Contract

AGREEMENT This Agreement (this “Agreement”) is made and entered into as of the 1st day of December, 2019 (the “Effective Date”) by and between Ameriprise Bank, FSB, having its home offices at 000 0xx Xxxxxx Xxxxx, Xxxxxxxxxxx, Xxxxxxxx Xxxxxx, XX 00000 (“Bank”) and Ameriprise Certificate Company, having offices at 000 0xx Xxxxxx Xxxxx, Xxxxxxxxxxx, Xxxxxxxx Xxxxxx, XX (“Company”). WHEREAS, Bank and Company are both wholly owned subsidiaries of Ameriprise Financial, Inc.; and WHEREAS, Bank and Company wish to engage each other regarding certain Ameriprise Rewards fulfillment Services, as described herein; and WHEREAS, the Parties intend that the Services to be provided as further defined herein will be governed by the terms and conditions of this Agreement; and WHEREAS, the Parties are affiliates for purposes of Sections 23A and 23B of the Federal Reserve Act (12 U.S.C. §§ 371c – 371c-1) as implemented by Regulation W of the Board of Governors of the Federal Reserve System (12 C.F.R. Part 223) and as made applicable to the Bank by Section 11(a) of the Home Owners Loan Act (12 U.S.C. § 1468(a)) (together, the “Transactions with Affiliates Rules”). NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, and intending to be legally bound hereby, Bank and Company agree as follows: Section 1. Definitions. As used in this Agreement, the following terms shall have the meaning hereinafter defined: “Applicable Law” means all laws, statutes, rules and regulations of any federal or state government or body having jurisdiction over the Parties or that apply to the Services. “Customer Information” shall have the meaning set forth in Section 6(a). “Indemnified Parties” shall have the meaning set forth in Section 8. “OCC” means the Office of the Comptroller of the Currency. “Parties” means both Ameriprise Bank, FSB and Ameriprise Certificate Company. “Party” means either Ameriprise Bank, FSB or Ameriprise Certificate Company, as applicable. “Party Data” means data and information supplied to Servicing Party by Receiving Party for purposes of using the Services. “Receiving Party” means the Party that obtains Services from Servicing Party pursuant to any Schedule. “Services” shall have the meaning set forth in Section 2. “Servicing Party” means the Party that provides Services to Receiving Party pursuant to this Agreement. Section 2. Services. Page 2 of 8

(a) A Servicing Party acknowledges and agrees that, solely to enable Servicing Party to perform its obligations pursuant to this Agreement, Receiving Party may provide to Servicing Party “nonpublic personal information,” as such term is defined in Section 509 of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 and regulations promulgated thereunder, and information and data derived therefrom, concerning customers of Receiving Party (such Party Data being, collectively, “Customer Information”). Servicing Party further acknowledges and agrees that it shall have the right to use Customer Information solely to fulfill and perform its obligations under this Agreement and otherwise comply with legal and regulatory requirements applicable to Servicing Party. Servicing Party shall have no right to use, reuse or disclose any Customer Information to any person or entity for any reason not specifically permitted under this Agreement. Servicing Party agrees to establish and maintain appropriate controls and measures designed to ensure the security and confidentiality of Customer Information, to protect against any anticipated threats or hazards to the security and integrity of such information, and to protect against unauthorized access to or use of such information, all designed to meet the guidelines set forth at 12 C.F.R. Part 170, Appendix B. Servicing Party further agrees to require any third-party service provider utilized by Servicing Party in accordance with the terms of this Agreement to also agree in writing to establish and maintain such controls and measures and to maintain the confidentiality of Customer Information to the same extent required of Servicing Party. Upon Receiving Party’s request, Servicing Party shall promptly provide audit reports, written test results and such other information reasonably requested by Receiving Party concerning its compliance with this Section 6(a). If Receiving Party reasonably determines that additional monitoring of Servicing Party’s information security measures is appropriate, it may, upon reasonable notice, conduct an audit of Servicing Party to determine whether Servicing Party is satisfying its obligations regarding information security. Servicing Party shall promptly provide Receiving Party with complete information regarding any failure of such controls and measures or any security breach related to Customer Information. (b) Subject to Section 6(a) above, the Parties agree that Party Data furnished by a Party to the other Party shall be received in confidence and kept confidential by the other Party and used by the other Party only for the purpose of providing or receiving Services under this Agreement. The confidentiality obligations of this Section 6(b) do not apply to the extent that such information (i) is already lawfully known to the other Party when received; (ii) thereafter becomes lawfully known from other sources; (iii) is disclosed to affiliates, auditors, agents, third party service providers or counsel or is voluntarily disclosed to regulators or rating agencies, provided that such entity or person has agreed in writing or is required by law to keep such information confidential, or (iv) is required by Applicable Law or court order to be disclosed by the other Party, provided that prior notice of such disclosure (other than to its affiliates, auditors, counsel, regulators or rating agencies) has been given to the other Party by the Party required to make disclosure, when legally permissible, and the Party required to make the disclosure shall (1) provide sufficient notice to permit the other Party to take legal action to prevent the disclosure and (2) to the extent reasonably practicable, cause the entity or person receiving such information to keep it confidential. (c) Servicing Party shall retain Party Data in accordance with Servicing Party’s then- prevailing record retention policy. Servicing Party may, in conformity with such policy, dispose of media containing Receiving Party data in any manner deemed appropriate by Servicing Party. (d) Servicing Party shall maintain a business continuity plan, including plans for disaster recovery, emergency preparedness and business resumption, all designed in accordance with industry standards. Servicing Party shall be solely responsible for the preparation, periodic testing, review and implementation of disaster recovery, emergency preparedness and business resumption plans, and the expenses associated with such plans. Such periodic testing shall occur at least annually. Receiving Party reserves the right to review a copy of Servicing Party’s disaster recovery, emergency preparedness and business resumption plans and participate in such testing. Page 4 of 8

(g) Notwithstanding any provision in this Agreement to the contrary, no Party shall be liable to another Party to the extent fulfillment or performance of any terms or provisions of this Agreement is delayed or prevented by an act of God, war, act of terrorism, civil commotion, fire or other casualty, power outages, general shortages of labor, materials or equipment, government regulations or other cause beyond the reasonable control of such Party. (h) All notices to any of the Parties are to be made in writing and are to be delivered by person, U.S. Mail, courier, facsimile or electronic mail at the following points of contact: If to the Bank: President Ameriprise Bank, FSB One World Trade Center – 00xx Xxxxx Xxx Xxxx, XX 00000 Facsimile Number: 000-000-0000 Electronic Mail Address: xxx.x.xxxx@xxxx.xxx If to ACC: Treasurer Ameriprise Certificate Company 000 0xx Xxx X Xxxxxxxxxxx, XX 00000 Electronic Mail Address: xxx.xxxxxxx@xxxx.xxx All notices are deemed delivered and received upon receipt. Either Party may change the address(es) or addressee(s) for notice hereunder upon written notice to the other Party. (i) No waiver of any right under this Agreement shall be effective unless in writing executed by the Party against which enforcement of such waiver is sought. Any waiver shall be effective only for the specific circumstances with respect to which the waiver was provided and shall in no way act as a waiver of future rights. (j) No provision of this Agreement may be amended, altered or modified unless agreed to in writing by both Parties. (k) If any provision of this Agreement is held invalid, illegal, void or unenforceable by reason of any rule of law, administrative order, judicial decision or public policy, all other provisions of this Agreement shall nonetheless remain in full force and effect. (l) The headings in this Agreement have been inserted for convenience of reference only and shall in no way restrict or modify any of the terms or provisions hereof or thereof. (m) This Agreement shall be governed by and construed in accordance with the laws of the State of Minnesota. (n) This Agreement may be executed in one or more counterparts, each of which shall be an original, and all of which shall constitute one and the same instrument. Page 7 of 8

(o) This Agreement (whether now or hereafter existing), shall supersede any and all prior agreements thereto, representations and understandings between the Parties, whether written or oral, with respect to the subject matter of this Agreement. IN WITNESS WHEREOF, Bank and Company have caused this Agreement to be executed on their behalf by their duly authorized officers as of the Effective Date. AMERIPRISE CERTIFICATE COMPANY AMERIPRISE BANK, FSB By: /s/ Xxxxx X. Xxxxxxx, Xx. By: /s/ Xxx Xxxx Name: Xxxxx X. Xxxxxxx, Xx. Name: Xxx Xxxx Title: Treasurer Title: President and Chief Executive Officer Date: 12/9/2019 Date: 12/19/2019 Page 8 of 8