Settlement Agreement between Heartland Payment Systems, Inc. and MasterCard



 Exhibit 10.1 

SETTLEMENT AGREEMENT 

Dated May 19, 2010 

by and between 

MASTERCARD INTERNATIONAL INCORPORATED 

and 

HEARTLAND PAYMENT SYSTEMS, INC. 







 TABLE OF CONTENTS 

 

							
	 1.
	 	DEFINITIONS; CERTAIN RULES OF CONSTRUCTION.	  	1
				
		 	 1.1.
	  	Definitions	  	1
				
		 	 1.2.
	  	Certain Rules of Construction	  	6
			
	 2.
	 	ACCOUNTING STATEMENT	  	7
			
	 3.
	 	ALTERNATIVE RECOVERY OFFER	  	7
				
		 	 3.1.
	  	Terms of Communication	  	7
				
		 	 3.2.
	  	Issuer Release	  	7
				
		 	 3.3.
	  	Alternative Recovery Amount	  	8
				
		 	 3.4.
	  	Settlement Payment	  	8
				
		 	 3.5.
	  	Reduction for Non-Acceptances	  	8
			
	 4.
	 	UNSATISFIED THRESHOLD EVENT; ALTERNATIVE RECOVERY ACCEPTANCE REPORT; MASTERCARD REPRESENTATIONS; DELIVERY OF ISSUER RELEASES.	  	9
				
		 	 4.1.
	  	Unsatisfied Threshold Event	  	9
				
		 	 4.2.
	  	Alternative Recovery Acceptance Report	  	9
				
		 	 4.3.
	  	MasterCard Representations	  	10
				
		 	 4.4.
	  	Delivery of Issuer Releases	  	10
			
	 5.
	 	PAYMENT BY HPS; DISTRIBUTION BY MASTERCARD	  	11
			
	 6.
	 	NON-COMPLIANCE ASSESSMENTS; CLOSING CONDITIONS; MASTERCARD RELEASE.	  	11
				
		 	 6.1.
	  	Non-Compliance Assessments.	  	11
				
		 	 6.2.
	  	Closing Conditions.	  	11
				
		 	 6.3.
	  	MasterCard Release	  	12
			
	 7.
	 	RELEASE; CONSUMMATION DATE.	  	12
				
		 	 7.1.
	  	Release	  	12
				
		 	 7.2.
	  	Conditions to Consummation; Consummation Date	  	13
			
	 8.
	 	OPT-IN THRESHOLD CONDITION; TERMINATION, ETC.	  	13
				
		 	 8.1.
	  	Opt-In Threshold Condition	  	13
				
		 	 8.2.
	  	Termination	  	13

  

 -i- 









							
		 	 8.3.
	  	Effect of Termination	  	14
			
	 9.
	 	REPRESENTATIONS AND WARRANTIES; MASTERCARD AND HPS INDEMNIFICATION.	  	15
				
		 	 9.1.
	  	Representations and Warranties	  	15
				
		 	 9.2.
	  	MasterCard Indemnification	  	17
				
		 	 9.3.
	  	HPS Indemnification	  	17
				
		 	 9.4.
	  	Indemnification for Future Litigation Costs	  	18
			
	 10.
	 	MISCELLANEOUS.	  	18
				
		 	 10.1.
	  	Notices	  	18
				
		 	 10.2.
	  	Succession and Assignment; No Third-Party Beneficiary	  	20
				
		 	 10.3.
	  	Amendments and Waivers	  	20
				
		 	 10.4.
	  	Entire Agreement	  	20
				
		 	 10.5.
	  	Counterparts; Effectiveness	  	20
				
		 	 10.6.
	  	Non-Severability	  	21
				
		 	 10.7.
	  	Headings	  	21
				
		 	 10.8.
	  	Construction	  	21
				
		 	 10.9.
	  	Survival of Covenants, Reliance, etc	  	21
				
		 	 10.10.
	  	Governing Law	  	21
				
		 	 10.11.
	  	Jurisdiction; Venue and Limitation on Actions; Service of Process.	  	22
				
		 	 10.12.
	  	Specific Performance	  	23
				
		 	 10.13.
	  	Waiver of Jury Trial	  	23
				
		 	 10.14.
	  	No Admission of Liability	  	23
				
		 	 10.15.
	  	SEC Filings; Public Announcements	  	23

  

 -ii- 








 EXHIBITS 

 

			
	Exhibit 3	 	Form of ARO Communication
		
		 	Exhibit A – Form of Issuer Release
		
		 	Exhibit B – Form of ARO
		
		 	Exhibit C – Information Regarding Putative Class Action Proceedings
		
	Exhibit 7.1	 	Form of HPS and HPS Acquirers Release
		
	Exhibit 10.15A	 	HPS Press Release
		
	Exhibit 10.15B	 	MasterCard Press Release

  

 -iii- 








 SETTLEMENT AGREEMENT 

SETTLEMENT AGREEMENT dated as of May 19, 2010 (together with the attached Exhibits called this “Settlement
Agreement”), by and between MASTERCARD INTERNATIONAL INCORPORATED, a Delaware corporation (“MasterCard”), and HEARTLAND PAYMENT SYSTEMS, INC., a Delaware corporation (“HPS”). 

WHEREAS, on January 20, 2009, HPS publicly announced that it had suffered a computer system intrusion (further defined below as the
HPS Intrusion), during which payment card account data were at risk of being stolen; 
 WHEREAS, certain issuers of payment
cards bearing the “MasterCard,” “MasterCard Electronic,” “Maestro,” and/or “Cirrus” brand names may have certain rights under the MasterCard Operating Regulations (as defined below) to recover certain amounts
(which amounts may be payable by the HPS Acquirers and indemnifiable by HPS) by reason of losses and costs associated with the HPS Intrusion allegedly incurred by those issuers; and 

WHEREAS, in order to settle claims and resolve other disputes among HPS and its acquiring banks, on the one hand, and MasterCard and
certain MasterCard issuers, on the other hand, with respect to the possible rights of MasterCard issuers described above and actual and potential associated claims by MasterCard and MasterCard issuers asserting such possible rights and other
possible rights, HPS and MasterCard have entered into this Settlement Agreement. 
 NOW, THEREFORE, in consideration of the
representations, warranties and covenants set forth in this Settlement Agreement and subject to all the terms and conditions set forth in this Settlement Agreement, MasterCard and HPS agree as follows: 

1. DEFINITIONS; CERTAIN RULES OF CONSTRUCTION. 

1.1. Definitions. The following capitalized terms and non-capitalized words and phrases have the meanings respectively assigned to
them below, which meanings are applicable equally to the singular and plural forms of the terms so defined: 

“Acceptance Deadline” means June 25, 2010, unless such date is extended by MasterCard pursuant to Section 8.1,
in which event the Acceptance Deadline shall mean July 2, 2010. 
 “Acceptance Delivery Date” has the
meaning set forth in Section 4.4. 
 “Accepting Issuer” has the meaning set forth in Section 3.2.

 “Accounting Statement” means a written statement (i) that sets forth MasterCard’s calculation of
the aggregate number of Alerted-On Accounts and the aggregate numbers of the Covered MasterCard Issuers’ Alerted-On Accounts and Claimed-On Accounts (including MasterCard’s calculation of how many of the Covered MasterCard Issuers’
Claimed-On Accounts constitute Reissued Accounts and how many constitute Specially Monitored Accounts), and that contains detail sufficient to confirm the accuracy of the MasterCard 

 

 1 








 
representations and warranties contained in clauses (c), (d) and (e) of Section 9.1.1.3; (ii) that includes an issuer-by-issuer breakdown identifying each Eligible MasterCard
Issuer by means of a numerical identifier, rather than by name, setting forth the fully deduplicated number of Alerted-On Accounts and the number of Claimed-On Accounts of each Eligible MasterCard Issuer and its Sponsored Issuers (including how many
of the Claimed-On Accounts are Reissued Accounts and how many are Specially Monitored Accounts); (iii) that sets forth the Maximum Operating Expense Claim Amount and the Maximum Compliance Claim Amount of each Eligible MasterCard Issuer and its
Covered Sponsored Issuers and shows that the sum of the Maximum Operating Expense Claim Amounts of all the Eligible MasterCard Issuers equals the Maximum Aggregate Operating Expense Claim Amount and that the sum of the Maximum Compliance Claim
Amounts of all the Eligible MasterCard Issuers equals the Maximum Aggregate Compliance Claim Amount; and (iv) that sets forth the ARA of each Eligible MasterCard Issuer and shows that the ARA of each Eligible MasterCard Issuer is 41.65% of the
sum of the issuer’s Maximum Operating Expense Claim Amount and Maximum Compliance Claim Amount, and the sum of the ARAs of all the Eligible MasterCard Issuers equals $41,400,100. 

“Affiliate” means any MasterCard Issuer that controls, is controlled by, or is under common control with, another
MasterCard Issuer. 
 “Affiliate Member” has the meaning set forth in Section 1.1.3 of the MasterCard
Rules. 
 “Affiliated Person” means, as to any Person, the past, present, and future representatives,
attorneys, agents, accountants, assigns, insurers, administrators, officers, directors, trustees, employees, retained contractors, parents, affiliates, subsidiaries, predecessors, and successors of the Person, and any other Persons acting on behalf
of the Person, all in their capacities as such. 
 “Alerted-On Account” means (i) in general, any
MasterCard Account with respect to which MasterCard or any of its Affiliated Persons issued an alert in connection with the HPS Intrusion, and (ii) with respect to each Covered MasterCard Issuer, the group of MasterCard Accounts issued by such
issuer with respect to which MasterCard issued an alert in connection with the HPS Intrusion. 
 “Alleged
Non-Compliance” has the meaning set forth in Section 6.3. 
 “Alternative Recovery Acceptance
Report” has the meaning set forth in Section 4.2. 
 “ARA” has the meaning set forth in
Section 3.1. 
 “ARO” has the meaning set forth in Section 3.1. 

“ARO Communication” has the meaning set forth in Section 3. 

“ARO Date” has the meaning set forth in Section 3. 

 

 2 








 “Business Day” means any day other than any Saturday, Sunday or other day
on which commercial banks are authorized or required to close in New York City. 
 “Challenge Declaration” has
the meaning set forth in Section 5. 
 “Challenged Awards” has the meaning set forth in
Section 3.5.3. 
 “Claimed-On Account” means an Eligible Alerted-On Account of a Covered MasterCard Issuer
as to which such Covered MasterCard Issuer either made or had made on its behalf an Issuer Operating Expense Claim. A Covered MasterCard Issuer’s Claimed-On Accounts shall include any Eligible Alerted-On Account of such Covered MasterCard
Issuer as to which the Issuer Claim as to such MasterCard Account may have been waived subsequent to such Issuer Claim having been made with MasterCard. 

“Closing Conditions” has the meaning set forth in Section 6.2. 

“Closing Deadline” has the meaning set forth in Section 8.2.2. 

“Consummation Date” has the meaning set forth in Section 7.2. 

“Covered Action” has the meaning set forth in Section 10.13. 

“Covered MasterCard Issuer” means each MasterCard Issuer, including without limitation any Affiliate Member and any
Affiliate, that: (i) was the issuer of one or more Alerted-On Accounts; and (ii) either made or had made on its behalf an Issuer Compliance Claim and/or an Issuer Operating Expense Claim with MasterCard under the MasterCard Operating
Regulations with respect to one or more of its Eligible Alerted-On Accounts. 
 “Covered Sponsored Issuer”
means (A) in general, a Covered MasterCard Issuer that is a Sponsored Issuer of an Eligible MasterCard Issuer; and (B) with respect to any Eligible MasterCard Issuer, any Covered MasterCard Issuer that is a Sponsored Issuer of such
Eligible MasterCard Issuer. 
 “Eligible Alerted-On Account” means an Alerted-On Account that was, under the
MasterCard Operating Regulations, eligible to be made the subject of an Issuer Compliance Claim and/or an Issuer Operating Expense Claim. 

“Eligible MasterCard Issuer” means a Covered MasterCard Issuer that is not an Affiliate Member; provided,
however, that in the event two or more Covered MasterCard Issuers that are Affiliates of one another would be Eligible MasterCard Issuers under the foregoing definition, then one and only one of such Affiliates (to be designated by
MasterCard) shall be an Eligible MasterCard Issuer. 
 “Financing Condition” has the meaning set forth in
Section 6.2. 
  

 3 








 “HPS Acquirers” means KeyBank National Association and Heartland Bank, in
their capacities as acquiring banks for HPS or an Affiliated Person of HPS in the MasterCard payment-card network. 

“HPS Intrusion” means the HPS computer system intrusion(s) referenced in the MasterCard Alerts issued under case number
MCA1805-US-08, including all of its subparts. 
 “Issuer Claim” means any Issuer Compliance Claim or Issuer
Operating Expense Claim. 
 “Issuer Compliance Claim” means a compliance claim regarding the HPS Intrusion
submitted to MasterCard by or on behalf of a MasterCard Issuer under the MasterCard Operating Regulations with respect to one or more of its Eligible Alerted-On Accounts. 

“Issuer Operating Expense Claim” means a timely operating expense reimbursement claim regarding the HPS Intrusion
submitted to MasterCard by or on behalf of a MasterCard Issuer under the MasterCard Operating Regulations with respect to one or more of its Eligible Alerted-On Accounts. 

“Issuer Release” has the meaning set forth in Section 3.2. 

“Loan” has the meaning set forth in Section 6.2. 

“Loan Commitment” has the meaning set forth in Section 6.2. 

“MasterCard Account” means a payment card account utilized by a payment card bearing the MasterCard symbol or MasterCard
brand mark, the MasterCard Electronic symbol or MasterCard Electronic brand mark, the Maestro symbol or Maestro brand mark, and/or the Cirrus symbol or Cirrus brand mark, and issued by or through a member of MasterCard (or by or through some other
entity sponsored directly or indirectly by an Affiliated Person of a member of MasterCard), that enables the purchase of goods from a merchant. 

“MasterCard Issuer” means an issuer of a MasterCard Account. 

“MasterCard Operating Regulations” means the governing bylaws, rules and regulations, published policies, and any other
manuals of MasterCard prepared in connection with any program or service or activity of MasterCard and published to the members of MasterCard from time to time, for example, and not by way of limitation, the MasterCard Rules, the Security
Rules and Procedures, and the Chargeback Guide, as currently or formerly in effect. 
 “Maximum Aggregate
Compliance Claim Amount” has the meaning set forth in clause (j) of Section 9.1.1.3. 
 “Maximum
Aggregate Issuer Liability” has the meaning set forth in clause (j) of Section 9.1.1.3. 
  

 4 








 “Maximum Aggregate Operating Expense Claim Amount” has the meaning set
forth in clause (h) of Section 9.1.1.3. 
 “Maximum Compliance Claim Amount” means, as to any
Eligible MasterCard Issuer, the maximum aggregate amount that MasterCard would award on the Issuer Compliance Claim(s) of such issuer and its Covered Sponsored Issuers as determined by MasterCard in accordance with its preliminary review processes.

 “Maximum Issuer Liability” means, as to any Eligible MasterCard Issuer, the sum of the issuer’s Maximum
Compliance Claim Amount and the issuer’s Maximum Operating Expense Claim Amount. 
 “Maximum Operating Expense
Claim Amount” means, as to any Eligible MasterCard Issuer, the maximum aggregate amount that MasterCard would award on the Issuer Operating Expense Claim(s) of such issuer and its Covered Sponsored Issuers as determined by MasterCard in
accordance with its preliminary review processes. 
 “Non-Accepting Issuer” has the meaning set forth in
Section 3.5. 
 “Non-Accepting Issuer ARA Amount” means the aggregate amount of the ARAs of the
Non-Accepting Issuers. 
 “Non-Accepting Issuer Award” means a final ruling and award on the Issuer Claim of a
Non-Accepting Issuer that is made by MasterCard and noticed to HPS in accordance with Section 3.5. 

“Non-Accepting Issuer Awards Amount” means the aggregate amount of the Non-Accepting Issuer Awards. 

“Non-Accepting Issuer Awards Report” has the meaning set forth in Section 3.5. 

“Non-Compliance Assessments” has the meaning set forth in Section 6.1. 

“Opt-In Threshold Condition” has the meaning set forth in Section 8.1. 

“Person” means any individual or any corporation, association, partnership, limited liability company, joint venture,
joint stock or other company, business trust, trust, organization, governmental authority or other entity of any kind. 

“Reissued Account” means a Claimed-On Account with respect to which a Covered MasterCard Issuer has submitted or had
submitted on its behalf an Issuer Operating Expense Claim asserting that the MasterCard card of the accountholder of that particular Claimed-On Account was reissued as a result of the HPS Intrusion. 

“Release” has the meaning set forth in Section 7.1. 

 

 5 








 “Reports on Compliance” means the following reports prepared for HPS in
conjunction with the annual assessment of HPS’s compliance with the Payment Card Industry Data Security Standards and/or other then existing data security standards: Attestation of Compliance for Onsite Assessments—Services Providers,
dated April 20, 2010; the 2009 Level 1—PCI Data Security Standard Report on Compliance dated April 15, 2009 prepared for HPS by VeriSign Inc.; and the 2008 Payment Card Industry Report of Compliance dated April 10, 2008
prepared for HPS by Trustwave. 
 “Retained Non-Compliance Assessment” has the meaning set forth in
Section 6.1. 
 “Ruling Condition” has the meaning set forth in Section 6.2. 

“Settlement” means the settlement embodied in this Settlement Agreement. 

“Settlement Agreement” has the meaning set forth in the preamble hereto. 

“Settlement Amount” means $41,400,100 less the amount of any downward adjustment to the Settlement Amount provided for
in Section 3.5. 
 “Settlement Payment” means the Settlement Amount (as adjusted in accordance with
Section 3.5) less $6,600,868. 
 “Specially Monitored Account” means a Claimed-On Account with respect to
which a Covered MasterCard Issuer has submitted or had submitted on its behalf an Issuer Operating Expense Claim asserting that special monitoring procedures were implemented with respect to that particular Claimed-On Account as a result of the HPS
Intrusion. 
 “Sponsored Issuer” means (A) in general, any MasterCard Issuer that is (i) an
Affiliate of an Eligible MasterCard Issuer or (ii) an Affiliate Member of an Eligible MasterCard Issuer or one of its Affiliates; and (B) with respect to any Eligible MasterCard Issuer, any MasterCard Issuer (i) that is an Affiliate
of such Eligible MasterCard Issuer or (ii) an Affiliate Member of such Eligible MasterCard Issuer or one of its Affiliates. 

“Termination Date” has the meaning set forth in Section 8.2. 

“Unsatisfied Threshold Event” means that the Eligible MasterCard Issuers that validly accept their AROs by the
Acceptance Deadline did not issue (together with their Covered Sponsored Issuers), in the aggregate, at least 80% of the Claimed-On Accounts. 

1.2. Certain Rules of Construction. Except as otherwise explicitly specified to the contrary, (a) references to a Section,
Exhibit or Schedule means a Section of, or Schedule or Exhibit to, this Settlement Agreement, unless another agreement or document is specified, (b) the word “including” will be construed as “including without limitation,”
(c) references to a particular statute or regulation include all rules and regulations thereunder and any predecessor or successor statute, rules or regulation, in each case as amended or otherwise modified from time to time, (d) words in
the singular or plural form include the plural and singular form, respectively and (e) references to a particular Person include such Person’s successors and assigns to the extent not expressly prohibited by this Settlement Agreement.

  

 6 








 2. ACCOUNTING STATEMENT. Prior to the execution and delivery of this Settlement
Agreement, MasterCard has delivered to HPS the Accounting Statement. 
 3. ALTERNATIVE RECOVERY OFFER. On May 27,
2010 (the “ARO Date”), MasterCard shall send to each Eligible MasterCard Issuer the communication attached hereto as Exhibit 3 (the “ARO Communication”), appropriately completed for each Eligible MasterCard Issuer.

 3.1. Terms of Communication. The ARO Communication shall (i) include an offer to the Eligible MasterCard Issuer
to which it is addressed (in the form appearing as Exhibit B to Exhibit 3 hereto), as an alternative to any recovery in regard to the HPS Intrusion that may otherwise be available to said Eligible MasterCard Issuer and its Covered Sponsored Issuers,
of a specified dollar amount (as to each Eligible MasterCard Issuer, such offer being defined as such issuer’s “ARO” and the specified dollar amount of such offer being defined as such issuer’s “ARA”);
(ii) recommend that each Eligible MasterCard Issuer accept its ARO on behalf of itself and its Covered Sponsored Issuers; and (iii) provide (in the form appearing as Exhibit C to Exhibit 3 hereto) information regarding the putative class
action proceedings referenced in Section 3.2. 
 3.2. Issuer Release. Any Eligible MasterCard Issuer that desires to
accept its ARO must, on or before the Acceptance Deadline, fully complete, duly execute, and deliver to MasterCard a release and covenant not to sue (the “Issuer Release”) in the form appearing as Exhibit A to Exhibit 3 hereto (each
Eligible MasterCard Issuer that so accepts its ARO is herein called an “Accepting Issuer”). As provided in the Issuer Release, each Accepting Issuer shall, effective on the Consummation Date, irrevocably waive its right, the right
of any of its Covered Sponsored Issuers, and the right of any of its or their Affiliated Persons, to assert against MasterCard, HPS, the HPS Acquirers, and the Affiliated Persons of each of them, and shall fully and finally release MasterCard, HPS,
the HPS Acquirers, and the Affiliated Persons of each of them from, the following: (a) any claim or right of recovery the Accepting Issuer or any of its Covered Sponsored Issuers or any of its or their Affiliated Persons might otherwise have
had under the MasterCard Operating Regulations by reason of any matter, occurrence, or event pertaining to the HPS Intrusion, (b) any dispute or objection the Accepting Issuer, or any of its Covered Sponsored Issuers, or any of its or their
Affiliated Persons, might otherwise be entitled to raise or make with respect to the amount, or the calculation of the amount, of its ARA as determined by MasterCard, and (c) any claim or right the Accepting Issuer, or any of its Covered
Sponsored Issuers, might be entitled to assert, and any monetary recovery or other relief that the Accepting Issuer, or any of its Covered Sponsored Issuers, or any of its or their Affiliated Persons, might be entitled to seek or receive, in any
litigation or other proceeding (including without limitation the pending putative class action proceedings consolidated under the caption entitled In Re: Heartland Payment Systems Inc. Data Security Breach Litigation, Master Docket
No. 09-md-02046, and Lone Star National Bank, N.A., et al. v. KeyBank N.A., et al., Case No. 4:10-cv-00171, both pending in the United States District Court for the Southern District of Texas), or under any other laws, rules or
regulations, in connection with any injury or harm the Accepting Issuer, or any of its Covered Sponsored Issuers, or any of its or their Affiliated 

 

 7 








 
Persons, may have incurred in its capacity as a MasterCard Issuer with respect to any of its Alerted-On Accounts or by reason of any matter, occurrence, or event pertaining to the HPS Intrusion
(whether or not such matter, occurrence, or event is known to the Accepting Issuer as of the date of the Issuer Release). No Eligible MasterCard Issuer shall be deemed to have timely and validly accepted its ARO unless such issuer shall have fully
completed, duly executed, and timely delivered its Issuer Release and such fully completed, duly executed, and timely delivered Issuer Release shall in turn have been timely delivered to HPS by MasterCard. 

3.3. Alternative Recovery Amount. Each Eligible MasterCard Issuer’s ARO shall reflect an ARA equal to 41.65% of the
issuer’s Maximum Issuer Liability, and the aggregate amount of all the Eligible MasterCard Issuers’ ARAs shall equal $41,400,100. 

3.4. Settlement Payment. The Settlement Payment will be paid by HPS to MasterCard on the Consummation Date. The Settlement Payment
shall be deemed to include $380,000 for reimbursement of outside counsel legal fees and other third-party expenses incurred by MasterCard in connection with the HPS Intrusion. MasterCard will elect not to retain such $380,000 for its own account,
but rather will use that amount toward funding the payments to issuers contemplated herein. 
 3.5. Reduction for
Non-Acceptances. In the event that one or more of the Eligible MasterCard Issuers does not timely and validly accept its ARO (any such Eligible MasterCard Issuer that does not so accept its ARO is herein called a “Non-Accepting
Issuer”), but the Opt-In Threshold Condition nonetheless is either met or waived as provided in Section 4.1, MasterCard will, within seventy-five (75) days from the date of MasterCard’s delivery of the Alternative Recovery
Acceptance Report, determine the Non-Accepting Issuer Award for each Non-Accepting Issuer and provide HPS with written notice (as provided in Section 10.1) of each Non-Accepting Issuer Award (the “Non-Accepting Issuer Awards
Report”), such notice to (i) identify each Non-Accepting Issuer by name and by the numerical identifier used for such issuer in the Accounting Statement; (ii) set forth the amount of each such issuer’s ARA and Non-Accepting
Issuer Award; and (iii) calculate the Non-Accepting Issuer ARA Amount and the Non-Accepting Issuer Awards Amount. MasterCard’s provision of the Non-Accepting Issuer Awards Report shall constitute a representation and warranty by MasterCard
as to the accuracy of the information contained therein. The Settlement Amount will thereupon be adjusted downward, as follows: 

3.5.1. If the Non-Accepting Issuer Awards Amount is 50% or less of the Non-Accepting Issuer ARA Amount, then the Settlement Amount shall
be reduced by an amount equal to the difference between the Non-Accepting Issuer ARA Amount and the Non-Accepting Issuer Awards Amount. In such event, HPS will not challenge (in any judicial or non-judicial proceeding), and will cause the HPS
Acquirers not to challenge, any of the Non-Accepting Issuer Awards, including any individual Non-Accepting Issuer Award that exceeds 50% of the Non-Accepting Issuer’s ARA, and will release MasterCard from any liability thereon pursuant to the
Release, in the event the Consummation Date occurs. 
 3.5.2. If the Non-Accepting Issuer Awards Amount is greater than 50% of
the Non-Accepting Issuer ARA Amount, but the Consummation Date nevertheless occurs by reason of HPS and MasterCard waiving, in writing at least five (5) Business Days before the 

 

 8 








 
Closing Deadline, the Ruling Condition, then (i) in the event HPS timely makes the Challenge Declaration the Settlement Amount shall be reduced by an amount equal to the difference between
the Non-Accepting Issuer ARA Amount and the aggregate amount of those Non-Accepting Issuer Awards that are 50% or less of the ARA of the Non-Accepting Issuers in question, and (ii) in the event HPS does not timely make the Challenge
Declaration, the Settlement Amount shall be reduced by an amount equal to the difference between the Non-Accepting Issuer ARA Amount and the Non-Accepting Issuer Awards Amount. (In the event HPS timely makes the Challenge Declaration, HPS will not
challenge, and will cause the HPS Acquirers not to challenge, any Non-Accepting Issuer Award that is 50% or less of the ARA of the Non-Accepting Issuer in question, and will release MasterCard from any liability thereon pursuant to the Release, in
the event the Consummation Date occurs, and HPS may challenge or cause the HPS Acquirers to challenge only those Non-Accepting Issuer Awards that exceed 50% of the ARA of the Non-Accepting Issuers in question. In the event HPS does not timely make
the Challenge Declaration, HPS will not challenge, and will cause the HPS Acquirers not to challenge, any of the Non-Accepting Issuer Awards, and will release MasterCard from any liability thereon pursuant to the Release, in the event the
Consummation Date occurs.) 
 3.5.3. In the event of a Challenge Declaration, MasterCard will not pay the challenged
Non-Accepting Issuer Awards (the “Challenged Awards”) from Settlement Amount funds, but instead will apply its process with regard to all Challenged Awards. 

4. UNSATISFIED THRESHOLD EVENT; ALTERNATIVE RECOVERY ACCEPTANCE REPORT; MASTERCARD REPRESENTATIONS; DELIVERY OF ISSUER RELEASES.

 4.1. Unsatisfied Threshold Event. This Settlement Agreement shall become void, and each party shall be relieved of any
obligation to consummate the transactions contemplated herein, in the event the Unsatisfied Threshold Event occurs and the Opt-In Threshold Condition is not waived in writing by both MasterCard and HPS within five (5) Business Days of
MasterCard’s delivery of the written certification described in the following sentence. If the Unsatisfied Threshold Event occurs, MasterCard shall deliver (as provided in clause (a), (b) or (d) of Section 10.1) to HPS not later
than 5:00 p.m., Eastern time, three (3) Business Days following the Acceptance Deadline a written certification to the effect that the Unsatisfied Threshold Event has occurred. The delivery by MasterCard of such a written certification shall
constitute a representation and warranty by MasterCard, and MasterCard shall be deemed to represent and warrant by such delivery, that the information contained therein is true and correct. 

4.2. Alternative Recovery Acceptance Report. If the Unsatisfied Threshold Event shall not have occurred and, accordingly, the
Opt-In Threshold Condition shall have been met, or if the Opt-In Threshold Condition shall have been waived as provided in Section 4.1, MasterCard shall deliver (as provided in clause (a), (b) or (d) of Section 10.1) to HPS not
later than 5:00 p.m., Eastern Time five (5) Business Days following either the Acceptance Deadline (in a case where the Opt-In Threshold Condition has been met) or the date of the waiver of the Opt-In Threshold Condition (in a case where the
Opt-In Threshold Condition has been waived) a written report (the “Alternative Recovery Acceptance Report”) that sets forth the same information contained in the Accounting Statement and identifies by name and MasterCard ICA

  

 9 








 
(and by the numerical identifier used for such Eligible MasterCard Issuer in the Accounting Statement) each Eligible MasterCard Issuer that validly accepted its ARO and is thereby an Accepting
Issuer, together with the number of Claimed-On Accounts of each Accepting Issuer and its Covered Sponsored Issuers. The Alternative Recovery Acceptance Report shall also set forth MasterCard’s calculation either demonstrating that the Opt-In
Threshold Condition has been met (in a case where the Opt-In Threshold Condition has been met) or showing the extent to which the Opt-In Threshold Condition has not been met (in a case where the Opt-In Threshold Condition has been waived).

 4.3. MasterCard Representations. The delivery of the Alternative Recovery Acceptance Report by MasterCard shall
constitute a representation and warranty by MasterCard, and MasterCard shall be deemed to represent and warrant by such delivery, that (i) MasterCard has in the Alternative Recovery Acceptance Report correctly set forth the names and MasterCard
ICAs of the Accepting Issuers and the number of Alerted-On Accounts and Claimed-On Accounts (including the number of Reissued Accounts and Specially Monitored Accounts) of each of the Accepting Issuers and their Sponsored Issuers, (ii) each
Accepting Issuer identified as such in the Alternative Recovery Acceptance Report has timely provided MasterCard with a fully completed and duly executed Issuer Release, (iii) MasterCard has no reason to believe that any Accepting Issuer or any
Covered Sponsored Issuer of such issuer failed to comply with the “one-claim-per-account” provisions of Section 10.3.4 of the MasterCard Security Rules and Procedures manual in the Issuer Operating Expense Claim relative to
such issuer’s Claimed-On Accounts, (iv) MasterCard has in the Alternative Recovery Acceptance Report correctly calculated either that the Opt-In Threshold Condition has been met (in a case where the Opt-In Threshold Condition has been met)
or the extent to which the Opt-In Threshold Condition has not been met (in a case where the Opt-In Threshold Condition has been waived), and (v) the numerical information contained in the Alternative Recovery Acceptance Report with respect to
the Accepting Issuers and their Covered Sponsored Issuers accurately reflects such numerical information as it was provided to MasterCard by the Accepting Issuers in their Issuer Releases and matches such numerical information as it was provided to
MasterCard by the Accepting Issuers and their Covered Sponsored Issuers in their Issuer Claims and as it was set forth as to the Accepting Issuers and their Covered Sponsored Issuers in the Accounting Statement. 

4.4. Delivery of Issuer Releases. In the event that the Opt-In Threshold Condition shall have been met or waived as provided in
Section 4.1, then not later than five (5) Business Days after MasterCard has delivered the Alternative Recovery Acceptance Report to HPS, MasterCard shall deliver to HPS a true and correct copy of an Issuer Release that has been fully
completed, duly executed, and timely delivered by each Eligible MasterCard Issuer identified as an Accepting Issuer in the Alternative Recovery Acceptance Report. The delivery of an Issuer Release by MasterCard to HPS pursuant to Section 4.4
shall constitute a representation and warranty by MasterCard, and MasterCard shall be deemed to represent and warrant by such delivery, that Schedule I of each Issuer Release accurately sets forth, as shown in MasterCard’s records at
May 27, 2010, the Sponsored Issuer(s), including any Affiliate(s), of the Accepting Issuer that executed such Issuer Release. The date on which MasterCard has delivered to HPS an Issuer Release fully completed, duly executed, and timely
delivered by each Eligible MasterCard Issuer identified as an Accepting Issuer in the Alternative Recovery Acceptance Report is defined herein as the “Acceptance Delivery Date.” 

 

 10 








 5. PAYMENT BY HPS; DISTRIBUTION BY MASTERCARD. Subject to all the conditions of this
Settlement Agreement having been met or waived and the satisfaction of all the other party’s obligations hereunder, (a) HPS shall pay the Settlement Payment to MasterCard in same day funds on the Consummation Date (by federal wire transfer
to a bank account specified by MasterCard on not less than two (2) Business Days advance written notice); (b) within five (5) Business Days of the Consummation Date, HPS shall deliver to the HPS Acquirers a copy of each Issuer Release
received from MasterCard pursuant to Section 4.4; and (c) within fifteen (15) Business Days of the Consummation Date, MasterCard shall (i) pay each Accepting Issuer its ARA; and (ii) pay to each Non-Accepting Issuer the
amount of such issuer’s Non-Accepting Issuer Award, unless the Non-Accepting Issuer Awards Amount exceeds 50% of the Non-Accepting Issuer ARA Amount and HPS declares, within two (2) Business Days of MasterCard’s having provided HPS
with the Non-Accepting Issuer Awards Report in the manner called for in Section 3.5, its intention to challenge or cause the HPS Acquirers to challenge any Non-Accepting Issuer Award that is in excess of 50% of a Non-Accepting Issuer’s ARA
(the “Challenge Declaration”), in which event MasterCard shall pay only those Non-Accepting Issuer Awards that are not Challenged Awards. 

6. NON-COMPLIANCE ASSESSMENTS; CLOSING CONDITIONS; MASTERCARD RELEASE. 

6.1. Non-Compliance Assessments. The non-compliance assessments that MasterCard previously imposed on and collected from the HPS
Acquirers in connection with the HPS Intrusion (the “Non-Compliance Assessments”) total $7,100,868. Upon and subject to the Consummation Date having occurred: (i) HPS shall cause the HPS Acquirers to withdraw with prejudice
their pending appeals of the $200,000 portion of the Non-Compliance Assessments imposed by MasterCard on July 15, 2009; (ii) MasterCard shall retain $500,000 (the “Retained Non-Compliance Assessment”) of the Non-Compliance
Assessments that MasterCard imposed on April 16, 2009 pursuant to Section 10.3.2 of the MasterCard Security Rules and Procedures with respect to the period from February 6, 2009 through and including April 16, 2009 by reason of
HPS’s alleged failure during such time to cooperate with MasterCard’s investigation of the HPS Intrusion, such Retained Non-Compliance Assessment being distinct from and independent of the Settlement Amount; and (iii) MasterCard shall
contribute the balance of the Non-Compliance Assessments, viz., $6,600,868, to funding the payments to issuers contemplated herein. 

6.2. Closing Conditions. The obligations of HPS to pay the Settlement Payment, deliver the Release, and consummate the Settlement,
and the obligation of MasterCard to consummate the Settlement, are all subject to the following conditions (the “Closing Conditions”) having either been met or waived by both HPS and MasterCard at least five (5) Business Days
before the Closing Deadline: (1) HPS shall have entered into a binding agreement (the “Loan Commitment”) entitling HPS to receive a loan in the principal amount of not less than $30.7 million (the “Loan”), the
proceeds of which will be used by HPS as a portion of its payment of the Settlement Payment (the “Financing Condition”); and (2) MasterCard shall have made, and provided HPS notice of in accordance with Section 3.5, each
of the Non-Accepting Issuer Awards and the Non-Accepting Issuer Awards Amount shall not exceed 50% of the Non-Accepting Issuer ARA Amount (the “Ruling Condition”). 

 

 11 








 6.3. MasterCard Release. Subject to the Consummation Date occurring as provided
herein, MasterCard hereby agrees that no further non-compliance assessments will be imposed or collected and no changes in interchange fee rates will be imposed by MasterCard or any of its Affiliated Persons based upon or in connection with the HPS
Intrusion, and MasterCard hereby releases and agrees that neither it nor any of its Affiliated Persons will assert any claim, demand, cause of action, amount, or assessment of any kind (including any claim or assessment seeking to recover any amount
that MasterCard or any of its Affiliated Persons may award or allow on, or otherwise asserting any rights or obligations or demanding any payment in connection with or by reason of, any Issuer Claim heretofore or hereafter asserted under the
MasterCard Operating Regulations by or on behalf of any MasterCard Issuer, whether or not such MasterCard Issuer receives or accepts an ARO) that otherwise might be asserted by MasterCard or any of its Affiliated Persons against HPS or the HPS
Acquirers or any of its or their Affiliated Persons (a) with respect to the HPS Intrusion (whether or not such claim or assessment or the facts, events, or occurrences giving rise thereto were known, suspected, or anticipated by MasterCard as
of the date of this Settlement Agreement and may have materially affected MasterCard’s decision to agree to this Settlement Agreement if known) or (b) by reason of any alleged non-compliance by HPS or the HPS Acquirers or any of its or
their Affiliated Persons with any of the data security requirements of the MasterCard Operating Regulations on or before the date of this Settlement Agreement (an “Alleged Non-Compliance”) to the extent such Alleged Non-Compliance
relates to the HPS Intrusion (whether or not such Alleged Non-Compliance was known, suspected or anticipated by MasterCard as of the date of this Settlement Agreement and may have materially affected MasterCard’s decision to agree to this
Settlement Agreement if known) or was known to MasterCard as of the date of this Settlement Agreement or had been disclosed in one of the Reports on Compliance (whether or not such Alleged Non-Compliance relates to the HPS Intrusion). The release
and covenant provided by MasterCard in the preceding sentence shall not be interpreted to extend to any claim or assessment seeking to recover or collect the amount (but no more than the amount) of any Non-Accepting Issuer Award that is a Challenged
Award, and the release and covenant provided by MasterCard in clause (b) of the preceding sentence shall not be interpreted to extend to any claim or assessment by MasterCard (i) where an Alleged Non-Compliance is alleged to have continued
after the date of this Settlement Agreement and such claim or assessment is asserted or imposed with respect to that portion of the Alleged Non-Compliance that is alleged to have occurred or continued after the date of this Settlement Agreement,
(ii) where an Alleged Non-Compliance is alleged to have resulted in an actual or possible account data compromise event and such alleged account data compromise event was not known to MasterCard as of the date of this Settlement Agreement and
such claim or assessment is asserted or imposed with respect to such account data compromise event, (iii) where such claim or assessment is the return of a transaction by a MasterCard Issuer to an HPS Acquirer as a chargeback pursuant to the
MasterCard Chargeback Guide, or (iv) where such claim or assessment is based upon an Alleged Non-Compliance by an HPS Acquirer that concerns an entity other than HPS and its Affiliated Persons or one of HPS’s merchants. 

7. RELEASE; CONSUMMATION DATE. 

7.1. Release. On the Consummation Date, upon and subject to the satisfaction of all of the other conditions set forth in
Section 7.2 below, HPS hereby agrees that it shall deliver to MasterCard a duly executed version of the form of release attached to this Settlement Agreement as Exhibit 7.1 (the “Release”). 

 

 12 








 7.2. Conditions to Consummation; Consummation Date. It is a condition to the
consummation of the Settlement that the Opt-In Threshold Condition shall have been met or waived as provided in Section 4.1, the Closing Conditions shall have been met or waived as provided in Section 6.2, and a termination notice pursuant
to Section 8.2 shall not have been given by HPS or MasterCard. In the event that the Opt-In Threshold Condition shall have been met or waived as provided in Section 4.1, the Closing Conditions shall have been met or waived as provided in
Section 6.2, and such a termination notice has not been given, the Settlement shall be consummated on the date that is five (5) Business Days after the date on which the Closing Conditions shall have been met or waived as provided in
Section 6.2 (the “Consummation Date”) by HPS paying MasterCard the Settlement Payment as required by Section 5 and delivering the Release to MasterCard as required by Section 7.1, provided that all of the following
additional conditions to consummation of the settlement contemplated by this Settlement Agreement shall have also been met by MasterCard or waived by HPS as of such date: 

7.2.1.1 MasterCard shall have delivered to HPS (i) the Non-Accepting Issuer Awards Report as required by Section 3.5,
(ii) the Alternative Recovery Acceptance Report as required by Section 4.2, and (iii) copies of the Issuer Releases as required by Section 4.4; and 

7.2.1.2 The representations and warranties of MasterCard referenced or made in Section 9.1.1 shall be true and correct in all
material respects on the Consummation Date with the same force and effect as if made as of the Consummation Date and MasterCard shall have performed and complied with all agreements, obligations and covenants contained in this Settlement Agreement
that are required to be performed or complied with by it. 
 8. OPT-IN THRESHOLD CONDITION; TERMINATION, ETC. 

8.1. Opt-In Threshold Condition. The obligations of HPS to pay MasterCard the Settlement Payment and to deliver the Release to
MasterCard as set forth in Section 7 are subject to the condition that the Unsatisfied Threshold Event shall not have occurred (such condition is herein called the “Opt-In Threshold Condition”). In the event that as of
June 25, 2010 Eligible MasterCard Issuers that (together with their Covered Sponsored Issuers) in the aggregate issued at least 70% (but less than 80%) of the Claimed-On Accounts of all the Eligible MasterCard Issuers and their Covered
Sponsored Issuers have validly accepted their AROs, MasterCard may, by written notice to HPS delivered not later than 5:00 p.m., Eastern Time, on the third (3) Business Day after June 25, 2010, extend the Acceptance Deadline by five
(5) Business Days. 
 8.2. Termination. This Settlement Agreement shall automatically terminate in the event that
the Opt-In Threshold Condition shall not be met or waived as provided in Section 4.1, and this Settlement Agreement may also be terminated (the date on which the Settlement Agreement is terminated, the “Termination Date”) at
any time prior to the Consummation Date: 
 8.2.1. by mutual written consent of HPS and MasterCard; 

8.2.2. by HPS or MasterCard by written notice to the other party, at any time after October 15, 2010 (the “Closing
Deadline”) if the Consummation Date has not 
  

 13 








 
occurred by such date (unless the Consummation Date has not occurred as the result of one or more breaches or violations of, or material inaccuracies in, any covenant, agreement, representation
or warranty of this Settlement Agreement by the terminating party); 
 8.2.3. by HPS, by written notice to MasterCard, if
either (i) there has been or will be a material breach of, or inaccuracy in, any representation or warranty of MasterCard contained in this Settlement Agreement as of the date of this Settlement Agreement or as of any subsequent date (other
than representations or warranties that this Settlement Agreement expressly limits so as to speak only as of a specific date or time, with respect to which HPS’s right to terminate will arise only in the event of a breach of, or inaccuracy in,
such representation or warranty as of such specified date or time), or (ii) MasterCard has breached or violated any of its covenants and agreements contained in this Settlement Agreement; and 

8.2.4. by MasterCard, by written notice to HPS, if either (i) there has been or will be a material breach of, or inaccuracy in, any
representation or warranty of HPS contained in this Settlement Agreement as of the date of this Settlement Agreement or as of any subsequent date (other than representations or warranties that this Settlement Agreement expressly limits so as to
speak only as of a specific date or time, with respect to which MasterCard’s right to terminate will arise only in the event of a breach of, or inaccuracy in, such representation or warranty as of such specified date or time), or (ii) HPS
has breached or violated any of its covenants and agreements contained in this Settlement Agreement. 
 Effective upon the Opt-In Threshold
Condition having been neither met nor waived as provided in Section 4.1 and effective upon the execution of any mutual consent to termination or the giving of any termination notice in accordance with Section 8.2 (delivered as provided in
Section 10.1), this Settlement Agreement shall terminate and be void and shall be of no further force or effect, except as provided in Section 8.3. 

8.3. Effect of Termination. If this Settlement Agreement is terminated as provided by or pursuant to the provisions of
Section 8.2, such termination shall be effective as against both parties to this Settlement Agreement and shall be without liability of either party to the other party to this Settlement Agreement, except for liabilities arising in respect of
breaches of representations and warranties and covenants under this Settlement Agreement by either party on or prior to the Termination Date. In the event of such termination it is agreed by the parties that, as provided in Section 10.14, none
of MasterCard’s agreement to present the AROs to Eligible MasterCard Issuers, HPS’s agreement to pay the Settlement Payment, or any other provision of this Settlement Agreement shall be cited in any way by MasterCard or HPS, or be deemed
evidence of an admission on the part of either of the parties, in any subsequent dispute other than a dispute relative to the enforcement of this Settlement Agreement. The provisions of Section 8.3, Sections 9.2 and 9.3, and Section 10
shall survive any termination pursuant to Section 8.2. 
  

 14 








 9. REPRESENTATIONS AND WARRANTIES; MASTERCARD AND HPS INDEMNIFICATION. 

9.1. Representations and Warranties. Each of the parties to this Settlement Agreement hereby makes the following representations
and warranties to the other party: 
 9.1.1. Representations and Warranties of MasterCard. In addition to its
representations and warranties made in connection with either the delivery of the certification regarding the Unsatisfied Threshold Event as provided in Section 4.1 or the delivery of the Non-Accepting Issuer Awards Report, the Alternative
Recovery Acceptance Report, and the Issuer Releases as provided in Section 3.5, Section 4.3, and Section 4.4 respectively, MasterCard hereby represents and warrants that: 

9.1.1.1 Authorization. The execution, delivery and performance of this Settlement Agreement, including the Exhibits to which
MasterCard is a party, and the consummation by MasterCard of the transactions contemplated hereby and thereby, are within its corporate powers and have been duly authorized by all necessary corporate action. This Settlement Agreement constitutes,
and each of the Exhibits to which MasterCard is a party when executed and delivered by it will constitute, a valid and binding agreement of MasterCard, enforceable against MasterCard in accordance with its terms, except to the extent such
enforceability may be limited to bankruptcy, insolvency, moratorium or other similar laws affecting or relating to creditors’ rights generally and general principles of equity. 

9.1.1.2 Non-Contravention. The execution, delivery and performance by MasterCard of this Settlement Agreement and the Exhibits to
which MasterCard is a party (a) do not and will not (i) violate the certificate of incorporation or by-laws of MasterCard, or (ii) require any consent that has not been given or other action that has not been taken by any Person under
any instrument binding upon MasterCard, and (b) do not require any action by or filing with any domestic or foreign, federal, state or local governmental authority, department, court or agency. 

9.1.1.3 Accounting Statement. 
  

	 	(a)	the Accounting Statement correctly sets forth the information required to be set forth therein by the terms of the definition of the term “Accounting
Statement” in Section 1.1; 

  

	 	(b)	each entity identified in the Accounting Statement as an Eligible MasterCard Issuer is an Eligible MasterCard Issuer and no entity identified in the Accounting
Statement as an Eligible MasterCard Issuer is a Sponsored Issuer of any other entity identified in the Accounting Statement as an Eligible MasterCard Issuer; 


 

	 	(c)	the Alerted-On Accounts constitute 39,361,486 unique MasterCard Accounts; 

  


	 	(d)	the Alerted-On Accounts of the Covered MasterCard Issuers constitute, in the aggregate, 36,935,155 of the Alerted-On Accounts; 


 

	 	(e)	the Claimed-On Accounts constitute, in the aggregate, 26,963,514 of the Alerted-On Accounts and include, in the aggregate, 10,557,117 Reissued Accounts and 16,406,397
Specially Monitored Accounts; 

  

 15 









	 	(f)	MasterCard has no reason to believe that any Covered MasterCard Issuer has failed to comply with “one-claim-per-account” provisions of Rule 10.3.4 of the
MasterCard Security Rules and Procedures in preparing or submitting to MasterCard an Issuer Operating Expense Claim or in having an Issuer Operating Expense Claim prepared or submitted to MasterCard on its behalf;


  

	 	(g)	with respect to each of the Issuer Operating Expense Claims, the number MasterCard used to populate Item 4.1 of the MasterCard Online Issuer Claim for
Reimbursement Worksheet for such claim is identical to the fully deduplicated number of Alerted-On Accounts of the issuer in question reflected in the Accounting Statement; 


 

	 	(h)	upon having applied its preliminary review process, MasterCard has determined that the maximum aggregate amount that MasterCard would award on the Issuer Operating
Expense Claims is $45,742,359.60 (the “Maximum Aggregate Operating Expense Claim Amount”); 

  

	 	(i)	except for 19 Eligible MasterCard Issuers that issued 493,355 of the Alerted-On Accounts and that submitted Issuer Compliance Claims representing in the aggregate
Maximum Compliance Claim Amounts of not more than $1.7 million, which 19 Eligible MasterCard Issuers are identified as Banks 264-282 on the Accounting Statement, each Eligible MasterCard Issuer submitted an Issuer Operating Expense Claim on behalf
of itself and/or one or more of its Sponsored Issuers; 

  

	 	(j)	 upon having applied its preliminary review process, MasterCard has determined that the amount sought by the Issuer Compliance Claims that were not
duplicative of another Issuer Compliance Claim, were made the subject of a precompliance item within 150 days of the MasterCard Alert relative to the Alerted-On Accounts that are the subject of such claims, were elevated to compliance no earlier
than the later of the denial of such precompliance item by the relevant HPS Acquirer or the expiration of 30 days from the submission of such precompliance item, and were elevated to compliance within 180 days of such alert, and accordingly the
maximum aggregate amount that 


  

 16 









	 	
MasterCard would award on Issuer Compliance Claims, is $53,657,640.40 (the “Maximum Aggregate Compliance Claim Amount” and, together with the Maximum Aggregate Operating Expense
Claim Amount, the “Maximum Aggregate Issuer Liability”); and 

  

	 	(k)	the calculations and the numbers set forth in the Accounting Statement accurately reflect the numerical information provided to MasterCard by the Eligible MasterCard
Issuers and their Covered Sponsored Issuers in the Issuer Claims they submitted to MasterCard in connection with the HPS Intrusion and the results of MasterCard’s having applied its preliminary review processes to such claims.


 9.1.2. Representations and Warranties of HPS. HPS hereby represents and warrants that:

 9.1.2.1 Authorization. The execution, delivery and performance of this Settlement Agreement, including the Exhibits
to which HPS is a party, and the consummation by HPS of the transactions contemplated hereby and thereby, are within its corporate powers and have been duly authorized by all necessary corporate action. This Settlement Agreement constitutes, and
each of the Exhibits to which HPS is a party when executed and delivered by it will constitute, a valid and binding agreement of HPS, enforceable against HPS in accordance with its terms, except to the extent such enforceability may be limited to
bankruptcy, insolvency, moratorium or other similar laws affecting or relating to creditors’ rights generally and general principles of equity. 

9.1.2.2 Non-Contravention. The execution, delivery and performance by HPS of this Settlement Agreement and the Exhibits to which
HPS is a party (a) do not and will not (i) violate the certificate of incorporation or by-laws of HPS, or (ii) require any consent that has not been given or other action that has not been taken by any Person under any instrument
binding upon HPS, and (b) do not require any action by or filing with any domestic or foreign, federal, state or local governmental authority, department, court or agency. 

9.2. MasterCard Indemnification. MasterCard agrees to indemnify HPS and the HPS Acquirers and its and their respective
Affiliated Persons against and shall hold each of them harmless from any and all damage, loss, liability, fines, penalties and expense (including reasonable expenses of investigation and reasonable attorneys’ fees and expenses in connection
with any action, suit or proceeding whether involving a third-party claim or a claim solely between the parties hereto) incurred or suffered by HPS or any of the HPS Acquirers or any of its or their respective Affiliated Persons arising out of any
misrepresentation or breach of warranty or breach of covenant or agreement made or to be performed by MasterCard pursuant to this Settlement Agreement. 

9.3. HPS Indemnification. HPS agrees to indemnify MasterCard and its Affiliated Persons against and shall hold each of them
harmless from any and all damage, loss, 
  

 17 








 
liability, fines, penalties and expense (including reasonable expenses of investigation and reasonable attorneys’ fees and expenses in connection with any action, suit or proceeding whether
involving a third-party claim or a claim solely between the parties hereto) incurred or suffered by MasterCard or any of its Affiliated Persons arising out of any misrepresentation or breach of warranty or breach of covenant or agreement made or to
be performed by HPS pursuant to this Settlement Agreement. 
 9.4. Indemnification for Future Litigation Costs. Subject
to the Consummation Date occurring as provided herein, (a) HPS agrees to indemnify MasterCard for 50% of all outside counsel fees and other costs reasonably incurred by MasterCard in responding to and/or contesting any discovery requests served
upon MasterCard (as a non-party) by HPS or the HPS Acquirers in connection with any litigation (including without limitation the pending putative class action proceedings consolidated under the caption entitled In Re: Heartland Payment Systems
Inc. Data Security Breach Litigation, Master Docket No. 09-md-02046, pending in the United States District Court for the Southern District of Texas) relating to the HPS Intrusion; and (b) MasterCard covenants not to invoke or otherwise
rely upon Rule 3.3 of the MasterCard Rules to seek or collect any other or further reimbursement from HPS or the HPS Acquirers for any legal fees or other costs incurred by MasterCard in connection with such non-party discovery requests.

 10. MISCELLANEOUS. 

10.1. Notices. All notices, requests, demands, claims and other communications required or permitted to be delivered, given or
otherwise provided under this Settlement Agreement must be in writing and must be delivered, given or otherwise provided: 
 (a)
by hand (in which case, it will be effective upon delivery); 
 (b) by facsimile (in which case, it will be effective upon
receipt of confirmation of good transmission); 
 (c) by overnight delivery by a nationally recognized courier service (in which
case, it will be effective on the Business Day after being deposited with such courier service); or 
 (d) by electronic mail
(in which case it will be effective on transmission to each representative of a party for whom an email address is listed below, unless the party making delivery is notified that it was not received by such a representative of the other party);

 in each case, to the address (or facsimile number or e-mail address) listed below: 

If to MasterCard, to it at: 

MasterCard International Incorporated 

2000 Purchase Street 

Purchase, NY 10577 

Facsimile Number: (914) 249-4703 

wendy_murdock@mastercard.com 

Attention: Wendy Murdock 
  

 18 








 with a copy to: 

MasterCard International Incorporated 

2000 Purchase Street 

Purchase, NY 10577 

Facsimile Number: (914) 249-4262 

noah_hanft@mastercard.com 

Attention: Noah Hanft, Esq. 

Golenbock Eiseman Assor Bell & Peskoe LLP 

437 Madison Avenue, 35th Floor 

New York, NY 10022 

Facsimile number: (212) 754-0777 

mhyman@golenbock.com 

Attention: Martin S. Hyman, Esq. 

If to HPS, to it at: 

Heartland Payment Systems, Inc. 

90 Nassau Street 

Princeton, NJ 08542 

Facsimile number: (609) 683-3815 

Charles.Kallenbach@e-hps.com 

Attention: Charles Kallenbach, Esq. 

with a copy to: 

Ropes & Gray LLP 

One International Place 

Boston, Massachusetts 02110 

Facsimile number: (617) 951-7050 

Douglas.Meal@ropesgray.com 

Attention: Douglas H. Meal, Esq. 

Each of the parties to this Settlement Agreement may specify a different address or facsimile number or email address by giving notice in accordance with
this Section 10.1 to each of the other parties. Any party delivering, giving, or otherwise providing any notice pursuant to clause (b) or (d) above shall follow up such notice by delivering a hard copy of such notice to the other
party pursuant to clause (a) or (c) above; provided, however, that the failure of such party to deliver such a follow-up hard copy to the other party shall not affect the effectiveness of the notice in question. 

 

 19 








 10.2. Succession and Assignment; No Third-Party Beneficiary. This Settlement
Agreement will be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns, each of which such successors and permitted assigns will be deemed to be a party for all purposes of this Settlement
Agreement. No party may assign, delegate or otherwise transfer either this Settlement Agreement or any of its rights, interests, or obligations hereunder without the prior written approval of the other party. This Settlement Agreement is for the
sole benefit of the parties and nothing in this Settlement Agreement (whether expressed or implied) is intended to give or shall be construed to give any Person (including without limitation Covered MasterCard Issuers), other than the parties, any
legal or equitable rights in connection with this Settlement Agreement except that (i) the HPS Acquirers and their Affiliated Persons and the Affiliated Persons of HPS are intended beneficiaries of the provisions of Section 6.3 and
Section 9.2 to the extent of enforcing the release and covenant and indemnity provided to them in these sections, (ii) the HPS Acquirers and their Affiliated Persons and the Affiliated Persons of HPS are the intended beneficiaries of the
Issuer Releases and Section 10.15 to the extent of enforcing the release and covenant not to sue and indemnity provided to them therein, (iii) the HPS Acquirers and their Affiliated Persons and the Affiliated Persons of HPS are intended
beneficiaries of the representations and warranties made by MasterCard in Section 4.4, (iv) the Affiliated Persons of MasterCard are intended beneficiaries of the Issuer Releases to the extent of enforcing the release and covenant not to
sue and indemnity provided to them therein and the provisions of Section 9.3 to the extent of enforcing the release provided to them in the Release and the indemnity provided to them in Section 9.3, and (v) the Released Parties (as
that term is defined in the Release) are intended beneficiaries of the Release to the extent of enforcing the release provided to them therein. 

10.3. Amendments and Waivers. No amendment or waiver of any provision of this Settlement Agreement will be valid and binding
unless it is in writing and signed, in the case of an amendment, by MasterCard and HPS, or in the case of a waiver, by the party against whom the waiver is to be effective. No waiver by any party of any breach or violation of or default under or
inaccuracy in any representation, warranty or covenant hereunder, whether intentional or not, will extend to any prior or subsequent breach or violation of, default under, or inaccuracy in, any such representation, warranty or covenant or affect in
any way any rights arising by virtue of any such prior or subsequent occurrence. No waiver by any party of any condition to the consummation of the Settlement shall constitute a waiver by such party of any other right or remedy available to such
party by reason of the circumstance causing the condition in question not to have been met. No delay or omission on the part of any party in exercising any right, power or remedy under this Settlement Agreement will operate as a waiver thereof.

 10.4. Entire Agreement. This Settlement Agreement, together with any documents, instruments and certificates
explicitly referred to herein, constitutes the entire agreement among the parties with respect to the subject matter of this Settlement Agreement and supersedes any and all prior discussions, negotiations, proposals, undertakings, understandings and
agreements, whether written or oral, with respect such subject matter (other than the parties’ existing confidentiality obligations to one another with respect to such subject matter). 

10.5. Counterparts; Effectiveness. This Settlement Agreement may be executed in any number of counterparts, each of which will be
deemed an original, but all of which together will constitute but one and the same instrument. A facsimile signature shall be deemed an original for purposes of this Settlement Agreement. This Settlement Agreement will become effective when duly
executed by each party hereto. 
  

 20 








 10.6. Non-Severability. The parties to this Settlement Agreement have negotiated the
provisions of this Settlement Agreement as an integral whole and would not have entered into this Settlement Agreement if the provisions hereof had not been written as they appear herein. Accordingly, if at any time, whether before or after the
Consummation Date, any term or provision of this Settlement Agreement or any document delivered pursuant to this Settlement Agreement should be held invalid or unenforceable by any court of competent jurisdiction, the parties intend that this
Settlement Agreement may be terminated by written notice to the other party referencing this Section 10.6 and delivered in accordance with Section 10.1, which notice shall have the same effect as if a termination notice pursuant to
Section 8.2 had been delivered, as provided in Section 8.3, and that each party shall thereafter take such action as may be necessary to restore the other party to its position immediately prior to its execution of this Settlement
Agreement. 
 10.7. Headings. The headings contained in this Settlement Agreement are for convenience purposes only and
will not in any way affect the meaning or interpretation hereof. 
 10.8. Construction. The parties have participated
jointly in the negotiation and drafting of this Settlement Agreement. In the event an ambiguity or question of intent or interpretation arises, this Settlement Agreement will be construed as if drafted jointly by the parties and no presumption or
burden of proof will arise favoring or disfavoring any party by virtue of the authorship of any of the provisions of this Settlement Agreement. The parties intend that each representation, warranty and covenant contained herein will have independent
significance. If any party has breached or violated, or if there is an inaccuracy in, any representation, warranty or covenant contained herein in any respect, the fact that there exists another representation, warranty or covenant relating to the
same subject matter (regardless of the relative levels of specificity) that the party has not breached or violated, or in respect of which there is not an inaccuracy, will not detract from or mitigate the fact that the party has breached or
violated, or there is an inaccuracy in, the first representation, warranty or covenant. 
 10.9. Survival of Covenants,
Reliance, etc. All covenants, agreements, representations and warranties made in this Settlement Agreement shall survive the execution and delivery of this Settlement Agreement, the delivery of the other instruments referenced herein as
Exhibits, and if it should occur, the Consummation Date, provided that representations and warranties shall not be required to be true and correct on and as of any date after the Consummation Date. No investigation made by any party and no
knowledge of any breach of the other party obtained by any party or on its behalf shall impair the materiality or enforceability of any covenant, agreement, representation or warranty contained in this Settlement Agreement or the right of such party
to rely upon each such covenant, agreement, representation and warranty notwithstanding such party’s investigation or knowledge. 

10.10. Governing Law. This Settlement Agreement, and the rights of the parties and all actions arising in whole or in part under
it, will be governed by and construed in accordance with the domestic substantive laws of the State of New York, without giving effect to any choice or conflict of law provision or rule that would cause the application of the laws of any other
jurisdiction. 
  

 21 








 10.11. Jurisdiction; Venue and Limitation on Actions; Service of
Process. 
 10.11.1. Jurisdiction. Each party to this Settlement Agreement, by its execution hereof, (a) hereby
irrevocably submits to the exclusive jurisdiction of the state courts located in the Borough of Manhattan of the State of New York and the United States District Court located in the Southern District of New York for the purpose of any action
brought by a party against the other party arising in whole or in part under or in connection with this Settlement Agreement, (b) hereby waives to the extent not prohibited by applicable law, and agrees not to assert, by way of motion, as a
defense or otherwise, in any such action, any claim that it is not subject personally to the jurisdiction of the above-named courts, that its property is exempt or immune from attachment or execution, that any such action brought in one of the
above-named courts should be dismissed on grounds of forum non conveniens, should be transferred or removed to any court other than one of the above-named courts, or should be stayed by reason of the pendency of some other proceeding in any other
court other than one of the above-named courts, or that this Settlement Agreement or the subject matter hereof may not be enforced in or by such court, and (c) hereby agrees not to commence any such action other than before one of the
above-named courts. Notwithstanding the previous sentence a party may commence any action in a court other than the above-named courts solely for the purpose of enforcing an order or judgment issued by one of the above-named courts. 

10.11.2. Venue and Limitation on Actions. Each party agrees that for any action brought by a party against the other party
arising in whole or in part under or in connection with this Settlement Agreement, such party may bring actions only in the state courts located in the Borough of Manhattan or in the United States District Court for the Southern District of New
York. Each party further waives any claim and will not assert that venue should properly lie in any other location within the selected jurisdiction. Notwithstanding anything to the contrary in any otherwise applicable law or statute, no action
arising in whole or in part under or in connection with this Settlement Agreement may be brought unless such action is commenced within two years after the accrual of the claim that is the basis for such action. 

10.11.3. Service of Process. Each party hereby (a) consents to service of process in any action brought by a party against
the other party arising in whole or in part under or in connection with this Settlement Agreement in any manner permitted by New York law, (b) agrees that service of process made in accordance with clause (a) or made by registered or
certified mail, return receipt requested, at its address specified pursuant to Section 10.1, will constitute good and valid service of process in any such action and (c) waives and agrees not to assert (by way of motion, as a defense, or
otherwise) in any such action any claim that service of process made in accordance with clause (a) or (b) does not constitute good and valid service of process. 

10.11.4. Other Litigation. Nothing in Section 10.11 shall limit any right either party otherwise would have to assert a
claim against the other party (whether as a cross claim, third-party claim, counterclaim, or otherwise) in any action not initiated by the party asserting the claim. 

 

 22 








 10.12. Specific Performance. The parties will have such entitlement as may be
provided under applicable law to seek and obtain an injunction or injunctions to prevent breaches or violations of the provisions of this Settlement Agreement and to enforce specifically this Settlement Agreement and the terms and provisions hereof
in any action instituted in accordance with Section 10.11, in addition to any other remedy to which the parties may be entitled, at law or in equity. 

10.13. Waiver of Jury Trial. TO THE EXTENT NOT PROHIBITED BY APPLICABLE LAW THAT CANNOT BE WAIVED, THE PARTIES HEREBY WAIVE, AND
COVENANT THAT THEY WILL NOT ASSERT (WHETHER AS PLAINTIFF, DEFENDANT OR OTHERWISE), ANY RIGHT TO TRIAL BY JURY IN ANY ACTION ARISING IN WHOLE OR IN PART UNDER OR IN CONNECTION WITH THIS SETTLEMENT AGREEMENT OR ANY OF THE TRANSACTIONS CONTEMPLATED BY
THIS SETTLEMENT AGREEMENT, WHETHER NOW EXISTING OR HEREAFTER ARISING, AND WHETHER SOUNDING IN CONTRACT, TORT OR OTHERWISE (A “COVERED ACTION”). THE PARTIES AGREE THAT ANY OF THEM MAY FILE A COPY OF THIS PARAGRAPH WITH ANY COURT AS
WRITTEN EVIDENCE OF THE KNOWING, VOLUNTARY AND BARGAINED-FOR AGREEMENT AMONG THE PARTIES IRREVOCABLY TO WAIVE THEIR RIGHTS TO TRIAL BY JURY IN ANY COVERED ACTION AND TO HAVE ANY COVERED ACTION INSTEAD BE TRIED IN A COURT OF COMPETENT JURISDICTION BY
A JUDGE SITTING WITHOUT A JURY. 
 10.14. No Admission of Liability. Neither this Settlement Agreement nor the AROs, nor
any act performed or document executed pursuant to or in furtherance of this Settlement Agreement or the AROs: (a) is or may be deemed to be or may be used as an admission of, or evidence of, the validity or lack thereof of any claim or right
of recovery or cause of action against or by, or of any wrongdoing or liability of, either of the parties to this Settlement Agreement, the HPS Acquirers or the Affiliated Persons of each of them; or (b) is or may be deemed to be or may be used
as an admission of, or evidence of, any fault or omission of either of the parties to this Settlement Agreement, the HPS Acquirers or the Affiliated Persons of each of them, in any civil, criminal, or administrative proceeding in any court,
administrative agency, or other tribunal. Either of the parties to this Settlement Agreement may file this Settlement Agreement, the Release, and/or the Issuer Releases in any action that may be brought against it in order to support a defense or
counterclaim based on principles of res judicata, collateral estoppel, release, good faith settlement, judgment bar or reduction or any other theory of claim preclusion or issue preclusion or similar defense or counterclaim. 

10.15. SEC Filings; Public Announcements. The parties agree that this Settlement Agreement may be filed by either of them with the
Securities and Exchange Commission and each of the parties may also describe the terms of this Settlement Agreement in any report it files with the Securities and Exchange Commission to the extent such party determines that the inclusion of a
description of the terms of this Settlement Agreement is required by applicable securities laws or regulations or the rules of any stock exchange upon which such party’s securities are traded, provided, however that information or
documents relating to MasterCard Issuers, including but not limited to, the names of Eligible MasterCard Issuers that accept or do not accept their AROs, the names of their Sponsored Issuers, or any other information that may lead to the disclosure
or identification of a MasterCard Issuer, shall 
  

 23 








 
not be publicly disclosed by either party under any circumstances, except as required by law or as necessary to enforce this Settlement Agreement or any document delivered pursuant thereto, and
except that either party may provide on a confidential basis to the HPS Acquirers any document provided to such party by the other party pursuant to the terms and conditions of this Settlement Agreement. The parties further agree that their public
announcement of this Settlement Agreement will be made by means of a press release by HPS (in the form attached hereto as Exhibit 10.15A), and by public disclosure by MasterCard (in the form attached hereto as Exhibit 10.15B).

 [Remainder of page intentionally left blank] 
  


 24 








 IN WITNESS WHEREOF, each of the undersigned has executed this Settlement Agreement as an
agreement under seal as of the date first above written. 
  

					
	 MASTERCARD INTERNATIONAL

INCORPORATED

		
	By:	 	 /s/ Wendy Murdock

		 	Name:	 	Wendy Murdock
		 	Title:	 	Chief Franchise Officer
	
	HEARTLAND PAYMENT SYSTEMS, INC.
		
	By:	 	 /s/ Robert H.B. Baldwin, Jr.

		 	Name:	 	Robert H.B. Baldwin, Jr.
		 	Title:	 	President and CFO










 EXHIBIT 3 

 

 May 27, 2010 

Dear MasterCard Impacted HPS Issuer: 

On May 19, 2010, MasterCard International Incorporated (“MasterCard”) and Heartland Payment Systems, Inc. (“HPS”)
entered into a Settlement Agreement (“Settlement Agreement”) provisionally calling for a settlement (“Settlement”) with regard to the HPS Intrusion (Case No. MCA 1805-US-08, and all of its subparts). Click here to access
the Settlement Agreement. The objective of the Settlement is to resolve all claims between MasterCard and its issuers, on the one hand, and HPS and its acquirers, on the other hand, relating to the HPS Intrusion, including all compliance cases and
operating expense claims filed by MasterCard issuers as well as claims that might be asserted in any litigation or other proceeding in connection with the HPS Intrusion. Pursuant to the Settlement Agreement, HPS has agreed to pay up to $41,400,100
to resolve issuer claims relating to the HPS Intrusion. 
 This communication will summarize the principal components of the
Settlement Agreement. You should, of course, read the Settlement Agreement in its entirety and feel free to ask questions. In this regard, please note that in the event of any inconsistency between this communication and the terms of the Settlement
Agreement, the Settlement Agreement will control. 
 Alternative Recovery Offers 

In light of the magnitude and unique and complex nature of the HPS Intrusion, MasterCard has been working on behalf of its issuers to
achieve the most appropriate resolution to, and obtain a prompt and certain recovery on, their claims stemming from the HPS Intrusion. Rule 3.1 of the MasterCard Rules provides that “MasterCard has the right, but not the obligation,









 EXHIBIT 3 

 

 
to resolve any dispute between or among Members including, but not limited to, any dispute involving [MasterCard], the Standards or the Members’ respective Activities, and any such
resolution by [MasterCard] is final and not subject to appeal or other similar action.” 
 In furtherance of its efforts to
achieve a resolution, MasterCard has reached an agreement with HPS and its acquirers that would enable eligible issuers to receive and decide upon an Alternative Recovery Offer (“ARO”). This offer gives eligible issuers the option of
electing to accept an Alternative Recovery Amount (“ARA”) in lieu of any other form of relief or recovery to which they might be entitled by reason of the HPS Intrusion. Your ARO is attached to this email, including the Acceptance of ARO
form (“Acceptance”) that you will be required to complete, execute and timely return in order to accept the ARO. 

The Settlement will become effective if, among other things, eligible issuers representing at least 80% of all claimed-on cards —
viz., cards for which operating expense claims have been filed — submit to MasterCard fully completed and duly executed Acceptances not later than June 25, 2010 at 5:00 p.m. Eastern. Issuers accepting the ARO will be notified if and
when this Settlement contingency (and all other contingencies) have been met or waived. Issuers who decline to “opt-in” to the Settlement will have their claims resolved by MasterCard pursuant to its internal processes. 

MasterCard Recommendation 

MasterCard believes that it would be in your interest to accept your ARO and therefore recommends that you do so. Assuming that the 80%
threshold is met and certain other pre-closing conditions are satisfied (or waived by MasterCard and HPS), issuers that accept their 








 EXHIBIT 3 

 

 
AROs will be assured of receiving the amounts reflected in their AROs promptly (expected to be during the third calendar quarter of 2010), without the added costs, burdens, delays and
uncertainties associated with potentially protracted litigation. In contrast, HPS has indicated that, absent a settlement of the type proposed herein, it will contest all compliance case and operating expense reimbursement awards. If HPS were to
commence litigation, your receipt of any amount MasterCard might award on your compliance case and operating expense reimbursement claims could be significantly delayed (regardless of the ultimate outcome of the suit) and the amount of any such
award could be reduced or even eliminated entirely. 
 The AROs reflect what MasterCard believes to be a fair and reasonable
resolution of your claims relating to the HPS Intrusion. We also believe that the amounts to be paid to issuers under this Settlement are comparable to, and may actually be more favorable than, the amounts paid to issuers under the Visa/HPS
settlement that was accepted by a large majority of Visa issuers. MasterCard will not assess any administrative fees in connection with the Settlement and will contribute all of the outside legal fees and other third party expenses (for which HPS
has agreed to reimburse MasterCard) to the fund from which issuers will be compensated. 
 Alternative Recovery Amounts

 The amount offered under each ARO represents 41.65% of the maximum issuer operating expense reimbursement and
compliance case award that MasterCard has determined each eligible issuer would be awarded under MasterCard’s Standards, including Rule 3.1 and Rule 5.10.4 (applicable to compliance case claims). While MasterCard has not yet determined
issuer operating expense reimbursement and compliance case awards, and does not expect to be 








 EXHIBIT 3 

 

 
in a position to do so in the near future, it has determined the aforesaid maximum amounts based on a preliminary vetting of compliance claims and claims for monitoring and re-issuance expenses.
This process has involved, among other things, an identification of facially-defective submissions. The maximum award amounts determined by MasterCard are set forth in each issuer’s ARO and do not necessarily reflect what each issuer ultimately
would be awarded on its claims under MasterCard’s Standards. MasterCard’s final determinations will involve, to the extent feasible given the unprecedented number of compliance case filings, a detailed and time-consuming evaluation of each
issuer’s issuer operating expense reimbursement claims and compliance case filings in light of the numerous defenses asserted by HPS and its acquirers, which evaluation may result in awards to individual issuers that are lower than the maximum
awards initially determined by MasterCard and below the amount of an individual issuer’s ARA. 
 Alternative Recovery Offer
Acceptance Instructions 
 Issuers wishing to accept their AROs must complete the steps described herein no later than
5:00 p.m. Eastern time on June 25, 2010 (as such date may be extended, “Acceptance Deadline”). MasterCard has established the Acceptance Deadline to ensure that issuer payments can be completed promptly if the Settlement is
consummated. The Acceptance, including Schedule I thereto, must be completed and signed by a person who is authorized to bind not only the Issuer receiving the ARO (“eligible issuer”), but also: (i) all affiliates of the eligible
issuer on behalf of which claims were submitted (even if such an affiliated issuer submitted its own separate claim), and (ii) all affiliate member issuers on behalf which the eligible issuer or one of its affiliates submitted a claim (the
issuers described in clauses (i) and (ii) being defined as the eligible issuer’s “covered sponsored issuers”). Please note that an eligible issuer must identify (list) on Schedule I of the Acceptance all of its covered
sponsored issuers. Acceptances 








 EXHIBIT 3 

 

 
received after the Acceptance Deadline will not be valid. In order for an Acceptance to be considered timely received, two original fully-completed and duly executed Acceptances, including
Schedule I, must be sent by overnight mail, next business day delivery, to: 
 Heidi Davidson 

MasterCard Worldwide 

2000 Purchase Street 

Purchase, NY 10577 

914-249-2000 
 so as to be
received no later than the Acceptance Deadline, and a PDF email of the fully-completed and duly executed Acceptance, including Schedule I, should be sent to ARO@mastercard.com at or before the Acceptance Deadline. 

Required Waiver and Release for Acceptance 

Issuers wishing to accept their AROs must accept the offer on behalf of themselves and all their covered sponsored issuers, must waive
their and all their covered sponsored issuers’ rights to receive any other form of recovery under MasterCard Rules based on any of their alerted-on accounts, and must release all claims against HPS, its acquirers, and MasterCard related to the
HPS Intrusion based on any of their and their covered sponsored issuers’ alerted-on accounts, including claims that are being or might be asserted in pending class action litigations, including In re Heartland Payment Systems, Inc. Data
Security Breach Litigation, MDL Docket No. 2046 and Lone Star National Bank, N.A. et al. v. KeyBank, N.A., et al. Case No. 4:10-cv-00171, both pending in the United States District Court for the Southern District of Texas. Click
here to access a copy of the Master Amended Complaint for the Financial Institution’s Track of In re Heartland Payment Systems, Inc. Data Security Breach Litigation, the Class Action Complaint for Lone Star National Bank v.
KeyBank, and a description of the pending class actions. 








 EXHIBIT 3 

 

 The waivers and releases in the Acceptances will become effective only if the Settlement
is consummated, as provided in the Settlement Agreement. 
 Risks of Required Waiver and Release 

If the Settlement Agreement is consummated, any issuer that accepts the ARO will: 

 

	 	•	 	 Give up its and its covered sponsored issuers’ rights to obtain any other recoveries for the HPS Intrusion relative to their alerted-on MasterCard
accounts under the MasterCard Standards, which recoveries theoretically could exceed the eligible issuer’s ARA. 


  

	 	•	 	 Give up its and its covered sponsored issuers’ rights to participate in, or recover amounts relative to their alerted-on accounts in, the putative
financial institution class actions described above or any other litigation or proceeding relative to the HPS Intrusion. 



Non-Participating Issuers 

If an eligible issuer does not complete the steps to accept its ARO by the Acceptance Deadline, that issuer will be deemed to have opted
out of the Settlement and will not be entitled to accept its ARO or receive its ARA. Non-accepting issuers will reserve their ability to receive whatever recovery MasterCard determines they are entitled to on their issuer operating expense
reimbursement and compliance case claims under the MasterCard Standards. As provided in the MasterCard Standards, the issuer operating expense reimbursement and compliance case claims of non-accepting issuers will be subject to a comprehensive
review, including, in some cases, an audit. Those reviews may result in awards to individual issuers that are less than the ARAs the issuers would have received if they had accepted their AROs and the Settlement was thereafter consummated.

 Issuers who choose to not to accept their AROs (again, please note that an issuer’s failure to timely and properly
submit its Acceptance will be deemed a non-acceptance or “opt-out”) could receive awards on their issuer operating expense reimbursement and compliance case claims that are less than their ARAs, or may receive nothing at all on those
claims, depending on 








 EXHIBIT 3 

 

 
a variety of factors, including, but not limited to, MasterCard’s final adjudication of the claims and the outcome of litigation. In this regard, under the terms of the Settlement Agreement,
if MasterCard were to award non-accepting issuers as a group an amount that exceeds 50% of their aggregate ARAs, HPS could elect not to consummate the Settlement. Moreover, even if HPS elects to consummate the Settlement, in that event HPS
and its acquirers would be permitted to challenge any individual award that exceeds 50% of the issuer’s ARA (awards at or below 50% of the issuer’s ARA would be paid out of settlement funds). In the event of a challenge, MasterCard
will make no distribution of the amount of the challenged award until the challenge is fully and finally adjudicated in a court of law. MasterCard is unable to predict when such challenges by HPS or its acquirers would be finally resolved or whether
such awards would be upheld, in whole or in part, by the courts. 
 Questions/Contacts 

If you have questions about the Settlement Agreement or the ARO process, please e-mail us at aro@mastercard.com. If you wish to
speak with us regarding your ARO, please be sure to include a phone number (including country code and area code). A qualified MasterCard Team member will contact you as soon as possible. 








 EXHIBIT A to EXHIBIT 3 

 

 Acceptance of ARO 

[Name of accepting MasterCard issuer] (the “Issuer”), on its own behalf and on behalf of each of the Covered
Sponsored Issuers listed on Schedule I attached to this acceptance, hereby irrevocably accepts the ARO contained in the communication from MasterCard International Incorporated (“MasterCard”) dated May 27, 2010, which
communication in turn references the Settlement Agreement dated May 19, 2010 (the “Settlement Agreement”) between MasterCard and Heartland Payment Systems, Inc. (“HPS”), a copy of which has been provided to the Issuer
by MasterCard. Capitalized terms not otherwise defined herein shall have the same meanings as in the Settlement Agreement. 

The Issuer represents and warrants that (i) this acceptance has been duly authorized, executed and delivered by the Issuer,
(ii) Schedule I hereto contains a complete and accurate list of the Issuer’s Sponsored Issuers, and the Issuer has accurately identified on Schedule I hereto which of its Sponsored Issuers are Covered Sponsored Issuers,
(iii) the Issuer is authorized to execute and deliver this acceptance on behalf of its Covered Sponsored Issuers, (iv) the Claimed-On Accounts of the Issuer and its Covered Sponsored Issuers constitute [MasterCard to fill in the number
of Issuer’s Claimed-On Accounts as shown on the Accounting Statement] unique MasterCard Accounts and include [MasterCard to fill in the number of Issuer’s Reissued Accounts as shown on the Accounting Statement] unique MasterCard
Accounts with respect to which the Issuer (or a Covered Sponsored Issuer) reissued the accountholder’s MasterCard card as a result of the HPS Intrusion (the “Reissued Cards”) and [MasterCard to fill in the number of Issuer’s
Specially Monitored Accounts as shown on the Accounting Statement] unique MasterCard Accounts with respect to which the Issuer (or a Covered Sponsored Issuer) implemented special monitoring procedures as a result of the HPS Intrusion (the
“Monitored Accounts”); (v) the Issuer Operating Expense Claim that the Issuer made with MasterCard with respect to the Claimed-On Accounts of the Issuer and its Covered Sponsored Issuers quantifies with reasonable accuracy the
incremental unit costs that the Issuer (or a Covered Sponsored Issuer) incurred to reissue the Reissued Cards and to monitor the Monitored Accounts; (vi) none of the Claimed-On Accounts of the Issuer and its Covered Sponsored Issuers was issued
by any of the Issuer’s Sponsored Issuers other than the Issuer’s Covered Sponsored Issuers; and (vii) no assignment to another Person has been made of, and no other Person has become subrogated to or otherwise acquired any interest
in, any of the Issuer Claims of the Issuer or any of its Covered Sponsored Issuers or any other right or claim of the Issuer or any of its Covered Sponsored Issuers that is, was, or otherwise would be a Released Issuer Claim. 

This acceptance shall become effective when, and only if, the Consummation Date has occurred. Subject to this acceptance having become
effective, the Issuer, on its own behalf and on behalf of each of its Covered Sponsored Issuers, and on behalf of its and their Affiliated Persons, irrevocably waives any right to assert against MasterCard, HPS, the HPS Acquirers, and the Affiliated
Persons of each of them (collectively, the “Releasees”), and fully and finally releases the Releasees from, the following (collectively, the “Released Issuer Claims”): 

(a) any claim or right of recovery the Issuer or any of its Covered Sponsored Issuers or any of its or their Affiliated Persons might
otherwise have had in respect of any of its Alerted-On Accounts under the MasterCard Operating Regulations (whether under the compliance rules contained in said Regulations, the operating expense reimbursement rules contained in said Regulations, or
otherwise) by reason of any matter, occurrence, or event pertaining to the HPS Intrusion, 








 EXHIBIT A to EXHIBIT 3 

 

 (b) any dispute or objection the Issuer or any of its Covered Sponsored Issuers or any
of its or their Affiliated Persons might otherwise be entitled to raise or make with respect to the amount or the calculation of the amount by MasterCard of its ARA as shown in the ARO, and 

(c) any claim or right the Issuer or any of its Covered Sponsored Issuers or any of its or their Affiliated Persons might be entitled to
assert, and any monetary recovery or other relief that the Issuer or any of its Covered Sponsored Issuers or any of its or their Affiliated Persons might be entitled to seek or receive in any litigation or other proceeding, whether currently
pending, hereafter commenced, or hereafter amended (including without limitation the pending putative class action proceedings consolidated under the caption entitled In re Heartland Payments Systems, Inc. Customer Data Security Breach
Litigation, No. H-09-MD-02046, and Lone Star National Bank, N.A., et al. v. KeyBank N.A., et al., Case No. 4:10-cv-00171, both currently pending before the United States District Court for the Southern District of Texas), under any
applicable laws, rules or regulations, in connection with any injury or harm the Issuer or any of its Covered Sponsored Issuers or any of its or their Affiliated Persons may have incurred in its capacity as a MasterCard Issuer by reason any of its
Alerted-On Accounts, or by reason of any matter, occurrence, or event pertaining to the HPS Intrusion (whether or not such matter, occurrence, or event is known to the Issuer as of this date). 

Subject to this acceptance having become effective, the Issuer covenants and agrees that neither it nor any of its Covered Sponsored
Issuers nor any of its or their respective Affiliated Persons will assert any of the Released Issuer Claims against, or otherwise seek to obtain any monetary recovery or other relief by reason of any of the Released Issuer Claims from, MasterCard or
HPS or any of the HPS Acquirers or any of the Affiliated Persons of each of them. 
 Subject to this acceptance having become
effective, the Issuer agrees to indemnify HPS and the HPS Acquirers and its or their respective Affiliated Persons against and shall hold each of them harmless from any and all damage, loss, liability, fines, penalties and expense (including
reasonable expenses of investigation and reasonable attorneys’ fees and expenses in connection with any action, suit or proceeding whether involving a third-party claim or a claim solely between the parties hereto) incurred or suffered by HPS
or any of the HPS Acquirers or any of its or their respective Affiliated Persons arising out of any misrepresentation or breach of warranty made by the Issuer in this acceptance or any breach of any covenant or agreement made or to be performed by
the Issuer or any of its Covered Sponsored Issuers or any of its or their respective Affiliated Persons pursuant to this acceptance. 

This acceptance, the rights of any person or entity hereunder, and any action arising hereunder, will be governed by and construed in
accordance with the substantive laws of the State of New York, without giving effect to any choice or conflict of law provision that would cause the application of the laws of any other jurisdiction. To further effectuate the intention of the waiver
and release contained herein, the Issuer certifies that it has read and understands, and hereby expressly waives, the benefits of Section 1542 of the California Civil Code, and any and all similar statutes, rules, and legal doctrines in
California or any other jurisdiction. 








 EXHIBIT A to EXHIBIT 3 

 

 Dated: [            ], 2010 

 

			
	[Name of Accepting MasterCard Issuer]
		
	By:	 	  











 EXHIBIT A to EXHIBIT 3 

 

 Schedule I 

[MasterCard to list names of Issuer’s Sponsored Issuers; Issuer to identify which of its 

Sponsored Issuers are Covered Sponsored Issuers] 

Issuer: 
 Sponsored Issuers

     of the Issuer: 

Covered Sponsored Issuers 

    of the Issuer: 








 EXHIBIT B to EXHIBIT 3 

 

 ARO 

ICA: xxxx 

Name: [Bank] 

Summary: 
 Please refer to the
Settlement Agreement dated May 19, 2010, between MasterCard International Incorporated (“MasterCard”) and Heartland Payment Systems, Inc. (“HPS”), a copy of which is incorporated in the MasterCard communication dated
May 27, 2010. Capitalized terms not otherwise defined herein have the meanings ascribed to them in the Settlement Agreement. 
 The
MasterCard issuer(s) having the above ICA(s) and its/their Sponsored Issuers (collectively “[Bank]”) had [# alerted-on cards] Alerted-On Accounts in connection with the HPS Intrusion. [Bank] submitted Issuer Operating
Expense Claims to MasterCard with respect to [number] Specially Monitored Accounts and [number] Reissued Accounts by reason of the HPS Intrusion (if necessary). [Bank] has also submitted to MasterCard Issuer Compliance Claims
related to the HPS Intrusion (if necessary). MasterCard has preliminarily reviewed and evaluated [Bank’s] Issuer Claims as set forth below and, based on its preliminary review, and subject to the contingencies described in the Settlement
Agreement, makes [Bank] the following ARO: 
 Results of MasterCard Preliminary Review of Bank’s Issuer Claims: 

On [Bank’s] Specially Monitored Accounts, the maximum reimbursement amount is $x.xx per account (if necessary) and on [Bank’s]
Reissued Accounts, the maximum reimbursement amount is $x.xx per account (if necessary). As a result, [Bank’s] Maximum Operating Expense Claim amount is: 

Total: [Bank’s Maximum Operating Expense Claim Amount] 

On [Bank’s] Issuer Compliance Claims, [Bank’s] Maximum Compliance Claim Amount is (if necessary): 

Total: [Bank’s Maximum Compliance Claim Amount] 

ARO: 
 Under Bank’s ARO, the TOTAL
ARA for the MasterCard issuer(s) having the above ICA(s) and its/their Sponsored Issuers is 41.65% of the sum of Bank’s Maximum Operating Expense Claim Amount and Bank’s Maximum Compliance Claim Amount, which is: 

TOTAL: [Bank’s ARA] 








 EXHIBIT C to EXHIBIT 3 

 

 On June 10, 2009, the Judicial Panel on Multidistrict Litigation entered an Order
in MDL Docket No. 2046, In re Heartland Payment Systems, Inc. Customer Data Security Breach Litigation, to transfer all actions related to the Heartland Data Security Breach, pending in various different federal district courts, to the
United States District Court in the Southern District of Texas for coordinated or consolidated pretrial proceedings. On August 28, 2009, the transferee District Court in the Southern District of Texas (“Court”) entered a Case
Management Order separating the Financial Institution cases from the Consumer cases, therein creating two separate litigation tracks: a “Financial Institution Track” and a “Consumer Track.” The Financial Institution Track
includes all those cases brought by banks, credit unions, and other financial institutions seeking to recover damages allegedly caused by the Heartland computer intrusion. 

The Master Amended Complaint for the Financial Institution Track, which incorporated the claims from each transferred case into the
Master Amended Complaint, was filed on September 23, 2009 (“FI Complaint”). The FI Complaint purports to represent various state-law subclasses and a nationwide class of “[a]ll banks, credit unions, financial institutions and
other entities in the United States that issued credit cards and/or debit cards; received a Visa and/or MasterCard alert or were otherwise notified that such credit cards and/or debit cards were compromised by the Heartland Data Breach; and
re-issued compromised credit cards and/or debit cards, and/or absorbed unauthorized charges on compromised cards.” 
 The
FI Complaint assert claims for negligence, breach of contract, breach of implied contract, negligence per se, negligent misrepresentation, intentional misrepresentation, violations of the New Jersey Consumer Fraud Act, violations of state statutes
broadly prohibiting unfair acts or practices, violations of state statutes broadly prohibiting false, misleading, or deceptive acts or practices, and violations of state statutes broadly prohibiting unconscionable acts or practices. The FI Complaint
seeks to recover compensatory damages for the costs associated with re-issuing payments cards and for the unauthorized transactions on the compromised cards, and also seeks injunctive relief, multiple or punitive damages where available, and
attorney’s fees and costs. 
 On October 23, 2009, after the FI Complaint was filed, Heartland filed a motion to
dismiss the FI Complaint in its entirety with prejudice. Briefing on the motion to dismiss concluded on February 1, 2010, and the outcome of the motion is uncertain. Heartland has also filed a motion to stay all discovery proceedings during the
pendency of its motion to dismiss. The parties have fully briefed and argued the motion to stay, but the Court has not yet ruled on this motion. Heartland intends to defend this action vigorously. 

On January 19, 2010, financial institutions, including certain of the named plaintiffs in the Financial Institutions Track,
commenced an action against Heartland’s sponsor banks in the United States District Court for the Southern District of Texas, captioned Lonestar National Bank, N.A. et al. v. KeyBank NA, et al., Civ. No. 4:10-cv-00171 (the
“Sponsor Bank Action”). The complaint against KeyBank National Association (“KeyBank”) and Heartland Bank asserts claims for breach of contract, breach of fiduciary duty, negligence, and vicarious liability and likewise
seeks to represent all financial institutions that issued payment cards to cardholders whose transaction information is alleged to have been placed at risk in the course of the 








 EXHIBIT C to EXHIBIT 3 

 

 
Heartland Data Breach. On April 9, 2010, KeyBank and Heartland Bank filed a motion to dismiss. The motion to dismiss has not yet been fully briefed, and the outcome of the motion is
uncertain. KeyBank and Heartland Bank intend to defend this action vigorously. 
 Any issuer that accepts the optional
Alternative Recovery Offer will waive and release any right such issuer would otherwise have had to obtain any recovery from Heartland, KeyBank or Heartland Bank by reason of the Heartland Data Breach with regard to any of its alerted-upon accounts
from or in either the putative Financial Institution Track class action litigation described above, or the Sponsor Bank Action, or any other litigation or other proceeding. 








 EXHIBIT 7.1 

 

 HPS’s and the HPS Acquirers’ Release of MasterCard Relating to the HPS
Intrusion 
 Heartland Payments Systems, Inc. (“HPS”) and KeyBank National Association and Heartland Bank (the
“HPS Acquirers) hereby grant the full, complete and final release, discharge, and covenant not to sue set forth in detail below, on their own behalf and, to the extent any of the following persons or entities purports to assert any Claim(s) (as
defined below) of HPS or the HPS Acquirers, on behalf of each of their past, present and future representatives, attorneys, associates, parents, subsidiaries, affiliates, agents, assigns, insurers, administrators, trustees, officers, directors,
employees, retained contractors, predecessors, successors, and any other person or entity claiming on behalf of either of them. Capitalized terms not otherwise defined herein have the meanings set forth in the Settlement Agreement dated May 19,
2010 between MasterCard International Incorporated (“MasterCard”) and HPS, to which this release is an exhibit (the “Settlement Agreement”). 

For purposes of this release, the “Released Parties” are MasterCard, MasterCard Worldwide, MasterCard Issuers that validly and
timely accept their AROs and their Covered Sponsored Issuers (such MasterCard Issuers and their Covered Sponsored Issuers being defined collectively as the “Released MasterCard Issuers”), and (in their capacities as such) MasterCard’s
and any such Released MasterCard Issuer’s past, present, and future representatives, attorneys, agents, accountants, assigns, insurers, administrators, officers, directors, trustees, employees, retained contractors, parents, affiliates,
subsidiaries, predecessors, successors, and any other person or entity acting on behalf of any of them; provided, however, that the Released Parties do not include (i) MasterCard Issuers that are not eligible to receive, or that do not validly
and timely accept their, AROs, or (ii) any Sponsored Issuer that is not a Covered Sponsored Issuer of a MasterCard Issuer that timely and validly accepted its ARO (the issuers described in clauses (i) and (ii) of this sentence being
defined herein as the “Non-Released MasterCard Issuers”). 
 For purposes of this release, the term “Claims”
shall mean any and all claims, causes of action, suits at law or in equity, assertions of wrongdoing or fault, liabilities, awards, judgments, demands, debts, defenses, losses and expenses, damages, obligations, attorney fees, costs and/or
sanctions, of whatever kind or nature, whether now known or unknown, suspected or unsuspected, liquidated or unliquidated, matured or unmatured, including even those Claims that, if known as of the date of this release, may have materially affected
HPS’s decision to agree to the settlement reflected in the Settlement Agreement or HPS and the HPS Acquirers’ decision to grant this release. 

By this release, HPS and the HPS Acquirers release the Released Parties from any and all Claims that HPS and the HPS Acquirers ever had,
now have, or may have in the future against MasterCard, or any of the other Released Parties in their capacities as such, by reason of any act, omission or occurrence before the date hereof on the part of MasterCard or any Released MasterCard Issuer
related to the HPS Intrusion, whether those Claims are (a) affirmatively made against MasterCard or a Released MasterCard Issuer, (b) made as a defense to any acts or omissions by MasterCard or a Released MasterCard Issuer relating to
MasterCard’s Operating Regulations, or (c) assertions of MasterCard’s or a Released MasterCard Issuer’s fault as a defense to allegations by a third party, including but not limited to MasterCard Issuers (all the Claims described
in this sentence as having been released being defined herein as the “Released Claims”). 








 EXHIBIT 7.1 

 

 Notwithstanding anything to the contrary in the preceding paragraphs, the Released
Claims do not include (i) any objection, dispute, or Claim HPS or the HPS Acquirers might otherwise be entitled to assert with respect to (A) any claim with respect to the HPS Intrusion that may have been submitted to MasterCard by a
Non-Released MasterCard Issuer prior to the date of the Settlement Agreement (in the case of a Non-Released MasterCard Issuer that did not validly and timely accept its ARO, in the event and only in the event HPS has timely made the Challenge
Declaration and the amount of such issuer’s Non-Accepting Issuer Award exceeds 50% of such issuer’s ARA), or that may be submitted to MasterCard by any MasterCard Issuer after the date of the Settlement Agreement, under
MasterCard’s Operating Regulations or (B) any ruling made by MasterCard with respect to any such claim described in clause (i)(A) of this sentence; (ii) any right HPS or the HPS Acquirers otherwise would have to assert or seek to
establish, as a defense to any claim asserted against it by a MasterCard Issuer in litigation or otherwise, the facts or results of any actions or inactions involving MasterCard or a Released MasterCard Issuer, provided that HPS or the HPS Acquirers
do not seek to establish that any such actions or inactions, or the results thereof, constituted legal wrongdoing on MasterCard’s or a Released MasterCard Issuer’s part or created legal liability on MasterCard’s or a Released
MasterCard Issuer’s part; or (iii) any of the rights and obligations created by or under the Settlement Agreement or any Claim arising under or based upon any such rights and obligations. 

This release, the rights of any person or entity hereunder, and any action arising hereunder, will be governed by and construed in
accordance with the substantive laws of the State of New York, without giving effect to any choice or conflict of law provision that would cause the application of the laws of any other jurisdiction. To further effectuate the intention of this
release, HPS and the HPS Acquirers certify that they have read and understand, and hereby expressly waive, the benefits of Section 1542 of the California Civil Code, and any and all similar statutes, rules, and legal doctrines in California or
any other jurisdiction. This release may be executed in counterparts, and a facsimile signature shall be deemed an original for purposes of this release. 
  

									
		 	Dated:             , 2010	 		 	On behalf of Heartland Payment Systems, Inc.
					
		 		 		 	By:	 	 Officer’s Signature

		 		 		 		 	Officer’s Name and Title
				
		 	Dated:             , 2010	 		 	On behalf of KeyBank National Association
					
		 		 		 	By:	 	 Officer’s Signature

		 		 		 		 	Officer’s Name and Title
				
		 	Dated:             , 2010	 		 	On behalf of Heartland Bank
					
		 		 		 	By:	 	 Officer’s Signature

		 		 		 		 	Officer’s Name and Title









 EXHIBIT 10.15A 

 


							
	



	  	Heartland Payment Systems
	  	90 Nassau Street
	  	Princeton, NJ 08542
	  	888.798.3131
	  	HeartlandPaymentSystems.com

  

 
 HEARTLAND PAYMENT SYSTEMS®
AND MASTERCARD AGREE 
 TO $41.4 MILLION INTRUSION SETTLEMENT 

Company has now reached breach-related settlements with three major card brands 

Princeton, NJ — May 19, 2010 — Heartland Payment Systems® (NYSE: HPY), the nation’s fifth largest payments processor, has
entered into a settlement agreement with MasterCard Worldwide to resolve claims from MasterCard and its issuers related to the 2008 criminal intrusion into Heartland’s payment system environment. Under the agreement, alternative recovery offers
totaling $41.4 million will be made to eligible MasterCard issuers with respect to losses alleged to have been incurred by them as a result of the criminal intrusion, and MasterCard will recommend that eligible MasterCard issuers accept such offers.

 Bob Carr, Heartland’s chairman and chief executive officer, stated, “We are pleased to have reached an equitable settlement
agreement that helps issuers of MasterCard-branded cards obtain a recovery with respect to losses they may have incurred from the intrusion. We look forward to working with MasterCard to encourage these issuers to participate in the settlement
program for a speedy resolution.” 
 The settlement is contingent upon financial institutions representing 80 percent of the claimed-on
MasterCard accounts accepting their alternative recovery offers by June 25, 2010. The settlement also includes mutual releases between Heartland and its sponsoring bank acquirers on the one hand – and MasterCard and the accepting issuers
on the other. Issuers that accept their alternative recovery offers must waive rights to any other recovery of alleged intrusion-related losses from Heartland and its sponsoring bank acquirers through litigation or other remedies and release
MasterCard, Heartland and its sponsoring bank acquirers from all legal and financial responsibility related to the intrusion. 
 All eligible
issuers will soon receive notification from MasterCard with full details of the settlement agreement and how to accept their alternative recovery offers before the offers expire. 

# # # 
 About
Heartland Payment Systems  
 Heartland Payment Systems, Inc. (NYSE: HPY), the fifth largest payments processor in the United States,
delivers credit/debit/prepaid card processing, gift marketing, payroll, check management and related business solutions to more than 250,000 business locations nationwide. Heartland is the founding supporter of The
Merchant Bill of Rights, a public advocacy initiative that educates merchants about fair credit and debit card processing practices. For more information, please visit HeartlandPaymentSystems.com, MerchantBillOfRights.org,
CostOfABurger.com and E3secure.com. 








 EXHIBIT 10.15A 

 


			
	Contacts	  	
		
	Leanne Scott Brown	  	Nancy Gross
	Vault Communications	  	Heartland Payment Systems
	610.455.2742	  	888.798.3131 x2202
	LBrown@VaultCommunications.com	  	Nancy.Gross@e-hps.com

 Forward-Looking
Statement 
 This press release contains forward-looking statements. These statements may be identified by the use of words such as
“will,” “believes,” “anticipates,” “intends,” “estimates,” “expects,” “projects,” “plans” or similar expressions. Such forward-looking statements include, without
limitation, statements about the settlement agreement, strategy, future operations, prospects, plans and objectives of management and events or developments that Heartland expects or anticipates will occur. The forward-looking statements reflect
Heartland’s current views and assumptions and are subject to risks and uncertainties, which may cause actual and future results and trends to differ materially from the forward-looking statements, including but not limited to the risk that all
of the conditions necessary to the consummation of the settlement agreement among MasterCard WorldWide, its issuers, Heartland Payment Systems, Inc., Heartland Bank and KeyBank National Association may not be satisfied or waived; Heartland’s
ability to achieve its strategic objectives and the expected goals of the settlement agreement; general market conditions; the outcome of legal proceedings; uncertainties inherent in its operations; and the impact of law and regulations. Many of
these factors are beyond the company’s ability to control or predict. Given these factors, you should not place undue reliance on the forward-looking statements. 








 EXHIBIT 10.15B 

 


 

 


 

 

 MasterCard Reaches Settlement with Heartland Payment Systems to Provide Issuers 

Worldwide up to $41.4 Million for Data Breach Claims 

Purchase, NY, May 19, 2010 - MasterCard Worldwide today announced it has reached a settlement with Heartland Payment Systems
(Heartland) to resolve claims by MasterCard and its issuers in connection with Heartland’s previously announced data security breach. 

The settlement agreement calls for Heartland to fund up to $41.4 million of “alternative recovery offers” to be made to eligible MasterCard
card issuers to settle their claims for operational costs and fraud losses alleged to have been incurred by them as a result of the breach. Issuers accepting their offers must agree to certain terms and conditions. 

“We feel that this settlement represents an appropriate and fair resolution for our issuing financial institution customers and will enable them to
avoid uncertainties and delays associated with potentially protracted litigation,” said Wendy Murdock, chief franchise officer for MasterCard Worldwide. “The agreement underscores MasterCard’s continuing efforts to maintain the
integrity of payment card industry standards and mitigate the impact of account data compromise events.” 
 Under the terms of the
settlement, MasterCard card issuers that filed timely claims for reimbursement of operational expenses or to recover fraud losses on certain accounts processed by Heartland during 2008 will be eligible to receive a specified dollar payment with
receipt expected during the third calendar quarter of 2010, if they choose to accept their offers. 
 The settlement is contingent upon, among
other things, MasterCard card issuing financial institutions representing at least 80 percent of the claimed-on MasterCard accounts having accepted their offers by June 25, 2010. 

Issuers that choose to accept their offers must agree to forgo any other remedies or recoveries they might otherwise be able to obtain from Heartland and
its acquirers by reason of the Heartland data security breach, and to release MasterCard, Heartland and Heartland’s acquirers from all legal and financial liability associated with the breach. 

-more- 







 Page 2/MasterCard Announces Settlement with Heartland 

Issuers that elect not to accept their offers will have their claims determined pursuant to MasterCard’s internal processes. They may receive more or
less than the amounts they were offered, or nothing at all, depending on various factors, including MasterCard’s determinations of their claims and the outcome of any litigation that Heartland may file, and has threatened to file, to challenge
claim awards that exceed certain amounts. 
 All MasterCard card issuers eligible to participate in the settlement should expect to soon receive
notification from MasterCard with full details of the settlement and the steps necessary to accept their offers. Eligible issuers will have until June 25 at 5 p.m. ET to accept their offers before the offers expire. 

About MasterCard Worldwide 
 MasterCard
Worldwide advances global commerce by providing a critical economic link among financial institutions, businesses, cardholders and merchants worldwide. As a franchisor, processor and advisor, MasterCard develops and markets payment solutions,
processes approximately 22 billion transactions each year, and provides industry-leading analysis and consulting services to financial-institution customers and merchants. Powered by the MasterCard Worldwide Network and through its family of brands,
including MasterCard®, Maestro® and Cirrus®, MasterCard serves consumers and businesses in more than 210 countries and territories. For more information go to www.mastercard.com. Follow us on Twitter@MasterCardNews. 

### 
 Contact: Chris Monteiro

 Chris_monteiro@mastercard.com 

914-249-5826