In these Operating Rules, the words "we," "us," "our" and "Clareon" refer to Clareon, and the words "you," "your" and "Client" refer to the business that is enrolling to become, or has enrolled as, a member of the Network (a "Network Member") by completing the enrollment process and submitting an executed Terms of Use Agreement (an "Agreement"). The word "Collector" refers to a Network Member that is enrolled to receive payments, and "Disburser" refers to a Network Member that is enrolled to make payments. The acronym "DPA" (or "digital payment authorization") refers to a payment instruction sent by a Disburser to Clareon.

These Operating Rules are binding on all Network Members. We may amend them, and any amendment shall be effective and binding upon Network Members fifteen (15) days after Network Members are notified about such amendments, as set forth below under "Notices." Your continued use of the Processing Services after the effective date of any amendment shall be deemed your acceptance of the amendment. If there is any conflict between the provisions of the Agreement and the Operating Rules, the provisions of the Agreement shall govern.

These Operating Rules cover the following topics:

	•	Clients' Responsibilities
	•	Security Matters
	•	Processing DPAs
	•	Notices
	•	Fee Assessment and Billing
	•	Intellectual Property Matters
	•	Business Days and Customer Service

1. Clients' Responsibilities

1.1 Collector Responsibilities. If you are a Collector, you must:

	a.	Accept payments received by you in accordance with payment instructions provided by your Disburser.
	b.	Provide us in a timely manner with accurate and complete information about the bank accounts to which payments in connection with Disburser DPAs should be credited ("Collection Accounts"), and provide us on a timely basis with updated information about such Collection Accounts.
	c.	Cooperate with us in error correction procedures. All credits to your Collection Accounts are provisional and subject to correction by Clareon until final settlement of all components of a transfer in accordance with rules governing the banking system (either the NACHA Rules or the rules of applicable clearinghouse or wire transfer service).
	d.	Keep secure and protect from unauthorized use all security devices and codes used to access your account.

1.2 Disburser Responsibilities. If you are a Disburser, you must:

	a.	Select a security procedure (we may offer different options from time to time) that is commercially reasonable for your business.
	b.	Keep secure and protect from unauthorized use all security devices and codes (including all private keys associated with Digital Signature Certificates) used in connection with your security procedure.
	c.	Put accurate payment information in your DPAs. We pay the Collector that you identify the amount that you indicate in accordance with your instructions.
	d.	Have collected funds in your Disbursement Account(s) to cover your payment(s). We may pay penalties (and may charge you a fee) if you have insufficient funds.

1.3 General Responsibilities. If you are either type of Client, you must:

	a.	Use the Processing Services only for business transactions that are lawful.
	b.	Resolve directly with your Collector or Disburser any disputes about the terms and performance of the underlying transaction in connection with which payments are being made.
	c.	Pay us fees for our Processing Services in accordance with our Fee Schedule, as revised by us from time to time upon notice to you, as set forth below under "Notices."
	d.	Identify in your enrollment application a "PayMode Membership Administrator," who will be authorized to manage information relating to your Transaction Account(s) and the information about your employees and agents authorized to use the Processing Services.
	e.	Notify us immediately of any change of the Authorized Signer designated in your enrollment application (the "Authorized Signer"), your PayMode Membership Administrator, your Disbursement or Collection Accounts (collectively, "Transaction Accounts"), or any employees or agents authorized by you to use the Processing Services. You must also notify us immediately of any change in the other information we collect about your business, such as a change in the form or ownership of your business (e.g., through a merger or sale) or in your taxpayer identification or other similar identifying number.
	f.	Notify us immediately if you suspect any errors in any DPA and related payment transaction and assist us in resolving any errors with the Disburser or Collector involved.
	g.	Notify us immediately if you suspect any loss, unauthorized use, compromise or other breach of any security code, private key or device used to access or use the Processing Services. If you are a Disburser, you may be liable for unauthorized DPAs that could have been prevented if you had told us of any such security breach that you suspected.

2. Security Matters

2.1 Digital Certificates. Once you are completely enrolled, we will issue Digital Certificates to your representatives. We issue to all Disburser Clients a Digital Signature Certificate for creating digitally signed DPAs (or files containing documents, including files containing DPAs) for use in the Processing Services, such as authenticating DPAs.

By accepting a Digital Certificate you and each person to whom the certificate is issued agree with the following:

	a.	to use a Digital Signature Certificate solely for authorizing and authenticating DPAs sent to Clareon and executing this Agreement. If you use your Digital Signature Certificate for any other purpose, you will indemnify and hold us and the certificate manufacturer harmless from any and all claims by any third parties arising out of your use of the Digital Signature Certificate.
	b.	to notify Clareon immediately if any individual designated in any Digital Certificate is no longer affiliated with, or no longer authorized to act for, the Client.
	c.	to use Digital Certificates in conformity to Clareon's Certificate Policies, which are available at www.fleet.paymode.com/policies
	d.	because Clareon may revoke any and all Digital Certificates at any time in its sole discretion, you agree to cease using all Digital Certificates when they are revoked and, in any event, upon termination of the Agreement.
	e.	your Digital Certificates are based upon the unique relationship of a private key that is in your sole possession and a public key identified in the Digital Certificate. You agree to comply with the following security procedures to keep your private key private:

		1.	you will safeguard and maintain your private key (and any user IDs, pass phrases, security codes, shared secrets, etc.) in strict secrecy
		2.	you will take reasonable security measures to prevent unauthorized access to, or disclosure, loss, modification, compromise or use of, your private key and the computer system or media on which your private key is stored
		3.	if you ever suspect or discover that your private key has been compromised, you will immediately contact Clareon and request that the corresponding Digital Certificate be revoked; you will also stop using the corresponding Digital Certificate immediately.

2.2 Account Changes. In order to protect Clients and Clareon, changes to Transaction Accounts or other information in a Client's profile may only be made in compliance with Clareon's security procedures. To update your profile information, you may access the PayMode secure site at www.fleet.paymode.com or you may contact Clareon Customer Support for assistance.

2.3 Integrated Disbursers. Some PayMode Disbursers may use payment application software that can read a standard payment file generated by their financial system, or may choose to modify their financial systems to generate a payment output file that can be read by standard PayMode payment application software, in order to make payments to other Network Members using data generated by their financial system without re-entering such data into such standard application software. Such Disbursers are responsible for ensuring that such files are stored in a secure location within the control of the Disburser. Such Disbursers are also responsible for ensuring that only users authorized to execute payment instructions on their behalf are allowed to generate such files. Subject to Section 3.6 of these Operating Rules, such Disbursers are bound by any DPAs within a file of DPAs sent to Clareon that are authenticated with an unrevoked Digital Signature Certificate issued to their users and accepted by Clareon in compliance with Clareon's security procedures.

3. Processing DPAs

3.1 Acceptance. DPAs must be in proper form and contain all required information, and must identify the Collector and the amount of the DPA. Clareon reserves the right to review DPAs before processing them and not to accept DPAs (1) if they are not (a) properly formatted or (b) signed with a valid Digital Signature Certificate associated with the Disburser, or (2) if they would exceed security or risk parameters or violate the Agreement or these Operating Rules.

3.2 Cut-off Times. Accepted DPAs received before 7:00 p.m. Eastern Time on a Clareon business day (Monday through Friday, except holidays as defined at section 7.1 of these Operating Rules) will be processed by Clareon on the next business day by debiting the Disburser's Disbursement Account. Clareon will process accepted DPAs received after 7:00 p.m., or on a weekend or holiday, on the next Clareon business day.

3.3 Processing Times. DPAs require a minimum of three business days after the date the Disbursement Account is debited for completion of funds transfer through the banking system. DPA processing may be delayed if the Disburser's bank, the Collector's bank and/or any other bank or processing entity involved in the funds transfer system utilized by Clareon to process DPAs is not open for business on a day on which it is required to act (for example, to accept a debit or credit instruction).

3.4 Stop Payments. Clareon will try to stop payment on any DPA in accordance with a valid cancellation request received from a Disburser if we receive the request a reasonable period prior to the scheduled cut-off time for the acceptance of DPAs and changes to DPAs. Clareon has no ability to stop payment of a DPA to a Collector after it has entered the banking system. Completely executed DPAs cannot be "recalled" or reversed.

3.5 Means of Executing DPAs. Clareon may use different funds transfer systems and intermediary financial institutions to execute DPAs. We will use the systems and institutions that we consider reasonable under the circumstances. We will have no obligation to use any specific system or intermediary unless we specifically and in writing agree with a Client to do so.

3.6 Binding Effect; Unauthorized and Misdirected DPAs. If you are a Disburser, you agree to be bound by any DPA that is issued in your name and authenticated with an unrevoked Digital Signature Certificate issued to your employee or agent and accepted by us in compliance with the security procedures you have chosen.

3.6.1 You are not liable for a DPA, if (i) the DPA is not in fact authorized by you or your agent and (ii) the DPA was not made in the following circumstances, which you and we agree are circumstances that you can best control and for which you bear the risk:

	a.	the unauthorized DPA was made, directly or indirectly, by a person entrusted by you at any time with duties to act for you with respect to DPAs or with the security procedure or who obtained access to your DPA transmitting facilities; or
	b.	the unauthorized DPA was made, directly or indirectly, by a person who obtained from a source controlled by you information that facilitated the security breach, regardless of whether you were at fault. (Information includes any access device, computer software or hardware security device.)

3.6.2 If the unauthorized DPA was not made under the circumstances described in paragraph 3.6.1 above, Clareon will pay the direct loss for the unauthorized DPA, subject to the limitations and exclusions set forth in the Agreement.

3.6.3 If you are not liable for an unauthorized DPA under paragraph 3.6.1 above but our liability is limited or excluded under the Agreement, then (and to the extent that our liability is limited or excluded) you will be liable for the unauthorized DPA notwithstanding paragraph 3.6.1 above.

3.7 Electronic Agents. If you use an electronic agent to create and deliver a DPA, you agree that any such DPA is legally attributable to you and that you will be bound by such a DPA. We shall not be liable to you for your choice of an electronic agent or for any failure of that electronic agent to work as intended.

4. Notices; Electronic Communications. We may send one another communications and information ("Notices") relating to this Agreement and your use of the Processing Services by mail, through an electronic message or by posting them on our Web site. Notices shall be deemed sent and received if sent in accordance with the procedures set forth below.

4.1 Form and Timing. Any Notice sent by mail shall be effective when received and except as provided in Section 4.3 below, shall be deemed received by the recipient three days after deposit in the United States mail, postage prepaid. Any Notice sent through an electronic message shall be deemed received on the date transmitted, provided that an electronic message Notice from a Client to Clareon shall be deemed received when Clareon confirms the authenticity of the sender using procedures intended to ensure such authenticity. Clareon may send Notices through unencrypted electronic messages that direct the recipient to further information on Clareon's secure Web site for Network Members. Such Notices shall be deemed to include the detailed information to which the recipient is directed. Any Notice sent by posting to our Web site shall be deemed received on the date the recipient actually accesses our Web site or, if it is posted but not accessed by the recipient, no later than five (5) business days after it is posted.

4.2 Notices Related to Certain Amendments. Notices to a Network Member related to amendments to the Agreement, these Operating Rules, or Clareon's Certificate and Privacy Policies shall only be effective if sent (a) by electronic message to the PayMode Membership Administrator for the Network Member, or (b) by mail.

4.3 Confirmation. Confirming the timing of receipt of certain types of Notices is important to each of us. You agree that Notices from you relating to a breach of a security procedure, an unauthorized DPA, or any change to an Account or persons authorized by you to access your Account must be delivered in the following manner to be effective:

	a.	If by mail, then by certified mail, return receipt requested, in which event receipt shall be the actual date of receipt.
	b.	If electronically, then through the use of a security procedure approved by Clareon in order to confirm the authenticity of such a Notice (such as through the use of a valid user identification and password for Notices sent to us through our Network Member Web site).

Note that you should promptly contact us in such circumstances by telephone, but must confirm such circumstances with a Notice sent in the manner described above in order for the Notice to be effective.

4.4 Effectiveness. Notices between you and Clareon that are authenticated by using applicable security procedures shall be deemed signed and in writing for all purposes of any law that requires any communication or agreement to be signed or in writing or both.

4.5 Addresses. Notices sent to you by United States mail shall be sent to your current address, as set forth in our records. Notices to us should be sent to: Clareon, 15 Casco Street, Portland, Maine 04101, Attention: Customer Support.

5. Fee Assessments and Billing. Our Processing Services are presently provided without charge, unless specific fees are set forth in a separate addendum you agreed to. We reserve the right to add a nominal transaction fee in the future and to otherwise change our fee structure by giving you notice in the manner described in section 4.2. If we have signed an Agreement with you that contains or attaches a specific Fee Schedule, such Fee Schedule may be amended only pursuant to the terms of such Agreement, and the Fees stated therein shall be due and payable on the terms stated therein.

You agree to pay Clareon by executing a DPA (or, if you are only a Collector, by authorizing us to debit your bank account). We reserve the right to assess a late fee equal to the lesser of 1.5% per month or the maximum amount permitted by law for all amounts that are past due, provided that if you pay the invoice within fifteen (15) days of the due date stated therein then we will not assess any late fee. It is your responsibility to notify Clareon of any billing disputes in a timely manner. All fees and other payments due under the Agreement or the Operating Rules are exclusive of taxes and duties, and you agree to bear and be responsible for the payment of all taxes and duties including, but not limited to, all sales, use, rental, receipt, personal property and other taxes (but excluding taxes based upon Clareon's income or property) that may be levied or assessed in connection with the Agreement.

You acknowledge and agree that we may charge fees to your trading partners that enroll in the PayMode Network and that the amount, timing and manner of payment of such fees shall be as agreed between Clareon and such trading partners.

6. Intellectual Property Matters

6.1 Software. We may, from time to time, provide you with accounts payable interface software and other software useful in the generation of DPAs, accessing the Network and the use of the other Processing Services (the "Clareon Software").

6.2 Grant of License to the Clareon Software. Subject to the terms and conditions of the Agreement and these Operating Rules, Clareon grants to each Client a royalty-free, personal, nonexclusive, nontransferable and revocable license to use the Clareon Software during the term of the Agreement exclusively for the purpose of using the Processing Services under the terms of this Agreement. You agree not to copy, modify, disassemble, decompile or reverse engineer the Clareon Software and will not rent, transfer, transmit, or otherwise distribute or provide the Clareon Software to any third party.

6.3 Ownership. As between each Client and Clareon, Clareon owns all rights, title and interest in and to the Clareon Software, including, without limitation, any and all copyrights, patents, trade secrets, trademarks and other intellectual property rights. You agree to hold the Clareon Software and any related documentation in strict confidence and not to use or disclose the Clareon Software, in whole or in part, except in connection with your use of the Processing Services.

6.4 Hardware. Clareon publishes a list of tested hardware compatible with the Clareon Software. You understand that the Clareon Software may not necessarily function properly in any other environment.

6.5 Termination. Upon termination of the Agreement, you shall have no further right to use any Clareon software.

7. Business Days and Customer Service

7.1 Clareon Business Days. Clareon business days are Monday through Friday, except for the following holidays:

New Year's Day Martin L. King, Jr. Day Presidents Day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

7.2 Customer Service. Clareon Customer Support is available Monday through Friday from 8 a.m. to 8 p.m. Eastern Time to assist with any problems you may have related to the use of the Processing Services, except holidays as defined at Section 7.1 of these operating rules. Such customer support shall be provided through the various means then supported by Clareon Customer Support.

8. Connections; Changes to Processing Services. You are responsible for establishing an Internet connection so that you may use the Processing Services. From time to time, we may make such changes as we determine to be necessary and/or appropriate in our sole discretion to the Processing Services (including the hardware, software or any third-party contractors or agents used to provide the Processing Services).

Download an Adobe Acrobat file of the Operating Rules.

Version 3.3 (09-24-03)