2.1.3.

3.9.3Denial. As part of each Program Schedule, the Parties shall establish the notice and disclosure requirements and responsibilities that apply in the event an Applicant is denied, including as a result of failing to meet the applicable Account Opening Requirements.

3.10Service Providers and Critical Service Providers.

3.10.1The Risk Management Program shall include policies and procedures for the engagement by Company of any Service Provider to perform marketing, data processing, or other services in connection with a Program (“Vendor Management Program”). The Vendor Management Program shall include policies and procedures for Service Provider due diligence, training, on-boarding, monitoring, risk assessments, compliance with Bank audit rights under this Agreement, and termination. Company may use Service Providers in the performance of its obligations under this Agreement, to the extent permitted by and in accordance with the Vendor Management Program. Company agrees to be fully responsible for the acts and omissions of all of its Service Providers, including, as applicable, their compliance with the applicable terms of this Agreement, applicable Program Schedules, applicable Program Policies, Applicable Law, and applicable Network Rules. Company shall be responsible and liable to Bank for any and all acts or omissions of its Service Providers to the same extent as if such acts

or omissions were taken or omitted by Company directly; provided, however, that any Service Providers listed on Exhibit Fis approved by the Bank to perform marketing, data processing, or other services in connection with a Program and shall not be subject to the requirements of this Section 3.10.1.

3.10.2Company shall provide notice and obtain Bank’s prior written approval (such approval not to be unreasonably withheld, conditioned, or delayed) before engaging any Critical Service Provider for use in a Program. A list of approved Critical Service Providers as of the Effective Date is attached as Exhibit Bhereto. In respect of the Critical Services Providers set forth in Exhibit Band any new Critical Service Providers required by Bank, where reasonably required by Bank, Company shall use commercially reasonable efforts to (i) ensure its agreements with Critical Service Providers include Bank as a third-party beneficiary and (ii) provide Bank the right to step in and assume Company’s right to direct the Critical Service Provider and receive the Critical Service Provider’s services at Company’s expense in the event of any occurrence that would permit Bank to terminate this Agreement. Company and Bank shall agree to any revisions required to the Vendor Management Program or existing agreements with Critical Service Providers set forth in Exhibit B.

3.10.3Company may retain a Critical Service Provider that is an Affiliate of Company (“Affiliated Critical Service Provider”) subject to any required diligence by Bank and Bank’s prior written approval. If Company engages or retains an Affiliated Critical Service Provider or outsources any of Company’s obligations hereunder to an Affiliate, Company shall engage such Affiliate or Affiliated Critical Service Provider through an intercompany services agreement that requires such Affiliate to assume responsibility for any of Company’s obligations pursuant to this Agreement or any Program Schedule for which such Affiliate or Affiliated Critical Service Provider is responsible (“Intercompany Agreement”), including but not limited to establishing and maintaining requisite Program Policies and complying with audit requests and reporting. Company shall not, in a manner that adversely affects the Program, amend any Intercompany Agreement between the Affiliate and Company without Bank’s review and written approval. Company shall be responsible for the acts and omissions of any of its Affiliated Critical Service Providers.

3.10.4From time to time, Bank may provide written feedback to Company regarding the quality and performance of any Service Providers utilized by Company in connection with a Program. In the event that a Service Provider fails to comply with Applicable Law and such failure, in Bank’s reasonable discretion, has or will have a material and adverse effect on the Program, Company will promptly take remediation measures to Bank’s reasonable satisfaction, including reducing or replacing the scope of services provided by such Service Provider in connection with the Program as soon as reasonably practicable. If such Service Provider’s noncompliance cannot be cured, or remains uncured for more than [***] or such longer period as may be approved by Bank, Bank may request in writing to Company that Company no longer use such Service Provider for the Program, and in such event, Company, acting in a commercially reasonable manner and using commercially reasonable efforts, shall commence the process to cease utilizing such Service Provider or find a replacement provider and wind down its use of such Service Provider. Any such wind-down shall be executed pursuant to a wind-down plan established by Company and approved by Bank, such approval not to be unreasonably withheld, conditioned or delayed.

3.11Marketing Program.

3.11.1Company’s Risk Management Program shall implement policies and procedures reasonably designed to ensure Marketing Materials comply with Applicable Law and Bank’s marketing guidelines, including prohibitions on unfair, deceptive, and abusive acts and practices (the “Marketing Policy”). Subject to Bank’s approval, Bank and Company shall agree upon the requirements and restrictions governing the use of all Marketing Materials, which shall be incorporated into the Marketing Policy. Company is responsible for ensuring all Marketing Materials and its marketing methods are in compliance with Applicable Law and the Marketing Policy. The Marketing Policy shall require that all Marketing Materials identify Bank as the issuer or originator of Accounts under a Program.

3.11.2All Marketing Materials are subject to prior written approval by Bank prior to use (such approval not to be unreasonably withheld, conditioned, or delayed); [***]. Where Bank’s approval is not provided, Bank shall provide a reasonable level of detail as to why such approval was withheld to allow Company to make modifications to allow for Bank’s approval. If Bank in its reasonable discretion determines that the content or use of any previously approved Marketing Materials should be modified as Bank shall request to comply with Applicable Law or Network Rules, Company shall promptly make such modifications all in accordance with Section 2.1.3, or discontinue using such Marketing Materials.

3.11.3Unless otherwise agreed in writing by Bank, Company shall be responsible for its own costs and expenses associated with the development of all Marketing Materials, including all costs and expenses associated with modifying or withdrawing Marketing Materials at Bank’s request.

3.11.4As between Company and Bank, Company shall have the exclusive right to market the Programs set forth in any Program Schedule to potential Accountholders. Either Party may also directly or indirectly market or solicit potential Applicants and Accountholders with offerings for other products or services offered by such Party, including without limitation deposit and other loan products that are not part of a Program. All marketing by Company of a Program shall be conducted in accordance with the Program Policies and Applicable Law. Notwithstanding the foregoing, Bank shall not directly or indirectly use Accountholder Data, Company Customer Information, or any data derived therefrom to market, advertise, solicit, or target any product or service offered by Bank or any third party to any Applicant or Accountholder under or in connection with any service outside of the Program, including any program with any other Person. For the avoidance of doubt, nothing herein shall restrict Bank from engaging in general market advertising, promotional activities, or public communications that are not specifically targeted at Applicants or Accountholders in connection with any service outside of the Program, including any program with any other Person.

3.12Tax Statements. Company shall deliver to all Accountholders or other appropriate parties all federal and state income tax forms as required by Applicable Law, including but not limited to any applicable IRS Forms 1099.

3.13Background Checks. Company shall, to the extent permitted by Applicable Law, request or conduct (or cause to be conducted or requested) background, educational, criminal record, employment verification, and/or other checks of any employee, agent, Service Provider or other key Person participating in the performance of marketing, origination assistance, or servicing in connection with this Agreement and the overall Programs, and who has access to Confidential Information, Accountholder Data, and/or information technology systems prior to granting such employee, agent, Service Provider, or other key Person access to such Confidential Information, Accountholder Data, or information technology systems in order to ensure Bank’s compliance with Section 19 of the Federal Deposit Insurance Act as amended by the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (12 U.S.C. § 1829).

3.14Notifications. Company shall, unless expressly prohibited by Applicable Law, promptly notify Bank of the termination, separation, or departure of any key Company personnel who is directly involved in the Program or in Company’s performance of its obligations under this Agreement, if such termination, separation, or departure resulted from Company’s reasonable belief that such person committed an act of fraud, theft, money laundering, or crime of moral turpitude.

3.15Patriot Act. The Parties hereto acknowledge that in order to help the United States government fight the funding of terrorism and money laundering activities, pursuant to federal regulations that became effective on October 1, 2003, Section 326 of the Patriot Act requires all financial institutions to obtain, verify, record, and update information that identifies each person establishing a relationship or opening an account. Company agrees that it will provide Bank such information as it may reasonably request, from time to time, in order for Bank to satisfy the requirements of the Patriot Act, including the name, physical address, tax identification number, and other information that will allow it to identify the individual or entity

who is establishing the relationship or opening the account and may also ask for formation documents such as articles of incorporation or other identifying documents to be provided.

3.16Company shall take all necessary steps to ensure Bank maintains adequate control of the Program. Neither Bank’s failure to establish and maintain any such controls nor the inadequacy of any Bank’s controls shall relieve Company of (i) its separate and independent obligations to establish and maintain its own such controls or to comply with this Agreement and Applicable Law or (ii) any liability in respect of the Program. Company understands that the Bank’s oversight program is designed in accordance with industry standards and any applicable regulatory guidance including guidance with respect to third-party relationships provided in OCC Bulletin 2023-17, or such successor or replacement guidance as may be in effect from Regulatory Authorities from time to time.

3.17Accounting System. Company shall establish and maintain, at its sole cost and expense, a comprehensive accounting and Account tracking system to accurately and promptly and timely reflect all Account Applications, Accounts, and related information regarding the Programs to satisfy the reasonable information requirements of Bank, Regulatory Authorities, and Bank’s internal and external auditors. Company shall provide, or shall ensure the system to provide, Bank with view access to copies of records and documentation authenticated by Account Applicants and Accountholders, including the information needed to underwrite and approve Account Applications pursuant to the Program Schedule for the related Program; provided, however, Company may limit information regarding the models and attributes used in the risk strategy to the level of generality that Bank determines in its reasonable discretion is required to confirm that such models and attributes adhere to all Program Guidelines and Program Policies. Company further agrees that the information reporting features, integrity, and security of the system shall be designed to operate in compliance with the Information Security Program to the reasonable satisfaction of Bank and its Regulatory Authorities.

Article 4

ACCOUNTHOLDER DATA, COMPANY CUSTOMER INFORMATION, AND OTHER RELATIONSHIPS WITH ACCOUNTHOLDERS

4.1Accountholder Data. Except as set forth in Section 4.2, the Program Policies, and Bank’s privacy policy (which Program Policies shall allow Company to use Accountholder Data consistent with Section 4.2) and privacy notice for each Program, Company may receive, use, and share Accountholder Data solely (i) for promotion of the Program; (ii) as otherwise appropriate to carry out its obligations or exercise its rights under this Agreement or any Program Document; and (iii) as necessary to comply with Applicable Law. Company may disclose Accountholder Data to its Critical Service Providers, which may receive, share, use, or disclose Accountholder Data only to the extent required for providing services to Company in connection with a Program. Company will only store Accountholder Data in the United States of America and by Critical Service Providers approved by the Bank, provided that Company or Service Provider employees located in India or Mexico may access certain items of Accountholder Data, but all Accountholder Data shall be stored on U.S. servers. Company shall provide Bank with direct, continuous, real-time and unrestricted view-only access (i.e., without date, time, or other restrictions, other than scheduled or emergency downtime for maintenance or service or updates, provided that Company shall provide notice to Bank of any such downtime) to any Accountholder Data in its possession or control (including any Accountholder Data held by a Service Provider). Company shall submit to Bank for Bank’s prior review and approval Company’s (A) internal policies and procedures for compliance with Privacy Laws and this section (“Privacy Compliance Policy”); and (B) public-facing privacy policy for the Program, which shall clearly and conspicuously describe the purposes for which Company may receive from Bank, use, and disclose Accountholder Data (“Privacy Policy”), which approval shall not be unreasonably withheld, conditioned, or delayed. As set forth in the applicable Purchase Agreement, following the purchase of any Loan by Company pursuant to the Purchase Agreement, Accountholder Data relating to such Loan shall be jointly owned by Bank and Company.

4.2Company Use of Accountholder Data.Notwithstanding Section 4.1, Bank and Company agree that Bank may share, and Company shall have the right to receive, use, and disclose Accountholder Data for any purpose permitted by Applicable Law, Network Rules, Program Policies, and Company’s Privacy Policy; provided that Company shall (i) where required by Applicable Law, as program manager and on Bank’s behalf, obtain, from each Applicant or Accountholder such Applicant’s or Accountholder’s affirmative consent to Bank’s sharing with Company for this purpose; (ii) submit its Privacy Policy for the Program for Bank’s prior review and approval as to the provisions relevant to the Program, which shall clearly and conspicuously describe the purposes for which Company may use or disclose Accountholder Data; (iii) where required by Applicable Law, clearly and conspicuously disclose such Applicant’s or Accountholder’s right to opt-out of such disclosure and the method for doing so and, to the extent any Applicant or Accountholder exercises such opt-out right, discontinue any further use or disclosure of such Accountholder Data, except as otherwise permitted by Applicable Law and this Agreement; (iv) where required by Applicable Law, implement policies and procedures to capture, track, and maintain records of each Applicant and Accountholder’s consent and provide such records applicable to the Program promptly to Bank upon request; (v) be responsible for all costs and expenses of developing the systems and compliance procedures necessary to implement this section; and (vi) indemnify and hold Bank harmless against any and all third party claims initiated by any Person against Bank, as a result of Company’s activities or omissions in connection with this section. Notwithstanding the foregoing, Company shall not sell Accountholder Data. For the avoidance of doubt, this Section 4.2 shall not prevent Company from directly or indirectly marketing or soliciting Accountholders with offerings for deposit products and other loan products offered by Company; provided that such activities comply with subsections (i) - (vi) of this Section 4.2.

4.3Company Customer Information. Subject to Applicable Law and Bank’s privacy policy for each Program, Bank may receive, use, and share Company Customer Information solely (i) for promotion of the Program; (ii) to carry out its obligations or exercise its rights under this Agreement; and (iii) as necessary to comply with Applicable Law. Company Customer Information shall be considered Company’s Confidential Information, regardless of which Party collects, generates, or maintains such Company Customer Information. For the avoidance of doubt, use of Accountholder Data shall be subject to Section 4.2 and 4.5 as applicable, and not this Section 4.3.

4.4Overlapping Data. The Parties acknowledge and agree that each Party has a separate customer relationship with Accountholders and that any Accountholder information Company obtains through such separate relationship shall be Company Customer Information owned by Company. Nothing contained in this Article 4 shall apply to, limit, or prohibit the use in any manner of, any Company Customer Information owned or held by Company or its Affiliates to the extent such information has been independently obtained by Company in connection with its separate customer relationship with Applicants and Accountholders, even if such information is duplicative of Accountholder Data and in each such case, Company and Bank shall independently own such overlapping Accountholder Data and Company Customer Information.

4.5[***]. [***].

Article 5

INTELLECTUAL PROPERTY

5.1Bank Marks. Bank hereby grants to Company and Affiliated Critical Service Providers during the Term a nonexclusive, royalty-free, non-assignable license in the United States to use Bank’s Marks and as Bank authorizes in connection with the description and promotion of the Program. Bank’s Marks shall

be used according to the Brand Guidelines shared by Bank and only in the forms and format expressly approved by Bank in writing.

5.2Company Marks. Company hereby grants to Bank during the Term a non-exclusive, royalty-free, non-assignable license in the United States to use Company’s Marks in connection with the description and promotion of the Program and Bank’s services, including by featuring Company’s Marks for promotional purposes on Bank’s website. Any use by Bank of Company’s Marks is subject to Company’s advance approval and Brand Guidelines.

5.3Use of Marks. Except as otherwise permitted by any Program Document, no materials shall be distributed by Company in any format or by any means, whether printed, broadcast, posted online, included in an app or transmitted electronically or by other means, that include Bank’s Marks that refer to a Program without the prior written approval of Bank, which shall not be unreasonably withheld, conditioned, or delayed. It is expressly agreed that neither Party is acquiring any right, title, and interest (other than the foregoing license rights) in the other Party’s Marks which – as between the Parties – shall remain the property of their respective owners. Each Party agrees that it shall not challenge the title or any rights of the other Party in and to its Marks. In no event and under no circumstances shall either Party use the other Party’s Marks in any manner that is derogatory, negative, likely to confuse a third party as to source of goods or services, or otherwise injurious to the other Party, as determined in such Party’s sole discretion, except in connection with any filing, correspondence, or communication with a Regulatory Authority or as otherwise directed by a Regulatory Authority. Each Party, in its role as the licensee of the other Party’s Mark’s, recognizes the value of the goodwill associated with the other Party’s Marks, in its role as licensor, and acknowledges that such licensor Party exclusively owns all right, title and interest in and to the licensor Party’s Marks and all goodwill pertaining thereto. All goodwill resulting from a Party’s use of the other Party’s Marks, as applicable, shall inure to the benefit of, and be owned by, the Party which owns the applicable Marks.

5.4Termination of License. Upon termination of this Agreement for any reason, the license granted in Section 5.1 and 5.2 above shall terminate automatically, except such license will remain in force during any period of post-termination assistance in accordance with this Agreement or any Program Schedule, including the Wind-Down Period.

5.5Intellectual Property. As between the Parties, the Parties agree that each Party is and shall remain the sole and exclusive owner of all right, title and interest in and to all Intellectual Property created or developed by or on behalf of such Party (it being understood for the purposes of this Agreement, Company is not creating any Intellectual Property on behalf of Bank), including its Marks, its websites, promotional materials, proprietary information, and technology, in connection with the Program during the Term of the Agreement. For clarity, the Platform, any derivatives (including feedback from Bank with respect to the Platform), enhancements or modifications to the Platform created by Company in connection with this Agreement and all Intellectual Property therein shall be the sole and exclusive property of the Company. If any term of this Agreement or any provision of any schedule referenced herein or any performance or other action in connection with this Agreement, including any action as a result of Applicable Law, is deemed to alter a Party’s ownership rights or to confer any rights or interest in such Party’s Intellectual Property in or on the other Party, the Party receiving such rights or interest hereby relinquishes and assigns all such rights and interests to the other Party and agrees to execute and deliver all necessary documentation to convey, reconvey or transfer all such rights to the other Party without compensation of any kind immediately upon request. Neither Party will take any actions to dispute the validity of the other Party’s ownership in its Intellectual Property. Neither Party shall, anywhere in the world, use or seek to register in its own name, or that of any third party, any Marks that are the other Party’s Marks, that are colorably or confusingly similar to such other Party’s Marks, or that incorporate the Licensing Party’s Marks or any element colorably or confusingly similar to the Licensing Party’s Marks. Without limitation of the foregoing, except as expressly authorized herein, neither Party will take any action to convey to any third party any interest in the other Party’s Intellectual Property, whether by sublicense, transfer, lien hypothecation or otherwise, nor suffer any lien to be asserted over the other

Party’s Intellectual Property, and will immediately take all actions and execute all documents at its sole expense, including payment of all sums necessary to a third party, to cause any such liens to be removed. Each Party’s Intellectual Property shall be considered its Confidential Information pursuant to Article 6 below.

5.6Licenses. During the Term and any period of post-termination assistance (and/or transition) and strictly for the purpose of this Agreement, the Parties grant each other a non-exclusive, worldwide, royalty-free, non-transferable license (subject to a right to sublicense to Service Providers) to copy, use, and display Intellectual Property solely in the performance of and strictly in accordance with the requirements and restrictions stated in this Agreement. Any use, adaptation, modification or amendment of Intellectual Property shall be subject to prior written approval by the Party licensing the Intellectual Property in question. Except as expressly stated, nothing in this Agreement shall grant or be deemed to grant to any Party any right, title or interest in Intellectual Property licensed to that Party by the other Party. In using the other Party’s Intellectual Property, each Party shall follow the other Party’s reasonable instructions having regard to the purpose of such use under this Agreement.

Article 6

CONFIDENTIALITY

6.1General. Each Party agrees that Confidential Information of the other Party shall be used by such Party solely in the performance of its obligations and exercise of its rights pursuant to this Agreement, each Program Schedule, and the Program Documents. For purposes of this Article 6, a Party that receives Confidential Information shall be the “Restricted Party,” and the Party that discloses Confidential Information shall be the “Disclosing Party.” A Party’s Confidential Information shall not include information that (i) is generally available to the public through lawful means; (ii) has become publicly known, without fault on the part of the Restricted Party or any of its Representatives, subsequent to the Restricted Party acquiring the information; (iii) was otherwise known by, or available to, the Restricted Party prior to entering into this Agreement and was not otherwise the subject of a nondisclosure agreement prior to such date; (iv) becomes available to the Restricted Party on a non-confidential basis from a Person, other than a Party to this Agreement, who is not known by the Restricted Party after reasonable inquiry to be bound by a confidentiality agreement with the Disclosing Party or otherwise prohibited from transmitting the information to the Restricted Party; or (v) was or hereafter is independently developed by either Party without using, or referencing, Confidential Information of the other Party and without any violation of its obligations under this Agreement or any other nondisclosure agreement between the Parties. Each Party represents and covenants that it will protect the Confidential Information of the other Party in accordance with prudent business practices and will use the same degree of care to protect the other Party’s Confidential Information that it uses to protect its own confidential information of a similar type. Except as expressly provided herein, no right or license whatsoever is granted with respect to the Confidential Information or otherwise.

6.2Exceptions. Except as required by Applicable Law or legal process, neither Party shall disclose Confidential Information of the other Party to third parties without such Party’s prior written consent; provided, however, that the Restricted Party may disclose Confidential Information of the other Party (i) to the Restricted Party’s Affiliates, agents, representatives or subcontractors (collectively, the “Representatives”) for the sole purpose of fulfilling the Restricted Party’s obligations under this Agreement provided such parties are subject to confidentiality obligations at least as restrictive as those provided in this Agreement, and provided further, that, in all events, the Restricted Party shall be responsible for any breach of the confidentiality obligations hereunder by any of its Representatives (other than Company as agent for Bank), (ii) to the Restricted Party’s auditors, accountants and other professional advisors, or to a Regulatory Authority, provided, that, in all events, the Restricted Party shall be responsible for any breach of the confidentiality obligations hereunder by any of its auditors, accountants, or other professional advisors, or (iii) to any other third party as mutually agreed by the Parties, provided, that, in all events, the Restricted Party shall be responsible for any breach of the confidentiality obligations hereunder by such

third parties of Restricted Party except to the extent such third party directly enters into an agreement with the Disclosing Party related to such disclosure. Each Party may also file this Agreement with the U.S. Securities and Exchange Commission, without the other Party’s prior written consent and may share Confidential Information of the other Party with actual or prospective acquirers, investors or financing parties, including in connection with a transaction involving such Party or any Consumer Credit Products, solely to the extent necessary to facilitate due diligence associated with such transactions, and provided that the recipient of the information shall be subject to confidentiality obligations at least as restrictive as those provided in this Agreement and Applicable Law. Nothing in this Agreement shall prevent Company or its designee from providing an anonymized data tape for informational purposes to a new purchaser or other financing source in connection with a whole loan transfer or financing transaction with respect to Loans originated by Bank.

6.3Return. Upon written request or upon the termination of this Agreement, each Party shall, within thirty (30) days, return to the other Party or destroy all Confidential Information of the other Party in its possession that is in written form, including by way of example, but not limited to, reports, plans and manuals; provided, however, that either Party may maintain in its possession all such Confidential Information of the other Party (i) required to be maintained under Applicable Law relating to the retention of records for the period of time required thereunder or the requirements of a Regulatory Authority or (ii) information relating to the Program stored on back-up servers or systems as a result of Company’s back-up procedures, provided that any retained information shall remain subject to the confidentiality provisions of this Agreement. At the request of the Disclosing Party made at the time of its request for the return or destruction of Confidential Information, the return or destruction of materials in accordance with the foregoing shall be certified to the Disclosing Party in writing by an authorized officer of the Restricted Party.

6.4Notice. In the event that a Restricted Party is requested or required (by oral questions, interrogatories, requests for information or documents, subpoena, civil investigative demand or similar process) to disclose any Confidential Information of the Disclosing Party, the Restricted Party will provide the Disclosing Party with prompt notice of such request(s) to the extent permitted by Applicable Law and (i) to the extent practicable and permitted, the Restricted Party agrees to reasonably cooperate with the Disclosing Party to limit such disclosure or seek confidential treatment of such Confidential Information, and (ii) if the Restricted Party or its applicable representative is compelled to disclose all or a portion of the Disclosing Party’s Confidential Information, the Restricted Party or its applicable representative may disclose that Confidential Information that its counsel advises that it is legally compelled to disclose and will exercise such efforts to obtain reasonable assurance that confidential treatment will be accorded to the Confidential Information that is being so disclosed as the Restricted Party would exercise in assuring the confidentiality of any of its own Confidential Information.

Article 7

REPRESENTATIONS AND WARRANTIES

7.1Bank Representations and Warranties. Bank hereby represents and warrants, as of the Effective Date, or covenants, as applicable, to Company that:

7.1.1Bank (i) is a national banking association, duly organized and validly existing and in good standing under the laws of the United States, the deposits of which are insured by the FDIC to the maximum extent allowed by law, (ii) is authorized, registered, and licensed to do business in each state in which the nature of its activities makes such authorization, registration, or licensing necessary or required, and (iii) has the requisite power and authority to execute and deliver, and perform its obligations under this Agreement, including originating Consumer Credit Products in accordance with this Agreement and the Product Documents;

7.1.2The execution, delivery and performance of this Agreement have been duly authorized, are not in conflict with and do not violate the terms of the certificate of incorporation or bylaws of Bank and will not result in a material breach of or constitute a default under, or require any consent under, any material indenture, loan or agreement to which Bank is a party or by which it is bound and will not violate any outstanding judgment, order, writ, injunction, law, rule or regulation to which it is subject;

7.1.3Bank is in, and will maintain, good standing with the Networks;

7.1.4All approvals, authorizations, consents, and other actions by, notices to and filings with any Person required to be obtained for the execution, delivery, and performance of this Agreement by Bank have been obtained;

7.1.5Bank has full corporate power and authority to execute, deliver and perform all of its obligations under this Agreement;

7.1.6The execution of this Agreement and the completion of all actions required or contemplated to be taken by Bank hereunder are within the ordinary course of Bank’s business and not prohibited by Applicable Law;

7.1.7This Agreement constitutes a legal, valid and binding obligation of Bank, enforceable against Bank in accordance with its terms, except as such enforceability may be limited by (i) applicable bankruptcy, insolvency, reorganization, moratorium, receivership, conservatorship or other similar laws now or hereafter in effect, including the rights and obligations of receivers and conservators under 12 U.S.C. § 1821 (d) and (e), which may affect the enforcement of creditors’ rights in general, and (ii) general principles of equity (whether considered in a suit at law or in equity);

7.1.8There are no proceedings or investigations pending or, to the knowledge of Bank, threatened against Bank (i) asserting the invalidity of this Agreement, (ii) seeking to prevent the consummation of any of the transactions contemplated by Bank pursuant to this Agreement, (iii) that would have a materially adverse financial effect on Bank or its operations if resolved adversely to it, (iv) seeking any determination or ruling that, in the reasonable judgment of Bank, would materially and adversely affect the performance by Bank of its obligations under this Agreement, or (v) seeking any termination or ruling that would adversely and materially affect the validity or enforceability of the Loans;

7.1.9Bank is not Insolvent and is well-capitalized;

7.1.10The Intellectual Property that Bank licenses to Company, if any, and their use as contemplated by this Agreement, do not violate or infringe upon, or constitute an infringement or misappropriation of, any U.S. patent, copyright or U.S. trademark, service mark, trade name or trade secret of any person or entity, and Bank has the right to grant the licenses set forth in Section 5.1;

7.1.11Bank is in compliance with all Applicable Law applicable to it under this Agreement and any Program Schedule and shall comply with Applicable Law in the performance of its obligations and exercise of its rights under this Agreement and any Program Schedule and with regard to any Program;

7.1.12Bank is located in California and Utah for purposes of 12 U.S.C. § 85, as applicable, and, as of the Effective Date, has authority under such section to charge interest allowed by the laws of California or Utah on a Loan made to a Borrower who resides anywhere in the United States; and

7.1.13None of Bank, any of its Affiliates or any of their respective officers, directors, managers or members is a Person (or to Bank’s knowledge, is owned or controlled by a Person) that (i) is listed on any Government Lists, (ii) has been determined by competent authority to be subject to the prohibitions contained in Presidential Executive Order No. 13224 (Sept. 23, 2001) or any other similar prohibitions contained in the rules and regulations of OFAC or in any enabling legislation or other Presidential

Executive Orders in respect thereof, (iii) has been previously indicted for or convicted of any felony involving a crime or crimes of moral turpitude or for any Patriot Act Offense (as defined below), (iv) is currently under investigation by any Regulatory Authority for alleged felony involving a crime of moral turpitude, or (v) is a Sanctioned Person.

7.2Company Representations and WarrantiesCompany hereby represents and warrants, as of the Effective Date, or covenants, as applicable, to Bank that:

7.2.1Company is a corporation, duly organized, and validly existing in good standing under the laws of the State of Delaware, and has the requisite power and authority to execute and deliver, and perform its obligations under, this Agreement;

7.2.2The execution, delivery and performance of this Agreement have been duly authorized, are not in conflict with and do not violate the terms of the organizational documents of Company and will not result in a material breach of or constitute a default under or require any consent under any material indenture, loan or agreement to which Company is a party or by which it is bound and will not violate any outstanding judgment, order, writ, injunction, law, rule or regulation to which it is subject;

7.2.3Company is authorized, registered, and licensed to do business in each state in which the nature of its activities makes such authorization, registration or licensing necessary or required, except where the failure to be so authorized, registered or licensed would not be reasonably expected to have a Material Adverse Effect on Company;

7.2.4To the extent applicable to the Program, Company is in, and will maintain, good standing with the Networks;

7.2.5All approvals, authorizations, consents, and other actions by, notices to, and filings with any Person required to be obtained for the execution, delivery, and performance of this Agreement by Company, have been obtained;

7.2.6This Agreement constitutes a legal, valid and binding obligation of Company, enforceable against Company in accordance with its terms, except as such enforceability may be limited by (i) applicable bankruptcy, insolvency, reorganization, moratorium or other similar laws now or hereafter in effect, which may affect the enforcement of creditors’ rights in general, and (ii) general principles of equity (whether considered in a suit at law or in equity);

7.2.7The execution of this Agreement and the completion of all actions required or contemplated to be taken by Company hereunder are within the ordinary course of Company’s business and not prohibited by Applicable Law;

7.2.8There are no proceedings or investigations pending or, to the best knowledge of Company, threatened against Company (i) asserting the invalidity of this Agreement, (ii) seeking to prevent the consummation of any of the transactions contemplated by Company pursuant to this Agreement or (iii) that would have a materially adverse financial effect on Company or its operations if resolved adversely to it;

7.2.9Company is not Insolvent and is not in default under any of its financing agreements in a manner that materially affects Company’s ability to perform under the Program, including the ability to meet purchase obligations under the applicable Purchase Agreement;

7.2.10The execution, delivery, and performance of this Agreement by Company shall comply with Applicable Law;

7.2.11Neither Company nor any Control Person has been convicted of a crime, or has agreed to or entered into a pretrial diversion or similar program, or is under indictment, in each case in connection with a dishonest act or a breach of trust or money laundering, as set forth in Section 19 of the Federal Deposit Insurance Act, 12 U.S.C. § 1829(a);

7.2.12Company and its Affiliates are in compliance in all material respects with all applicable Anti-Money Laundering Laws and Anti-Corruption Laws. Without limiting the generality of the foregoing, Company has established an AML compliance program that is in compliance, in all material respects, with all applicable Anti-Money Laundering Laws and Anti-Corruption Laws and Bank’s written requirements provided by Bank to Company from time to time;

7.2.13Company and its Affiliates have and shall maintain all necessary licenses, permits, consents, concessions, authorizations of governmental, regulatory or administrative agencies or authorities, whether federal, state or local, required to engage in the activities as contemplated by this Agreement;

7.2.14The Intellectual Property that Company licenses, if any, and their use as contemplated by this Agreement, do not violate or infringe upon, or constitute an infringement or misappropriation of, any U.S. patent, copyright or U.S. trademark, service mark, trade name or trade secret of any person or entity, and Company has the right to grant the license set forth in Section 5.2;

7.2.15Company is in compliance with all Applicable Law applicable to it under this Agreement, any Program Schedule, and any Program Documents and shall comply with Applicable Law in the performance of its obligations and exercise of its rights under this Agreement and any Program Schedule and with regard to any Program;

7.2.16All information maintained by Company for Bank through Company’s Platform or provided by Company to Bank in connection with an Account is true, correct, and consistent with the information obtained or generated by Company;

7.2.17Company is not a “money services business” as such term is defined in 31 C.F.R. § 1010.100(ff);

7.2.18Company is not required to register as an “investment company” within the meaning of the Investment Company Act of 1940, as amended, and is not owned or controlled by an “investment company” within the meaning of the Investment Company Act of 1940, as amended; and

7.2.19None of Company, any of its Affiliates or any of their respective officers, directors, managers or members is a Person (or to Company’s knowledge, is owned or controlled by a Person) that (i) is listed on any Government Lists, (ii) has been determined by competent authority to be subject to the prohibitions contained in Presidential Executive Order No. 13224 (Sept. 23, 2001) or any other similar prohibitions contained in the rules and regulations of OFAC or in any enabling legislation or other Presidential Executive Orders in respect thereof, (iii) has been previously indicted for or convicted of any felony involving a crime or crimes of moral turpitude or for any Patriot Act Offense, (iv) is currently under investigation by any Regulatory Authority for alleged felony involving a crime of moral turpitude, or (v) is a Sanctioned Person. For purposes of this Section 7, the term “Patriot Act Offense” means any violation of the criminal laws of the United States of America or of any of the several states, or that would be a criminal violation if committed within the jurisdiction of the United States of America or any of the several states, relating to terrorism or the laundering of monetary instruments, including any offense under (A) the criminal laws against terrorism; (B) the criminal laws against money laundering, (C) the Bank Secrecy Act, as amended, (D) the Money Laundering Control Act of 1986, as amended, or (E) the Patriot Act. “Patriot Act Offense” also includes the crimes of conspiracy to commit, or aiding and abetting another to commit, a Patriot Act Offense.

7.3Generally. The representations and warranties of Bank and Company contained in this Article 7, except those representations and warranties contained in subsections 7.1.8 and 7.2.8, are made continuously throughout the Term. In the event that any investigation or proceeding of the nature described in subsection 7.1.8 or subsection 7.2.8 is instituted or threatened against a Party, such Party shall promptly notify the other Party of the pending or threatened investigation or proceeding, provided that such disclosure is permitted by Applicable Law or a Regulatory Authority, as applicable.

Article 8

ADDITIONAL COVENANTS

8.1Conduct of Business. Company shall perform all actions necessary to remain duly organized or incorporated, validly existing, and in good standing in its jurisdiction of formation and to maintain all requisite authority to conduct its business in each jurisdiction in which it conducts business.

8.2Preservation of Corporate Existence. Company shall preserve and maintain its corporate existence, rights, franchises, and privileges in the jurisdiction of its formation, and qualify and remain qualified in good standing as a foreign corporation in each jurisdiction where the failure to preserve and maintain such existence, rights, franchises, privileges, and qualification has had, or could reasonably be expected to have, a material adverse effect with respect to Company.

8.3Representations. Each Party shall promptly, upon having knowledge thereof, provide the other Party with written notice that any representation or warranty set forth herein or in any Program Document or Program Schedule was incorrect at the time it was given or deemed to have been given, which failure or breach would reasonably be expected to materially and adversely affect such other Party, including reasonable detail of the nature of such facts and circumstances.

8.4Notice of Material Events. Each Party shall, as soon as practicable and permitted, after becoming aware thereof, provide the other Party with written notice of any event or circumstances that, in its reasonable judgment, has had or would reasonably be expected to have a Material Adverse Effect with respect to the Party.

8.5Notice of other Changes.Each Party shall, within thirty (30) days, after becoming aware thereof, provide the other Party with written notice of any material adverse changes in such Party’s financial position, business, or operations related to the Program, provided that neither Party shall be required to provide the other Party with confidential supervisory information.

8.6Financial Covenants. [***].

8.7Accounting Changes. Company shall promptly notify Bank of any material change in Company’s accounting policies that adversely affect a Program.

8.8Software Connection. With respect to Consumer Credit Products, Company shall establish and maintain an application program interface connectivity to Bank’s automated accounting and loan tracking system designed to accurately reflect all Loan Applications, Loans, and related information regarding the Program to satisfy the commercially reasonable information requirements of Bank, Regulatory Authorities, and Bank’s internal and external auditors.

8.9Material Systems Failure. Company shall promptly notify Bank of any material systems failure that would adversely affect a Program and shall advise Bank of the estimated time required to remedy such material systems failure. Until such material systems failure is remedied, Company shall (i) furnish to Bank such periodic status reports and other information relating to such material systems failure as Bank may reasonably request and (ii) promptly notify Bank if it believes that such material systems failure cannot be remedied by the estimated date, which notice shall include a description of the circumstances

which gave rise to such delay, and the actions proposed to be taken in response thereto. Company shall promptly notify Bank when such a material systems failure has been remedied.

Article 9

AUDIT AND REPORTING REQUIREMENTS

9.1Bank Audit. During the Term and any Wind-Down Period, Bank shall have the rights to audit and inspect (directly or through third parties) Company’s books, records, operations, premises, and physical assets to confirm Company’s compliance with Applicable Law, Network Rules, this Agreement, the Program Policies and any Program Schedule, and any other contractual obligations of Company to Bank. Bank shall make commercially reasonable efforts to (i) avoid undue disruption of Company’s business operations; (ii) perform any onsite audit activities during normal business hours; and (iii) provide at least thirty (30) days’ advance written notice of an audit, except in exigent circumstances where such prior notice cannot be provided. [***]. Additional audits in the same year shall be at Bank’s expense unless the audit identifies, or was required as a result of, noncompliance by Company with Applicable Law, Network Rules, Program Policies, or this Agreement, including a Program Schedule, in which case Bank’s reasonable, documented third-party (i) legal expenses; and (ii) expenses in conducting such audit and any additional audits, as necessary to resolve the noncompliance, shall be at Company’s expense. Bank will use commercially reasonable efforts to minimize the costs of any audit.

9.2Bank Regulatory Audit. Company acknowledges that (i) Bank is subject to examination and audit by Regulatory Authorities; and (ii) that Regulatory Authorities may also examine and audit Company, as Bank’s service provider and program manager, or require Bank to perform such audit. Company further acknowledges that its performance is subject to examination by Bank Regulatory Authorities, including access to all Program-related work papers, drafts, and other materials or locations in which Company performs any obligations under this Agreement. During the Term and for a period of [***] following the termination or expiration of this Agreement and any Wind-Down Period, Company agrees to cooperate fully with respect to all such audits at no additional cost to Bank, but subject to the cap set forth in Section 9.1. The timing, scope, and manner of such audits shall be as requested by the applicable Regulatory Authority and, Company agrees to provide Bank or the applicable Regulatory Authority with reasonable access to and assistance with any information, materials, personnel, systems, or locations required by Bank or the Regulatory Authority to confirm Company’s compliance with Applicable Law, this Agreement, the Program Policies and any Program Schedule. Company further agrees to notify Bank as soon as practicable of any formal request by any Bank Regulatory Authority to examine Company’s records pertaining to Bank or its customers where permitted by Applicable Law. Any audit of Company required by a Regulatory Authority shall be at Company’s expense.

9.3Audit Findings. If Company is determined to be noncompliant with Applicable Law, Network Rules, this Agreement, the Program Policies or any Program Schedule as a result of any audit, Company shall (i) take action to remedy the non-compliance within a commercially reasonable period of time, provided that Bank may agree to extend this period in its sole reasonable discretion and Company shall provide Bank with evidence of the steps taken to rectify the audit finding; and (ii) conduct any additional audits as may be requested by Bank at Company’s sole expense.

9.4Information Security Audits.

9.4.1At least once annually, Company shall cooperate with and bear the reasonable expenses of a SOC 2 Type 2 audit, which shall include review of the Information Security Program, and shall be conducted by a third-party audit firm that is selected by Company, subject to Bank’s approval, which approval shall not be unreasonably withheld, conditioned, or delayed. The scope of each audit shall be consistent with industry standards and Bank shall receive all final reports from the audit firm and, at Bank’s written request, shall be included in meetings or correspondence related to the audit that directly relate to Bank. Notwithstanding the foregoing, Bank may, in its sole discretion, accept in lieu of such third

party annual audit the report of an information technology audit conducted by Company. In all circumstances, Company shall promptly provide management’s response to any errors or deficiencies identified in any such report or audit, and take action to correct any material errors or deficiencies identified in any such report or audit and shall develop, with the approval of Bank, a schedule for the correction of such errors and deficiencies.

9.4.2Company shall engage a third party to conduct penetration testing and vulnerability scans, the frequency and scope of which will be mutually agreed to by the Parties, and Company shall promptly provide a high-level summary of the results of such testing to Bank. Company shall report to Bank on the remediation or other actions taken in response to the findings of such testing. To the extent permitted by the agreement(s) between Company and any Critical Service Provider, Company shall require each of its Critical Service Provider to provide, on an annual basis, evidence reasonably satisfactory to Bank that it has sufficient information security protections. Following Bank’s request and subject to any confidentiality restrictions in Company’s agreements with its Critical Service Providers, Company shall provide Bank with a copy of any security documentation provided by such Critical Service Provider. Notwithstanding the foregoing, if, after using reasonable efforts to obtain the foregoing evidence and documentation from such Critical Service Providers, Company cannot obtain such evidence or documentation, Company may (i) provide a summary of any such security documentation (redacted, where necessary) that may materially impact operations specific to the Program or (ii) request a waiver from this requirement from Bank and Bank may, in its discretion, grant such waiver (not to be unreasonably withheld, conditioned, or delayed).

9.5Reporting.

9.5.1Periodic Reports. Company shall provide to Bank on [***] (i) standard reporting identified in the Program Guidelines provided by Bank; and (ii) responses to surveys or questionnaires reasonably provided by Bank concerning Company’s policies, procedures, and controls to ensure that Company is maintaining compliance with its obligations pursuant to this Agreement. To the extent Company relies on a Critical Service Provider (including a Processor) for any information reasonably required by Bank under this provision, Company shall facilitate such reporting that is reasonably available to Company. Additionally, Company shall (A) if Company uses any models as part of a Program including but not limited to any credit model, assist Bank in its model validation process and provide necessary documentation and information to ensure general understanding of the modeling approach, assumptions, input data, and model performance to meet the requirement of model governance framework at a summary-level (it being understood that Company may withhold specific modeling information including any information that Company considers to be proprietary information) and (B) subject to the following sentence, participate in third party management monitoring calls as may be required by Bank to meet its third-party oversight requirements, comply with Applicable Law, or comply with the requirements of a Regulatory Authority. Bank shall not be entitled to copy or retain any source code, algorithms, or other proprietary methodologies underlying such credit models. Any model validation or audit required by Bank shall be first conducted by Company’s internal model validation team and Company shall provide Bank with a summary or a report of the same with any source code, algorithms, or other proprietary methodologies underlying such credit models redacted, it being understood that Company shall use reasonable efforts to provide Bank with such model validation information as is reasonably necessary to address any legal or regulatory concerns of Bank. Following such model validation or audit, to the extent that Bank reasonably determines that an independent third-party audit is necessary to comply with Bank’s obligations under Applicable Law, Company shall cooperate with a third-party auditor selected by Bank and approved by Company (which approval Company shall not unreasonably withhold, condition, or delay), provided that such third-party audit shall not entitle Bank to separately receive, copy, or retain any source code, algorithms, or other proprietary methodologies underlying such credit models, and Company may redact any related report accordingly. The Parties shall agree on a case-by-case basis to the time frame within which Company must provide the information required by Bank, except where Bank must request the information on behalf of or instruction from any Bank Regulatory Authority, in which case the term set by such Regulatory Authority must be complied with. Company will ensure that all information

provided to Bank (directly or indirectly) is correct, and all records reported are complete and accurate. Company agrees to comply with the requirements of this section at Company’s expense. For the avoidance of doubt, as between the Parties, Company is and shall remain the sole and exclusive owner of all right, title, and interest in and to its credit models (including all Intellectual Property therein), and nothing in this Agreement or any Program Document shall be deemed to transfer, assign, or otherwise convey any ownership interest in Company’s credit models to Bank.

9.5.2Financial Statements. Company shall provide to Bank (i) an audited annual financial statement, which shall, at a minimum, include a balance sheet and related statements of income and cash flow, audited by an independent accounting firm within [***] following the end of Company’s fiscal year, and such financial statements shall be accompanied by an opinion of such independent accounting firm that the consolidated financial statements present fairly, in all material respects, the financial position of Company and the results of its operations in accordance with accounting principles generally accepted in the United States and (ii) an unaudited quarterly financial statement, including a balance sheet and related statements of income, cash flow, and forecast complied by Company, within [***] after the end of each quarter, certified by the chief executive officer, chief financial officer, treasurer or controller of Company as fairly presenting the financial position, results of operations of Company and as having been prepared in accordance with GAAP, subject only to normal year-end audit adjustments, and including financial statements both for that quarter and year-to-date. Company may satisfy the obligations contained in this Section 9.5.2 through any publicly available annual or quarterly financial statements that have been filed with a Company Regulatory Authority.

9.5.3Information Requested by Bank. Company shall provide to Bank any other data submissions and reports as may be reasonably required by Bank, or as agreed to between the Parties, to maintain effective enterprise risk management, internal controls, and compliance management systems and to monitor Company and its Service Providers for compliance with this Agreement, any Program Schedule, Program Documents, Program Policies, and Applicable Law in order to facilitate Bank’s compliance with Applicable Law.

9.6Document Retention. Company shall maintain and retain on behalf of Bank all original Applications and copies of all notices and other documents relating to rejected Applications for the period required by Applicable Law, [***]. Company shall further maintain originals or copies, as applicable, of all the Product Documents, Marketing Materials, and any other documents provided to or received from Accountholders and/or Applicants for a period [***].

9.7Notification to Bank. Company agrees that should an audit, investigation or review of Company or its Service Providers reveal material noncompliance with this Agreement, a Program Schedule, Program Policies, and/or Applicable Law, Company shall notify Bank as soon as reasonably possible but, in any case, [***] of its actual knowledge of the noncompliance. In addition to the indemnification provided for in Section 12.2.1, Company agrees to take all necessary steps reasonably requested in writing by Bank or required by Bank’s Regulatory Authorities to remediate and conform in all material respects Company’s or Company’s Service Providers’ actions with this Agreement, the applicable Program Schedule, Program Documents, Program Policies, and/or Applicable Law, including reporting any potential restitution to any affected Borrowers that is reasonably acceptable to the Bank. Company further agrees to establish appropriate mitigation steps to Bank’s reasonable satisfaction designed to prevent the reoccurrence of any such noncompliance.

9.8Consumer Credit Products. With respect to Consumer Credit Products, and without limiting the foregoing, Company shall provide such supplemental information that is reasonably available to Company without undue effort or expense as Bank may reasonably request regarding the performance of Consumer Credit Products originated through the Program using measures such as production volumes and trends, approval rates, decline rates, losses, delinquencies, collections, prepayments, Consumer Credit Products in bankruptcy, identification of Consumer Credit Products that have been granted modified terms together with, to the extent applicable, a description of the modifications, late payments,

non-sufficient funds fees, returns, and reversal fees, any other events factoring into the repayment history of a Consumer Credit Products, and any other measure that Company internally tracks (all of which shall be deemed Company’s Confidential Information). Company shall provide such information within a timeframe reasonably acceptable to Bank, in a commercially reasonable manner, and in a form sufficient to permit Bank to conduct a meaningful analysis for risk or compliance purposes, including compliance and credit quality, including by individual third parties, loan type, origination period or vintage, and credit grade or score bands.

Article 10

FEES AND EXPENSES

10.1General.

10.1.1Fees and pricing for each Program shall be set forth in each Program Schedule. Company shall bear all expenses in the marketing, opening, management, and servicing of Programs and Accounts, including the costs associated with all funds transfers executed in connection with a Program, and, to the extent Bank incurs any of the foregoing, Company shall promptly reimburse Bank for its reasonable, out-of-pocket external cost and expenses that are directly attributable to the Program. [***]. Subject to any applicable Program Schedule, Company shall be responsible for (i) any BIN sponsorship fees, other Network or Processor fees incurred in registering Company with any Network (if applicable), and any other Network fees incurred in connection with the operation of a Program; (ii) all actual, out-of-pocket costs of obtaining credit reports, delivering adverse action notices and other regulatory disclosures, preparing other Program materials, and administering any rewards programs; (iii) any actual, out-of-pocket fees for Company’s own use of Bank’s services, including ACH, wire, and account fees; (iv) Bank’s actual legal costs associated with the Program, including but not limited to review of new Programs or Program features, legal review of Marketing Materials, changes to Account Opening Requirements or Account Agreements, [***], and resolution of Company compliance issues, [***] (v) Bank’s variable compliance costs and expenses; (vi) reasonable legal fees associated with Bank entering into another agreement at Company’s request with Company or a third party with respect to the Program, including third party sale agreements, agency agreements and any agreements with, or in connection with, the credit bureaus, [***], (vii) modifications to this Agreement, any Program Schedule, or any other Program Documents requested by Company or otherwise required by Bank for compliance purposes, [***]; (viii) Company submitting a change management request; (ix) actual, out-of-pocket fees for any Uniform Commercial Code filings relating to any Consumer Credit Product; and (x) reasonable legal fees associated with transactions to which Bank is not otherwise a party but in which Bank’s participation is requested by Company based on Bank’s role in a Program. [***]. Without limiting the generality of the foregoing, Company is responsible for the costs associated with all funds transfers executed in connection with a Program.

10.2Operating Account. Company shall, during the Term and any Wind-Down Period, maintain an operating account (“Operating Account”) at Bank. The Operating Account will be used to accumulate Program revenues owed to Company and to fund amounts owed to Bank. The Operating Account shall be governed by the terms and conditions of Bank’s standard commercial deposit account and treasury management agreements, as applicable.

10.3Taxes. Each Party shall be responsible for payment of any federal, state or local taxes or assessments associated with the performance of its obligations under this Agreement and for compliance with all filing, registration, and other requirements with regard thereto. Company acknowledges and agrees that all excise, sales, use, transfer, documentary, stamp tax, intangible or similar taxes that are payable, that relate to, or arise as a result of any Loans, including Consumer Products, contemplated by this Agreement, including without limitation Florida’s documentary stamp tax set forth in Section 201.08 of the Florida Statutes (“Taxes”) and any recording or filing fees relating to the Taxes, shall be timely paid by Company. In the event that Bank pays the Taxes described in the immediately preceding sentence,

including any penalties or interest imposed thereon, then Company shall promptly reimburse Bank for its payment of such amounts.

10.4Payments. Notwithstanding anything to the contrary contained herein, neither Party shall be excused from making any payment required of it under this Agreement as a result of a breach or alleged breach by the other Party of any of its obligations under this Agreement or any other agreement; provided, that the making of any payment hereunder shall not constitute a waiver by the Party making the payment of any rights it may have under this Agreement, any Program Schedule, or Applicable Law.

10.5Invoices. Bank shall provide Company a periodic, reasonably itemized invoice for amounts due pursuant to this Article or the corresponding provisions of any Program Schedule for the preceding month, including any usage-based fees. Company shall pay any such undisputed invoice within thirty (30) days of receipt of such invoice. Company may raise a good faith dispute on the amounts in an invoice by providing written notice to Bank together with a reasonably detailed description of the reason for dispute. If Company fails to provide notice of a dispute within sixty (60) days of the date of the applicable invoice, Company shall be deemed to have waived its dispute rights. Payment shall be due thirty (30) days after the date of an invoice and Bank shall debit the Operating Account for the undisputed amount of the invoice. In the event there are insufficient funds in the Operating Account to make payment on an invoice when due, Company shall make an immediate payment to Bank.

10.6Reserve Accounts.

10.6.1Program Reserve Accounts. In connection with a Program, Company must establish one or more reserve accounts as and to the extent set forth in the applicable Purchase Agreement to secure Company’s obligations under this Agreement and any Program. Company agrees to fund such reserve account in such minimum amounts as may be set forth in an applicable Purchase Agreement. In the event of wind-down under Section 11.4, Bank will not be obligated to return the remaining balance in the reserve account to Company until the conclusion of the Wind-Down Period or until all outstanding obligations are satisfied, whichever occurs later.

10.6.2Required Minimum Balance. As and to the extent set forth in the applicable Program Schedule, Bank shall establish and Company shall fund and maintain at all times a noninterest-bearing deposit account at Bank in the Company’s name to hold funds to cover Losses and any other unpaid obligations of Company to Bank, which shall be controlled by Bank and held on behalf of Company (the “Reserve Account”). Company shall ensure the Reserve Account is funded at all times with a minimum balance [***]. For the avoidance of doubt, Bank may not change the calculation of the Required Minimum Balance (except as set forth in Section 10.6.4) unless mutually agreed to by the Parties. Company shall fund the Reserve Account prior to the provision of any Services to Borrowers or marketing the Consumer Loan Program to any Person and shall maintain the Required Minimum Balance in the Reserve Account for a minimum of [***] days following the termination of this Schedule and any Wind-Down Period. In the event a Reserve Account falls below the Required Minimum Balance, Bank shall notify Company and Company shall deposit sufficient funds within [***]. The Bank retains the right to withhold the Reserve Account balance in the event obligations are outstanding at the end of the Wind-Down Period. For the avoidance of doubt, the existence of the Reserve Account shall not limit any liability for any Losses, liabilities, costs or other expenses that Company is responsible for under the terms of any Program Documents or any Schedule. Company grants to Bank a security interest in the Reserve Account to secure the full and faithful performance of Company’s payment and other obligations under any Program Documents, including this Agreement.

10.6.3Bank’s Right to Withdraw from Reserve Account. Without limiting any other rights or remedies of Bank under any Program Documents, the applicable Program Schedule or as may be available at law or equity, Bank shall have the right to withdraw funds from the Reserve Account to [***]. Prior to any of Bank’s withdrawal of funds in connection with this Section, Bank shall provide written notice to Company at least [***] Days prior to such withdrawal. Thereafter if not paid directly by Company

and such amounts are withdrawn by Bank, then Company will deposit into the Reserve Account an amount sufficient to cause the balance to be not less than the Required Minimum Balance within [***] after receipt of such notice. Repeated failures by the Company to maintain the Required Minimum Balance may result in modifications to the minimum reserve levels in accordance with Section 10.6.4.

10.6.4Modifications.Bank reserves the right to increase or decrease the Required Minimum Balance as set forth in Exhibit Dat any time or to otherwise modify the method through which it is calculated in each case (other than in respect of a decrease) in the event of the occurrence of a Material Adverse Effect on the Company, provided that any such change resulting in an increase to the calculation of the Required Minimum Balance is subject to advance written notice and shall only occur in the event that (i) a Regulatory Authority finds that the Required Minimum Balance is not sufficient to cover the risks collateralized by the Reserve Account or (ii) Company causes repeated breaches of Program Documents. Any increase shall be commensurate with the risk relating to the occurrence giving rise to the increase in the Required Minimum Balance. Following receipt of such notice, Company shall have [***] to increase the Required Minimum Balance to the amount provided in the notice, and this amount shall then become the Required Minimum Balance.

10.6.5Company’s Right to Withdraw from Reserve Account. Company acknowledges and agrees it shall not, and shall have no rights to, withdraw funds from the Reserve Account unless and solely to the extent such withdrawal shall not cause the balance in the Reserve Account to fall below the Required Minimum Balance.

10.7Losses. Except to the extent that any Losses arise from (a) gross negligence or willful misconduct on the part of Bank or Bank or Bank employee fraud or (b) Company’s compliance with Bank-mandated actions that are a violation of Applicable Law, [***].

10.8Rightof Setoff. Bank may, in its sole discretion, set-off, combine, consolidate or otherwise appropriate and apply [***].

Article 11

TERM AND TERMINATION

11.1Term.

11.1.1Agreement Term. Unless terminated earlier in accordance with this Article 11, this Agreement shall have an initial term beginning on the Effective Date and ending on the final day of the calendar month that is the fourth (4th) anniversary of the Effective Date (the “Initial Term”) and shall renew automatically for successive terms of one (1) year each (each a “Renewal Term,” and, collectively, the Initial Term and Renewal Term(s), together with any Wind-Down Period, shall be referred to as the “Term”), unless either Party provides written notice of non-renewal to the other Party at least one hundred and eighty (180) days prior to the end of the Initial Term or any Renewal Term or this Agreement is earlier terminated in accordance with the provisions hereof.

11.1.2Program Schedule Term. Each Program Schedule shall have a term expiring at the end of the Term, unless otherwise specified in such Program Schedule.

11.2Termination.

11.2.1Program Schedule Termination. Either Party shall have the right to terminate this Agreement upon the expiration or earlier termination of all Program Schedules; provided, that the provisions that are specifically noted to survive any expiration or termination in this Agreement or any Program Schedule shall survive such expiration or termination.

11.2.2Bank Termination Rights. Bank shall have the right to terminate this Agreement:

11.2.2.1upon thirty (30) days’ notice to Company, if Bank determines in its reasonable discretion (i) that in good faith (a) its continued performance under this Agreement or any Program Schedule would be in violation of Applicable Law, including but not limited to, as a result of a change in Applicable Law, any judicial decision of a court having jurisdiction over Bank, or any interpretation of a Regulatory Authority with jurisdiction over Bank, or (b) its continued performance under this Agreement or any Program Schedule would materially and adversely affect the safety and soundness of Bank; and (ii) that such material violation cannot be cured through timely modification of a Program, as provided herein (it being understood that modifying the underlying action or omission or aspect of the Program such that it would not cause a violation on a go-forward basis shall be deemed to cure the violation, except in the case of repeated violations); provided that Bank shall retain all suspension rights under Section 11.2.5 (as applicable) during the thirty (30) day notice period;

11.2.2.2immediately upon written notice to Company, if there is a Material Adverse Effect with respect to Company that, if capable of cure, remains uncured more than thirty (30) Business Days after written notice thereof from Bank;

11.2.2.3immediately upon written notice to Company, if Company breaches its obligations to fund any Reserve Account and does not fund the Reserve Account up to the Required Minimum Balance as set forth in Section 10.6.2; or

11.2.2.4immediately upon written notice to Company, if there is a Change of Control at Company that has not otherwise been approved in writing by Bank (such approval not to be unreasonably withheld, conditioned, or delayed).

11.2.3Mutual Termination Rights. Either Party shall have the right to terminate this Agreement immediately upon written notice to the other Party in any of the following circumstances:

11.2.3.1the Party’s continued participation in the Program has been prohibited by order or injunction of any court or any requirement of Regulatory Authority;

11.2.3.2any representation or warranty made by the other Party in this Agreement or any Program Schedule is or becomes incorrect in any material respect and is not corrected within thirty (30) Business Days after written notice thereof has been given to such other Party;

11.2.3.3the other Party defaults in the performance of any material obligation or undertaking under this Agreement or any Program Schedule, and such default continues for thirty (30) Business Days after written notice thereof has been given to such other Party;

11.2.3.4the other Party has a receiver or conservator appointed for it, commences a voluntary case or other proceeding seeking liquidation, reorganization or other relief with respect to itself or its debts under any bankruptcy, insolvency, receivership, conservatorship or other similar law now or hereafter in effect or seeking the appointment of a trustee, receiver, liquidator, conservator, custodian or other similar official of it or any substantial part of its property, or consents to any such relief or to the appointment of a trustee, receiver, liquidator, conservator, custodian or other similar official or to any involuntary case or other similar proceeding commenced against it, or makes a general assignment for the benefit of creditors, or fails generally to pay its debts as they become due, or takes any corporate action to authorize any of the foregoing;

11.2.3.5an involuntary case or other proceeding, whether pursuant to banking regulations or otherwise, is commenced against the other Party seeking liquidation, reorganization or other relief with respect to it or its debts under any bankruptcy, insolvency, receivership, conservatorship or other similar law now or hereafter in effect or seeking the appointment of a trustee, receiver, liquidator,

conservator, custodian or other similar official of it or any substantial part of its property and such action or proceeding remains undismissed sixty (60) days after its filing; or an order for relief is entered against the other Party under the federal bankruptcy laws as now or hereafter in effect; or

11.2.3.6by providing the other Party with written notice at least one hundred and eighty (180) days prior to the end of the Initial Term or any Renewal Term, as the case may be.

11.2.4Company Termination Rights. Company shall have the right to terminate this Agreement immediately upon written notice to Bank:

11.2.4.1if Bank can no longer support the Program in all material respects or perform its obligations under the Program or originate or issue the products contemplated under any Program Schedule;

11.2.4.2if Bank limits the Program (including the volume of any transactions) in connection with an activity, event, or circumstance unrelated to Company’s (i) breach of this Agreement (ii) violation of Applicable Law; or (iii) action causing a material risk of Losses, reputational risk, or adverse effects on the safety and soundness of Bank;

11.2.4.3[***].

11.2.4.4[***].

11.2.5Suspension. In addition to any other rights or remedies available to Bank under this Agreement or by law, following the provision of written notice to Company, Bank shall have the right to suspend performance of its obligations under this Agreement during the period commencing with the occurrence [***]. Bank shall only exercise its suspension rights under this section if the circumstances giving rise to Bank’s suspension rights cannot be alleviated by the good faith consultation between Company and Bank within a reasonable time after written notice from Bank to Company, and shall work with Company in good faith to lift the suspension.

11.2.6Effect of Termination.

11.2.6.1The termination or expiration of this Agreement either in part or in whole shall not discharge any Party from any obligation incurred prior to such termination.

11.2.6.2To the extent this Agreement, or a Program Schedule, is terminated or expires, the Parties shall cooperate to transition or wind down the Program, as set forth in Section 11.4. Company shall (i) purchase any Consumer Credit Products or Receivables owned by Bank as of the termination date in accordance with the applicable Purchase Agreement (other than Retained Loans); and (ii) Bank may, but will no longer be obligated to, originate any Consumer Credit Products or Receivables (except in respect of any applications for Credit Products received prior to the effective date of termination), unless a Party terminates pursuant to Section 11.2.3.6.

11.3[***].[***].

11.4Post-Termination Assistance and Wind-Down.

11.4.1So long as it is not prohibited by Applicable Law, in the event of the termination or expiration of this Agreement or a Program Schedule, the Parties agree to cooperate in good faith to transition or wind-down any affected Program(s) in accordance with Applicable Law in a commercially reasonable way within 180 days from the date of termination or expiration (the “Wind-Down Period”). Each Party acknowledges that the goals of any transition or wind-down of any Program are to benefit the Accountholders by minimizing any possible burdens or confusion and to protect and enhance the names

and reputations of the Parties. During the Wind-Down Period, Company shall not accept any Account Applications, onboard Accountholders, or open any new Accounts on Bank’s behalf. Except as otherwise provided in this section, each Party shall remain in compliance with all provisions of the Agreement and any Program Schedule, including the maintenance of the appropriate balances in the Operating Account and any Reserve Account and the timely payment of all other amounts under the Agreement and any Program Schedule. In the event (i) Company fails to provide effective notice of its intent to transition a Program pursuant to Section 11.4.2 below; or (ii) a transition is otherwise not permitted, the Parties shall work in good faith to wind down the Program and terminate all Accounts in accordance with their terms and in compliance with Applicable Law. The Bank shall retain the right to shorten the Wind-Down Period if required by a Regulatory Authority.

11.4.2Transition. If this Agreement or any Program Schedule terminates or expires, Company may elect at its sole cost and expense to transition the affected Program to a qualified successor financial institution (“Successor Bank”); provided that, notwithstanding anything herein to the contrary, Bank shall be under no obligation to transition any Program if (i) Bank has terminated this Agreement or any Program Schedule for material non-payment and the same is not cured; (ii) to the extent transitioning the Program would result in Bank’s noncompliance with Applicable Law or the supervisory guidance of a Regulatory Authority; or (iii) the assignment or other documentation used to effectuate the transition does not provide that Bank will be fully indemnified and released with respect to any and all liabilities associated with the transition, it being understood that either Company or Successor Bank may satisfy such indemnification requirement. In the event Company is eligible to transition the Program (a “Transition Event”), Company must give written notice of its decision to exercise this option within sixty (60) days of the notice giving rise to termination of this Agreement or any Program Schedule and, within thirty (30) days of such notice, must provide a detailed, written transition plan, including Company’s proposed timeline for transition, transition procedures, planned Successor Bank, the proposed assignment or other documentation and any other information reasonably requested by Bank (a “Transition Plan”). The Transition Plan must ensure the transition is accomplished prior to the end of the Wind-Down Period.

11.4.3Bank and Company shall meet promptly and use best efforts to finalize a mutually agreed Transition Plan. Unless otherwise contemplated by the Transition Plan, Bank and Company shall continue to be bound by and comply with the terms of this Agreement and any Program Schedule and to perform all of their obligations hereunder until such time as all obligations have been satisfied and resolved to Bank’s satisfaction. If Company is unable or unwilling to continue meeting its obligations under this Agreement, or if the Parties have not agreed on a final Transition Plan within thirty (30) days of the Bank’s receipt of notice of transition to a Successor Bank, the Parties agree to wind down the Program. During any such wind down, Bank will continue to provide all of the services necessary to maintain the Program(s), or any part or portion thereof.

11.4.4Except as required by Applicable Law, in no event will either Party make any public statement or customer communication regarding the wind-down of this Agreement, or any Program without the express prior written approval of the other, which shall not be unreasonably withheld, conditioned, or delayed. Notwithstanding the foregoing, Bank and Company may communicate the termination or expiration of this Agreement with any third party with which it has contracted to provide services for the affected Program(s) and in the case of a Transition Event, Company may communicate the termination or expiration of this Agreement to any third party with which it desires to negotiate to take over as Successor Bank.

11.4.5Upon notice of termination of this Agreement, the Parties shall mutually agree in good faith upon the allocation of expenses and costs associated with a wind-down of any Program or transition to a Successor Bank of any Program; provided, however, that Company shall be responsible for all reasonable and documented third party expenses and costs associated with such wind-down or transition where this Agreement is terminated for cause by Bank. If, after good faith discussions, the Parties are unable to agree on the allocation of expenses and costs within twenty (20) days of notice of termination, then Company shall be responsible for all reasonable and documented third party expenses and costs

associated with such wind-down or transition. Notwithstanding anything to the contrary in this Section 11.4.5, in no event shall Company be responsible for any expenses, costs, fees, charges, or other amounts payable or reimbursable under this Section 11.4.5 that exceed the rates customarily charged by Bank in connection with the wind-down or transition of programs. Failure by Company to pay for post-termination assistance in accordance with these terms shall constitute grounds for Bank to cease providing the post-termination assistance. In addition, Company shall reimburse Bank for all reasonable and documented third-party expenses incurred by Bank in connection with the transfer of any Program to a Successor Bank, including any third-party costs associated with preparing or negotiating any documentation with Company and Successor Bank. Each Party shall pay its own internal costs and expenses incurred in connection with any wind-down of this Agreement or Transition Event.

Article 12

LIMITATION OF LIABILITY; DISCLAIMER OF WARRANTIES AND INDEMNIFICATION

12.1Limitation of Liability. NOTWITHSTANDING ANYTHING IN THIS AGREEMENT TO THE CONTRARY, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL, OR EXEMPLARY DAMAGES OR LOST PROFITS (EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR ANY PROGRAM SCHEDULE. THE FOREGOING LIMITATION SHALL NOT, HOWEVER, APPLY TO ANY CLAIM ARISING FROM ANY INTENTIONAL OR WILLFUL BREACH OF THIS AGREEMENT, BREACH OF THE CONFIDENTIALITY OBLIGATIONS IN ARTICLE 6, INDEMNIFICATION OBLIGATIONS TO THE EXTENT OF AMOUNTS PAYABLE TO A THIRD PARTY, OR A SECURITY BREACH. Notwithstanding anything to the contrary contained in this Agreement, Bank’s total liability for any and all damages shall not exceed [***].

12.2Indemnification.

12.2.1Company Obligations. Except to the extent of any Losses [***], Company shall be liable to and shall indemnify, defend, and hold harmless Bank and its respective directors, officers, employees, agents and Affiliates and permitted assigns from and against any and all Losses arising out of [***].

12.2.2Bank Obligations. Except to the extent of any Losses [***], Bank shall be liable to and shall indemnify, defend, and hold harmless Company and its respective directors, officers, employees, agents and Affiliates, and permitted assigns from and against any and all Losses arising out of [***].

12.2.3Notice of Claims. To the extent permitted by Applicable Law, the Party seeking indemnification (the “Indemnified Party”) hereunder shall promptly notify the indemnifying party (the “Indemnifying Party”), but, in the case of lawsuit, in no event later than the time necessary to enable the Indemnifying Party to file a timely answer to the complaint, in writing, of any notice of the assertion by any third party of any claim or of the commencement by any third party of any legal or regulatory proceeding, arbitration or action, or if the Indemnified Party determines the existence of any such claim or the commencement by any third party of any such legal or regulatory proceeding, arbitration or action, whether or not the same shall have been asserted or initiated, in any case with respect to which the Indemnifying Party is or may be obligated to provide indemnification (an “Indemnifiable Claim”), specifying in reasonable detail the nature of the claim and, if known, the amount or an estimate of the amount of the Losses; provided, that failure to promptly give such notice shall only limit the liability of the Indemnifying Party to the extent of the actual prejudice, if any, suffered by the Indemnifying Party as a result of such failure. The Indemnified Party shall provide to the Indemnifying Party as promptly as practicable thereafter information and documentation reasonably requested by the Indemnifying Party to defend against the Indemnifiable Claim.

12.2.4Defense and Counsel. Subject to the terms hereof, the Indemnifying Party shall have the right to assume the defense of any suit, claim, action or proceeding. The Indemnifying Party shall

have [***] after receipt of any notification of an Indemnifiable Claim (a “Claim Notice”) to notify each relevant Indemnified Party in writing of the Indemnifying Party’s election to assume the defense of the Indemnifiable Claim and, through counsel of the Indemnifying Party’s own choosing, and at its own expense, to commence the settlement or defense thereof, and each such Indemnified Party shall cooperate with the Indemnifying Party in connection therewith if such cooperation is so requested and the request is reasonable; provided, that the Indemnifying Party shall hold each Indemnified Party harmless from its reasonable out-of-pocket expenses, including reasonable attorneys’ fees, incurred in connection with the Indemnified Parties’ cooperation; provided, further, that if the Indemnifiable Claim relates to a matter before a Regulatory Authority, each Indemnified Party may elect, upon written notice to the Indemnifying Party, to assume the defense of the Indemnifiable Claim at the cost of and with the cooperation of the Indemnifying Party. If the Indemnifying Party assumes responsibility for the settlement or defense of any such claim, (i) the Indemnifying Party shall permit each relevant Indemnified Party to participate at such Indemnified Party’s expense (for which no claim of Losses shall be made) in such settlement or defense through counsel chosen by such Indemnified Party; provided, that, in the event that both the Indemnifying Party and an Indemnified Party are defendants in the proceeding, and such Indemnified Party has reasonably determined and notified the Indemnifying Party that representation of both parties by the same counsel would be inappropriate due to the actual or potential differing interests between them, then the reasonable fees and expenses of one such counsel for all Indemnified Parties in the aggregate shall be borne by the Indemnifying Party; and (ii) the Indemnifying Party shall not settle any Indemnifiable Claim without each relevant Indemnified Party’s consent (such consent not to be unreasonably withheld, conditioned, or delayed), except that the Indemnifying Party may settle any Indemnifiable Claim upon notice to each such Indemnified Party if the settlement involves only the payment of money damages (which such money damages are paid by the Indemnifying Party) and no admission of liability by any Person and no injunctive relief, and the settlement is subject to a confidentiality provision prohibiting disclosure of the terms of the settlement.

12.2.5Settlement of Claims. If the Indemnifying Party does not notify each relevant Indemnified Party in writing within [***] after receipt of the Claim Notice that it elects to undertake the defense of the Indemnifiable Claim described therein, or if the Indemnifying Party fails to contest any such Indemnifiable Claim, or if an Indemnified Party elects to control the defense of an Indemnifiable Claim before a Regulatory Authority as permitted by Section 12.2.4 above, then, in each case, the Indemnified Party shall have the right, upon reasonable written notice to the Indemnifying Party, to contest, settle (subject to the Indemnifying Party’s approval and such approval shall not be unreasonably withheld, conditioned, or delayed) or compromise (subject to the Indemnifying Party’s approval and such approval shall not be unreasonably withheld, conditioned, or delayed) the Indemnifiable Claim in the exercise of its reasonable discretion; provided that the Indemnified Party shall notify the Indemnifying Party in writing prior thereto of any compromise or settlement of any such Indemnifiable Claim and shall consider in good faith and discuss with the Indemnifying Party any objection to the settlement the Indemnifying Party may express and provided further that the foregoing shall not limit or modify the Indemnifying Party’s approval rights to any settlement or compromise as set forth in this Section 12.2.5. No action taken by any Indemnified Party pursuant to this Section 12.2.5 shall deprive such Indemnified Party of its rights to indemnification pursuant to this Article 12.

12.2.6Indemnification Payments. Amounts owing under Section 12.2 shall be paid promptly upon written demand for indemnification containing in reasonable detail the facts giving rise to such Losses, except where a Party notifies the other Party within thirty (30) days of receipt of such demand that it disputes its obligation to indemnify, or the Losses being claimed, and the Parties are not otherwise able to reach agreement.

Article 13

MISCELLANEOUS

13.1Relationship of Parties. Except as otherwise provided herein, Bank and Company agree that they are in the position of independent contractors in performing their responsibilities pursuant to this Agreement. This Agreement is not intended to create, nor does it create, and it shall not be construed to create, a relationship of partner or joint venturer or any association for profit between and among Bank and Company.

13.2Governing Law.This Agreement shall be governed by federal law, as well as the internal laws, and not by the laws regarding conflicts of laws, of the State of California. Each Party hereby submits to the jurisdiction of the federal and state courts sitting in San Francisco, California for the resolution of any and all claims arising out of or related to this Agreement, and waives any objection to venue with respect to actions brought in such courts.

13.3Severability. Any provision of this Agreement that is deemed invalid, illegal or unenforceable in any jurisdiction shall, as to that jurisdiction, be ineffective to the extent of such invalidity, illegality or unenforceability, without affecting in any way the remaining portions hereof in such jurisdiction, which such remaining portions shall remain in full force and effect, or rendering such provision or any other provision of this Agreement invalid, illegal or unenforceable in any other jurisdiction. In addition, if the operation of a Program or the compliance by a Party with its obligations set forth herein causes or results in a violation of an Applicable Law, the Parties agree to negotiate in good faith to modify the impacted Program or this Agreement as necessary in order to permit the Parties to continue the impacted Program in full compliance with Applicable Law.

13.4Assignment. This Agreement and the rights and obligations hereunder it shall be binding upon and inure solely to the benefit of the Parties and their respective successors and permitted assigns. Neither Party shall be entitled to assign or transfer any interest under this Agreement without the prior written consent of the other Party, provided that following advance notice to Company, Bank may assign or transfer any interest to its Affiliates as part of an internal restructuring at any time without the consent of Company, so long as such assignee remains a federally-chartered bank with the ability to meet the obligations of Bank under the Program. No assignment under this section shall relieve a Party of its obligations under this Agreement.

13.5Third-Party Beneficiaries. Nothing contained herein shall be construed as creating a third-party beneficiary relationship between either Party and any other Person.

13.6Notices. All notices and other communications under this Agreement shall be in writing and shall be deemed received (a) on the day delivered, if delivered by hand; (b) on the day transmitted, if transmitted by facsimile or e-mail with receipt confirmed; (c) three (3) Business Days after the date of mailing to the other Party, if mailed first-class mail postage prepaid; or (d) when delivered in person, if mailed by express or overnight mail delivered by a nationally recognized courier (delivery charged prepaid), in each case at the applicable address that follows (or such other address as either Party shall specify in a notice to the other):

To Bank: Column National Association

Attention: Legal

[***]

Email: [***]

To Company: Oportun, Inc.
Attention: Chief Legal Officer

1825 South Grant Street, Suite 850

San Mateo, CA 94402

Email: [***]

13.7Amendment and Waiver. This Agreement may not be amended orally, but only by a written instrument signed by all Parties. The delay or failure of a Party to require the performance of any term of this Agreement or the waiver by a Party of any default under this Agreement shall not prevent a subsequent enforcement of such term and shall not be deemed a waiver of any subsequent breach. All waivers must be in writing and signed by the Party against whom the waiver is to be enforced.

13.8Entire Agreement. This Agreement, together with the Program Documents and the exhibits hereto and any exhibits thereto, constitute the entire agreement between the Parties with respect to the subject matter hereof and supersede any prior or contemporaneous negotiations or oral or written agreements with regard to the same subject matter.

13.9Further Assurances. From time to time, and subject to the terms of this Agreement, each Party will execute and deliver to the other such additional documents and will provide such additional information as the other Party may reasonably require to carry out the terms of this Agreement.

13.10Referrals. Neither Party has agreed to pay any fee or commission to any agent, broker, finder or other person for or on account of such person’s services rendered in connection with this Agreement that would give rise to any valid claim against the other Party for any commission, finder’s fee or like payment.

13.11Counterparts. This Agreement may be executed and delivered by the Parties in any number of counterparts, and by different parties on separate counterparts, each of which counterpart shall be deemed to be an original and all of which counterparts, taken together, shall constitute but one and the same instrument. The Parties agree that this Agreement and signature pages may be transmitted between them by electronic mail, that PDF signatures may constitute original signatures, and that a PDF signature page containing the signature (PDF or original) is binding upon the Parties.

13.12Interpretation. The Parties acknowledge that each Party and its counsel have reviewed and revised this Agreement and that the normal rule of construction to the effect that any ambiguities are to be resolved against the drafting party shall not be employed in the interpretation of this Agreement or any amendments hereto, and the same shall be construed neither for nor against either Party but shall be given a reasonable interpretation.

13.13Force Majeure. If any Party is unable to carry out the whole or any part of its obligations under this Agreement by reason of a Force Majeure Event, then the performance of the obligations under this Agreement of such Party as they are affected by such cause shall be excused during the continuance of the inability so caused, except that should such inability not be remedied within thirty (30) days after the date of such cause, the Party not so affected may at any time after the expiration of such thirty (30) days period, during the continuance of such inability, terminate this Agreement on giving written notice to the other Party and without further liability, payment of a termination fee or other penalty. To the extent that the Party not affected by a Force Majeure Event is unable to carry out the whole or any part of its obligations under this Agreement because a prerequisite obligation of the Party so affected has not been performed, the Party not affected by a Force Majeure Event also is excused from such performance during such period. A “Force Majeure Event” as used in this Agreement shall mean an unanticipated event that is not reasonably within the control of the affected Party or its subcontractors (including, but not limited to, acts of God, acts of governmental authorities, strikes, war, riot and any other causes of such nature), and which by exercise of reasonable due diligence, such affected Party or its subcontractors could not reasonably have been expected to avoid, overcome or obtain, or cause to be obtained, a commercially reasonable substitute therefor. No Party shall be relieved of its obligations hereunder if its failure of performance is due to removable or remediable causes which such Party fails to remove or remedy using commercially reasonable efforts within a reasonable time period. Either Party rendered

unable to fulfill any of its obligations under this Agreement by reason of a Force Majeure Event shall give prompt notice of such fact to the other Party, followed by written confirmation of notice, and shall exercise due diligence to remove such inability with all reasonable dispatch.

13.14Insurance. Company agrees to maintain adequate insurance coverage on the terms and conditions specified in ExhibitCat all times during the Term and to notify Bank promptly of any cancellation or lapse of any such insurance coverage. Insurance policies required to be maintained hereunder shall be procured from reputable insurance companies. Company shall provide evidence of its insurance coverages in the form of certificates of insurance promptly following the Effective Date and promptly following any reasonable request from Bank.

13.15Headings. Captions and headings in this Agreement are for convenience only and are not to be deemed part of this Agreement.

13.16Publicity. Neither Bank nor Company shall make, or cause to be made, any press release or public announcement in respect of the Program or this Agreement or the transactions contemplated hereby, or otherwise communicate with any news media regarding the Program or this Agreement, without the prior consent of the other Party (such consent not to be unreasonably withheld, conditioned, or delayed). The Parties agree to cooperate to publicize a press release announcing the Program in a form and manner reasonably acceptable to both Parties. Bank and Company agree that nothing in this Section 13.16 limits or restricts any legal or regulatory disclosure obligations of Bank or Company.

13.17Manner of Payments. Unless the manner of payment is expressly provided herein, all payments under this Agreement shall be made by ACH transfer, wire, or other payment methods agreed by the Parties to the bank accounts designated by the respective Parties. Notwithstanding anything to the contrary contained herein, neither Party shall fail to make any payment required of it under this Agreement as a result of a breach or alleged breach by the other Party of any of its obligations under this Agreement or any other agreement, provided that the making payment hereunder shall not constitute a waiver by the Party making the payment of any rights it may have under this Agreement or by law.

13.18Disputes.

13.18.1In the event of any dispute, controversy or claim arising out of or relating to this Agreement or the construction, interpretation, performance, breach, termination, enforceability or validity thereof (hereinafter, a “Dispute”), the Party raising such Dispute shall notify the other promptly and no later than sixty (60) days from the date of its discovery of the Dispute, provided that any disputes related to Losses are subject to Section 13.18.2. The Parties shall cooperate and attempt in good faith to resolve any Dispute promptly by negotiating between persons who have authority to settle the Dispute and who are at a higher level of management than the relationship managers with direct responsibility for administration and performance of the provisions or obligations of this Agreement that are the subject of the Dispute. If such persons are unable to resolve the Dispute within fifteen (15) days, then the Parties can seek remedies from a court of competent jurisdiction subject to Section 13.2. Notwithstanding the foregoing, this Section 13.18 shall not limit a Party’s right to obtain any provisional remedy, including, without limitation, specific performance or injunctive relief from any court of competent jurisdiction (subject to Section 13.2), as may be necessary, in the sole discretion of the aggrieved Party, to protect its rights under this Agreement or to institute formal proceedingsprior to the expiration of the time periods set forth in this Section 13.18 to preserve a superior position with respect to other creditors.

13.18.2[***].

13.19Survival. The terms of Articles 4, 6, 12, and 13 and Sections 5.5, 9.2 (to the extent set forth therein), 9.6 (to the extent set forth therein), 10.4, 10.5, 10.6 (to the extent set forth therein), 10.7, 11.2.6, 11.3, and 11.4, and any terms that are applicable to or necessary to interpret the foregoing, shall survive termination or expiration of this Agreement.

[Signature Pages Follow]

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their respective duly authorized officers as of the date first written above.

COLUMN NATIONAL ASSOCIATION

By: __/s/ William Hockey
Name: William Hockey
Title: CEO

OPORTUN, INC.

By: /s/ Gaurav Rana
Name: Gaurav Rana
Title: SVP & General Manager, Lending

Exhibit A

Program Policies

Exhibit B

Company’s Critical Service Providers

Exhibit C

Insurance Requirements

Exhibit D

Reserve Account Required Minimum Balance

Exhibit E

Accountholder File Minimum Requirements

Exhibit F

Approved Service Providers

FILING DETAILS