ACH DEBIT PROTECTION SERVICE TERMS

Section 1. THE SERVICE.

These ACH Debit Protection Service Terms (the “Service Terms”) set forth the terms under which
Customer may automate the reconciliation of ACH debits against Customer’s Accounts to better
monitor and detect unauthorized transactions (the “Service”). The Service is also subject to the
General Provisions of the Treasury Management Terms and Conditions Agreement (the “Agreement”) as
if fully incorporated herein and all Applicable Laws. In the event of a conflict between these Service
Terms and other terms in the Agreement, these Service Terms shall control. Unless otherwise defined
herein, any capitalized terms shall have the meaning as set forth in the Agreement. Any reference to the
Agreement herein shall be deemed to include these Service Terms.

Section 2. IMPLEMENTATION.

Customer will specify its preferences for the Service during the implementation process, including
designation of the Accounts to be enrolled in the Service and election of the service options described
below and such other information required on the applicable Operational Instructions. The Service will
commence upon notification by Bank that all implementation steps are complete.

Customer is solely responsible for the timeliness, accuracy and completeness of the instructions and
information provided by Customer in connection with the Service. Bank will rely on the accuracy of
the information Customer provides Bank in connection with the Service. Any Change Request or
other additions or changes to the Operational Instructions for the Service must be submitted to Bank at
least five (5) Business Days prior to Bank’s receipt of any ACH instructions relating to Customer’s
Account(s) which may be affected by Customer’s proposed additions or changes.

Section 3. SERVICE OPTIONS.

With the Service, Customers can either choose to block all ACH entries from posting to the Account
(“Block All”), or specify select business trading partners that are pre-approved to post ACH debits
against Customer’s Accounts (“Selective Authorization”). Each of these Service options are described
further below and in the applicable Operational Instructions.

       (a)   Block All.  By selecting “Block All” on the applicable Operational Instructions, Customer
authorizes Bank to block all ACH debits and credits from posting to Customer’s Account. With this
option, Bank will automatically reject all ACH debits and credits to Customer’s Account. Customer
understands that even ACH debits or credits Customer has authorized or initiated will be rejected, and
Customer accepts full responsibility for that decision and any claims from the Originator regarding a
returned ACH debit or credit entry.

       (b)   Selective Authorization.  By selecting “Selective Authorization” on the applicable
Operational Instructions, Customer will provide to Bank a list of vendors and other persons that are
authorized to originate ACH debits against Customer’s Account (“Originators”). Customer must have
agreed with an Originator that Customer and the Originator will both be bound by the Rules.
Customer may also provide specific parameters for authorized ACH debits from a particular Originator
within the applicable Operational Instructions. Any ACH debit from the Account that is originated by a
person other than an Originator or outside of the parameters preapproved by Customer for an
Originator is an “Exception.”

With Selective Authorization, Customer has two options for Exception handling. Customer can direct
Bank to (i) automatically return all Exceptions (“Automatic Return”), or (ii) provide to Customer a report
of all Exceptions (an “Exception Report”) for Customer to review and decision (“ACH Positive Pay”) as
described in Section 3(c) below.

        (c)   ACH Positive Pay.  Bank will pay (charge to the Account(s)) or return (to the originating bank)
Exceptions pursuant to Customer’s instructions (“Pay Request” and “Return Request,” respectively)
received prior to the applicable Cutoff Time and in accordance with the specifications set forth in the
Operational Instructions. If Customer issues a Pay Request, Customer is authorizing and instructing Bank
to pay the Exception from the Account. If Customer issues a Return Request, Customer is authorizing
and instructing Bank to return the Exception.

Bank will notify Customer of the availability of the Exception Report in the manner indicated in the
applicable Operational Instructions. Customer acknowledges that Pay or Return Requests must be
based on the Exception Report. It is Customer’s responsibility to timely access the Exception Report and
enter decisions with respect to the Exceptions presented therein. Customer’s failure to receive notice
regarding availability of the Exception Report for any reason does not relieve Customer of its
responsibility to make the appropriate Pay or Return Request by the Cutoff Time. Bank may rely upon
Customer’s Pay Requests and Return Requests and is not responsible for detecting any Customer error
contained in any Pay Request or Return Request sent by Customer to Bank.

Bank shall not be obligated to comply with any Pay Request or Return Request received after the Cutoff
Time or in a format, medium, or place not designated in the Operational Instructions, but shall treat
such a Pay Request or Return Request as though it had not been received. Customer assumes full
responsibility for the timely and accurate submission of Pay Requests and Return Requests to Bank.
Customer shall be solely liable for all Losses relating to any untimely or inaccurate Pay Requests or
Return Requests. If Bank does not receive a timely Pay Request or Return Request from Customer, the
Exception will be returned by default.

       (d)  Dual Approval.  Dual approval is an option available for Customers who want to require a
second person to approve the following actions before they will be effective: (i) add, modify or delete an
Originator; (ii) add, modify or delete a User for the Service; (iii) for ACH Positive Pay, make a Pay or
Return Request with respect to an Exception. If Customer has elected the dual approval option and
secondary approval is not received by the Cutoff Time with respect to a Pay or Return Request for an
Exception, the Exception will be returned by default. Bank recommends Customer require dual
approval for all pay decisions using ACH Positive Pay. This process is part of the Security Procedures
for the Service.

Section 4. LIMITATION OF LIABILITY.

Except as expressly provided otherwise herein, if Bank pays an Exception in accordance with a Pay
Request issued by Customer, such payment shall be proper, and Customer waives any right Customer
may have to assert that the Exception was not properly payable. If Bank returns an Exception in
accordance with a Return Request issued by Customer or pursuant to the return default applied when
instructions are not received from Customer prior to the Cutoff Time, the dishonor shall be proper, and
Customer waives any right Customer may have to assert that the return was improper. Customer agrees
that Bank has exercised ordinary care if Bank pays or returns an Exception consistent with these Service
Terms.

Notwithstanding anything herein to the contrary, Bank shall have no liability to Customer for wrongful
dishonor when Bank, acting in good faith, returns an Exception if: (i) Bank reasonably believed the
Exception was not properly payable; (ii) there are insufficient Available Funds on deposit in the
Account(s); (iii) Bank is required to do so by Applicable Laws; or (iv) Bank acted in accordance with these
Service Terms, including acting upon any Return Request (irrespective of whether such request was
submitted erroneously) or the return default applied when instructions are not received from Customer
prior to the Cutoff Time, in which case such dishonor shall be proper, and Customer waives any right
Customer may have to assert that the return was improper.