Legal

Partner Platform Terms

The core agreement governing your use of the NAS platform, including the Services & Surfaces Schedule, Issuing Schedule, API & Webhook Security Schedule, Data Residency & Sub-processors Schedule, and Prohibitions.

Last revised: 25 May 2026

These NAS Partner Platform Terms (the “Platform Terms”) govern your access to and use of the NAS platform and the related Services described in Schedule A (Services & Surfaces). They form a single, binding agreement between Nano Advanced Services Limited, a company incorporated in the Hong Kong Special Administrative Region under company number 76848773, with registered office at Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen’s Road Central, Sheung Wan, Hong Kong (“NAS”, “we”, “us”), and the entity that signs the cover page of these Platform Terms or otherwise registers a Partner Account (the “Partner”, “you”).

By signing the cover page, accepting these Platform Terms electronically, or using the Services on an ongoing basis, you agree to be bound by these Platform Terms (including the Schedules and Annexes) as we may modify them in accordance with Section 21. The Services are a business product intended for commercial use only. Any attempt to access the Services or to reverse-engineer, copy, replicate, or otherwise circumvent the platform’s processes, integrations, data flows, or supplier relationships is strictly prohibited.

1. The Services and the Surfaces

1.1 Services. The Services comprise the platform components and surfaces described in Schedule A, including without limitation the Backend API, Consumer Web client, Business Portal, Support Portal, Admin Back-office, transactional messaging delivery, push notifications, the issuing and card-program services, the custody-and-safeguarding facilitation layer, KYC/KYB orchestration, the multi-currency wallet ledger, and the fee and discount engine. NAS contracts with one or more regulated back-end partners (including without limitation issuing institutions, custody providers, and banking partners) and makes the resulting capabilities available to Partner through the Services. Partner has no separate contractual relationship with NAS’s back-end partners under or by virtue of these Platform Terms.

1.2 Programs. The Services support the creation and operation of one or more “Programs” — branded Customer-facing product offerings (typically including cards, wallets, transfers, and supporting flows) configured for and operated by Partner under Partner’s brand. The features available for any given Program are determined by (i) NAS’s then-current back-end arrangements, (ii) the configuration agreed between the Parties in the applicable Program Order, and (iii) the technical capabilities of the Services at the relevant time.

1.3 Operator-ownership model. Partner is solely responsible for its end customers (the “Customers”), including Partner’s brand presentation, customer acquisition, commercial strategy, fee setting (within the limits of these Platform Terms and any applicable Program rules NAS communicates from time to time), and the Customer-facing contractual relationship. NAS does not face Customers and does not become party to any agreement between Partner and a Customer.

1.4 Surfaces — software provided by NAS, hosted by Partner. NAS provides Partner with the software for the Customer-facing and Partner-facing Surfaces (notably the Consumer mobile clients, the Consumer Web client, the Business Portal, the Support Portal, and the Admin Back-office), together with the supporting API layer. Partner is responsible for hosting, deploying and operating those Surfaces on Partner’s own infrastructure under Partner’s brand and theming. NAS itself hosts only (a) the central orchestration / control-plane API to which the Surfaces connect, and (b) the marketing site at nas.cards. Customer Personal Data captured through Partner-hosted Surfaces resides on Partner’s infrastructure; the data NAS Processes through the central API on Partner’s behalf is governed by the Data Processing Addendum.

1.5 Beta features. NAS may make Services or features available on a beta, preview, or early-access basis. Beta features are provided “as is” and are excluded from any warranty, service level, or uptime commitment.

2. Partner Account, On-boarding and Funding

2.1 Partner Account. You must provide accurate and complete information when registering for a Partner Account, and you must keep that information current. We may at any time request additional information about you, your activities, your ultimate beneficial owners, your directors or officers, your group structure, your financial condition, or your business operations. You must respond to any such request within ten (10) business days, or sooner where reasonably required by NAS’s back-end partners, a Regulatory Authority, or applicable law.

2.2 Notice of changes. You must notify us in writing no later than three (3) business days after: (a) you become subject to an Insolvency Event; (b) there is a material adverse change in your financial condition; (c) there is an actual or planned material change in the nature of your business; (d) there is a change in the control or beneficial ownership of your business or any parent entity (including any transaction that would constitute a “Change in Control” within the meaning of Annex 1); or (e) you receive a judgment, writ, warrant of attachment or execution, lien, or levy against twenty-five per cent (25%) or more of your assets.

2.3 On-boarding cooperation. Partner shall cooperate in good faith with NAS’s on-boarding, due diligence, and Program-readiness processes, including by providing requested documentation, granting access to relevant personnel, and meeting milestone dates agreed in the Program Order. Failure to meet on-boarding milestones may delay Program go-live and may, at NAS’s discretion, result in revision of commercial terms.

2.4 Funding Source. You must designate an eligible funding source for the Partner Account (either a bank account capable of accepting and sending the required Settlement currency, or a stablecoin reserve in a designated digital-asset wallet). You authorise NAS to initiate one-time and recurring debits and credits from and to that funding source as required to operate the Programs and to satisfy your payment obligations under these Platform Terms.

2.5 Liability for activity. You are fully responsible for all activity that occurs through your Partner Account, whether or not authorised by you, except to the extent caused by the gross negligence or wilful misconduct of NAS. We may suspend or terminate the Partner Account if you provide inaccurate or incomplete information, fail to maintain account-registration requirements, or otherwise breach these Platform Terms.

3. API, Webhooks, Surfaces and Technical Use

3.1 Access. NAS will provide Partner with API keys, OAuth client credentials, Admin Back-office credentials, and other access materials required to use the Services. Partner shall secure those materials with reasonable care, restrict access to personnel with a need to know, rotate them on NAS’s reasonable request, and notify NAS without undue delay (and in any event within twenty-four (24) hours) of any actual or suspected compromise.

3.2 API use. Partner shall use the Backend API only as described in NAS’s API documentation and any related implementation guidance (including bulletins, integration channels and emails). Partner shall keep its integrations current with NAS’s published documentation, including by making timely changes to support deprecations, schema changes, security fixes, and changes mandated by NAS’s back-end partners or by Applicable Law (including PCI-DSS).

3.3 Webhook integrity. Webhook payloads are signed by NAS as described in Schedule C (API & Webhook Security). Partner shall verify the signature on every webhook before acting on it, reject any payload whose signature does not validate, and treat the verification key with the same care as an API credential.

3.4 Rate limits. NAS may apply rate limits to the Backend API to protect the platform’s stability and to enforce equitable use across Partners. Default limits are described in Schedule C and may be adjusted from time to time. NAS will use commercially reasonable efforts to give advance notice of material reductions to a Partner’s rate limit, but may apply changes immediately where required for stability or security.

3.5 PII transmission. Partner shall transmit Customer personally identifiable information and the required transaction metadata via the Backend API in the formats specified in NAS’s API documentation. Partner shall not transmit any personal data to NAS by channels not designated for that purpose (e.g., email, support tickets, screen-shares) except where reasonably necessary and only under appropriate technical and organisational measures.

3.6 Acceptable use. Partner shall not, and shall not permit any person to: (a) circumvent, disable, or interfere with any security, access-control, usage-limitation, or monitoring feature of the Services; (b) access the Services through any means not expressly authorised by NAS; (c) attempt unauthorised access to any system, network, or data associated with the Services; (d) take any action designed to avoid or bypass fees, limits, or restrictions; or (e) use the Services to develop, train, benchmark, or improve any competing product or service.

4. Issuing and Card-Program Operations

4.1 Provision of regulated services through Back-end Partners. Regulated issuing, card-issuance, custody, account and related services are provided by regulated Back-end Partners holding the applicable authorisations. Depending on the Program, and as specified in the applicable Program Order, the Partner (or, where applicable, the Customer) may contract directly with the relevant Back-end Partner, or may contract with NAS, which in turn contracts with the Back-end Partner. For account, e-money and payment (BaaS) services, the Customer contracts directly with the regulated provider and is informed of its identity. In all cases, NAS facilitates and orchestrates access to those services, does not itself provide regulated banking, money-transmission, e-money or custody services, and does not hold client funds as principal. NAS arranges, contracts with, and manages the regulated back-end institutions and service providers necessary to deliver the Services (collectively, the “Back-end Partners”). The identity of any particular Back-end Partner is NAS’s confidential information and is disclosed to Partner, where required for diligence or compliance reasons, only under non-disclosure agreement.

4.1A The three paths — common principles. For every Program, regardless of the commercial structure: (i) the regulated services are provided by, and the related regulated decisions (including KYB/KYC and AML) are made by, the regulated Back-end Partner, with which the Customer or Partner interfaces directly for those purposes; (ii) client funds are held within the applicable regulated safeguarding structure and not on NAS’s balance sheet or by NAS as principal; and (iii) NAS’s role is the operational and technical layer.

4.2 Networks and scheme rules. Cards issued through the Services are issued under Visa, Mastercard, or other payment-network rules. Partner shall comply with all applicable payment-network rules, all operating policies of the issuing institution (as those policies are communicated by NAS to Partner from time to time, the “Program Rules”), and all Applicable Law in connection with each Program. NAS may, where required by network rules or by the issuing institution, require Partner to display particular attributions or disclosures in Customer-facing materials.

4.3 Approvals. Card designs, marketing materials, Customer-facing disclosures, and end-user agreements may require NAS’s (and, where required by the relevant Back-end Partner, the Back-end Partner’s) approval before deployment. NAS will use commercially reasonable efforts to obtain and communicate approvals on a timeline consistent with the Program Order.

4.4 Underwriting and account decisions. Decisions on Customer eligibility, credit limits, card-account approvals, BIN-assignment, transaction authorisation, and account closures are made by, or coordinated by NAS with, the relevant Back-end Partner. Such decisions are final as between Partner and NAS, and Partner shall not bring any claim against NAS on account of any such decision other than for breach by NAS of these Platform Terms.

4.5 Program modifications. NAS may modify any Program (including its features, supported jurisdictions, transaction limits, and supported currencies) from time to time. NAS will use commercially reasonable efforts to give Partner not less than thirty (30) calendar days’ advance notice of material modifications, except where a shorter period is required by Applicable Law, network rules, the Back-end Partner, or to address actual or suspected fraud, money laundering, terrorist financing, security, or other risk, in which case NAS will give as much notice as is reasonably practicable. Partner shall implement modifications within the timeframe NAS specifies, which in exigent circumstances may be as little as twenty-four (24) hours.

4.6 Changes in Back-end Partners. NAS may add, change, or remove Back-end Partners from time to time without Partner’s consent. Where a Back-end Partner change is reasonably expected to materially affect a Program (for example, by changing the supported jurisdictions, BIN range, or product capabilities), NAS will use commercially reasonable efforts to (a) notify Partner in advance, and (b) coordinate the migration of affected Programs. The migration mechanics and timing are determined by NAS in consultation with the incoming and outgoing Back-end Partners.

4.7 Card lifecycle. Cards issued through the Services pass through the lifecycle states defined in Schedule A (currently: Created, Dispatched, Active, Closed, Expired, Blocked). NAS may suspend, freeze, or close any Card or Customer account where required by Applicable Law, network rules, the Program Rules, or to address actual or suspected fraud, money laundering, terrorist financing, or other illegal activity. We will use commercially reasonable efforts to notify Partner of any such action, but may be unable to provide advance notice.

5. Custody and Safeguarding

5.1 Custody facilitation. The Services include a custody-and-safeguarding facilitation layer that interfaces with the applicable programme structure. Customer balances denominated in supported fiat currencies and in supported stablecoins are recorded in the platform ledger and, where held, sit within the applicable programme structure — a regulated custodian or a partner’s safeguarding arrangement, or NAS’s own MPC-based custody infrastructure depending on the Program — segregated and reconciled, and not held on NAS’s balance sheet or as principal.

5.2 No NAS principal custody of Customer funds. NAS does not hold client funds as principal and does not independently control customer safeguarding arrangements; client funds are not held on NAS’s balance sheet and remain within regulated safeguarding structures. NAS does not provide deposit-taking, banking, e-money or money-transmission services to Customers. Partner shall communicate this disclaimer to its Customers in a manner that complies with Applicable Law and in all Customer-facing materials, disclosures, and agreements relating to any Program.

5.3 Segregation and reconciliation. Customer balances are segregated from NAS’s operational funds and from Partner’s operational funds, and are reconciled continuously through the platform’s ledger and via reconciliation flows initiated from the custodian’s records. NAS will make available to Partner, on request and at reasonable intervals, the reconciliation reports relevant to Partner’s Programs.

5.4 Supported currencies and chains. The fiat currencies, stablecoins, and blockchain networks supported are listed in Schedule A and may be amended from time to time. The addition or removal of a supported asset may be subject to network, regulatory, or Back-end Partner considerations.

5.5 Partner reserve. NAS may, in its reasonable discretion and on written notice, require Partner to maintain a reserve balance (the “Partner Reserve”) sized to cover anticipated Program Losses, fees, fines, settlement timing differentials, and similar exposures. The Partner Reserve shall be held in an account or smart contract designated by NAS, shall bear no interest, and may be drawn upon by NAS to satisfy amounts owed by Partner under these Platform Terms. NAS will provide Partner with written notice and a reasonable opportunity to replenish the Partner Reserve before exercising any draw, except where immediate action is required to protect NAS, its Back-end Partners, or Customers from loss.

6. KYC, KYB and Compliance Operations

6.1 Regulated compliance functions. Customer identification, verification, ongoing due diligence, transaction monitoring, suspicious-activity escalation, sanctions screening, and similar regulated compliance functions in respect of Customers are performed by, or under the licence and oversight of, NAS’s Back-end Partners. NAS receives those services from its Back-end Partners and operates the platform-side workflows in connection with them.

6.2 NAS-orchestrated execution. The Services include compliance-orchestration tooling that allows Partner to execute Customer-facing compliance functions in line with the Program Rules, including KYC and KYB intake flows, document capture, status tracking, and audit-trail capture. NAS makes the orchestration tooling available; Partner executes the relevant functions in accordance with the Program Rules and NAS’s written instructions.

6.3 Partner cooperation. Partner shall (a) implement and follow the Program Rules, (b) provide NAS with the information, documentation, and access necessary for NAS (and through NAS, its Back-end Partners) to discharge their respective compliance obligations, and (c) implement any compliance-related change within the timeframe specified by NAS or, in the absence of such specification, within a commercially reasonable period and not more than thirty (30) calendar days.

6.4 AML, sanctions, anti-bribery. Partner represents and warrants that: (a) Partner and its directors, officers, employees, agents, and Service Providers are not the subject of any sanctions administered by the United Nations, the European Union, the United Kingdom, the United States Office of Foreign Assets Control, or any other applicable sanctions authority; (b) Partner maintains policies and controls sufficient to comply with applicable anti-money-laundering, counter-terrorist-financing, and anti-bribery laws (including, where applicable, the Hong Kong Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the Hong Kong Prevention of Bribery Ordinance (Cap. 201)); and (c) Partner shall promptly notify NAS of any actual or suspected breach of any of the foregoing in connection with any Program or the Services. Breach of this Section 6.4 is an immediate Event of Default with no cure period.

6.5 Prohibited and restricted activities. Partner shall comply with the Prohibitions and Restricted Activities set out in Schedule E (Prohibitions) and shall take all necessary and appropriate actions to ensure that Customers’ use of the Services complies with that Schedule.

7. Customer Relationships and Servicing

7.1 Customer agreements. Partner is responsible for entering into appropriate Customer-facing agreements with its Customers and for ensuring that those agreements (a) comply with Applicable Law, network rules, and the Program Rules, (b) include all required disclosures, (c) include the disclaimers about NAS’s role required by these Platform Terms (including Section 5.2 and Section 8.4), and (d) include any pass-through provisions reasonably required by NAS and communicated to Partner from time to time (such as terms relating to the regulated card-issuer’s role, scheme-rule incorporations, and dispute mechanics required by Applicable Law). NAS will make available template provisions for these pass-through requirements.

7.2 Servicing split. Subject to the Program Rules, servicing responsibilities are divided as follows: (a) Partner provides front-line Customer support to its Customers, including initial intake of Customer enquiries, complaints, and disputes; (b) NAS provides the technical surface, support tooling, audit-log capture, and the platform-side integration with the regulated servicing functions performed by its Back-end Partners (including any statutory billing-error procedures, regulated dispute resolution, and any periodic Customer-facing statements where required); and (c) NAS coordinates with its Back-end Partners on Partner’s behalf in respect of escalations that require the Back-end Partner’s involvement.

7.3 Customer complaints involving NAS or its Back-end Partners. If Partner or its Service Provider receives a Customer complaint or any notice from a Regulatory Authority, consumer-protection body, or similar third party that materially concerns NAS’s role or the role of any Back-end Partner, Partner shall promptly forward the complaint and any related documentation to NAS for review, investigation, and (where appropriate) onward escalation to the relevant Back-end Partner. Partner shall not respond on NAS’s behalf without prior written authorisation, and shall use commercially reasonable efforts to cooperate in the resolution of the complaint.

7.4 Card lifecycle. Section 4.7 governs Card-lifecycle actions taken at NAS’s initiative. Where Partner determines that a Customer account or Card should be suspended or closed, Partner may instruct NAS through the Admin Back-office or via the Backend API, and NAS will action the instruction in accordance with the Program Rules.

8. Fees, Charges and Financial Terms

8.1 Platform fee. Partner shall pay NAS the recurring platform fee specified in the Program Order (the “Platform Fee”), together with any per-Program, per-card, per-transaction, per-Surface, or volume-based fees described there.

8.2 Pass-through costs. Partner shall reimburse NAS for, or shall pay directly as directed by NAS, out-of-pocket costs reasonably incurred in operating Partner’s Programs, including network fees, card-production and shipping costs, ACH and bank-transfer fees, blockchain network fees, audit fees attributable to Partner, and similar third-party costs. Where direct attribution is not practicable, NAS may apply reasonable estimates and shall, on request, provide the methodology used.

8.3 Rebates. Where the Program Order provides for rebates linked to Program volume, NAS shall calculate, accrue, and apply rebates in accordance with the schedule set out there. Rebate eligibility may be conditional on Partner being in good standing under these Platform Terms.

8.4 No NAS deposits; capacity of NAS. Partner acknowledges and agrees that: (a) NAS is not a bank, savings institution, credit union, e-money institution, scheme member, or other deposit-taking or stored-value institution; (b) Nano Advanced Services Limited is registered with the U.S. Financial Crimes Enforcement Network (FinCEN) as a foreign-located money-services business; that registration is for US AML / money-services purposes and is not a general or cross-jurisdictional authorisation. NAS does not hold client or Customer funds as principal and does not independently control customer safeguarding arrangements, and does not provide regulated money-transmission, custody, or banking services directly to Customers; (c) NAS is not engaged in the business of receiving deposits in connection with the Services or any Program; (d) NAS contracts with regulated Back-end Partners that provide the underlying regulated services, and any control, custody or safeguarding function operates only through the applicable programme structure and the relevant regulated or safeguarded arrangement; and (e) neither Partner nor any Customer shall have any claim against NAS arising from any characterisation of NAS as a depository institution or any allegation that NAS is engaged in unauthorised deposit-taking or banking activities. Partner shall communicate these disclaimers to all Customers in a manner that complies with Applicable Law and in all Customer-facing materials, disclosures, and agreements.

8.5 Program Losses. Partner is solely responsible for all Program Losses — including chargebacks, force-posts, negative-balance write-offs, insufficient-funds events, provisional credits, dispute losses, fraud losses, and related amounts arising in respect of Partner’s Programs — except to the extent directly caused by the gross negligence or wilful misconduct of NAS. NAS’s approval, review, or acceptance of any Program, funds-flow structure, or go-live decision is not an assumption of Program Losses or any other liability.

8.6 Regulatory fines and assessments. Partner shall pay or reimburse NAS (or any indemnified person under Section 15) any fines, penalties, reimbursements, assessments, or similar amounts imposed by any Regulatory Authority, network, scheme, or Back-end Partner to the extent arising from (a) Partner’s or its Service Providers’ acts or omissions, (b) any failure to comply with Applicable Law, network rules, the Program Rules, or these Platform Terms in connection with a Program. Amounts under this Section 8.6 are payable within five (5) business days of NAS’s written demand and are not subject to set-off, defence, or counter-claim. Failure to pay is an Event of Default.

8.7 Set-off and security. NAS may apply funds held in the Partner Reserve, or in any other account established by Partner or by NAS for Partner’s benefit in connection with the Services, to satisfy amounts owed by Partner under these Platform Terms. To the extent permitted by Hong Kong law, Partner grants NAS a first-priority charge over the Partner Reserve and the proceeds thereof to secure Partner’s obligations under these Platform Terms.

8.8 Reconciliation, invoicing and late payment. NAS will produce a monthly reconciliation and invoice within twenty (20) calendar days after the end of each calendar month. Undisputed amounts are payable within fourteen (14) calendar days of invoice date. Amounts that remain unpaid for more than twenty (20) business days after the due date accrue interest at the lesser of ten per cent (10%) per annum or the maximum rate permitted by Applicable Law, calculated daily.

8.9 Recourse. NAS has full recourse against Partner for all amounts owed under these Platform Terms and may pursue any remedy concurrently. NAS is not required to elect among remedies. Partner is responsible for NAS’s reasonable out-of-pocket costs (including reasonable legal fees) incurred in collecting amounts owed.

9. Audits, Reporting and Records

9.1 Financial reporting. On NAS’s written request, Partner shall provide quarterly unaudited financial statements promptly, and annual audited financial statements within thirty (30) calendar days of request. Partner shall provide other information reasonably requested by NAS for due-diligence, regulatory, scheme, or tax purposes within ten (10) business days of request.

9.2 Compliance reporting. Partner shall participate in NAS’s ongoing due-diligence and monitoring, respond to questionnaires and information requests, and provide on request any independent audit or compliance reports it holds, including SOC 2 reports, BSA/AML audits, PCI-DSS assessments, and cybersecurity risk reports.

9.3 Audit rights. NAS, and any Regulatory Authority with jurisdiction, may audit Partner’s facilities, systems, records, and personnel insofar as relevant to the Services and to Partner’s compliance with these Platform Terms, the Program Rules, and Applicable Law. Where a Back-end Partner of NAS is required by its own regulator or scheme to conduct or commission an audit covering Partner activity, NAS will coordinate the audit on Partner’s side; Partner shall provide reasonable cooperation. Audits will be conducted on reasonable notice (or no notice in the case of a regulator-led audit), during normal business hours, and at the auditing party’s expense (unless a material breach is identified, in which case Partner shall bear the reasonable costs of the audit).

9.4 Audit response. Following any audit identifying deficiencies, Partner shall provide a written response and corrective-action plan within twenty (20) business days and shall implement the corrective actions within the timeframe specified by NAS.

9.5 Recordkeeping. Partner shall maintain complete and accurate records of (a) each Customer’s identity and the steps taken to verify it, (b) Cards and accounts issued to and activated by each Customer, (c) balances and transactions, and (d) fees and other charges, for the period required by Applicable Law and the Program Rules and in any event for not less than five (5) years after the closure of the relevant Program or termination of the relevant Customer relationship.

10. Marketing, Brand, and Surfaces

10.1 Marketing materials. Partner may develop marketing materials promoting Partner’s Programs (“Marketing Materials”). Where required by Applicable Law, network rules, or the Program Rules, Marketing Materials must be approved by NAS prior to publication. Partner shall submit Marketing Materials for review at least ten (10) business days prior to intended publication.

10.2 Marketing standards. Partner shall ensure that all Marketing Materials (a) comply with Applicable Law, network rules, the Program Rules, and any marketing guidelines published by NAS from time to time; (b) accurately describe the role of NAS and, to the extent required by network rules or Applicable Law, of the regulated card-issuer or other Back-end Partner, and do not mischaracterise either; and (c) do not co-mingle the Program with other products or services in a manner that could reasonably confuse a Customer about the source, sponsorship, or nature of the Program.

10.3 Withdrawal of approval. NAS may withdraw approval of previously-approved Marketing Materials at any time where required for legal, regulatory, network, or risk-management reasons, and Partner shall comply with any such withdrawal demand within five (5) business days.

10.4 Branding of NAS-operated Surfaces. Partner’s brand and theming are applied to the Consumer Web client, Business Portal, Support Portal, and any other Partner-branded Surface in accordance with the configuration agreed during on-boarding. NAS reserves the right to display its own attribution or that of the regulated card-issuer or other Back-end Partner where required by Applicable Law, network rules, or the Program Rules.

11. Confidentiality and Non-Circumvention

11.1 Confidential Information. Each Party may disclose to the other (the “Recipient”) information that is confidential, including business plans, customer information, technical documentation, pricing, supplier relationships, the identity of NAS’s Back-end Partners, and the contents of these Platform Terms and any Program Order (collectively, “Confidential Information”). The Recipient shall protect the Confidential Information with the same degree of care it uses for its own information of like sensitivity (and in any event not less than a reasonable degree of care), use it only for the purposes of these Platform Terms, and disclose it only to its personnel and advisers on a need-to-know basis under equivalent confidentiality obligations.

11.2 Customer Information. Personal data relating to Customers (“Customer Information”) is governed by these Platform Terms, the Data Processing Addendum (the “DPA”) and Applicable Law (including, as applicable, the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), the EU General Data Protection Regulation, and the UK General Data Protection Regulation). The Parties shall treat Customer Information as Confidential Information regardless of any other categorisation.

11.3 Exceptions. Confidential Information does not include information that the Recipient can demonstrate (a) was lawfully in its possession before disclosure, (b) is or becomes publicly available other than by breach of these Platform Terms, (c) is lawfully received from a third party without confidentiality obligations, or (d) is independently developed without use of the Confidential Information.

11.4 Compelled disclosure. Where the Recipient is required by Applicable Law or by a Regulatory Authority to disclose Confidential Information, the Recipient shall (to the extent legally permitted) notify the discloser promptly, cooperate reasonably with any lawful effort to limit the disclosure, and disclose only what is required.

11.5 Non-circumvention. During the Term and for two (2) years after termination, Partner shall not, directly or indirectly, use NAS’s Confidential Information or any knowledge of NAS’s supplier, banking, custody, issuing, or other Back-end Partner relationships obtained through the Services to (a) replicate the Services, (b) circumvent NAS’s role in any Program, or (c) assist any third party in doing either. This Section 11.5 does not apply to relationships Partner can demonstrate it maintained independently and prior to the Effective Date through documentary evidence reasonably acceptable to NAS.

12. Information Security and Incident Response

12.1 Security programme. Each Party shall maintain an information-security programme that includes appropriate physical, administrative, and technical safeguards designed to (a) ensure the confidentiality and integrity of Customer Information and Confidential Information, (b) protect against reasonably anticipated threats and unauthorised access, and (c) comply with these Platform Terms, the DPA, and Applicable Law.

12.2 Multi-factor authentication. Partner shall enforce multi-factor authentication for all access to the Business Portal, the Admin Back-office, and any other Surface from which sensitive Customer or Program data can be accessed.

12.3 Testing. Each Party shall conduct regular testing of its security safeguards (including penetration testing and vulnerability scanning) appropriate to the risk profile of its role.

12.4 Service Providers. Each Party shall ensure that its Service Providers with access to Customer Information or Confidential Information maintain comparable security measures and incident-response capabilities.

12.5 Incident notification. A Party that becomes aware of an Information Security Incident affecting the other Party’s Confidential Information or Customer Information shall (a) initiate response measures to identify the scope and nature of the incident, (b) notify the other Party’s designated security contact as soon as reasonably practicable and in any event within forty-eight (48) hours of becoming aware, (c) complete any required incident-response forms reasonably provided by the other Party, and (d) cooperate in good faith on remediation, regulatory notification, and Customer communication.

12.6 External communications. Neither Party shall publish, communicate, or otherwise disclose details of an Information Security Incident in a way that identifies the other Party without the other Party’s prior written consent, except as required by Applicable Law or Regulatory Authority direction.

13. Intellectual Property

13.1 NAS IP. As between the Parties, NAS owns all right, title, and interest in and to the Services, the platform, the Backend API, the SDKs, the dashboards, the documentation, all derivatives of the foregoing, and all related Intellectual Property (“NAS IP”). NAS grants Partner a non-exclusive, non-transferable, non-sublicensable, royalty-free, revocable licence to use the NAS IP solely as needed to access and use the Services during the Term.

13.2 Partner brand and content. As between the Parties, Partner retains all right, title, and interest in and to its brand, trade marks, logos, and content provided for use on Partner-branded Surfaces (“Partner Brand Materials”). Partner grants NAS and its Back-end Partners a non-exclusive, royalty-free licence to use the Partner Brand Materials as needed to operate Partner’s Programs during the Term.

13.3 Customer data. Ownership of, and rights in, Customer Information are governed by the DPA. The Parties acknowledge that NAS’s Back-end Partners have rights to certain Customer Information necessary for them to discharge their regulated functions.

13.4 Restrictions. Partner shall not (a) reverse-engineer, disassemble, decompile, or otherwise attempt to derive the source code or trade secrets of the Services; (b) use the Services or any output of the Services to develop, train, benchmark, or improve a product or service that competes with the Services; or (c) remove, obscure, or alter any proprietary notice. Breach of this Section 13.4 entitles NAS to seek injunctive relief without posting bond, in addition to any other remedy.

13.5 Feedback. If Partner submits suggestions, comments, or ideas about the Services (“Feedback”), Partner grants NAS a worldwide, perpetual, irrevocable, royalty-free licence to use the Feedback for any purpose without obligation of attribution or compensation.

14. Representations and Warranties

14.1 By each Party. Each Party represents and warrants that (a) it has the authority to enter into these Platform Terms, (b) execution and performance do not violate any other agreement to which it is bound, (c) these Platform Terms constitute its legal, valid, and binding obligation, and (d) it holds and will maintain all licences, permits, registrations, and authorisations necessary for it to perform its obligations.

14.2 By Partner. Partner additionally represents and warrants that (a) Partner and its directors, officers, and beneficial owners have not been subject to any criminal conviction (other than minor offences) in any jurisdiction in the last seven (7) years, any unpaid tax lien, any pending regulatory enforcement action, or any injunction or judgment alleging fraud or deceptive practice (except as previously disclosed in writing), (b) all information provided by or on behalf of Partner in connection with on-boarding and the Services is true, accurate, and not misleading in any material respect, (c) Partner has, and will maintain, the operational, financial, and personnel resources necessary to perform its obligations, and (d) Partner maintains insurance reasonable for its business and the scale of its Programs.

14.3 By NAS. NAS additionally represents and warrants that (a) the Services will be provided with reasonable skill and care; (b) NAS will use commercially reasonable efforts to make the platform available in accordance with the service-level commitments described in the applicable Program Order or service-level schedule; and (c) NAS will maintain comprehensive general liability, professional indemnity, and cyber-liability insurance with reputable insurers at coverage levels appropriate to its business.

14.4 Disclaimer. Except as expressly set out in these Platform Terms, the Services are provided “as is” and “as available.” NAS disclaims all other warranties, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, non-infringement, and warranties arising from course of dealing or course of performance. NAS does not warrant that the Services will be uninterrupted, error-free, or free from harmful components, or that all errors will be corrected.

15. Indemnification

15.1 Partner indemnity. Partner shall defend, indemnify, and hold harmless NAS, its Affiliates, its Back-end Partners (as third-party beneficiaries of this Section 15.1 to the extent permitted by Applicable Law), and their respective officers, directors, employees, and agents (the “NAS Indemnified Parties”) from and against any third-party claim, and any losses, liabilities, damages, fines, penalties, costs, and reasonable expenses (including reasonable legal fees) arising out of or related to (a) Partner’s breach of these Platform Terms, (b) any act or omission by Partner or its Service Providers that violates Applicable Law, network rules, or the Program Rules, (c) any regulatory or scheme inquiry, examination, or enforcement action arising from Partner’s conduct or its Service Providers’ conduct, (d) any third-party claim arising from Partner’s marketing, servicing, or administration of any Program, or (e) any Program Losses.

15.2 NAS indemnity. NAS shall defend, indemnify, and hold harmless Partner, its Affiliates, and their respective officers, directors, employees, and agents (the “Partner Indemnified Parties”) from and against any third-party claim, and any losses, liabilities, damages, costs, and reasonable expenses (including reasonable legal fees), to the extent directly resulting from (a) NAS’s material breach of these Platform Terms, (b) NAS’s gross negligence or wilful misconduct in performing the Services, (c) third-party intellectual-property infringement by the Services as provided by NAS (excluding infringement attributable to Partner Brand Materials, Partner-supplied content, or use of the Services in combination with non-NAS materials), or (d) an Information Security Incident caused by NAS’s breach of Section 12.

15.3 Procedure. The indemnified Party shall (a) promptly notify the indemnifying Party of any claim, (b) grant the indemnifying Party sole control of the defence and settlement (subject to the indemnified Party’s right to participate at its own cost), and (c) reasonably cooperate at the indemnifying Party’s expense. The indemnifying Party shall not settle any claim in a manner that imposes any liability, admission, or obligation on the indemnified Party without the indemnified Party’s prior written consent (not to be unreasonably withheld). The indemnifying Party shall not have the right to control the defence of any claim brought by a Regulatory Authority.

16. Limitation of Liability

16.1 No special damages. Except for liability arising under Section 15 (Indemnification), Section 11 (Confidentiality), or from gross negligence, wilful misconduct, fraud, or breach of Applicable Law, neither Party shall be liable to the other for any indirect, incidental, special, consequential, punitive, or exemplary damages, or for loss of profit, revenue, goodwill, or opportunity, in each case howsoever arising, whether in contract, tort, statute, or otherwise, and even if the Party has been advised of the possibility of such damages.

16.2 Aggregate cap. Subject to Sections 16.3 and 16.4, NAS’s total aggregate liability to Partner under or in connection with these Platform Terms, regardless of the form of action or theory of liability, is capped at the lesser of (a) the direct damages actually proven by Partner, or (b) USD 250,000.

16.3 Enhanced cap for indemnified claims. For claims under Section 15.2 (NAS’s indemnification), the cap in Section 16.2 is increased to USD 500,000.

16.4 Exclusions from cap. The caps in Sections 16.2 and 16.3 do not apply to (a) Partner’s payment obligations under Section 8, (b) liability for fraud, wilful misconduct, or breach of confidentiality, (c) liability that cannot be excluded or limited under Hong Kong law (including liability for death or personal injury caused by negligence), or (d) Partner’s indemnification obligations under Section 15.1.

16.5 Acknowledgement. The Parties acknowledge that the allocation of risk in this Section 16 is a material part of the commercial bargain reflected in these Platform Terms, that the fees paid by Partner reflect that allocation, and that the limitations would apply even if any limited remedy fails of its essential purpose.

17. Term, Suspension and Termination

17.1 Term. These Platform Terms commence on the Effective Date and continue for the initial term specified in the cover page or Program Order, and shall renew automatically for successive twelve-month renewal terms unless either Party gives at least ninety (90) calendar days’ written notice of non-renewal.

17.2 Termination without cause. Either Party may terminate these Platform Terms without cause on ninety (90) calendar days’ written notice, subject to (a) Partner’s payment of any early-termination fee specified in the Program Order, and (b) the wind-down obligations in Section 17.5.

17.3 Termination for cause. Either Party may terminate these Platform Terms immediately on written notice if the other Party (a) commits a material breach that is incapable of cure or that is not cured within thirty (30) calendar days of written notice (or five (5) business days in the case of a payment default), (b) suffers an Insolvency Event, (c) ceases or threatens to cease carrying on business, (d) (in the case of Partner) undergoes a Change in Control without NAS’s prior written consent, (e) is the subject of a formal enforcement action by a Regulatory Authority that materially affects its ability to perform these Platform Terms, or (f) is subject to an adverse direction from a Regulatory Authority requiring it to cease or materially limit performance.

17.4 Suspension. NAS may suspend access to the Services, in whole or in part, on notice (or immediately where the circumstances require) if (a) Partner is in default of any payment obligation, (b) Partner is the subject of a regulatory, scheme, or Back-end Partner inquiry that materially threatens NAS, its Back-end Partners, or Customers, (c) NAS reasonably believes that continued access poses a risk of loss to NAS, its Back-end Partners, Customers, or the platform, (d) a Back-end Partner directs suspension, or (e) Applicable Law or a Regulatory Authority direction requires suspension. NAS will use commercially reasonable efforts to limit any suspension to the affected Services and to restore access as soon as the basis for suspension is removed.

17.5 Wind-down. On termination of these Platform Terms (for any reason): (a) Partner shall cease accessing the Services as of the termination date, except as required during the agreed transition period; (b) the Parties shall cooperate in good faith on the orderly transition or wind-down of Partner’s Programs, including the orderly closure or transfer of Customer relationships as permitted by the Program Rules and Applicable Law; (c) the transition period shall be up to one hundred and eighty (180) calendar days for Partner-initiated termination without cause and not less than thirty (30) calendar days for NAS-initiated termination for cause; (d) Partner remains responsible for all amounts owed up to the date of completion of the wind-down; and (e) both Parties shall retain records relating to the Programs for the period required by Section 9.5.

17.6 Effect. Termination does not affect any right, remedy, obligation, or liability that has accrued before termination. The provisions intended by their nature to survive termination — including Sections 5.2, 8 (with respect to accrued amounts), 11, 13, 15, 16, 18, 19, 20, and this Section 17.6 — survive.

18. Exclusivity, Non-Disparagement and Non-Solicitation

18.1 Platform exclusivity. During the Term, NAS shall be Partner’s exclusive provider of the categories of services that comprise the Services (the platform layer combining card issuing, multi-currency wallet ledger, custody facilitation, KYC orchestration, and the operator-facing Surfaces). For the avoidance of doubt, this Section 18.1 does not restrict Partner from contracting with multiple banking partners or other downstream regulated providers in respect of services that are not Services under these Platform Terms.

18.2 No NAS exclusivity to Partner. NAS may provide the Services to other partners, including partners that compete with Partner.

18.3 Non-disparagement. Neither Party shall make, or permit any of its directors, officers, employees, or Affiliates to make, any disparaging public statement about the other Party, its Services, its Affiliates, its Back-end Partners, or its personnel, during the Term and for two (2) years thereafter. This Section 18.3 does not apply to statements required by Applicable Law or made in connection with any legal or regulatory proceeding.

18.4 Non-solicitation. During the Term and for twelve (12) months after termination, neither Party shall, directly or indirectly, solicit, recruit, hire, or engage as a contractor any person who is or was an employee or principal contractor of the other Party within the preceding twelve (12) months. This restriction does not apply to general public recruitment activity not specifically targeted at the other Party’s personnel, or to responses to such general activity.

19. Dispute Resolution, Governing Law and Notices

19.1 Governing law. These Platform Terms, and any non-contractual obligation arising in connection with them, are governed by the laws of the Hong Kong Special Administrative Region.

19.2 HKIAC arbitration. Any dispute, controversy, or claim arising out of or relating to these Platform Terms, including their existence, validity, interpretation, performance, breach, or termination, shall be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (“HKIAC”) under the HKIAC Administered Arbitration Rules in force at the time the notice of arbitration is submitted. The seat of arbitration shall be Hong Kong. The number of arbitrators shall be one (1) unless the disputed amount exceeds USD 1,000,000, in which case three (3). The language of the arbitration shall be English. The arbitral award shall be final and binding on the Parties.

19.3 Pre-arbitration good-faith resolution. Before commencing arbitration, the disputing Party shall send the other Party written notice describing the dispute (a “Notice of Dispute”). The Parties shall use commercially reasonable efforts in good faith to resolve the dispute within thirty (30) calendar days of the Notice of Dispute, including by senior-management discussion.

19.4 No class or collective arbitration. Arbitration shall proceed solely on an individual basis. The Parties expressly waive any right to bring or participate in a class, collective, consolidated, coordinated, or mass arbitration.

19.5 Notices. Notices under these Platform Terms shall be in writing and delivered (a) by hand, (b) by international courier, or (c) by email to the address designated by the recipient Party. Notices are deemed received (i) on delivery, in the case of hand or courier, or (ii) on the next business day after sending, in the case of email (absent any error or non-delivery response). Each Party shall maintain a designated email address for receipt of notices and shall keep that address current.

20. Data Protection

20.1 DPA. The processing of personal data in connection with the Services is governed by the NAS Data Processing Addendum (the “DPA”), which is incorporated into these Platform Terms by reference. In the event of conflict between these Platform Terms and the DPA in respect of personal-data processing, the DPA controls.

20.2 Data residency. Customer Personal Data captured through Partner-hosted Surfaces resides on Partner’s own hosting infrastructure (Partner is the controller and the host). The data NAS Processes through the central orchestration API on Partner’s behalf — together with the Partner-representative and prospective-Partner data NAS Processes in its own right — is hosted on cloud infrastructure operated by a tier-one cloud-services provider in the European Union (primary location: Frankfurt, Germany). Further detail is set out in Schedule D (Data Residency & Sub-processors) and the DPA.

20.3 International transfers. Cross-border transfers of personal data, where required, will be subject to appropriate transfer mechanisms (including the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and any equivalent mechanism applicable to the Hong Kong SAR and to other jurisdictions).

21. General

21.1 Amendments. NAS may amend these Platform Terms from time to time. NAS will give Partner not less than thirty (30) calendar days’ advance written notice of any material amendment, except where a shorter notice period is required by Applicable Law, network rules, or a Back-end Partner, or where the amendment is necessary to address a security, regulatory, or scheme issue (in which case NAS will give as much notice as is reasonably practicable). Continued use of the Services after the effective date of an amendment constitutes acceptance. Partner’s sole remedy if it does not accept an amendment is to terminate these Platform Terms on written notice within thirty (30) calendar days of the amendment’s effective date, subject to the wind-down obligations in Section 17.5.

21.2 Assignment. Partner may not assign, novate, or otherwise transfer its rights or obligations under these Platform Terms without NAS’s prior written consent. NAS may assign or novate its rights and obligations under these Platform Terms to an Affiliate, or in connection with a sale of all or substantially all of NAS’s business or assets, on notice to Partner.

21.3 Subcontracting. Each Party may engage Service Providers to perform its obligations, subject to (in Partner’s case) NAS’s reasonable objection to any Service Provider whose engagement creates a material risk to NAS, its Back-end Partners, the platform, or Customers. Engagement of a Service Provider does not relieve the engaging Party of its obligations.

21.4 Force majeure. Neither Party shall be liable for delay or failure to perform (other than payment obligations) to the extent caused by an event beyond its reasonable control (including act of God, war, terrorism, civil unrest, pandemic, natural disaster, internet or telecommunications outage, embargo, or government action). The affected Party shall notify the other Party promptly and shall use commercially reasonable efforts to resume performance. If the force-majeure event continues for more than sixty (60) calendar days, either Party may terminate on written notice.

21.5 Independent contractors. The Parties are independent contractors. Nothing in these Platform Terms creates a partnership, joint venture, agency, or employment relationship.

21.6 Third parties. Except as expressly provided in Section 15.1 (Partner indemnity, with NAS’s Back-end Partners as named beneficiaries), a person who is not a party to these Platform Terms has no right under the Hong Kong Contracts (Rights of Third Parties) Ordinance (Cap. 623) to enforce any of its terms. This Section 21.6 does not affect any right or remedy of a third party that exists or is available apart from that Ordinance.

21.7 Severability. If any provision of these Platform Terms is held to be invalid or unenforceable, the remaining provisions continue in force, and the invalid or unenforceable provision shall be replaced by a valid and enforceable provision that most closely reflects the Parties’ original commercial intent.

21.8 Entire agreement. These Platform Terms (together with the Schedules, Annexes, any executed Program Order, and the DPA) constitute the entire agreement between the Parties relating to the subject matter and supersede all prior agreements, representations, and understandings (whether written or oral). Each Party acknowledges that it has not relied on any statement, representation, assurance, or warranty not expressly set out in these Platform Terms.

21.9 Waiver. No failure or delay by a Party to exercise any right or remedy constitutes a waiver of that or any other right or remedy.

21.10 Counterparts and signature. These Platform Terms may be signed in counterparts (including by electronic signature), each of which is an original and which together constitute one agreement.

Schedule A — Services & Surfaces

The Services made available under these Platform Terms comprise the components described below. NAS may add to, remove from, or modify the Services in accordance with these Platform Terms and the applicable Program Order.

A.1 Backend API. A REST application programming interface published under OpenAPI 3.0, with corresponding documentation. Access is authenticated via OAuth 2.0 client credentials (for server-to-server integrations) and JSON Web Tokens (for end-user-authenticated calls). The Backend API supports rate-limiting and is monitored for abuse.

A.2 Webhooks. A real-time event-delivery channel. NAS publishes webhook events for Card lifecycle changes (Created, Dispatched, Active, Closed, Expired, Blocked), Customer lifecycle changes, KYC/KYB status changes, transaction events, and other Program events. Webhook payloads are signed as described in Schedule C.

A.3 Consumer Web client. A mobile-optimised consumer web application, served at a Partner-branded subdomain, providing Customer-facing flows including registration, identity verification intake, wallet view, card view and management, transfer initiation, on-ramp and off-ramp flows, and self-service support. The Services may, from time to time, include a successor native mobile application; native mobile clients are added to the Services on written notice from NAS.

A.4 Business Portal. A web application, served at a Partner-branded subdomain, providing the Customer’s business-account flows (including business onboarding, employee provisioning, employee permissions, manager/team hierarchy, and Card-request approval workflow).

A.5 Support Portal. A web application supporting Partner’s Customer-support function (ticket intake, status, and resolution workflows).

A.6 Admin Back-office. A web application operated by NAS and accessed by Partner’s authorised personnel, providing settlement and reconciliation views, fee and discount configuration (within the Program Order parameters), Customer-support tooling, KYC/KYB review queues, audit-log access, and content-management for Partner-controlled Customer-facing content.

A.7 Multi-currency wallet ledger. A ledger maintained on the platform that records Customer balances by currency and by asset, supports internal transfers, and reconciles against the custodian’s records. Currently supported fiat currencies, stablecoins, and blockchain networks are listed in the on-boarding pack and may be amended from time to time.

A.8 KYC and KYB orchestration. Workflow tooling that supports the regulated identity-verification and business-onboarding requirements applicable to each Program, including intake, document capture, status tracking, and audit-log capture. Regulated decisions on Customer eligibility are coordinated by NAS with its Back-end Partners.

A.9 Custody facilitation. An integration layer that interfaces with the regulated custody infrastructure operated by NAS’s custody Back-end Partners for Customer fiat balances and supported digital assets, providing balance recording, transfer instruction, and reconciliation flows.

A.10 Issuing services. Card issuance (virtual and, where supported, physical), card lifecycle management, transaction authorisation, settlement, and related services. NAS provides these services to Partner under these Platform Terms by combining its own platform capabilities with services it obtains from regulated Back-end Partners.

A.11 Transactional messaging. Email and SMS delivery for transactional messages (one-time passwords, status notifications, statement delivery, and similar), and push notifications to consumer mobile clients.

A.12 Fee and discount engine. A configurable engine supporting per-Program and per-Partner fee structures, rebate tiers (where contracted in the Program Order), and distributor-tier mark-ups.

A.13 Audit log. An immutable record of platform events, including admin actions, webhook dispatches, KYC decisions, transaction events, and Customer-impacting actions, retained for the period required by Applicable Law.

A.14 Service levels. Service-level commitments (including availability targets and support response times) are described in the Program Order or, where not specified there, in NAS’s standard service-level schedule, as amended from time to time.

Schedule B — Issuing Schedule

B.1 NAS as the contracting party. NAS provides Program-related issuing, card-issuance, custody and similar regulated services to Partner under these Platform Terms by combining NAS’s platform with services it obtains from one or more regulated Back-end Partners. Partner has no separate contractual relationship with any Back-end Partner under or by virtue of these Platform Terms, and shall not represent otherwise.

B.2 Disclosure under NDA. Information about NAS’s then-current Back-end Partners (including identities, supported jurisdictions, BIN ranges, product identifiers, supported Customer jurisdictions, and operating constraints) is NAS’s Confidential Information. NAS may disclose such information to Partner during on-boarding and on Partner’s reasonable request thereafter, in each case under non-disclosure agreement and subject to NAS’s confidentiality obligations to the Back-end Partners.

B.3 Constraints. Program features, supported Customer jurisdictions, transaction limits, allowable use cases, supported currencies, and similar matters are subject to operating constraints imposed by NAS’s Back-end Partners and by the relevant network rules. NAS shall communicate material constraints to Partner during on-boarding and as they change.

B.4 Changes in Back-end Partners. NAS may add, change, or remove Back-end Partners from time to time in accordance with Section 4.6 of these Platform Terms. Where a change is reasonably expected to materially affect a Program, NAS will use commercially reasonable efforts to give Partner advance notice and to coordinate any migration.

B.5 Pass-through requirements. Where a Back-end Partner, the relevant network, or Applicable Law requires Partner to comply with specific operational, marketing, technical, or compliance requirements (collectively, the “Pass-Through Requirements”), NAS will communicate the Pass-Through Requirements to Partner. Partner shall comply with the Pass-Through Requirements as if they were obligations under these Platform Terms, and a material failure to do so is a material breach of these Platform Terms.

Schedule C — API and Webhook Security

C.1 API authentication. Server-to-server calls to the Backend API are authenticated by OAuth 2.0 client credentials (client_id and client_secret) issued to Partner. End-user-authenticated calls are authenticated by JSON Web Tokens issued by the platform’s identity service.

C.2 Transport security. All API and webhook traffic is encrypted in transit using TLS 1.2 or higher.

C.3 Webhook signing. Webhook payloads are signed by NAS using HMAC-SHA256 keyed with a secret known only to NAS and Partner. The signature is Base64-encoded and is included as a header on the webhook HTTP request. Partner shall verify the signature using a constant-time comparison (to prevent timing attacks) before acting on the payload.

C.4 Webhook delivery and retry. Webhook events are queued and delivered asynchronously. Failed deliveries (HTTP responses other than 2xx, network errors, timeouts) are retried on a back-off schedule. Partner is responsible for accepting webhook deliveries idempotently — duplicate deliveries can occur and shall not result in duplicate processing on Partner’s side.

C.5 Replay protection. Webhook payloads include a unique event identifier and a timestamp. Partner shall reject any webhook whose timestamp is materially out of date (the recommended tolerance is five (5) minutes), and shall record processed event identifiers to detect and discard duplicate deliveries.

C.6 Rate limits. The Backend API enforces rate limits using a token-bucket algorithm. Default limits are documented in the API documentation and may be adjusted per Partner in the Program Order. Rate-limit responses include retry-after metadata.

C.7 Credential rotation. Partner shall rotate API credentials at least every twelve (12) months and immediately on personnel change with credential access, on suspected compromise, or on NAS’s request.

C.8 Multi-factor authentication. Multi-factor authentication is required for all access to the Business Portal, the Admin Back-office, and any other administrative Surface, per Section 12.2.

Schedule D — Data Residency and Sub-processors

D.1 Data residency.

(a) Partner-hosted Surfaces. Customer Personal Data captured and stored through the Customer-facing and Partner-facing Surfaces (Consumer mobile, Consumer Web, Business Portal, Support Portal, Admin Back-office) resides on Partner’s own hosting infrastructure. Partner is responsible for the residency, security and lawful processing of that data on its infrastructure.

(b) NAS-hosted central layer. The central orchestration / control-plane API operated by NAS, together with the Partner-representative and prospective-Partner data NAS Processes in its own right, is hosted on cloud infrastructure operated by a tier-one cloud-services provider in the European Union (primary location: Frankfurt, Germany). The nas.cards marketing site is hosted by the same provider in the same region and delivered globally through a content-delivery network.

NAS may, on prior written notice to Partner, expand the residency footprint of the NAS-hosted central layer to additional regions where required to comply with Applicable Law or to support new Programs.

D.2 Sub-processors. NAS engages sub-processors to support the Services. The current list of sub-processors (including each sub-processor’s identity, role, geographic location, and the categories of personal data processed) is set out in the Sub-processor Schedule to the DPA, which is shared with Partner under non-disclosure agreement.

D.3 New sub-processors. NAS shall give Partner at least thirty (30) calendar days’ prior written notice of the addition of any new sub-processor that will process Customer Information. Partner may object on reasonable data-protection grounds within fifteen (15) calendar days of notice; the Parties shall discuss in good faith to resolve the objection, and if no resolution can be reached either Party may terminate the affected Service or these Platform Terms in accordance with Section 17.

D.4 International transfers. Cross-border transfers of personal data, where they occur, are subject to appropriate transfer mechanisms (including the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and any equivalent mechanism applicable to the Hong Kong SAR and other relevant jurisdictions). Details are set out in the DPA.

Schedule E — Prohibitions and Restricted Activities

E.1 Prohibited use. Partner shall not use the Services, and shall take all necessary and appropriate actions to prevent its Customers from using the Services, for any of the following:

E.2 Restricted activities. The following categories of activity are restricted and may only be supported with NAS’s prior written approval and, where required, with additional onboarding, monitoring, or risk-management measures:

E.3 Downstream resellers. Partner shall not directly or indirectly resell, sublicense, distribute, white-label, bundle, repackage, or otherwise commercialise the Services to any third party without NAS’s prior written consent and a separate written agreement signed by an authorised officer of NAS.

E.4 Enforcement. Breach of this Schedule E constitutes a material breach of these Platform Terms and may result in immediate suspension or termination under Section 17, without prejudice to any other remedy available to NAS.

Annex 1 — Definitions

In these Platform Terms, capitalised terms have the meanings set out below, unless the context requires otherwise.