Document:

EX-4.2

 Exhibit 4.2 

L BRANDS, INC. 
 THE GUARANTORS
PARTY HERETO, as Guarantors 
 and 

U.S. BANK NATIONAL ASSOCIATION 

as Trustee 
  

 
 6.750% Senior
Notes due 2036 
 FIRST SUPPLEMENTAL INDENTURE 

Dated as of June 16, 2016 

to 
 INDENTURE 

Dated as of June 16, 2016 
  

 
  

 ARTICLE ONE 

DEFINITIONS AND OTHER PROVISIONS OF 

GENERAL APPLICATION 
  

							
	SECTION 1.1.	 	 Definitions
	  	 	2	  
	
	ARTICLE TWO	  
	
	SECURITIES FORMS	  
			
	SECTION 2.1.	 	 Creation of the Notes; Designations
	  	 	7	  
	SECTION 2.2.	 	 Forms Generally
	  	 	8	  
	
	ARTICLE THREE	  
	
	GENERAL TERMS AND CONDITIONS OF THE NOTES	  
			
	SECTION 3.1.	 	 Title and Terms of Notes
	  	 	8	  
	
	ARTICLE FOUR	  
	
	REDEMPTION	  
			
	SECTION 4.1.	 	 Optional Redemption
	  	 	9	  
	SECTION 4.2.	 	 Optional Redemption Procedures
	  	 	10	  
	
	ARTICLE FIVE	  
	
	COVENANTS	  
			
	SECTION 5.1.	 	 Limitations on Mergers and Sales of Assets
	  	 	10	  
	SECTION 5.2.	 	 Successor Person Substituted
	  	 	10	  
	SECTION 5.3.	 	 Reports
	  	 	11	  
	SECTION 5.4.	 	 Additional Subsidiary Guarantees
	  	 	11	  
	SECTION 5.5.	 	 Change of Control
	  	 	11	  
	
	ARTICLE SIX	  
	
	GUARANTEE OF NOTES	  
			
	SECTION 6.1.	 	 Guarantee
	  	 	12	  
	SECTION 6.2.	 	 Execution and Delivery of Notation of Guarantee
	  	 	13	  
	SECTION 6.3.	 	 Limitation of Guarantee
	  	 	13	  
	SECTION 6.4.	 	 Release of Guarantor
	  	 	14	  
	SECTION 6.5.	 	 Waiver of Subrogation
	  	 	14	  

  
 -i- 

							
	
	ARTICLE SEVEN	  
	
	SATISFACTION AND DISCHARGE	  
	SECTION 7.1.	 	 Satisfaction and Discharge
	  	 	15	  
	
	ARTICLE EIGHT	  
	
	SUPPLEMENTAL INDENTURES	  
	SECTION 8.1.	 	 Without Consent of Holders, Company and Trustee May Enter Into Supplemental Indentures for
Specified Purposes
	  	 	19	  
	
	ARTICLE NINE	  
	
	MISCELLANEOUS	  
	SECTION 9.1.	 	 Effect of First Supplemental Indenture
	  	 	20	  
	SECTION 9.2.	 	 Effect of Headings
	  	 	20	  
	SECTION 9.3.	 	 Successors and Assigns
	  	 	20	  
	SECTION 9.4.	 	 Severability Clause
	  	 	20	  
	SECTION 9.5.	 	 Benefits of First Supplemental Indenture
	  	 	20	  
	SECTION 9.6.	 	 Conflict
	  	 	21	  
	SECTION 9.7.	 	 Governing Law
	  	 	21	  
	SECTION 9.8.	 	 Trustee
	  	 	21	  

  
 -ii- 

 FIRST SUPPLEMENTAL INDENTURE, dated as of June 16, 2016, among L BRANDS, INC., a Delaware
corporation (hereinafter called the “Company”), the Guarantors (as hereinafter defined) and U.S. BANK NATIONAL ASSOCIATION, a national banking association, as trustee hereunder (hereinafter called the “Trustee”).

 RECITALS 
 WHEREAS, the
Company and the Trustee entered into an indenture, dated June 16, 2016 (the “Base Indenture”), pursuant to which senior unsecured debentures, notes or other evidences of indebtedness of the Company may be issued in one or more
series from time to time; 
 WHEREAS, Section 13.01(g) of the Base Indenture permits the forms and terms of the Debt Securities of any
series as permitted in Sections 2.01, 2.02 and 3.02 to be established in an indenture supplemental to the Base Indenture; 
 WHEREAS,
Section 13.01 of the Base Indenture provides that a supplemental indenture may be entered into by the Company and the Trustee without the consent of any Holders of the Debt Securities, for Specified Purposes stated therein; 

WHEREAS, the Company has requested the Trustee to join with it and the Guarantors in the execution and delivery of this First Supplemental
Indenture in order to supplement the Base Indenture by, among other things, establishing the forms and certain terms of a series of Debt Securities to be known as the Company’s “6.750% Senior Notes due 2036” (the
“Notes”), and adding certain provisions thereof for the benefit of the Holders of the Notes; 
 WHEREAS, the Company has
furnished the Trustee with a duly authorized and executed issuer order dated June 16, 2016 authorizing the execution of this First Supplemental Indenture and the issuance of the Notes, such issuer order sometimes referred to herein as the
“Authentication Order”; 
 WHEREAS, all things necessary to make this First Supplemental Indenture a valid, binding and
enforceable agreement of the Company, the Guarantors and the Trustee and a valid supplement to the Base Indenture have been done; and 

NOW, THEREFORE, THIS FIRST SUPPLEMENTAL INDENTURE WITNESSETH: 

For and in consideration of the premises and the purchase of the Notes to be issued hereunder by Holders thereof, the Company, the Guarantors
and the Trustee mutually covenant and agree, for the equal and proportionate benefit of the Holders from time to time of the Notes, as follows: 

  
 -1- 

 ARTICLE ONE 

DEFINITIONS AND OTHER PROVISIONS OF 

GENERAL APPLICATION 
 SECTION 1.1.
Definitions. 
 The Base Indenture together with this First Supplemental Indenture are hereinafter sometimes collectively referred to
as the “Indenture.” For the avoidance of doubt, references to any “Section” of the “Indenture” refer to such Section of the Base Indenture as supplemented and amended by this First Supplemental Indenture.
All capitalized terms which are used herein and not otherwise defined herein are defined in the Base Indenture and are used herein with the same meanings as in the Base Indenture. If a capitalized term is defined in the Base Indenture and this First
Supplemental Indenture, the definition in this First Supplemental Indenture shall apply to the Notes (and any Guarantee endorsed therein). 

For all purposes of this First Supplemental Indenture, except as otherwise expressly provided or unless the context otherwise requires: 

(1) the terms defined in this article have the meanings assigned to them in this article and include the plural as well as the
singular; 
 (2) all other terms used herein which are defined in the Trust Indenture Act, including terms defined therein by
reference to the Securities Act of 1933 (“Securities Act”) (except as herein otherwise expressly provided or unless the context otherwise clearly requires), shall have the meanings assigned to such terms in said Trust Indenture Act
and in said Securities Act as in force at the date of this Indenture; 
 (3) all accounting terms not otherwise defined
herein have the meanings assigned to them in accordance with generally accepted accounting principles in the United States, and, except as otherwise herein expressly provided, the term “generally accepted accounting principles” with
respect to any computation required or permitted hereunder shall mean such accounting principles as are generally accepted at the date of such computation; 

(4) the words “herein,” “hereof” and “hereunder” and other words of similar import refer to this
Indenture as a whole and not to any particular article, section or other subdivision; and 
 (5) all references used herein
to the male gender shall include the female gender. 
 “Additional Notes” has the meaning set forth in
Section 3.1. 
 “Below Investment Grade Rating Event” means the Notes are rated below an Investment Grade Rating by
both of the Rating Agencies on any date from the date of the public notice of an arrangement that could result in a Change of Control until the end of the 60-day period following public notice of the occurrence of the Change of Control (which 60-day
period 

  
 -2- 

 
shall be extended so long as the rating of the Notes is under publicly announced consideration for possible downgrade by any of the Rating Agencies (the “Relevant Period”));
provided that a Below Investment Grade Rating Event otherwise arising by virtue of a particular reduction in rating shall not be deemed to have occurred in respect of a particular Change of Control (and thus shall not be deemed a Below
Investment Grade Rating Event for purposes of the definition of Change of Control Triggering Event) if the Rating Agencies making the reduction in rating to which this definition would otherwise apply either (i) did not reduce the ratings of
the Notes during the Relevant Period or (ii) do not announce or publicly confirm that the reduction was the result, in whole or in part, of any event or circumstance comprised of or arising as a result of, or in respect of, the applicable
Change of Control (whether or not the applicable Change of Control shall have occurred at the time of the Below Investment Grade Rating Event). 

“Change of Control” means the occurrence of any of the following: (1) the direct or indirect sale, transfer, conveyance
or other disposition (other than by way of merger or consolidation), in one or a series of related transactions, of all or substantially all of the properties or assets of the Company and its Subsidiaries taken as a whole to any “Person”
(as that term is used in Section 13(d)(3) of the Exchange Act) other than the Company or one of its Subsidiaries; (2) the consummation of any transaction (including, without limitation, any merger or consolidation) the result of which is
that any “Person” (as that term is used in Section 13(d)(3) of the Exchange Act) becomes the beneficial owner, directly or indirectly, of more than 50% of the then outstanding number of shares of the Company’s voting stock; or
(3) the first day on which a majority of the members of the Company’s Board of Directors are not Continuing Directors. Notwithstanding the foregoing, a transaction will not be deemed to involve a Change of Control if (1) the Company
becomes a wholly owned Subsidiary of a holding company that has agreed to be bound by the terms of the Notes and (2) the holders of the voting stock of such holding company immediately following that transaction are substantially the same as
the holders of the Company’s Voting Stock immediately prior to that transaction. 
 “Change of Control Offer” has the
meaning set forth in Section 5.5. 
 “Change of Control Notice” means a written notice sent by or on behalf of the
Company by first-class mail, postage prepaid, to each Holder of the Notes at its address appearing in the register for the Notes on the date of the Change of Control Notice offering to purchase all outstanding Notes in accordance with
Section 5.5. The Change of Control Notice shall contain all the information required by applicable law to be included therein and shall also state: 

(1) that the Change of Control Offer is being made pursuant to Section 5.5 of this Indenture; 

(2) a description of the transaction or transactions that constitute or may constitute the Change of Control Triggering Event;

 (3) the Change of Control Payment Date; 

(4) the Change of Control Payment; 

(5) that the Holder of any Notes may tender all or any portion of such Notes registered in the name of such Holder and that any
portion of a Note tendered must be 

  
 -3- 

 
tendered in an integral multiple of $1,000 principal amount and that all Notes tendered in such manner for payment and not withdrawn shall be accepted; 

(6) the place or places where Notes are to be surrendered for tender pursuant to the Change of Control Offer; 

(7) that interest on any Note not tendered pursuant to the Change of Control Offer will continue to accrue; 

(8) that on the Change of Control Payment Date the Change of Control Payment will become due and payable upon each Note being
accepted for payment pursuant to the Change of Control Offer and that, unless the Company defaults in the payment of the Change of Control Payment therefor, interest thereon shall cease to accrue on and after the Change of Control Payment Date; 

(9) that each Holder electing to tender all or any portion of a Note pursuant to the Change of Control Offer will be required
to surrender such Note, with the form entitled “Option of Holder to Elect Purchase” on the reverse of the Note completed, at the place or places specified in the Change of Control Notice on or prior to the close of business on a date no
earlier than the third Business Day prior to the Change of Control Payment Date (such Note being, if the Company so requires, duly endorsed by, or accompanied by a written instrument of transfer in form satisfactory to the Company duly executed by,
the Holder thereof or its attorney duly authorized in writing); 
 (10) that Holders will be entitled to withdraw all or any
portion of Notes tendered if the Company receives, not later than the close of business on the fifth Business Day preceding the Change of Control Payment Date, a telegram, telex, facsimile transmission or letter setting forth the name of the Holder,
the principal amount of the Note the Holder tendered, the certificate number of the Note the Holder tendered and a statement that such Holder is withdrawing all or a portion of its tender; and 

(11) that in the case of any Holder whose Note is purchased only in part, the Company shall execute and deliver to the Holder
of such Note without service charge, a new Note or Notes, in an aggregate principal amount equal to and in exchange for the unpurchased portion of the Note so tendered, in denominations of $2,000 principal amount or integral multiples of $1,000 in
excess thereof. 
 “Change of Control Payment” has the meaning set forth in Section 5.5. 

“Change of Control Payment Date” has the meaning set forth in Section 5.5. 

“Change of Control Triggering Event” means the occurrence of both a Change of Control and a Below Investment Grade Rating
Event. 
 “Comparable Treasury Issue” means the United States Treasury security selected by an Independent Investment
Banker as having a maturity comparable to the remaining term of the Notes to be redeemed that would be utilized, at the time of selection and in accordance with 

  
 -4- 

 
customary financial practice, in pricing new issues of corporate debt securities of comparable maturity to the remaining term of such Notes. 

“Comparable Treasury Price” means, with respect to any redemption date, (1) the average of the Reference Treasury Dealer
Quotations for such redemption date, after excluding the highest and lowest such Reference Treasury Dealer Quotations, or (2) if the Company obtains fewer than four such Reference Treasury Dealer Quotations, the average of all such quotations.

 “Continuing Directors” means, as of any date of determination, any member of the Board of Directors of the Company who
(1) was a member of such Board of Directors on the Issue Date; or (2) was nominated for election or elected to such Board of Directors with the approval of a majority of the Continuing Directors who were members of such Board of Directors
at the time of such nomination or election (either by a specific vote or by approval of the Company’s proxy statement in which such member was named as a nominee for election as a director, without objection to such nomination). 

“Default” shall mean an Event of Default or an event that, with the giving of notice, the passage of time, or both, would
constitute an Event of Default. 
 “Disqualified Equity Interests” of any Person means any class of Equity Interests of
such Person that, by its terms, or by the terms of any related agreement or of any security into which it is convertible, puttable or exchangeable, is, or upon the happening of any event or the passage of time would be, required to be redeemed by
such Person, whether or not at the option of the holder thereof, or matures or is mandatorily redeemable, pursuant to a sinking fund obligation or otherwise, in whole or in part, on or prior to the date which is 91 days after the final maturity date
of the Notes. 
 “Domestic Subsidiary” means any of the Company’s Subsidiaries which is organized under the laws of
the United States or any state thereof or the District of Columbia. 
 “Equity Interests” of any Person means (1) any
and all shares or other equity interests (including common stock, preferred stock, limited liability company interests and partnership interests) in such Person and (2) all rights to purchase, warrants or options (whether or not currently
exercisable), participations or other equivalents of or interests in (however designated) such shares or other interests in such Person. 

“Exchange Act” means the Securities Exchange Act of 1934, as amended, and the rules and regulations of the Commission
promulgated thereunder. 
 “Guarantee” means a guarantee of the Notes on the terms set forth in this Indenture. 

“Guarantor” means: 

(1) each Domestic Subsidiary of the Company on Issue Date that is a guarantor of our Senior Credit Facility; and 

  
 -5- 

 (2) each Subsidiary of the Company or other Person that executes a Guarantee in
accordance with the provisions of the Indenture; 
 and their respective successors and assigns, in each case, until such Subsidiary or Person is released
from its Guarantee in accordance with the terms of the Indenture. 
 “Independent Investment Banker” means one of the
Reference Treasury Dealers as appointed by the Company. 
 “Interest Payment Dates” means each January 1 and
July 1, commencing January 1, 2017. 
 “Investment Grade Rating” means a rating equal to or higher than Baa3 (or
the equivalent) by Moody’s and BBB- (or the equivalent) by S&P, and the equivalent investment grade credit rating from any replacement Rating Agency or Rating Agencies selected by the Company. 

“Issue Date” means June 16, 2016. 

“Lien” means, with respect to any asset, any mortgage, lien, pledge, charge, security interest or encumbrance of any kind in
respect of such asset, whether or not filed, recorded or otherwise perfected under applicable law, including any conditional sale or other title retention agreement, any lease in the nature thereof, any option or other agreement to sell or give a
security interest in and any filing of or agreement to give any financing statement under the Uniform Commercial Code (or equivalent statutes) of any jurisdiction; provided, however, that in no event shall an operating lease be deemed to constitute
a Lien. 
 “Moody’s” means Moody’s Investors Service, Inc. 

“Notes” means any 6.750% Senior Notes due 2036 issued by the Company hereunder, including, without limitation, any Additional
Notes, treated as a single class of securities. 
 “Obligations” means any principal, interest, penalties, fees,
indemnifications, reimbursements (including, without limitation, reimbursement obligations with respect to letters of credit), damages and other liabilities of the Company under this Indenture. 

“Officer” means the Chairman of the Board of Directors, the President, any Executive Vice President, the Treasurer, an
Assistant Treasurer, the Secretary or an Assistant Secretary of the Company, or any direct or indirect parent of the Company, or any Guarantor, as applicable. 

“Qualified Equity Offerings” means a public or private offering of Equity Interests (other than Disqualified Equity
Interests) of the Company generating gross proceeds of at least $50.0 million. 
 “Rating Agencies” means (1) each of
Moody’s and S&P; and (2) if either Moody’s or S&P ceases to rate the Notes or fails to make a rating of the Notes publicly available for reasons outside of the Company’s control, a “nationally recognized statistical
rating organization” 

  
 -6- 

 
within the meaning of Rule 15c3-1(c)(2)(vi)(F) under the Exchange Act, selected by the Company (as certified by a Board Resolution) as a replacement agency for Moody’s or S&P, or both of
them, as the case may be. 
 “Redemption Date” when used with respect to any Note to be redeemed, in whole or in part,
means the date fixed for such redemption pursuant to the terms of the Notes. 
 “Redemption Price” has the meaning as set
forth in Section 4.1. 
 “Reference Treasury Dealer Quotations” means, with respect to each Reference Treasury Dealer
and any Redemption Date, the average, as determined by the Company, of the bid and asked prices for the Comparable Treasury Issue (expressed in each case as a percentage of its principal amount) quoted in writing to the Company by such Reference
Treasury Dealer at 5:00 p.m. on the third Business Day preceding such Redemption Date. 
 “Reference Treasury Dealers”
means (1) Merrill Lynch, Pierce, Fenner & Smith Incorporated, J.P. Morgan Securities LLC and Citigroup Global Markets, Inc. and their respective successors; provided, however, that if any of the foregoing shall cease to
be a primary U.S. Government securities dealer (a “Primary Treasury Dealer”), the Company shall substitute another nationally recognized investment banking firm that is a Primary Treasury Dealer, and (2) two other Primary
Treasury Dealers selected by the Company. 
 “S&P” means S&P Global Ratings, a division of S&P Global Inc. 

“Senior Credit Facility” shall mean each of (i) the Amended and Restated Five-Year Revolving Credit Agreement, among the
Company, the Lenders party thereto, and JPMorgan Chase Bank N.A., as Administrative Agent and Collateral Agent, dated as of October 6, 2004, as amended or amended and restated November 5, 2004, March 22, 2006, August 3,
2007, February 19, 2009, March 8, 2010 and July 15, 2011 and (ii) any other indebtedness for borrowed money of the Company or any of its Domestic Subsidiaries in excess of $100.0 million. 

“Treasury Rate” means, with respect to any Redemption Date, the rate per annum equal to the semi-annual equivalent yield to a
maturity of the Comparable Treasury Issue, assuming a price for the Comparable Treasury Issue (expressed as a percentage of its principal amount equal to the Comparable Treasury Price for such Redemption Date). 

ARTICLE TWO 
 SECURITIES FORMS

 SECTION 2.1. Creation of the Notes; Designations. 

In accordance with Section 3.01 of the Base Indenture, the Company hereby creates the Notes as a series of its Debt Securities issued
pursuant to the Indenture. The Notes shall be known and designated as the “6.750% Senior Notes due 2036” of the Company. 

  
 -7- 

 SECTION 2.2. Forms Generally. 

The Notes and the Trustee’s certificate of authentication shall be in the forms set forth in Exhibit I with the form of notation of
Guarantee to be endorsed thereon set forth in Exhibit II attached hereto, with such appropriate insertions, omissions, substitutions and other variations as are required or permitted by the Indenture and may have such letters, numbers or other marks
of identification and such legends or endorsements placed thereon as may be required to comply with the rules of any securities exchange or as may, consistently herewith, be determined by the officers executing such Notes, as evidenced by their
execution of the Notes. Any portion of the text of any Note may be set forth on the reverse thereof, with an appropriate reference thereto on the face of the Note. 

The Notes shall be printed, lithographed or engraved or produced by any combination of these methods or may be produced in any other manner,
as determined by the officers of the Company executing such Notes, as evidenced by their manual execution of such Notes. 
 ARTICLE THREE

 GENERAL TERMS AND CONDITIONS OF THE NOTES 

SECTION 3.1. Title and Terms of Notes. 

(a) The aggregate principal amount of Notes which shall be authenticated and delivered on the Issue Date under the Indenture shall be
$700,000,000; provided, however, that the Company from time to time, without giving notice to or seeking the consent of the Holders of the Notes, may issue additional notes (the “Additional Notes”) in any amount having
the same terms as the Notes in all respects, except for the issue date, the issue price and the initial interest payment date. Any such Additional Notes shall be authenticated by the Trustee upon receipt of a Company an Authentication Order to that
effect, and when so authenticated, will constitute “Notes” for all purposes of the Indenture and will (together with all other Notes issued under the Indenture) constitute a single series of Debt Securities under the Indenture;
provided that if the Additional Notes are not fungible with the Notes for U.S. federal income tax purposes, as applicable, the Additional Notes will have a separate CUSIP number. The Notes will be issued only in fully registered form without
coupons in denominations of $2,000 and integral multiples of $1,000 in excess thereof. 
 (b) The principal amount of the Notes is due and
payable in full on July 1, 2036 unless earlier redeemed. 
 (c) The Notes shall bear interest at the rate of 6.750% per annum
(computed on the basis of a 360-day year comprised of twelve 30-day months) from the Issue Date or from the most recent Interest Payment Date on which interest has been paid or duly provided for to maturity or early redemption; and interest will be
payable semi-annually in arrears on January 1 and July 1 of each year, commencing January 1, 2017, to the Persons in whose name such Notes were registered at the close of business on the preceding June 15 or December 15,
respectively. 
 (d) Principal of and interest on the Notes shall be payable in accordance with Sections 3.07 and 5.01 of the Base Indenture.

  
 -8- 

 (e) Other than as provided in Article Four of this First Supplemental Indenture, the Notes shall
not be redeemable. 
 (f) The Notes shall not be entitled to the benefit of any mandatory redemption or sinking fund. 

(g) The Notes shall not be convertible into any other securities. 

(h) Section 11.04 of the Base Indenture shall apply to the Notes. 

(i) The Company initially appoints the Trustee as Registrar and Paying Agent with respect to the Notes until such time as the Trustee has
resigned or a successor has been appointed. 
 (j) The Notes (and the notation of Guarantee endorsed thereon) will be issuable in the form of
one or more Global Debt Securities and the Depositary for such Global Security will be the Depository Trust Company. 
 (k) The Company shall
pay principal of, premium, if any, and interest on the Notes in money of the United States of America that at the time of payment is legal tender for payment of public and private debts. 

(l) A Holder may transfer or exchange Notes only in accordance with the Indenture. Upon any transfer or exchange, the Registrar and the Trustee
may require a Holder, among other things, to furnish appropriate endorsements or transfer documents. No service charge shall be made for any registration of transfer or exchange, but the Company or the Trustee may require the payment of a sum
sufficient to cover any tax or other governmental charge that may be imposed in connection therewith. 
 ARTICLE FOUR 

REDEMPTION 
 SECTION 4.1. Optional
Redemption. 
 (a) The Notes will be redeemable in whole or in part, at the Company’s option, at any time and from time to time at a
redemption price equal to the greater of (1) 100% of the principal amount of the Notes to be redeemed and (2) the sum of the present values of the remaining scheduled payments of principal and interest thereon to maturity discounted to the
Redemption Date on a semiannual basis (assuming a 360-day year consisting of twelve 30-day months) at the Treasury Rate, plus 50 basis points, plus accrued interest thereon to the Redemption Date. 

(b) Prior to July 1, 2019, the Company may, with the net proceeds of one or more Qualified Equity Offerings, redeem up to 35% of the
aggregate principal amount at maturity of the outstanding Notes (including Additional Notes) at a redemption price equal to 106.750% of the principal amount thereof (the “Redemption Price”), plus accrued and unpaid interest thereon,
if any, to, but not including, the applicable Redemption Date; provided that at 

  
 -9- 

 
least 65% of the principal amount at maturity of Notes (including Additional Notes) issued under this Indenture remains outstanding immediately after the occurrence of any such redemption
(excluding Notes held by the Company or its Subsidiaries) and that any such redemption occurs within 90 days following the closing of any such Qualified Equity Offering. 

(c) Unless the Company defaults in payment of the Redemption Price, on or after the Redemption Date, interest will cease to accrue on the Notes
or portions thereof called for redemption. 
 SECTION 4.2. Optional Redemption Procedures. 

The provisions of Article 4 of the Base Indenture shall apply in the case of a redemption pursuant to this Article Four. 

ARTICLE FIVE 
 COVENANTS 

Holders of the Notes shall be entitled to the benefit of all covenants in Article 5 of the Base Indenture (with the exception of
Section 5.05) and the following additional covenants, which shall be deemed to be provisions of the Base Indenture with respect to the Notes, provided that this Article Five shall not become a part of the terms of any other series of Debt
Securities: 
 SECTION 5.1. Limitations on Mergers and Sales of Assets. 

The Company shall not consolidate with or merge into another corporation, or sell, other than for cash or lease, all or substantially all of
its assets to another corporation, or purchase all or substantially all the assets of another corporation, unless: 
 (i)
either L Brands, Inc. is the continuing corporation or the successor corporation (if other than L Brands, Inc.) expressly assumes by supplemental indenture the obligations of the Notes (in which case, except in the case of such a lease, the Company
will be discharged from such obligations); and 
 (ii) immediately after the merger, consolidation, sale or lease, no Default
shall have occurred and be continuing. 
 SECTION 5.2. Successor Person Substituted. 

Upon any consolidation or merger, or any transfer of all or substantially all of the properties or assets of the Company and its Subsidiaries
taken as a whole in accordance with Section 5.1, the successor entity formed by such consolidation or into which the Company is merged or to which such transfer is made shall succeed to, and be substituted for, and may exercise every right and
power of, the Company under this Indenture with the same effect as if such successor entity had been named as the Company herein, and thereafter the predecessor entity shall be relieved of all obligations and covenants under this Indenture and the
Notes, but, in the case of a lease of all or substantially all its assets, the predecessor will not be released from the obligation to pay the principal of and interest on the Notes. 

  
 -10- 

 SECTION 5.3. Reports. 

Whether or not required by the rules and regulations of the Commission, so long as any Notes are outstanding, the Company will file with the
Commission (unless the Commission will not accept such filings) and furnish to the Holders of Notes all quarterly and annual financial information, and on dates, that would be required to be contained in a filing with the Commission on Forms 10-Q
and 10-K if the Notes were registered under the Exchange Act. 
 SECTION 5.4. Additional Subsidiary Guarantees. 

If any of the Domestic Subsidiaries of the Company becomes a borrower or guarantor under the Senior Credit Facility, then, in each such case,
the Company shall cause such Domestic Subsidiary to: 
 (a) execute and deliver to the Trustee a supplemental indenture
pursuant to which such Domestic Subsidiary shall unconditionally guarantee all of the Company’s obligations under the Notes and this Indenture; and 

(b) deliver to the Trustee one or more opinions of counsel that, subject to customary qualifications, such supplemental
indenture (i) has been duly authorized, executed and delivered by such Subsidiary and (ii) constitutes a valid and legally binding obligation of such Subsidiary in accordance with its terms. 

SECTION 5.5. Change of Control. 
 If a
Change of Control Triggering Event occurs, unless the Company has exercised its right to redeem the Notes pursuant to Section 4.01, Holders of Notes shall have the right to require the Company to repurchase all or any part in an integral
multiple of $1,000 of their Notes (provided that no Note will be purchased in part if the remaining principal amount of such Note would be less than $2,000) pursuant to the offer described below in this Section 5.5 (the “Change of
Control Offer”). 
 In the Change of Control Offer, the Company shall offer payment in cash equal to 101% of the aggregate
principal amount of Notes subject to such offer plus accrued and unpaid interest, if any, on the Notes repurchased to the date of purchase (the “Change of Control Payment”). 

Within 30 days following any Change of Control Triggering Event, or, at the Company’s option, prior to any Change of Control, but after
the public announcement of the Change of Control, the Company shall send a notice to Holders of Notes (the “Change of Control Notice”) describing the transaction or transactions that constitute or may constitute the Change of
Control Triggering Event and offering to repurchase such Notes on the date specified in the Change of Control Notice, which date shall be no earlier than 30 days and no later than 60 days from the date the Change of Control Notice is sent (the
“Change of Control Payment Date”), pursuant to the procedures described herein and in such notice. 

  
 -11- 

 The Change of Control Notice shall, if sent prior to the date of consummation of the Change of
Control, state that the offer to purchase is conditioned on the Change of Control Triggering Event occurring on or prior to the Change of Control Payment Date. 

The Company shall comply with the requirements of Rule 14e-1 under the Exchange Act and any other securities laws and regulations thereunder
to the extent those laws and regulations are applicable in connection with the repurchase of the Notes as a result of a Change of Control Triggering Event. To the extent that the provisions of any securities laws or regulations conflict with this
Section 5.5, the Company shall comply with the applicable securities laws and regulations and will not be deemed to have breached the Company’s obligations under the Change of Control provisions of this Indenture or the Notes by virtue of
such conflicts. 
 On the Change of Control Payment Date, the Company shall, to the extent lawful, (a) accept for payment all Notes or
portions of Notes properly tendered pursuant to the Change of Control Offer; (b) deposit with the paying agent an amount equal to the Change of Control Payment in respect of all Notes or portions of Notes properly tendered; and (c) deliver
or cause to be delivered to the Trustee the Notes properly accepted together with an Officers’ Certificate stating the aggregate principal amount of Notes or portions of Notes being purchased. 

ARTICLE SIX 
 GUARANTEE OF NOTES

 SECTION 6.1. Guarantee. 
 Subject to
the provisions of this Article Six, each Guarantor, by execution of this First Supplemental Indenture, jointly and severally, unconditionally guarantees to each Holder (i) the due and punctual payment of the principal of and interest and
premium, if any, on each Note, when and as the same shall become due and payable, whether at maturity, by acceleration or otherwise, the due and punctual payment of interest on the overdue principal of and interest on the Notes, to the extent
lawful, and the due and punctual payment of all other Obligations and due and punctual performance of all obligations of the Company to the Holders or the Trustee all in accordance with the terms of such Note and this Indenture, and (ii) in the
case of any extension of time of payment or renewal of any Notes or any of such other Obligations, that the same will be promptly paid in full when due or performed in accordance with the terms of the extension or renewal, at stated maturity, by
acceleration or otherwise. Each Guarantor, by execution of this First Supplemental Indenture, agrees that its obligations hereunder shall be absolute and unconditional, irrespective of, and shall be unaffected by, any invalidity, irregularity or
unenforceability of any such Note or the Indenture, any failure to enforce the provisions of any such Note or the Indenture, any waiver, modification or indulgence granted to the Company with respect thereto by the Holder of such Note, or any other
circumstances which may otherwise constitute a legal or equitable discharge of a surety or such Guarantor. 
 Each Guarantor hereby waives
diligence, presentment, demand for payment, filing of claims with a court in the event of insolvency or bankruptcy of the Company, any right to require a proceeding first against the Company, protest or notice with respect to any such Note or the
Indebtedness evidenced thereby and all demands whatsoever, and covenants that this Guarantee 

  
 -12- 

 
will not be discharged as to any such Note except by payment in full of the principal thereof and interest thereon. Each Guarantor hereby agrees that, as between such Guarantor, on the one hand,
and the Holders and the Trustee, on the other hand, (i) subject to this Article Six, the maturity of the Obligations guaranteed hereby may be accelerated as provided in this Article Six for the purposes of this Guarantee, notwithstanding any
stay, injunction or other prohibition preventing such acceleration in respect of the Obligations guaranteed hereby, and (ii) in the event of any declaration of acceleration of such Obligations as provided in this Article Six, such Obligations
(whether or not due and payable) shall forthwith become due and payable by each Guarantor for the purpose of this Guarantee. 
 SECTION 6.2. Execution
and Delivery of Notation of Guarantee. 
 To further evidence the Guarantee set forth in Section 6.1, each Guarantor hereby agrees
that a notation of such Guarantee, substantially in the form included in Exhibit II hereto, shall be endorsed on each Note authenticated and delivered by the Trustee and such Guarantee shall be executed by either manual or facsimile signature
of an Officer or an Officer of a general partner, as the case may be, of each Guarantor. The validity and enforceability of any Guarantee shall not be affected by the fact that it is not affixed to any particular Note. 

Each of the Guarantors hereby agrees that its Guarantee set forth in Section 6.1 shall remain in full force and effect notwithstanding
any failure to endorse on each Note a notation of such Guarantee. 
 If an Officer of a Guarantor whose signature is on this Indenture or a
Guarantee no longer holds that office at the time the Trustee authenticates the Note on which such Guarantee is endorsed or at any time thereafter, such Guarantor’s Guarantee of such Note shall be valid nevertheless. 

The delivery of any Note by the Trustee, after the authentication thereof hereunder, shall constitute due delivery of any Guarantee set forth
in this Indenture on behalf of the Guarantor. 
 SECTION 6.3. Limitation of Guarantee. 

Each Guarantor, and by its acceptance of Notes, each Holder, hereby confirms that it is the intention of all such parties that the Guarantee of
such Guarantor not constitute a fraudulent transfer or conveyance for purposes of any Bankruptcy Law, the Uniform Fraudulent Conveyance Act, the Uniform Fraudulent Transfer Act or any similar federal or state law to the extent applicable to any
Guarantee. To effectuate the foregoing intention, the Trustee, the Holders and the Guarantors hereby irrevocably agree that the obligations of each Guarantor are limited to the maximum amount as will, after giving effect to all other contingent and
fixed liabilities of such Guarantor and after giving effect to any collections from or payments made by or on behalf of any other Guarantor in respect of the obligations of such other Guarantor under its Guarantee or pursuant to its contribution
obligations under this Indenture, result in the obligations of such Guarantor under its Guarantee not constituting a fraudulent conveyance or fraudulent transfer under federal or state law. Each Guarantor that makes a payment or distribution under

  
 -13- 

 
a Guarantee shall be entitled to a contribution from each other Guarantor in a pro rata amount based on the assets of each Guarantor. 

SECTION 6.4. Release of Guarantor. 
 A
Guarantor shall be automatically and unconditionally released from all of its obligations under its Guarantee: 
 (i) in the
event of a sale or other transfer of Equity Interests in such Guarantor or dissolution of such Guarantor in compliance with the terms of this Indenture following which such Guarantor ceases to be a Subsidiary; 

(ii) upon such Guarantor ceasing to be a borrower or guarantor under any Senior Credit Facility; or 

(iii) in connection with a discharge of the Indenture or discharge of obligations thereunder pursuant to Sections 11.01, 11.02,
11.03 and 11.04, as applicable, of the Indenture; and 
 in each such case, upon delivery by the Company to the Trustee an Officers’ Certificate and an
Opinion of Counsel, each stating that all conditions precedent herein provided for relating to such transactions have been complied with and that such release is authorized and permitted hereunder. 

The Trustee shall execute any documents reasonably requested by the Company or a Guarantor in order to evidence the release of such Guarantor
from its obligations under its Guarantee endorsed on the Notes and under this Article Six. 
 SECTION 6.5. Waiver of Subrogation. 

Each Guarantor hereby irrevocably waives any claim or other rights which it may now or hereafter acquire against the Company that arise from
the existence, payment, performance or enforcement of such Guarantor’s obligations under its Guarantee and this Indenture, including, without limitation, any right of subrogation, reimbursement, exoneration, indemnification, and any right to
participate in any claim or remedy of any Holder of Notes against the Company, whether or not such claim, remedy or right arises in equity, or under contract, statute or common law, including, without limitation, the right to take or receive from
the Company, directly or indirectly, in cash or other property or by set-off or in any other manner, payment or security on account of such claim or other rights. If any amount shall be paid to any Guarantor in violation of the preceding sentence
and the Notes shall not have been paid in full, such amount shall have been deemed to have been paid to such Guarantor for the benefit of, and held in trust for the benefit of, the Holders, and shall forthwith be paid to the Trustee for the benefit
of such Holders to be credited and applied upon the Notes, whether matured or unmatured, in accordance with the terms of this Indenture. Each Guarantor acknowledges that it will receive direct and indirect benefits from the financing arrangements
contemplated by this Indenture and that the waiver set forth in this Section 6.5 is knowingly made in contemplation of such benefits. 

  
 -14- 

 ARTICLE SEVEN 

SATISFACTION AND DISCHARGE 
 SECTION 7.1.
Satisfaction and Discharge. 
 Article 11 of the Base Indenture shall be superseded in its entirety by the following language with
respect to, and solely for the benefit of the Holders of the Notes; provided that this Article Seven shall not become part of the terms of any other series of Debt Securities: 

SECTION 11.01 Discharge of Indenture. 

The Company may terminate its obligations and the obligations of the Guarantors under the Notes, the Guarantees and this Indenture, except the
obligations referred to in the last paragraph of this Section 11.01, if 
 (1) all Notes that have been authenticated
and delivered, except lost, stolen or destroyed Notes that have been replaced or paid and Notes for whose payment money has been deposited in trust or segregated and held in trust by the Company and thereafter repaid to the Company or discharged
from this trust, have been delivered to the Trustee for cancellation, or 
 (2) (a) all Notes not delivered to the Trustee
for cancellation otherwise (x) have become due and payable by reason of the mailing of a notice of redemption or otherwise, (y) will become due and payable by reason of the mailing of a notice of redemption or otherwise, or may be called
for redemption within one year or (z) have been called for redemption pursuant to Section 4.1 of the First Supplemental Indenture and, in any case, the Company has irrevocably deposited or caused to be deposited with the Trustee as trust
funds, in trust solely for the benefit of the Holders of Notes, cash in U.S. Dollars, non-callable Government Securities, or a combination thereof, in amounts as will be sufficient without consideration of any reinvestment of interest, to pay and
discharge the entire Indebtedness on the Notes not delivered to the Trustee for cancellation for principal, premium, and accrued interest through the date of maturity or the Redemption Date; or 

(b) no Default or Event of Default has occurred and is continuing on the date of the deposit or will occur as a result of the
deposit and the deposit will not result in a breach or violation of, or constitute a default under, any material instrument to which the Company is a party or by which the Company is bound; or 

(c) the Company has paid or caused to be paid all sums payable by it under this Indenture; and 

(d) the Company has delivered irrevocable instructions to the Trustee to apply the deposited money toward the payment of the
Notes at maturity or the Redemption Date, as the case may be. 

  
 -15- 

 In addition, if the Company delivers an Officers’ Certificate and an Opinion of Counsel
stating that all conditions precedent to satisfaction and discharge have been complied with, the Trustee shall acknowledge in writing the discharge of the Company’s and the Guarantors’ obligations under the Notes, the Guarantees and this
Indenture except for those surviving obligations specified below. 
 Notwithstanding the satisfaction and discharge of this Indenture, the
obligations of the Company in Sections 11.05 and 11.06 shall survive such satisfaction and discharge. 
 SECTION 11.02 Legal
Defeasance. 
 The Company may at its option, by Board Resolution of the Board of Directors of the Company, be discharged from its
obligations with respect to the Notes and the Guarantors discharged from their obligations under the Guarantees on the date the conditions set forth in Section 11.04 are satisfied (hereinafter, “Legal Defeasance”). For this
purpose, such Legal Defeasance means that the Company and the Guarantors shall be deemed to have paid and discharged the entire Indebtedness represented by the Notes and to have satisfied all its other obligations under such Notes and this Indenture
insofar as such Notes are concerned (and the Trustee, at the expense of the Company, shall, subject to Section 11.06, execute instruments in form and substance reasonably satisfactory to the Trustee and Company acknowledging the same), except
for the following which shall survive until otherwise terminated or discharged hereunder: (A) the rights of Holders to receive solely from the trust funds described in Section 11.04 and as more fully set forth in such Section, payments in
respect of the principal of, premium, and interest on such Notes when such payments are due from the trust referred to in Section 11.04; (B) the Company’s obligations hereunder with respect to such Notes concerning issuing temporary
Notes, registration of Notes, mutilated, destroyed, lost or stolen Notes and the maintenance of an office or agency for payment and money for security payments held in trust; (C) the rights, powers, trusts, duties, and immunities of the Trustee
hereunder (including claims of, or payments to, the Trustee under or pursuant to Section 11.01, and the Company’s obligations in connection therewith; and (D) this Article Eleven. Subject to compliance with this Article Eleven,
the Company may exercise its option under this Section 11.02 with respect to the Notes notwithstanding the prior exercise of its option under Section 11.03 with respect to the Notes. 

SECTION 11.03 Covenant Defeasance. 

At the option of the Company, pursuant to a Board Resolution of the Board of Directors of the Company, (x) the Company and the Guarantors
shall be released from their respective obligations under Section 5.2 through 5.3 of the First Supplemental Indenture (except for obligations mandated by the TIA) and Sections 5.06 and 5.07 and (y) clause (c) of Section 6.01
shall no longer apply with respect to the outstanding Notes on and after the date the conditions set forth in Section 11.03 are satisfied (hereinafter, “Covenant Defeasance”). For this purpose, such Covenant Defeasance means
that the Company and the Guarantors may omit to comply with and shall have no liability in respect of any term, condition or limitation set forth in any such specified Section or portion thereof, whether directly or indirectly by reason of any
reference elsewhere herein to any such specified Section or portion thereof or by reason of any reference in any such specified Section or portion thereof to any other provision herein or in any other document, but the remainder of this Indenture
and the Notes shall be unaffected thereby. 

  
 -16- 

 SECTION 11.04 Conditions to Legal Defeasance or Covenant Defeasance. 

The following shall be the conditions to application of Section 11.02 or Section 11.03 to the outstanding Notes: 

(1) the Company must irrevocably deposit with the Trustee, in trust, for the benefit of the Holders of the Notes issued
thereunder, cash in U.S. dollars, non-callable Government Securities, or a combination of cash in U.S. dollars, and non-callable Government Securities, in amounts as will be sufficient (without consideration of any reinvestment of interest), in the
opinion of a nationally recognized firm of independent public accountants selected by the Company, to pay the principal of, interest and premium, if any, on the outstanding Notes through the stated maturity or through the applicable Redemption Date,
as the case may be, and the Company must specify whether the Notes are being defeased to maturity or to a particular Redemption Date; 

(2) in the case of Legal Defeasance, the Company has delivered to the Trustee an Opinion of Counsel reasonably acceptable to
the Trustee confirming that (a) the Company has received from, or there has been published by, the Internal Revenue Service, a ruling or (b) since the Issue Date, there has been a change in the applicable U.S. federal income tax law, in
either case to the effect that, and based thereon such Opinion of Counsel will confirm that, the Holders and beneficial owners of the respective outstanding Notes will not recognize income, gain or loss for U.S. federal income tax purposes as a
result of such Legal Defeasance and will be subject to U.S. federal income tax (including, for greater certainty, withholding tax) on the same amounts, in the same manner and at the same times as would have been the case if such Legal Defeasance had
not occurred; 
 (3) in the case of Covenant Defeasance, the Company has delivered to the Trustee an Opinion of Counsel in
the United States reasonably acceptable to the Trustee confirming that the Holders and beneficial owners of the respective outstanding Notes will not recognize income, gain or loss for U.S. federal income tax purposes as a result of such Covenant
Defeasance and will be subject to U.S. federal income tax (including, for greater certainty, withholding tax) on the same amounts, in the same manner and at the same times as would have been the case if such Covenant Defeasance had not occurred;

 (4) no Default or Event of Default has occurred and is continuing on the date of such deposit or insofar as Events of
Default resulting from insolvency events are concerned, at any time in the period ending on the 91st day after the date of deposit; 

(5) such Legal Defeasance or Covenant Defeasance will not result in a breach or violation of, or constitute a default under,
any material agreement or instrument (other than this Indenture) to which the Company or any of its Subsidiaries is a party or by which the Company or any of its Subsidiaries is bound; 

(6) the Company must deliver to the Trustee an Officers’ Certificate stating that the deposit was not made by the Company
with the intent of preferring the Holders of the Notes over any of the other creditors of the Company or with the intent of defeating, hindering, delaying or defrauding creditors of the Company or others; and 

  
 -17- 

 (7) the Company must deliver to the Trustee an Officers’ Certificate and an
Opinion of Counsel, each stating that all conditions precedent relating to the Legal Defeasance or the Covenant Defeasance set forth in clauses (1) through (6) above (in the case of such Officer’s Certificate) or clauses
(2) and/or (3) and (5) above (in the case of such Opinion of Counsel) have been complied with. 
 If the funds deposited with
the Trustee to effect Covenant Defeasance are insufficient to pay the principal of and interest on the Notes when due, then the Company’s obligations and the obligations of the Guarantors under this Indenture will be revived and no such
defeasance will be deemed to have occurred. 
 SECTION 11.05 Deposited Money and Government Securities to Be Held in Trust; Other
Miscellaneous Provisions. 
 All money and non-callable Government Securities (including the proceeds thereof) deposited with the Trustee
pursuant to Section 11.04 in respect of the outstanding Notes shall be held in trust and applied by the Trustee, in accordance with the provisions of such Notes and this Indenture, to the payment, either directly or through any Paying Agent
(including the Company acting as Paying Agent), to the Holders of such Notes, of all sums due and to become due thereon in respect of principal, premium, if any, and accrued interest, but such money need not be segregated from other funds except to
the extent required by law. 
 The Company and the Guarantors shall (on a joint and several basis) pay and indemnify the Trustee against any
tax, fee or other charge imposed on or assessed against the Government Securities deposited pursuant to Section 11.04 or the principal, premium, if any, and interest received in respect thereof other than any such tax, fee or other charge which
by law is for the account of the Holders of the outstanding Notes. 
 Anything in this Article Eleven to the contrary notwithstanding,
the Trustee shall deliver or pay to the Company from time to time any money or non-callable Government Securities held by it as provided in Section 11.04 which, in the opinion of a nationally recognized firm of independent public accountants
expressed in a written certification thereof delivered to the Trustee, are in excess of the amount thereof which would then be required to be deposited to effect an equivalent Legal Defeasance or Covenant Defeasance. 

SECTION 11.06 Reinstatement. 

If the Trustee or Paying Agent is unable to apply any U.S. Dollars or non-callable Government Securities in accordance with Section 11.01,
11.02 or 11.03 by reason of any legal proceeding or by reason of any order or judgment of any court or governmental authority enjoining, restraining or otherwise prohibiting such application, the Company’s and each Guarantor’s obligations
under this Indenture, the Notes and the Guarantees shall be revived and reinstated as though no deposit had occurred pursuant to this Article Eleven until such time as the Trustee or Paying Agent is permitted to apply all such U.S. Dollars or
non-callable Government Securities in accordance with Section 11.01, 11.02 or 11.03, as the case may be; provided that if the Company or the Guarantors have made any payment of principal of, premium, if any, or accrued interest on any
Notes because of the reinstatement of their obligations, the Company or the Guarantors, 

  
 -18- 

 
as the case may be, shall be subrogated to the rights of the Holders of such Notes to receive such payment from the U.S. Dollars or non-callable Government Securities held by the Trustee or
Paying Agent. 
 SECTION 11.07 Moneys Held by Paying Agent. 

In connection with the satisfaction and discharge of this Indenture, all moneys then held by any Paying Agent under the provisions of this
Indenture shall, upon written demand of the Company, be paid to the Trustee, or if sufficient moneys have been deposited pursuant to Section 11.04, to the Company (or, if such moneys had been deposited by the Guarantors, to such Guarantors),
and thereupon such Paying Agent shall be released from all further liability with respect to such moneys. 
 SECTION 11.08 Moneys Held by
Trustee. 
 Subject to applicable law, any moneys deposited with the Trustee or any Paying Agent or then held by the Company or the
Guarantors in trust for the payment of the principal of, or premium, if any, or interest on any Note that are not applied but remain unclaimed by the Holder of such Note for two years after the date upon which the principal of, or premium, if any,
or interest on such Note shall have respectively become due and payable shall be repaid to the Company (or, if appropriate, the Guarantors), or if such moneys are then held by the Company or the Guarantors in trust, such moneys shall be released
from such trust; and the Holder of such Note entitled to receive such payment shall thereafter, as an unsecured general creditor, look only to the Company and the Guarantors for the payment thereof, and all liability of the Trustee or such Paying
Agent with respect to such trust money shall thereupon cease; provided that the Trustee or any such Paying Agent, before being required to make any such repayment, may, at the expense of the Company and the Guarantors, either mail to each
Holder affected, at the address shown in the register of the Notes maintained by the Registrar pursuant to Section 308, or cause to be published once a week for two successive weeks, in a newspaper published in the English language, customarily
published each Business Day and of general circulation in the City of New York, New York or the United States, a notice that such money remains unclaimed and that, after a date specified therein, which shall not be less than 30 days from the date of
such mailing or publication, any unclaimed balance of such moneys then remaining will be repaid to the Company. After payment to the Company or the Guarantors or the release of any money held in trust by the Company or any Guarantors, as the case
may be, Holders entitled to the money must look only to the Company and the Guarantors for payment as general creditors unless applicable abandoned property law designates another Person. 

ARTICLE EIGHT 
 SUPPLEMENTAL
INDENTURES 
 SECTION 8.1. Without Consent of Holders, Company and Trustee May Enter Into Supplemental Indentures for Specified Purposes. 

Section 13.01 of the Base Indenture shall be amended by adding the following language of new Sections 13.01(k), (l) and (m) with
respect to the Notes and solely for the 

  
 -19- 

 
benefit of the Holders of the Notes, provided that this Article Eight shall not become a part of the terms of any other series of Debt Securities: 

(k) to add a Guarantee of the Notes; 

(l) to release a Guarantor as provided in Section 6.5; and 

(m) to issue Additional Notes under Section 3.1 of the First Supplemental Indenture. 

ARTICLE NINE 
 MISCELLANEOUS 

SECTION 9.1. Effect of First Supplemental Indenture. 

(1) This First Supplemental Indenture is a supplemental indenture within the meaning of Section 13.01 of the Base Indenture, and the Base
Indenture shall be read together with this First Supplemental Indenture and shall have the same effect over the Notes, in the same manner as if the provisions of the Base Indenture and this First Supplemental Indenture were contained in the same
instrument. 
 (2) In all other respects, the Base Indenture is confirmed by the parties hereto as supplemented by the terms of this First
Supplemental Indenture. 
 SECTION 9.2. Effect of Headings. 

The Article and Section headings herein are for convenience only and shall not affect the construction hereof. 

SECTION 9.3. Successors and Assigns. 
 All
covenants and agreements in this First Supplemental Indenture by the Company, the Guarantors, the Trustee and the Holders shall bind their successors and assigns, whether so expressed or not. 

SECTION 9.4. Severability Clause. 
 In
case any provision in this First Supplemental Indenture or in the Notes shall be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby. 

SECTION 9.5. Benefits of First Supplemental Indenture. 

Nothing in this First Supplemental Indenture or in the Notes, express or implied, shall give to any Person, other than the parties hereto, any
benefit or any legal or equitable right, remedy or claim under this First Supplemental Indenture. 

  
 -20- 

 SECTION 9.6. Conflict. 

In the event that there is a conflict or inconsistency between the Base Indenture and this First Supplemental Indenture, the provisions
of this First Supplemental Indenture shall control; provided, however, if any provision hereof limits, qualifies or conflicts with another provision herein or in the Base Indenture, in either case, which is required or deemed to be
included in this Indenture by any of the provisions of the Trust Indenture Act, such required or deemed provision shall control. 
 SECTION 9.7.
Governing Law. 
 THIS FIRST SUPPLEMENTAL INDENTURE AND THE NOTES SHALL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE WITH THE LAWS OF
THE STATE OF NEW YORK APPLICABLE TO AGREEMENTS MADE OR ENTERED INTO AND, IN EACH CASE, PERFORMED, IN SAID STATE. 
 SECTION 9.8. Trustee. 

The Trustee shall not be responsible in any manner whatsoever for or in respect of the validity or sufficiency of this First Supplemental
Indenture or for or in respect of the recitals contained herein, all of which are made solely by the Company. 
 This instrument may be
executed in any number of counterparts, each of which so executed shall be deemed to be an original, but all such counterparts shall together constitute but one and the same instrument. 

[Signature page to follow] 

  
 -21- 

 IN WITNESS WHEREOF, the parties hereto have caused this First Supplemental Indenture to be duly
executed on the date and year first written above. 
  

			
	L BRANDS, INC.
		
	By:	 	 /s/ Stuart B. Burgdoerfer

		 	Name:     Stuart B. Burgdoerfer
		 	Title:       Chief Financial Officer

  
 -22- 

 
			
	GUARANTORS:
	
	BATH & BODY WORKS BRAND
	    MANAGEMENT, INC.
	BATH & BODY WORKS DIRECT, INC.
	BATH & BODY WORKS, LLC
	BEAUTYAVENUES, LLC
	INTIMATE BRANDS, INC.
	INTIMATE BRANDS HOLDING, LLC
	L BRANDS DIRECT FULFILLMENT, INC.
	L BRANDS SERVICE COMPANY, LLC
	 L BRANDS STORE DESIGN &

    CONSTRUCTION, INC.

	LA SENZA, INC.
	MAST INDUSTRIES, INC.
	VICTORIA’S SECRET DIRECT BRAND     MANAGEMENT, LLC
	VICTORIA’S SECRET STORES BRAND
	    MANAGEMENT, INC.
	VICTORIA’S SECRET STORES, LLC
		
	By:	 	 /s/ Timothy J. Faber

		 	Name:     Timothy J. Faber
		 	Title:       Senior Vice President and Treasurer

  
 -23- 

 
			
	U.S. BANK NATIONAL ASSOCIATION
	as Trustee
		
	By:	 	 /s/ Katherine Esber

		 	Name: Katherine Esber
		 	Title:   Vice President

  
 -24- 

 EXHIBIT I 

UNLESS AND UNTIL IT IS EXCHANGED IN WHOLE OR IN PART FOR THE INDIVIDUAL SECURITIES REPRESENTED HEREBY, THIS GLOBAL SECURITY MAY NOT BE TRANSFERRED EXCEPT AS A
WHOLE (I) BY THE DEPOSITARY TO A NOMINEE OF THE DEPOSITARY OR (II) BY A NOMINEE OF THE DEPOSITARY OR THE DEPOSITARY TO A SUCCESSOR DEPOSITARY OR A NOMINEE OF SUCH SUCCESSOR DEPOSITARY. UNLESS THIS CERTIFICATE IS PRESENTED BY AN AUTHORIZED
REPRESENTATIVE OF THE DEPOSITORY TRUST COMPANY (55 WATER STREET, NEW YORK, NEW YORK) TO THE ISSUER OR ITS AGENT FOR REGISTRATION OF TRANSFER, EXCHANGE OR PAYMENT AND ANY CERTIFICATE ISSUED IS REGISTERED IN THE NAME OF CEDE & CO. OR SUCH
OTHER NAME AS REQUESTED BY AN AUTHORIZED REPRESENTATIVE OF THE DEPOSITORY TRUST COMPANY AND ANY PAYMENT IS MADE TO CEDE & CO., ANY TRANSFER, PLEDGE OR OTHER USE HEREOF FOR VALUE OR OTHERWISE BY OR TO ANY PERSON IS WRONGFUL SINCE THE
REGISTERED OWNER HEREOF, CEDE & CO., HAS AN INTEREST HEREIN. 
 L BRANDS, INC. 

6.750% SENIOR NOTE DUE 2036 
  

			
	No. [    ]	 	$[    ]

 CUSIP No. 501797 AM6 

L BRANDS, INC., a Delaware corporation, for value received, promises to pay to Cede & Co., or registered assigns, the principal sum
of                         United States Dollars
(US$                    ) on July 1, 2036. 

Interest Payment Dates: January 1 and July 1. 

Regular Record Dates: June 15 and December 15. 

Additional provisions of this Note are set forth on the other side of this Note. 

 IN WITNESS WHEREOF, the Issuer has caused this instrument to be duly executed. 

 

			
	L BRANDS, INC.
		
	By:	 	  

		 	Name:
		 	Title:

  

			
	Attest:	 	
	
	L BRANDS, INC.
		
	By:	 	  

	Name:	 	
	Title:	 	

  
 -2- 

 TRUSTEE’S CERTIFICATE OF AUTHENTICATION 

This is one of the Notes of the series designated therein referred to in the within-mentioned Indenture. 

Dated: 
  

			
	U.S. BANK NATIONAL ASSOCIATION
	as Trustee
		
	By:	 	  

		 	Authorized Officer

  
 -3- 

 (Reverse of Note) 

6.750% Senior Note due 2036 
  

	1.	Interest 

 L Brands, Inc., a Delaware corporation (such corporation, and its successors and
assigns under the Indenture hereinafter referred to, being herein called the “Issuer”), for value received, promises to pay interest on the principal amount of this Note (the “Note”) at the rate of 6.750% per
annum. The Issuer shall pay interest semi-annually on January 1 and July 1 of each year, commencing January 1, 2017. Interest on the Note shall accrue from the Issue Date or from the most recent Interest Payment Date on which interest
has been paid or duly provided for to maturity or early redemption until the principal hereof is due. Interest shall be computed on the basis of a 360-day year comprised of twelve 30-day months. The Issuer shall pay interest on overdue principal at
the rate borne by the Note, and it shall pay interest on overdue installments of interest at the same rate to the extent lawful. 
  

	2.	Method of Payment 

 The Issuer shall pay interest on the Note (except defaulted interest, which
shall be paid pursuant to Section 3.07 of the Base Indenture) to the Persons who are registered holders at the close of business on the June 15 and December 15 (each, a “Record Date”) next preceding the Interest
Payment Date even if Notes are canceled after the applicable Record Date and on or before the Interest Payment Date. The Issuer shall pay principal, premium, if any, interest, and any additional amounts, in money of the United States of America that
at the time of payment is legal tender for payment of public and private debts. Payment of principal (and premium, if any), interest, and any additional amounts, in respect of Notes represented by a Global Security will be made by wire transfer of
immediately available funds to the accounts specified by the Depositary. Payments of principal (and premium, if any), interest, and additional amounts, in respect of a certificated Note may be made, at the option of the Issuer, either by wire
transfer in immediately available funds to the accounts specified by registered holders as of the relevant Record Dates or (subject to collection) by check mailed to the address of the registered holders as of the relevant Record Dates or at the
specified offices of any Paying Agent. Payment of principal in respect of a certificated Note will only be made against presentation and provided that payment is made in full, surrender of the appropriate certificate at the specified offices
of any Paying Agent. 
  

	3.	Paying Agent and Registrar 

 Initially, U.S. Bank National Association, a national banking
association (the “Trustee”), will act as Paying Agent and Registrar with respect to the Notes. The Issuer may appoint and change any Paying Agent or Registrar without notice. The Issuer may act as Paying Agent or Registrar. 

 

	4.	Indenture 

 The Issuer issued the Notes under an Indenture, dated as of June 16, 2016 (the
“Base Indenture”), between the Issuer and U.S. Bank National Association, as trustee (the 

  
 -4- 

 
“Trustee”), as supplemented by the first supplemental indenture, dated June 16, 2016 (the “First Supplemental Indenture”), among the Issuer, the guarantors
party thereto and the Trustee, which collectively constitutes the indenture governing the Debt Securities (the Base Indenture, as supplemented by the First Supplemental Indenture, the “Indenture”). The terms of the Notes include
those stated in the Indenture and those made part of the Indenture by reference to the Trust Indenture Act of 1939, as amended (15 U.S.C. Sections 77aaa-77bbbb) as in effect on the date of the Indenture (the “TIA”). The Notes
include all terms and provisions of the Indenture, and holders are referred to the Indenture and the TIA for a statement of such terms and provisions. This security is one of a series of securities designated as the 6.750% Senior Notes due 2036 of
the Issuer (the “Notes”). Capitalized terms used herein have the same meanings given in the Indenture unless otherwise indicated. 

The aggregate principal amount at maturity of the Notes which may be authenticated and delivered under the Indenture shall be unlimited. In
addition, the aggregate principal amount of Debt Securities of any class or series which may be authenticated and delivered under the Indenture shall be unlimited, provided that such Debt Securities shall rank equally with the Notes. 

 

	5.	Certain Covenants 

 The Indenture imposes certain limitations on the ability of the Issuer to,
among other things, create or incur Liens. The Indenture also imposes limitations on the ability of the Issuer to consolidate or amalgamate with or merge into any other Person or convey, transfer, sell or lease its property or assets substantially
as an entirety to any Person. 
  

	6.	Optional Redemption 

 The Notes will be redeemable, in whole or in part, at the Issuer’s
option, at any time and from time to time at a redemption price equal to the greater of: (A) 100% of the principal amount of the Notes to be redeemed and (B) the sum of the present values of the remaining scheduled payments of principal
and interest thereon to maturity discounted to the Redemption Date on a semi-annual basis (assuming a 360-day year consisting of twelve 30-day months) at the Treasury Rate, plus 50 basis points, plus accrued interest thereon to Redemption Date. 

Prior to July 1, 2019, the Issuer may, with the net proceeds of one or more Qualified Equity Offerings, redeem up to 35% of the aggregate
principal amount at maturity of the outstanding Notes (including Additional Notes) at a redemption price equal to 106.750% of the principal amount thereof (the “Redemption Price”), plus accrued and unpaid interest thereon, if any,
to, but not including, the applicable Redemption Date; provided that at least 65% of the principal amount at maturity of Notes issued under this Indenture remains outstanding immediately after the occurrence of any such redemption (excluding
Notes held by the Issuer or its Subsidiaries) and that any such redemption occurs within 90 days following the closing of any such Qualified Equity Offering. 

Unless the Company defaults in payment of the Redemption Price, on or after the Redemption Date, interest will cease to accrue on the Notes or
portions thereof called for redemption. 

  
 -5- 

 The provisions of Article 4 of the Base Indenture shall apply in the case of a redemption
pursuant to this Section 6. 
  

	7.	Sinking Fund 

 The Notes will not be entitled to the benefit of any mandatory redemption or
sinking fund. 
  

	8.	Notice of Redemption 

 Notice of redemption will be mailed by first-class mail, postage prepaid,
at least 30 days but not more than 60 days before the Redemption Date to each registered holder of Debt Securities to be redeemed at such holder’s registered address. Notes in denominations larger than $2,000 may be redeemed in part but only in
whole multiples of $1,000. If money sufficient to pay the Redemption Price of and accrued and unpaid interest, including premium, if any, on all Debt Securities (or portions thereof) to be redeemed on the Redemption Date is deposited with the Paying
Agent on or before the Redemption Date and certain other conditions are satisfied, on and after such date interest ceases to accrue on such Debt Securities (or such portions thereof) called for redemption. 

 

	9.	Offers to Purchase 

 The Indenture provides that upon the occurrence of a Change of Control
Triggering Event and subject to further limitations contained therein, the Issuer shall make an offer to purchase outstanding Notes in accordance with the procedures set forth in Section 5.5 of the First Supplemental Indenture. 

 

	10.	Denominations: Transfer, Exchange 

 The Notes are in fully registered form without coupons in
denominations of $2,000 and integral multiples of $1,000 in excess thereof. A registered holder may transfer or exchange Notes in accordance with the Indenture. Upon any transfer or exchange, the Registrar and the Trustee may require a holder, among
other things, to furnish appropriate endorsements or transfer documents. No service charge shall be made for any registration of transfer or exchange, but the Issuer or the Trustee may require the payment of a sum sufficient to cover any tax or
other governmental charge that may be imposed in connection therewith permitted by the Indenture. 
  

	11.	Persons Deemed Owners 

 The registered holder of this Note may be treated as the owner of it for
all purposes. 
  

	12.	Unclaimed Money 

 If money for the payment of principal or interest remains unclaimed for two
years, the Trustee will pay the money back to the Issuer at its written request. After that, Holders 

  
 -6- 

 
entitled to the money must look to the Issuer for payment as general creditors unless an “abandoned property” law designates another Person. 

 

	13.	Discharge and Defeasance 

 Subject to certain conditions and limitations set forth in the
Indenture, the Issuer may terminate some of or all its obligations under the Notes and the Indenture if the Issuer deposits with the Trustee money or U.S. Government Obligations for the payment of principal of, premium, if any, and interest, on, the
Notes to redemption or maturity, as the case may be. 
  

	14.	Modification and Waiver 

 The Indenture permits, with certain exceptions as therein provided,
the amendment thereof and the modification of the rights and obligations of the Issuer and the rights of the Holders under the Indenture at any time by the Issuer and the Trustee with the consent of the holders of at least a majority in aggregate
principal amount of Notes at the time outstanding of each series which is affected by such amendment or modification voting as one class, except that certain amendments specified in the Indenture may be made without approval of holders of the Notes.
The Indenture also contains provisions permitting the holders of a majority in aggregate principal amount of the outstanding Debt Securities of any series to waive on behalf of the holders of such series of Debt Securities compliance by the Issuer
with certain provisions of the Indenture and certain past defaults under the Indenture and their consequences. Any such consent or waiver by the holder of this Note shall be binding upon such holder and upon all future Holders of this Note and any
Note issued upon the registration of transfer hereof or in exchange herefor or in lieu hereof whether or not notation of such consent or waiver is made upon this Note. 
  

	15.	Successor Corporation 

 When a successor corporation assumes all the obligations of its
predecessor under the Notes and the Indenture and the transaction complies with the terms of Section 5.1 of the First Supplemental Indenture, the predecessor corporation will, except as provided in Section 5.2, be released from those
obligations. 
  

	16.	Defaults and Remedies 

 If an Event of Default, other than an Event of Default described in
Section 6.01(e) or 6.01(f) of the Base Indenture, with respect to the Notes shall have occurred and be continuing, the Trustee or the holders of at least 25% in aggregate principal amount of the Notes then outstanding, by notice in writing to
the Issuer (and to the Trustee if given by the holders of the Notes), will be entitled to declare all unpaid principal of and accrued interest on the Notes then outstanding to be due and payable immediately. In the case of an Event of Default
described in Section 6.01(e) or 6.01(f) of the Base Indenture, all unpaid principal of and accrued interest on all Notes then outstanding shall be due and payable immediately without any declaration or other act on the part of the Trustee or
the holders of any Notes. Such declaration of acceleration may be annulled and past defaults (except, unless theretofore cured, a default in payment of principal of, premium, if any, interest on the Notes) may be waived by the holders of a majority
in principal amount of the Notes then outstanding upon the conditions provided in the Indenture. 

  
 -7- 

	17.	Trustee Dealings with the Issuer 

 Subject to certain limitations imposed by the TIA, the
Trustee under the Indenture, in its individual or any other capacity, may become the owner or pledgee of Notes and may otherwise deal with and collect obligations owed to it by the Issuer or its Affiliates and, subject to the Indenture, may
otherwise deal with the Issuer with the same rights it would have if it were not Trustee. 
  

	18.	Guarantees 

 The Note will be entitled to the benefits of certain Guarantees made for the
benefit of the Holders. Reference is hereby made to the Indenture for a statement of the respective rights, limitations of rights, duties and obligations thereunder of the Guarantors, the Trustee and the Holders. 

 

	19.	No Recourse Against Others 

 No incorporator, shareholder, officer or director, as such, of the
Issuer shall have any liability for any obligations, covenants or agreements of the Issuer under the Notes or the Indenture or for any claim based thereon or otherwise in respect thereof. By accepting a Note, each holder expressly waives and
releases all such liability. The waiver and release are a condition of, and part of the consideration for, the execution of the Indenture and the issuance of the Notes. 
  

	20.	Authentication 

 This Note shall not be valid until an authorized signatory of the Trustee
manually signs the certificate of authentication on the other side of this Note. 
  

	21.	Abbreviations 

 Customary abbreviations may be used in the name of a holder or an assignee, such
as TEN COM (=tenants in common), TEN ENT (=tenants by the entireties), JT TEN (=joint tenants with rights of survivorship and not as tenants in common), COST (=custodian), and U/G/M/A (=Uniform Gifts to Minors Act). 

 

	22.	Governing Law 

 THE INDENTURE AND THIS NOTE SHALL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE
WITH THE LAWS OF THE STATE OF NEW YORK APPLICABLE TO AGREEMENTS MADE OR ENTERED INTO AND, IN EACH CASE, PERFORMED, IN SAID STATE. 
  

	23.	CUSIP Number 

 Pursuant to a recommendation promulgated by the Committee on Uniform Security
Identification Procedures, the Issuer has caused the CUSIP number to be printed on this Note and has directed the Trustee to use the CUSIP number in notices of redemption as a convenience 

  
 -8- 

 
to holders. No representation is made as to the accuracy of such number either as printed on this Note or as contained in any notice of redemption and reliance may be placed only on the other
identification numbers placed thereon. 
 The Issuer will furnish to any holder of Notes upon written request and without charge to the
holder a copy of the Indenture and a copy of this Note. 

  
 -9- 

 ASSIGNMENT FORM 

To assign this Note, fill in the form below: 
 I or we assign and
transfer this Security to 
  
  

(Print or type assignee’s name, address and zip code) 
  

 
 (Insert assignee’s soc. sec. or
tax I.D. No.) 
 and irrevocably appoint             agent to transfer this Note on the books of
the Issuer. The agent may substitute another to act for him. 
  
  

Date:                        
                         Your Signature:             
                                         
                                         
                                         
                       
  

 
 Sign exactly as your name appears on
the other side of this Note. 

  
 -10- 

 OPTION OF HOLDER TO ELECT PURCHASE 

If you want to elect to have all or any part of this Note purchased by the Issuer pursuant to Section 5.5 of the First Supplemental
Indenture, check the box:   ̈ 
 If you want to have only part of the Note
purchased by the Issuer pursuant to Section 5.5 of the First Supplemental Indenture, state the amount you elect to have purchased: 

$                         
                                         
     
 (multiple of $1,000, but not less than $2,000) 

Date:                         
  
  

			
	Your Signature:	 	  

		 	(Sign exactly as your name
		 	appears on the face of this Note)

 SIGNATURE GUARANTEE 

Signatures must be guaranteed by an “eligible guarantor institution” meeting the requirements of the Registrar, which requirements include
membership or participation in the Security Transfer Agent Medallion Program (“STAMP”) or such other “signature guarantee program” as may be determined by the Registrar in addition to, or in substitution for, STAMP, all in
accordance with the Securities Exchange Act of 1934, as amended. 

  
 -11- 

 SCHEDULE OF INCREASES OR DECREASES IN GLOBAL SECURITY 

The initial principal amount of this Global Security is $[            ]. The
following increases or decreases in this Global Security have been made: 
  

									
	 Date of

Exchange
	  	Amount of decrease in
Principal Amount of
this Global Security	  	Amount of
increase
in Principal
Amount of this
Global Security	  	Principal Amount
of this Global
Security following
such decrease or
increase	  	Signature of
authorized
signatory
of Trustee or Debt
Securities
Custodian

  
 -12- 

 Exhibit II 

NOTATION OF GUARANTEE 
 Each of
the undersigned (the “Guarantors”) hereby jointly and severally unconditionally guarantees, to the extent set forth in the First Supplemental Indenture and subject to the provisions in the Indenture dated as of June 16, 2016
(the “Base Indenture”), between the Issuer and U.S. Bank National Association, as trustee (the “Trustee”), as supplemented by the First Supplemental Indenture, dated June 16, 2016 (the “First
Supplemental Indenture”), among the Issuer, the guarantors party thereto and the Trustee, (the Base Indenture, as amended by the First Supplemental Indenture, the “Indenture”), (a) the due and punctual payment of the
principal of, and premium, if any, and interest on the Notes, when and as the same shall become due and payable, whether at maturity, by acceleration or otherwise, the due and punctual payment of interest on overdue principal of, and premium and, to
the extent permitted by law, interest, and the due and punctual performance of all other obligations of the Issuer to the holders or the Trustee, all in accordance with the terms set forth in Article Seven of the First Supplemental Indenture,
and (b) in case of any extension of time of payment or renewal of any Notes or any of such other obligations, that the same will be promptly paid in full when due or performed in accordance with the terms of the extension or renewal, whether at
stated maturity, by acceleration or otherwise, all in accordance with the terms set forth in Article Seven of the First Supplemental Indenture. 

The obligations of the Guarantors to the holders and to the Trustee pursuant to this Guarantee and the Indenture are expressly set forth in
Article Six of the First Supplemental Indenture, and reference is hereby made to the Indenture for the precise terms and limitations of this Guarantee. Each holder of the Note to which this Guarantee is endorsed, by accepting such Note, agrees to
and shall be bound by such provisions. 
 [Signatures on Following Pages] 

 IN WITNESS WHEREOF, each of the Guarantors has caused this Guarantee to be signed by a duly
authorized officer. 
  

			
	 BATH & BODY WORKS BRAND MANAGEMENT, INC.

	BATH & BODY WORKS DIRECT, INC.
	BATH & BODY WORKS, LLC
	BEAUTYAVENUES, LLC
	INTIMATE BRANDS, INC.
	INTIMATE BRANDS HOLDING, LLC
	L BRANDS DIRECT FULFILLMENT, INC.
	L BRANDS SERVICE COMPANY, LLC
	 L BRANDS STORE DESIGN & CONSTRUCTION, INC.

	LA SENZA, INC.
	MAST INDUSTRIES, INC.
	 VICTORIA’S SECRET DIRECT BRAND MANAGEMENT, LLC

	 VICTORIA’S SECRET STORES BRAND MANAGEMENT, INC.

	VICTORIA’S SECRET STORES, LLC
		
	By:	 	  

		 	Name:
		 	Title:

  
 -2-Exhibit 10.1

 Execution Copy

TRANSITION SERVICES AGREEMENT

This TRANSITION SERVICES AGREEMENT (this "Agreement") is made as of June !5, 2016 between Higher One, Inc., a Delaware corporation ("Seller") and Customers Bank, a bank chartered under the laws of the Commonwealth of Pennsylvania ("Buyer"). Seller and Buyer are referred to herein collectively as the "Parties" and individually as a "Party."

INTRODUCTION

WHEREAS, Seller and Buyer have entered into an Asset Purchase Agreement, dated as of December 15, 2015 (the "Purchase Agreement") (capitalized terms not defined in this Agreement shall have the meanings indicated in the Purchase Agreement);

WHEREAS, under the Purchase Agreement, Buyer has agreed to purchase from Seller certain assets related to Seller's business of disbursing refunds for its higher education institutional clients and servicing student-oriented checking accounts for the students of those clients (the "Business"), and the Purchase Agreement contemplates that the Parties shall execute and deliver this Agreement at the Closing; and

WHEREAS, Buyer and Seller desire that, after the Closing, Seller and/or certain of its Affiliates shall provide to Buyer, and Buyer and/or certain of its Affiliates shall provide to Seller, certain services on a transitional basis, as set forth herein.

NOW, THEREFORE, in consideration of the promises and covenants set forth herein and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree as follows:

ARTICLE I

 TRANSITION SERVICES

Section 1.1                          Transition Services.

(a)            Scope and Duration of Seller Transition Services. Seller, itself and/or by and through its Affiliates, and its and their respective employees, agents or contractors, shall provide or cause to be provided to Buyer, solely for the benefit of Buyer, those services set forth on Annex A hereto, as it may be amended from time to time by mutual written agreement of the Parties (collectively, the "Seller Transition Services") until the earlier of (i) expiration of the service period applicable to such Transition Services as set forth with respect to each applicable Seller Transition Service on Annex A hereto, or (ii) expiration of the Term (as defined below). Seller shall not be obligated to provide any services other than the Seller Transition Services expressly provided herein. Seller shall not be required to perform Seller Transition Services hereunder in any manner that violates any applicable law or regulation. It is acknowledged by Seller that the objective of this Agreement is to obligate Seller to provide, throughout the Term, any and all services and functions that Buyer is unable to perform with respect to the assets purchased and employees hired pursuant to the Purchase Agreement in order for the Business to perform at a comparable level of operation and functionality achieved during the 180 days prior to the closing under the Purchase Agreement.  In addition, Seller shall provide consulting services to Buyer related to the One Account structure and operation, marketing and managing relationships with colleges and universities, regulatory compliance matters, Department of Education introductions and relationship advice, product pricing matters, and contractual matters (with vendors as well as colleges and universities).

 

 

1

 

(b)            Scope and Duration of Buyer Transition Services. Buyer, itself and/or by and through its Affiliates, and its and their respective employees, agents or contractors, shall provide or cause to be provided to Seller, solely for the benefit of Seller, those services set forth on Annex B hereto, as it may be amended from time to time by mutual written agreement of the Parties (collectively, the "Buyer Transition Services", and together with the Seller Transition Services, the "Transition Services") until the earlier of (i) expiration of the service period applicable to such Buyer Transition Services as set forth with respect to each applicable Buyer Transition Service on Annex B hereto, or (ii) expiration of the Term (as defined below).

(c)            Modified Transition Services. Any modifications to the Transition Services shall be subject to mutual agreement pursuant to ARTICLE IX hereof.

(d)            Subcontractors. Upon prior consent of the other Party, which consent shall not be unreasonably withheld, conditioned or delayed, Seller or Buyer may subcontract with an unaffiliated third party (a "Subcontractor") to provide any Transition Services; provided that no notice shall be required with respect to the continued use of subcontractors in the manner utilized by Seller in connection with the Business immediately prior to the Closing, or with respect to changes in subcontractors which are consistent with Seller's operation of the Business immediately prior to the Closing.  Notwithstanding any subcontracting of Seller's or Buyer's obligations under this Agreement, each Party shall, for the term of this Agreement, remain primarily liable for the delivery and performance of the Transition Services.

Section 1.2                          Service Coordinators and Issue Resolution.

(a)            Seller and Buyer each hereby appoint as service coordinators their respective employees identified on Schedule 1.2 hereto (each, a "Service Coordinator") to be the primary point of contact between Seller and Buyer with respect to the Transition Services, including, and subject to the terms of this Schedule 1.2, with respect to disputes between the Parties arising out of or relating to this Agreement or the provision of Transition Services hereunder. Each Party shall have the right, upon reasonable advance written notice to the other Party, to replace its Service Coordinator with an employee or officer of such Party with comparable knowledge, expertise and decision-making authority.

(b)            In the event the Service Coordinators fail to resolve any dispute arising between the Parties in connection with the Transition Services within a reasonable time of receiving notice of such dispute from a Party, and in any event within ten (10) Business Days of such notification, then Buyer shall designate an officer or officers holding the office of Senior Vice President (or equivalent office) or above (such officers, the "Senior Officers") and such Senior Officers shall attempt in good faith to conclusively resolve any such dispute (i) with the members of an operating committee designated by Seller, and (ii) in the event the Senior Officers and operating committee fail to resolve the dispute, an executive committee shall be designated by Seller and Buyer. If the Senior Officers and the operating and executive committees designated by Seller and Buyer cannot resolve such dispute within a reasonable period of time, and in any event within twenty (20) Business Days of the referral of such dispute to them, either Party may submit the dispute to litigation as provided for in Section 10.8.

(c)            Any dispute arising out of or relating to this Agreement shall be submitted for resolution pursuant to this Section 1.2 before any Party may commence any legal proceeding in connection therewith. A Party's failure to comply with the preceding sentence shall constitute cause for the dismissal without prejudice of any such legal proceeding. This Section 1.2(c) is without prejudice to either Party's right to seek interim relief against the other Party (such as an injunction) to protect its rights and interests, or to enforce the obligations of the other Party and the parties need not negotiate disputes with respect to equitable remedies prior to seeking relief from a court of competent jurisdiction.

 

 

2

 

Section 1.3                          Migration Plan.

(a)            On or prior to the date hereof, the Parties shall have negotiated and materially finalized a plan to transition from the performance of the Seller Transition Services by Seller and its Affiliates to the performance of such services by Buyer, including moving the information technology systems and data used in the Business from Seller's infrastructure to Buyer's or its designee's infrastructure ("Migration") (such plan, the "Migration Plan"). The Migration Plan shall include a governance and arbitration process, in which both Parties shall agree to participate, which shall be subject to the change control process set forth in ARTICLE IX.

(b)            Buyer shall be responsible for the Migration, including the construction and deployment of any systems or physical space required for the Migration. Seller shall use commercially reasonable efforts to assist Buyer in completing the Migration. Buyer shall be responsible for all fees and expenses incurred by Buyer and reasonable out-of-pocket third party costs of Seller incurred in the course of providing any assistance with the Migration requested by Buyer.

(c)            The Parties acknowledge that the Migration Plan is a document that may change, and any such material changes will be subject to the change control process set forth in ARTICLE IX. Each Party shall use its commercially reasonable efforts to perform its obligations under the Migration Plan according to the schedule set forth in the Migration Plan, and each Party shall use sufficient and qualified resources and personnel to implement the Migration Plan, taking into account the need to reasonably manage the cost of such transition and minimize the disruption to the ongoing business activities of the Parties.

Section 1.4                          Additional Transition Services. If requested by either Party, the other Party shall provide services in addition to the Transition Services ("Additional Transition Services"), as may be agreed pursuant to the Change Control process set forth in ARTICLE IX. The scope of any such Additional Transition Services, as well as the prices and other terms applicable to such additional services, shall be as mutually agreed by Buyer and Seller, as further contemplated by ARTICLE IX.

Section 1.5                          Standard of Performance. Each Party shall use commercially reasonable efforts to perform or procure the provision of the Transition Services for the other Party to standards of performance comparable in all material respects to which such Transition Services were performed by Seller or its Affiliates in connection with the Business immediately prior to Closing; provided that Seller shall not be responsible for the performance of any product programs or features developed and/or implemented by Buyer after the Closing Date.

Section 1.6                          Access. Each Party shall use good faith efforts to provide the other Party with access to information and computer systems, facilities, networks (including voice or data networks) or software to the extent reasonably necessary to enable the provision of Transition Services contemplated by this Agreement, subject to Section 7 hereof. The Party requesting access shall give the other Party reasonable prior written notice and justification of the need for such access.

Section 1.7                          Independent Contractor. For all purposes hereof, each Party shall at all times act as an independent contractor and shall have no authority to represent the other Party in any way or otherwise be deemed an agent, lawyer, employee, representative, joint venturer or fiduciary of such other Party nor shall this Agreement or the transactions contemplated hereby be deemed to create any joint venture between the Parties. Each Party shall not declare or represent to any third party that such Party shall have any power or authority to negotiate or conclude any agreement, or to make any representation or to give any undertaking on behalf of the other Party in any way whatsoever.

 

 

3

 

ARTICLE II

 SERVICE FEES AND EXPENSES

Section 2.1                          Service Fees.

(a)            Subject to adjustment in accordance with this Section 2.1, Buyer shall pay a fee for the Seller Transition Services and Additional Transition Services it receives during the Term as follows (collectively, the "Buyer Service Fees"):

(i)            with respect to the Seller Transition Services, $5,000,000, payable in twelve (12) equal monthly instalments of $416,666.67, each of which shall be due and payable on the fifteenth (15th) day of each month; and

(ii)            with respect to any Additional Transition Services provided by Seller, on the timetable and in the amount agreed by the Parties and set out in the executed amendment to this Agreement under which such Additional Transition Services are provided as contemplated in Article IX.

(b)            Subject to adjustment in accordance with this Section 2.1, Seller shall pay a fee (the "Seller Service Fee", and together with the Buyer Service Fees, the "Service Fees") for the Additional Transition Services it receives from Buyer during the Term on the timetable and in the amount agreed by the Parties and set out in the amendment to this Agreement under which such Additional Transition Services are provided, which shall be entered into in accordance with ARTICLE IX.

(c)            The Service Fees are exclusive of any sales tax, transfer tax, value-added tax, goods and services tax or similar tax ("Taxes"). Any Taxes (but excluding any Tax based upon net income) payable with respect to the Service Fees shall be invoiced by the Party providing such services (the "Providing Party") and paid to such Party by the other Party (the "Receiving Party") within thirty (30) days of receipt of such invoice. The Party providing the service shall be responsible for remitting any such Taxes to the appropriate taxing authority.

(d)            If the cost to either Party of providing a Transition Service increases as a result of actions taken outside the scope of this Agreement by or at the request of the Receiving Party or as a result of any change in applicable law or regulation or action of any Government Entity (collectively, "Imposed Changes"), then the resulting increase in costs will be passed through to the Receiving Party by means of an increase in the relevant Service Fees in the amount of such actual increase in the cost of the provision of such Transition Services, plus any direct, out of pocket, up-front costs of modifying the Transition Services as a result of such Imposed Changes, provided, however, that (i) in no event shall the Party providing the service be obligated to perform any service hereunder other than in accordance with applicable law and regulation, and (ii) the Party providing the service shall not be obligated to perform such Service unless the Receiving Party agrees to pay such costs of modifying the Transition Services to comply with such Imposed Changes and such increased Service Fees.

Section 2.2                          Expenses. The Party receiving services shall be responsible for any direct third-party out-of-pocket costs or expenses incurred by the Party providing the services and disclosed in writing to the other Party prior to the date of this Agreement in connection with providing the Transition Services.

Section 2.3                          Records. Each Party shall maintain records of all receipts, invoices, reports and other documents relating to the Transition Services rendered hereunder in accordance with applicable law and regulation and its standard accounting practices and procedures, which practices and procedures are employed by such Party in its provision of services for itself and its Affiliates.

 

 

4

 

ARTICLE III

PAYMENT

Section 3.1                          Invoicing and Payment. For the Transition Services described on Annex A on the date hereof, Buyer shall pay the net monthly fees set forth in Section 2.1 on or before each due date for such fee, without an invoice from Seller. For any Additional Transition Services, the net monthly fee shall be adjusted and paid by Buyer in accordance with the executed amendment to this Agreement under which such Additional Transition Services are provided. For any third-party expenses incurred by either Party in connection with providing the Transition Services and payable by Receiving Party in accordance with Section 2.2 hereof, Providing Party shall invoice Receiving Party, and Receiving Party shall remit payment to Providing Party for all such invoiced expenses within thirty (30) calendar days after receipt of each such invoice. Any undisputed amount unpaid after the expiration of thirty (30) calendar days after the due date shall bear interest equal to one-half percent (0.5%) per month of the overdue amount. Each invoice for expenses shall set forth in reasonable detail, for the period covered by such invoice, the source of the expenses incurred.

Section 3.2                          No Set Off. Buyer shall not have the right to set off any claims of damages, under this Agreement, the Purchase Agreement or any other arrangement between Buyer and Seller, against payments owed under this Agreement with the exception of costs incurred under Section 2.2.

ARTICLE IV

TRANSITION

Section 4.1                          Return of Materials. Promptly at the end of the service period with respect to a Transition Service, at the end of the Term or upon termination of this Agreement in accordance with ARTICLE VI, as the case may be, the Receiving Party shall, at the other party's expense and written direction, return or destroy and certify the return or destruction of, any and all of the other Party's books, records, files, databases, intellectual property (including embodiments thereof), Confidential Information (as defined below) or information related to customer data in the possession, custody or control of the Receiving Party (the "Materials"); provided that a Receiving Party shall be permitted to retain one copy of the Materials solely as required in order to comply with applicable law and regulation, or for audit, compliance or regulatory purposes to the extent permitted by applicable law and regulation; and provided, further, that a Receiving Party shall not be obligated to destroy any Materials if such destruction would, in the reasonable opinion of counsel to such Receiving Party, constitute a violation of applicable law or regulation.

ARTICLE V

 INTELLECTUAL PROPERTY

Section 5.1                          Title to Intellectual Property.

(a)            Each of the Parties agrees that any intellectual property of the other Party made available to it in connection with the Transition Services, and any derivative works, additions, modifications or enhancements thereof created by the other Party pursuant to this Agreement, are and shall remain the sole property of the other Party, and such Party hereby irrevocably assigns any and all right, title and interest therein to such other Party. Each Party agrees not to use, and to cause its Affiliates not to use, intellectual property of the other Party for any purpose other than in connection with the performance of the Transition Services during the Term.

(b)            Each Party acknowledges that the other Party may be providing services similar to the Transition Services to its own businesses and/or to other third parties during the Term, without restriction hereunder.

Section 5.2                          Use of Trademarks. Except as expressly set forth in the Purchase Agreement, neither Party shall use the other Party's trademarks, service marks, trade names, domain names or other source identifiers without such Party's prior written consent.

Section 5.3                          Software Licenses and Data Subscriptions. Except as provided in the Purchase Agreement or as set forth on Schedule 5.3 hereto, Seller and its Affiliates shall not be required to transfer or assign to Buyer any third-party software licenses, data subscriptions or any software or hardware owned by Seller or any of its Affiliates in connection with the provision of the Seller Transition Services.

 

 

5

 

ARTICLE VI

 TERM AND TERMINATION

Section 6.1                          Term. The term of this Agreement (the "Term") shall commence on the Closing and continue from the Closing Date until June 30, 2017 (the "Termination Date"); provided that the Term of any individual Transition Service may be for a shorter period of time as may be set forth on Annex A hereto or as mutually agreed by the parties in writing.

Section 6.2                          Termination for Cause. Either Party (the "Terminating Party") may terminate this Agreement with immediate effect by notice in writing to the other Party (the "Other Party") on or at any time after the occurrence of any of the following events:

(a)            the Other Party is in default of any of its material obligations under this Agreement and (if the breach is capable of remedy) has failed to remedy the breach within thirty (30) days after receipt of notice in writing from the Terminating Party giving particulars of the breach;

(b)            the Other Party shall commence a voluntary case or other proceeding seeking liquidation, reorganization or other relief with respect to itself or its debts under any bankruptcy, insolvency or other similar law now or hereafter in effect or seeking the appointment of a trustee, receiver, liquidator, custodian or other similar official for it or any substantial part of its property, or shall consent to any such relief or to the appointment of or taking possession by any such official in an involuntary case or other proceeding commenced against it, or shall make a general assignment for the benefit of creditors, or shall fail generally to pay its debts as they become due, or shall take any corporate action to authorize any of the foregoing;

(c)            an involuntary case or other proceeding shall be commenced against the Other Party seeking liquidation, reorganization or other relief with respect to it or its debts under any bankruptcy, insolvency or other similar law now or hereafter in effect or seeking the appointment of a trustee, receiver, liquidator, custodian or other similar official for it or any substantial part of its property, and such involuntary case or other proceeding shall remain undismissed and unstayed for a period of sixty (60) days.

Section 6.3                          Survival. Section 2.2 (Expenses), Section 2.3 (Records), ARTICLE III (Payments)(to the extent such fees accrued prior to termination, cancellation or expiration), Section 4.1 (Return of Materials), Section 5.1 (Intellectual Property), this Section 6.3 (Survival), Section 7.1 (Confidentiality), Section 8.2 (Limitations of Liability) and Article X (Miscellaneous) shall survive any termination or expiration of this Agreement.

ARTICLE VII

 CONFIDENTIALITY

Section 7.1                          Confidentiality.

(a)            Each Party acknowledges that, in connection with the performance by a Party of its obligations hereunder, such Party may be provided with information about confidential and proprietary information of the other Party and third parties with which the other Party conducts business. The confidential information of such other Party and third parties is defined below and is collectively referred to as "Confidential Information." In recognition of the foregoing, each Party covenants and agrees:

(i)            that it will keep and maintain all Confidential Information in confidence, using such degree of care as is appropriate to avoid unauthorized use or disclosure;

(ii)            that it will not, directly or indirectly, disclose any Confidential Information to anyone outside of the other Party, except with the other Party's prior written consent or as may be permitted under this Article VII;

(iii)            that such Party will not make use of any Confidential Information for its own purpose or the benefit of anyone or any other entity other than the other Party, provided that Buyer can make use of any Confidential Information related to the Business in its operation of the Business; and

(iv)            that such Party will take no action with respect to the Confidential Information that is inconsistent with its confidential and proprietary nature.

(b)            Each Party shall be permitted to disclose the Confidential Information only as follows:

(i)            to its employees, agents, auditors, counsel, directors, officers and contractors ("Related Parties") and Subcontractors, having a need to know such information in connection with the performance of the Transition Services. Each Party shall be responsible for all its Related Parties and Subcontractors' compliance with the terms of this Agreement; and

(ii)            if disclosure is required by applicable law or regulation, provided that a Party shall notify the other Party in writing as soon as reasonably practicable in advance of such disclosure, and provide the other Party with copies of any related information so that the other Party may take appropriate action to protect the Confidential Information.

 

 

6

 

(c)            For purposes of this Agreement, Confidential Information shall include all business information of the other Party, including the following:

(i)            information relating to the other Party's planned or existing computer systems and systems architecture, including computer hardware, computer software, source code, object code, documentation, methods of processing and operational methods;

(ii)            sales, profits, organizational restructuring, new business initiatives and financial information;

(iii)            information that describes the other Party's products, including product designs, and how such products are administered and managed;

(iv)            information that describes the other Party's product strategies, tax interpretations, tax positions and treatment of any item; and

(v)            confidential information and software of, and contracts with (and any information related thereto), third parties with which the other Party conducts business.

(d)            Notwithstanding the foregoing, Confidential Information shall not include information that (i) is or becomes generally available to the public other than as a result of a disclosure directly or indirectly by a Party or its Related Parties or Subcontractors, (ii) was available to a Party on a non-confidential basis prior to its disclosure to such Party by the other Party or the other Party's Related Parties or Subcontractors or (iii) is or becomes available on a non-confidential basis to a Party from a Person other than the other Party, provided that such Person was not known to the receiving Party to be bound by any agreement with the disclosing Party to keep such information confidential or to be otherwise prohibited from transmitting the information. Each Party acknowledges that the disclosure of Confidential Information may cause irreparable injury and damages, that money damages would not be a sufficient remedy for any actual or threatened disclosure and that a Party shall (without proof of actual damages) be entitled to equitable relief, including an injunction and specific performance, as a remedy if the other Party breaches or threatens to disclose Confidential Information in violation hereof. A breaching Party shall not object to the entry of an injunction or other equitable relief against such Party on the basis that an adequate remedy is available at law or lack of irreparable harm. Without limitation of the foregoing, each Party shall advise the other Party promptly in the event that it learns or has reason to believe that any person or entity, which has had access to Confidential Information, has violated or intends to violate the terms of this Agreement. This provision shall not in any way limit such other remedies as may be available to either Party at law or in equity.

(e)            With regard to any Confidential Information of the type specified in Section 7.1(c)(v), each Party agrees to execute any commercially reasonable document or take any commercially reasonable action required by any vendor or licensor of software to the other Party in order to access and use such vendor's software in connection with such vendor's contracts with the other Party.

Section 7.2                          Systems Security. When Buyer is given access to Seller's computer system(s), facilities, networks (including voice or data networks) or software ("Systems") in connection with the Seller Transition Services or Migration Plan, Buyer shall comply with all lawful security regulations reasonably required by Seller from time to time "Security Regulations"), including without limitation the requirements set forth on Annex C hereto, and will not tamper with, compromise or circumvent any security or audit measures employed by Seller. Buyer's Related Parties may be required to execute a separate system access agreement for individuals who are to have access to Seller's Systems. Buyer shall ensure that only those users who are specifically authorized to gain access to Seller's Systems as necessary to utilize the Seller Transition Services or assist with the Migration gain such access and that such users do not engage in unauthorized destruction, alteration or loss of information contained therein. If at any time a Party determines that any personnel of Buyer has sought to circumvent or has circumvented Seller's Security Regulations or other security or audit measures or that an unauthorized person has accessed or may access Seller's Systems or a person has engaged in activities that may lead to the unauthorized access, destruction or alteration or loss of data, information or software, to the extent within Buyer's control, Buyer or Seller, as appropriate, shall immediately terminate any such person's access to Seller's Systems and immediately notify Seller. In addition, a material failure to comply with the Security Regulations shall be a breach of this Agreement; in which case, Seller shall notify Buyer and both Parties shall work together to rectify said breach. If the breach is not rectified within ten (10) days of its occurrence, the Service Coordinators of both Parties shall be advised in writing of the breach and work together to rectify said breach. If the breach has not been rectified within ten (10) days from such notice to the Service Coordinators, Seller shall be entitled to immediately terminate the Seller Transition Services to which the breach relates until such time as the breach is remedied.

Section 7.3                          Insurance. To the extent it has not already done so, Buyer and Seller each shall obtain, within ninety (90) days of the date hereof, from a financially sound and reputable insurer, cyber security and data breach liability insurance in an amount equal to at least $10,000,000 on terms and conditions reasonably satisfactory to the other Party, and will cause such insurance policy to be maintained until the Termination Date.

 

 

7

 

ARTICLE VIII

 REPRESENTATIONS AND WARRANTIES

Section 8.1                          Representations and Warranties.

(a)            Each Party represents and warrants that, on the Closing Date, it has the authority to enter into this Agreement and its performance under this Agreement will not conflict with any other obligation or agreement of such Party.

(b)            Except as expressly provided in this Agreement, no representation, warranty or condition, express or implied, statutory or otherwise, as to condition, quality, satisfactory quality, performance or fitness for purpose or otherwise is given by either Seller or Buyer and all such representations, warranties and conditions are excluded except to the extent that their exclusion is prohibited by applicable law.

Section 8.2                          Limitations of Liability.

(a)            THE AGGREGATE LIABILITY OF EITHER PARTY IN CONNECTION WITH THE PERFORMANCE, DELIVERY OR PROVISION OF THE TRANSITION SERVICES UNDER THIS AGREEMENT SHALL, WITH THE EXCEPTION OF A DATA BREACH, BE LIMITED TO $2,500,000 CUMULATIVELY.

(b)            EXCEPT FOR DAMAGES ARISING FROM THE GROSS NEGLIGENCE OR WILFUL MISCONDUCT OF SELLER, THE PARTIES EXPRESSLY WAIVE AND FOREGO ANY RIGHT TO RECOVER EXEMPLARY, LOST PROFITS, CONSEQUENTIAL OR SIMILAR DAMAGES IN ANY LITIGATION ARISING OUT OF OR RESULTING FROM ANY CONTROVERSY OR CLAIM RELATING TO THIS AGREEMENT OR ANY OF THE TRANSITION SERVICES PROVIDED HEREUNDER, WHETHER SUCH CLAIM IS BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE OR STRICT LIABILITY) OR OTHERWISE, EVEN IF AN AUTHORIZED REPRESENTATIVE OF SUCH PARTY IS ADVISED OF THE POSSIBILITY OR LIKELIHOOD OF THE SAME.

ARTICLE IX

 CHANGE CONTROL

Section 9.1                          Change Control.

(a)            Subject to this Article IX, either Party may propose any change or addition to the Transition Services by written notice to the other Party specifying the proposed change in reasonable detail (such notice, a "Change Request").

(b)            Seller or Buyer shall provide the other Party with a reasonably detailed written outline specification describing the nature of the change, an assessment of the impact of the change on the Transition Services, the Service Fees (as applicable) and an estimate of the time required to implement the change, the costs associated with the change and the terms for payment of such costs (such outline, an "Evaluation Report") within twenty (20) Business Days of receiving the Change Request.

(c)            The approving Party shall notify the requesting Party within ten (10) Business Days of the date on which the Evaluation Report was received whether or not the approving Party wishes to proceed with the Change Request; provided, however, that the Parties shall in good faith negotiate the terms and pricing of the Change Request before the requesting Party provides such notice to proceed.

(d)            Within ten (10) Business Days of receipt of the requesting Party's notice to proceed with the Change Request, the approving Party shall produce a final Evaluation Report which shall include a comprehensive list of the charges for the implementation of the Change Request ("Change Request Charges"). Any Change Request Charges shall be calculated in a manner consistent with Section 2.1.

 

 

8

 

(e)            Both the Seller and Buyer shall act in good faith in relation to Change Requests, and shall not unreasonably withhold any consent, or cause any delay in relation to them; provided that, notwithstanding anything to the contrary herein, the approving Party shall have sole discretion regarding whether to provide Additional Transition Services which were not performed by Seller or Buyer for the Business at any time during the one hundred eighty (180) day period prior to Closing. If the Seller and Buyer cannot agree upon a Change Request or the approving Party's final Evaluation Report (including the Change Request Charges), each of the Seller and Buyer may refer the matter to be resolved in accordance with Section 1.2.

(f)            The Seller shall not have any obligation to commence work in connection with any change to the approving Party Transition Services or any Additional Transaction Services until the relevant Change Request and Evaluation Report has been agreed to by each Party in writing.

ARTICLE X

 MISCELLANEOUS

Section 10.1                          No Third Party Beneficiaries. This Agreement shall not confer any rights or remedies upon any Person other than the Parties and their respective successors and permitted assigns and, to the extent specified herein, their respective Affiliates.

Section 10.2                          Entire Agreement. This Agreement (including the Annexes and Schedule hereto), together with the Purchase Agreement and any other documents delivered by the Parties in connection herewith or therewith, constitutes the entire agreement between the Parties with respect to the subject matter hereof and thereof and supersede any prior agreements or understandings between the Buyer, on the one hand, and the Seller, on the other hand.

Section 10.3                          Notices. All notices, requests, demands, claims and other communications hereunder shall be in writing. Any notice, request, demand, claim or other communication hereunder shall be deemed duly delivered four (4) Business Days after it is sent by registered or certified mail, return receipt requested, postage prepaid, or one (1) Business Day after it is sent for next Business Day delivery via a reputable nationwide overnight courier service, in each case to the intended recipient as set forth below:

	
If to the Buyer:

 

1015 Penn Avenue, Suite 103

Wyomissing, PA  19610

Attention:  Robert Wahlman,

                    Chief Financial Officer

E-mail:            rwahlman@customersbank.com

 

	
Copy to:

 

Stradley Ronon Stevens & Young, LLP

2600 One Commerce Square

Philadelphia, PA 19103

Attention:  Christopher S. Connell, Esquire

Facsimile:    215-564-8120

E-mail:             cconnell@stradley.com

 

	
If to the Seller:

 

Higher One, Inc.

115 Munson St.

New Haven, CT 06511

Attention:  Christopher Wolf, Executive

                    VP and Chief Financial Officer

Email: christopher.wolf@higherone.com

 

	
Copies to:

 

Wiggin and Dana LLP

One Century Tower

265 Church Street

New Haven, CT 06508

Attention: Paul Hughes

Email: phughes@wiggin.com

 

 

 

9

 

Any Party may give any notice, request, demand, claim, or other communication hereunder using any other means (including personal delivery, expedited courier, messenger service, ordinary mail, or electronic mail), but no such notice, request, demand, claim or other communication shall be deemed to have been duly given unless and until it actually is received by the party for whom it is intended. Any Party may change the address to which notices, requests, demands, claims and other communications hereunder are to be delivered by giving the other Parties notice in the manner herein set forth.

Section 10.4                          Amendment; Waiver. Subject to ARTICLE IX and Sections 1.4 and 10.10, any provision of this Agreement may be amended or waived if, and only if, such amendment or waiver is in writing and signed, in the case of an amendment, by both Parties, or in the case of a waiver, by the Party against whom the waiver is to be effective. No failure or delay by any Party in exercising any right, power or privilege hereunder shall operate as a waiver thereof nor shall any single or partial exercise thereof preclude any other or further exercise thereof or the exercise of any other right, power or privilege.

Section 10.5                          Severability. Any term or provision of this Agreement that is invalid or unenforceable in any situation in any jurisdiction shall not affect the validity or enforceability of the remaining terms and provisions hereof or the validity or enforceability of the offending term or provision in any other situation or in any other jurisdiction. If the final judgment of a court of competent jurisdiction declares that any term or provision hereof is invalid or unenforceable, the Parties agree that the body making the determination of invalidity or unenforceability shall have the power to reduce the scope, duration or area of the term or provision, to delete specific words or phrases, or to replace any invalid or unenforceable term or provision with a term or provision that is valid and enforceable and that comes closest to expressing the intention of the invalid or unenforceable term or provision, and this Agreement shall be enforceable as so modified.

Section 10.6                          Binding Agreement; Assignment. No Party may assign either this Agreement or any of its rights, interests, or obligations hereunder without the prior written approval of the other Party, which written approval shall not be unreasonably withheld, delayed or conditioned. Notwithstanding the foregoing, this Agreement, and all rights, interests and obligations hereunder, may be assigned, without such consent, by either Party to an Affiliate thereof or an entity that acquires all or substantially all of such Party's or such Affiliate's business or assets. This Agreement shall be binding upon and inure to the benefit of the Parties and their respective successors and permitted assigns.

Section 10.7                          Governing Law. This Agreement and any disputes hereunder shall be governed by and construed in accordance with the internal laws of the State of New York without giving effect to any choice or conflict of law provision or rule (whether of the State of New York or any other jurisdiction) that would cause the application of laws of any jurisdiction other than those of the State of New York.

Section 10.8                          Submission to Jurisdiction. Subject to Section 1.2 hereof, each of the Parties to this Agreement (a) agrees that all actions arising out of or relating to this Agreement or any of the transactions contemplated by this Agreement shall be heard and determined in the Federal Courts of the United States of America or the courts of the State of New York, in each case located in the City of New York and County of New York, (b) irrevocably consents to submit itself to the exclusive jurisdiction and venue of such courts in any action, (c) agrees that all claims in respect of such action shall be heard and determined in any such court, (d) agrees that it shall not attempt to deny or defeat such personal jurisdiction by motion or other request for leave from any such court, and (e) agrees not to bring any action arising out of or relating to this Agreement or any of the transactions contemplated by this Agreement in any other court. Each of the Parties hereto waives any defense of inconvenient forum to the maintenance of any action so brought and waives any bond, surety or other security that might be required of any other Party with respect thereto. Any Party hereto may make service on another Party by sending or delivering a copy of the process to the Party to be served at the address and in the manner provided for the giving of notices in Section 10.3. Nothing in this Section 10.8, however, shall affect the right of any Party to serve legal process in any other manner permitted by law.

Section 10.9                          Waiver of Jury Trial. To the extent permitted by applicable law, each Party hereby irrevocably waives all rights to trial by jury in any action (whether based on contract, tort or otherwise) arising out of or relating to this Agreement or the transactions contemplated hereby or the actions of any Party in the negotiation, administration, performance and enforcement of this Agreement. Each Party (a) certifies that no Representative of the other Party has represented, expressly or otherwise, that such Party would not, in the event of any action, seek to enforce the foregoing waiver and (b) acknowledges that it and the other Party have been induced to enter into this Agreement, by among other things, the mutual waiver and certifications in this Section 10.9.

 

 

10

 

Section 10.10                                        Force Majeure. If either Party is prevented from complying, either totally or in part, with any of the terms or provisions of this Agreement by reason of fire, flood, storm, strike, lockout or other labor trouble, any law, order, proclamation, regulation, ordinance, demand or requirement of any governmental authority, riot, war, terrorist act, rebellion or other causes beyond the reasonable control of such Party, or other acts of God (a "Force Majeure Event"), then, upon written notice to the other, the affected provisions and/or other requirements of this Agreement shall be suspended or reduced by an amount consistent with reductions made to the other operations of such Party affected by the Force Majeure Event during the period of such disability and the affected Party shall have no liability to the other in connection therewith. Each Party shall use reasonable commercial efforts to remove such disability within fifteen (15) days of giving notice of such disability.

Section 10.11                                        Mutual Drafting. This Agreement is the mutual product of the Parties, and each provision hereof has been subject to the mutual consultation, negotiation and agreement of each of the Parties, and shall not be construed for or against any Party. Each Party acknowledges and represents that it has been represented by its own legal counsel in connection with the transactions contemplated hereby, with the opportunity to seek advice as to its legal rights from such counsel.

Section 10.12                                        Headings. The headings in this Agreement are for convenience of reference only and will not affect the construction of any provisions hereof.

Section 10.13                                        Conflicts. To the extent any term or provision of the Purchase Agreement, or any other document or other agreement executed in connection with the Purchase Agreement, is in conflict with any term or provision of this Agreement or any Annex or Schedule hereto, the terms and provisions of this Agreement and the Annexes or Schedules hereto shall govern solely to the extent of any such conflict. To the extent any term or provision of this Agreement is in conflict with any term or provision of any Annex or Schedule hereto, the terms and provisions of the Annex or Schedule hereto shall govern solely to the extent of any such conflict.

Section 10.14                                        Counterparts and PDF Signature. This Agreement may be signed in any number of counterparts, each of which shall be an original, with the same effect as if the signatures thereto and hereto were upon the same instrument. The electronic transmission of any signed original counterpart of this Agreement shall be deemed to be the delivery of an original counterpart of this Agreement.

Section 10.15                                        Interpretation. For purposes of this Agreement, (a) the words "include," "includes" and "including" shall be deemed to be followed by the words "without limitation"; (b) the word "or" is not exclusive; and (c) the words "herein," "hereof," "hereby," "hereto" and "hereunder" refer to this Agreement as a whole. Unless the context otherwise requires, references herein: (x) to Articles, Sections, Schedules and Exhibits mean the Articles and Sections of, and Schedules and Exhibits attached to, this Agreement; (y) to an agreement, instrument or other document means such agreement, instrument or other document as amended, supplemented and modified from time to time to the extent permitted by the provisions thereof and (z) to a statute means such statute as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder. This Agreement shall be construed without regard to any presumption or rule requiring construction or interpretation against the Party drafting an instrument or causing any instrument to be drafted. The Schedules and Exhibits referred to herein shall be construed with, and as an integral part of, this Agreement to the same extent as if they were set forth verbatim herein.

[End of Text; Signature Page Follows]

 

 

11

 

IN WITNESS WHEREOF, the Parties hereto have executed this Transition Services Agreement as of the date first written above.

	 	
HIGHER ONE, INC.

	 	 
	 	 
	 	 
	 	
By: /s/ Marc Scheinbaum

	 	
Name: Marc Scheinbaum

	 	
Title: President  & CEO

	 	 
	 	 
	 	 
	 	
CUSTOMERS BANK

	 	 
	 	 
	 	 
	 	 
	 	
By: /s/ Robert E. Wahlman

	 	
Name:  Robert E. Wahlman

	 	
Title:  Executive Vice President & CFO

 

 

 

  

 

ANNEXES

	
ANNEX A

	
SELLER TRANSITION SERVICES

	
ANNEX B

	
BUYER TRANSITION SERVICES

	
ANNEX C

	
HIGHERONE SECURITY REQUIREMENTS

 

 

 

 

 

 

SCHEDULE 1.2

SERVICE COORDINATORS

 

Seller

Services Coordinator:

Cozzell Wilson

Chief Information Officer

203-776-7776 ext 4599

Cozzell.wilson@higherone.com

Buyer

Services Coordinator:

Jack Allison

Chief Informaiton Officer – Bankmobile

1015 Penn Ave

Wyomissing, PA  19610

856-581-1197

jallison@bankmobile.com

 

 

 

 

ANNEX A

 TRANSITION SERVICES

Transition Services Agreement (TSA)

Annex A – Section 1

Information Technology

Scope of Services

Seller, itself and/or by and through its Affiliates, shall provide or cause to be provided to Buyer the following information technology services in the manner set forth below:

		·	Chennai Resources

		o	Provide engineering services relating to the Business furnished by personnel located in Chennai, India.

		o	Provide the Chennai resources listed below (the "Chennai Resources"):

 

	
Manoj Kumar Ramesh

	
Senior Quality Analyst

	
Quality Assurance

	
Saravan Kumar Ekambaram

	
Senior Quality Analyst

	
Quality Assurance

	
Tamil Selvan Mohan

	
Project Lead

	
Quality Assurance

	
Gavathri Selvam

	
Jr. Software Engineer

	
Quality Assurance

	
Aishwariya Kandaswamy

	
Technology Trainee

	
Quality Assurance

	
Dhanalakshmi Sekar

	
Technology Trainee

	
Quality Assurance

	
Bharathkumar Sainathan

	
Associate Project Lead

	
Mobile Development

	
Anandababu Sivaprakasam

	
Sr. Software Developer

	
Mobile Development

	
Varun Muthu

	
Sr. Quality Analyst

	
Mobile Development

	
Hari Babu Goggi

	
Lead Developer

	
OD/OA Development

	
Mahesh Perumal

	
Sr. Project Lead

	
OD/OA Development

	
Suresh Allareddy

	
Associate Project Lead

	
OD/OA Development

	
Jeevakumar Jenadoss

	
Lead Developer

	
OD/OA Development

	
Praveen Rajan

	
Sr. Software Developer

	
OD/OA Development

	 	 	 
	
; subject to the following terms: (i) from September 19, 2016 until December 31, 2016, the Chennai Resources will be provided at an additional cost to Buyer of $25,000 per month, (ii) the Chennai Resources will be provided to Buyer until December 31, 2016, provided that Buyer may extend the use of such resources until the Termination Date upon ninety (90) days' written notice to Seller, (iii) the Chennai Resources shall be directed by a Manager selected by Buyer, (iv) onsite support shall be provided by Bala Meenakshisundarm (or other person at the sole discretion of Seller),and (v) Seller will provide support to Buyer in connection with Buyer's efforts to fill any vacancies created as a result of attrition of the Chennai Resources.

 

 

 

A-1

 

		·	Consulting

		o	Provide up to 1600 "SME" consulting hours during the Term, not to exceed more than 140 hours per month. SME consulting hours are for consultation on the planning and design of Buyer's future operating environment. SME consulting hours are in addition to the hours required to support the tasks set forth below under the "Operations; IT Infrastructure" heading. Any consulting hours in excess of 1600 shall be provided upon Seller's written approval, at a mutually agreed upon price.

		·	Computers and Access

		o	Maintain ("break/fix") Transferred Employee computers, onsite and remote access, office phones, local and long distance service, print services and current network connectivity at current support levels for Seller employees; provided that Buyer shall be responsible for the replacement cost of any Transferred Employee or Other Transferred Employee computers or parts therefor. Changes to computers' configurations and installed software will not occur during the Term.

		o	Process new access/access change requests from Transferred Employees to systems supported by Seller.

		o	Process new password reset requests from Transferred Employees to systems supported by Seller.

		o	Create and support new access requests for up to twenty (20) Buyer employees who are not Transferred Employees to Seller IT systems, utilizing a computer provided by Seller that will use VPN with two-factor authentication for the sole purpose of accessing systems maintained on Seller's internal networks. All costs incurred by Seller in connection with transferred computer hardware and installed software will be reimbursed by Buyer.

		·	Email and Phone Systems

		o	Maintain email accounts and "read only" access to email accounts for Transferred Employees for a period of 45 days after the date hereof.

		o	Forward inbound emails to new Buyer email accounts until October 15, 2016.

		o	In accordance with Seller's data retention policies, maintain historical email files to allow customer requested research, customer complaint related research and regulatory inquiries. Seller data retention policies are subject to change.

		o	Maintain Phone setup, configuration and system maintenance for Transferred Employees.

		o	Provide support to offshore contact center configuration, similar to what was provided prior to the transfer date.

		o	Provide Transferred Employees the ability to access and take certain actions as required on certain internal email accounts.

 

 

 

A-2

  

		·	Operations; IT Infrastructure

		o	Maintain and support the production and backup environments located at the Seller data centers in New Haven, CT and Altanta, GA for the OneDisburse/OneAccount application. This includes all systems that are involved in supporting the OneDisburse/OneAccount application, including but not limited to the WAN and LAN network infrastructure, the security infrastructure, database infrastructure, application server infrastructure, monitoring systems, SAN/NAS infrastructure and appliances (Terradata, load balancers). All current vulnerability and penetration testing, patch management policies, applicable vendor relations and software licenses will be maintained. Support and maintenance contracts for the data center facilities, which include HVAC, UPS, fire suppression systems, access control and generators, will be maintained at current levels.

		o	Maintain and support the development environment located at the New Haven Seller data center for the OneDisburse/OneAccount application. This includes all systems that are involved in supporting the OneDisburse/OneAccount application, including but not limited to the WAN and LAN network infrastructure, the security infrastructure, database infrastructure, application server infrastructure, monitoring systems, SAN/NAS infrastructure and appliances (Terradata, load balancers). Also included are development tools utilized in the development of the OneDisburse/OneAccount software, including code repositories, testing tools, and required tools for audit and security. All current patch management policies, applicable vendor relations and software licenses will be maintained. Support and maintenance contracts for the data center facilities, which include HVAC, UPS, fire suppression systems, access control and generators, will be maintained at current levels.

		o	Maintain and support the QA/testing environment located at the New Haven Seller data center for the OneDisburse/OneAccount application. This includes all systems that are involved in supporting the OneDisburse/OneAccount application, including but not limited to the WAN and LAN network infrastructure, the security infrastructure, database infrastructure, application server infrastructure, monitoring systems, SAN/NAS infrastructure and appliances (Terradata, load balancers). Also included are QA/testing tools utilized in the QA/testing of the OneDisburse/OneAccount software, including code repositories, testing tools, and required tools for audit and security. All current patch management policies, applicable vendor relations and software licenses will be maintained. Support and maintenance contracts for the data center facilities, which include HVAC, UPS, fire suppression systems, access control and generators, will be maintained at current levels.

		o	Maintain and support back office systems that are currently in place and used by the OneDisburse/OneAccount employees, including but not limited to the file shares, Microsoft Exchange, Bugzilla, Chat and ALM. Seller will also maintain all access to 3rd party SaaS applications that are currently in place and used by the OneDisburse/OneAccount employees, including but not limited to WebEx, ADP, SalesForce and RightNow. Seller will maintain and support the underlying infrastructure, which includes but is not limited to the WAN and LAN network infrastructure, the security infrastructure, database infrastructure, application server infrastructure, monitoring systems and SAN/NAS infrastructure. All current patch management policies, applicable vendor relations and software licenses will be maintained. A list of the current back office systems and 3rd party SaaS applications are provided in the application and 3rd party SaaS application documents.

		o	Provide IT operations management reports at the same intervals such reports were generated prior to the Closing, including root cause analysis for systems outages impacting OneDisburse and/or OneAccount, Client Facing Systems Up Time, Quarterly Support Desk Metrics, Quarterly Ubiquity Ticket Volume, Quarterly Refunds Service Outage Report, Quarterly Product Change Management Report, any other IT operations management reports regularly generated by Seller prior to Closing, and any other reports mutually agreed upon by the Parties.

		o	Data extracts and configuration information or system clones, as determined by the Migration Plan, will be supplied for systems where data and configuration information has been agreed to be migrated to Buyer, including but not limited to Bugzilla, ALM, source code repositories, and "H" drive.

		o	Support implementation of Buyer initiated circuits.

		o	Continue providing the current disk storage for electronic files, data backups and backups of production and development environments.

		o	Continue to support existing integration between OneDisburse and CashNet (including Single Sign-on, refund data on ePayment and OneAccount as tender type on CashNet).

 

 

 

A-3

 

		o	Provide DNS services for critical websites, including bankmobileadminsupport.com, and vibeaccount.com.

		o	Provide data security services for Seller's existing IT environment, including threat and event management, security monitoring, change management, access management, vulnerability and patch management, and information security review for vendors with access to non-public personal information.

		o	Buyer shall be responsible for any costs associated with changes to the existing computing environment proposed by Buyer and accepted by Seller.

 

		·	Governance

		o	A member of the Buyer transition team will be invited to the Seller change management board meetings for the OneDisburse/OneAccount environment and supporting systems changes. Buyer will create one or more distribution groups for system notifications which will be added to the Seller notification process.

		o	Define a mutually agreed upon governance process and participate with Buyer to support changes to the application environment and software for OneDisburse/OneAccount.

		o	Deploy OneDisburse/OneAccount code releases that are consistent with the OneDisburse/OneAccount product roadmap. Any releases that require changes to the existing computing environment shall be mutually agreed upon by Buyer and Seller.

		·	Audit

		o	Cooperate with Buyer, perform and maintain all current audit schedules for the SSAE16 and SOX audits on the OneDisburse/OneAccount environment during the Term. Seller is only responsible for performing and maintaining the current audit schedules for the environments under the Seller's control. Audits of environments that are implemented by the Buyer that are either in front of or behind the OneDisburse and/or OneAccount environments will be the responsibility of the Buyer.

		o	Cooperate with Buyer-initiated audits (financial, internal audit or any other audits) to the extent such audits are not duplicative of any audits performed by Seller.

		o	Perform the current DR testing plan one time on the OneDisburse/OneAccount environment during the Term, unless otherwise agreed by the Parties.

Duration of Services

		·	Cooperate with Buyer to identify and hire temporary staff resources in order to meet current demand.

Unless otherwise set forth herein, the service period applicable to the Seller Transition Services set forth in this Annex A – Section 1 shall begin on the Closing Date and end on the Termination Date.

 

 

 

  

A-4

 

Transition Services Agreement (TSA)

Annex A – Section 2

Accounting

Scope of Services

Seller, itself and/or by and through its Affiliates, shall provide or cause to be provided to Buyer the following accounting services in the manner set forth below:

		·	Forward OneDisburse/OneAccount vendor invoices received by Seller after Closing.

		·	Provide access to the Accounts Receivable System (ACCPAC) for the purpose of creating client invoices.

Duration of Services

The service period applicable to the Seller Transition Services set forth in this Annex A – Section 2 shall begin on the Closing Date and end on the Termination Date.

 

 

 

  

A-5

  

Transition Services Agreement (TSA)

Annex A – Section 3

Legal

Scope of Services

Seller, itself and/or by and through its Affiliates, shall provide or cause to be provided to Buyer the following legal services in the manner set forth below:

		·	Assist Buyer's legal team with the transfer of OneDisburse/OneAccount dedicated vendor contracts.

		·	Assist Buyer's legal team with the separation of vendor contracts that support both OneDisburse/One Account and the other businesses of Seller.

		·	Advise Buyer's legal team with respect to the transfer of customer agreements.

		·	Complete, at Buyers' reasonable request, any attestations required of Seller under Title IV regulations.

Duration of Services

The service period applicable to the Seller Transition Services set forth in this Annex A – Section 3 shall begin on the Closing Date and end on the Termination Date.

 

 

  

A-6

 

Transition Services Agreement (TSA)

Annex A – Section 4

Facilities

Lease

The provision of space described in this Section 4 is included in this Annex A for informational purposes only. The provision of the space, and other details in this Section 4, shall not constitute a Transition Service, or any other service or commitment, under this Agreement. The provision of the space shall be only as set forth in, and subject in all respects to, the Lease Agreement, dated as of the Closing Date, between Seller and Buyer (the "Lease").

Scope of Services

Seller, itself and/or by and through its Affiliates, shall provide or cause to be provided to Buyer the following facilities services in the manner set forth below:

		·	Provide office space at 115 Munson Street, New Haven.

		·	Maintain New Haven and Atlanta sites to current standards.

		·	Maintain employee access to Seller facilities for employees transferred to Buyer.

		·	Provide access to Seller facilities for Buyer employees who are not Transferred Employees.

		·	Provide mailroom services to employees at the New Haven location.

		·	Provide access to existing office equipment (e.g. copier, fax machine) at the New Haven location at a pass-through cost.

		·	Provide secure space for hard copy files at the New Haven location.

		·	Maintain existing copy files located at Iron Mountain and enable access to Transferred Employees.

		·	For so long as Seller provides food service to its employees in New Haven, provide food service to Buyer employees in New Haven, including lunch three times per week (Tuesday – Thursday), and coffee daily from 8:00a - 10:30a.

		·	Integrate into Buyer's business continuity and disaster recovery plan as related to data center operations and closures of New Haven and/or Atlanta Facilities.

Duration of Services

The service period applicable to the Seller Transition Services set forth in this Annex A – Section 4 shall begin on the Closing Date and end on the Termination Date.

 

 

 

  

A-7

 

ANNEX B

 BUYER TRANSITION SERVICES

Transition Services Agreement (TSA)

Scope of Services

Buyer, itself and/or by and through its Affiliates, shall provide or cause to be provided to Seller the following services in the manner set forth below:

		·	Banking Operations

		o	Provide sufficient ATM-related resources to complete Buyer's ATM Removal and Disposition Project. Such project, and the individuals involved therein, shall be directed by VP Deposit Operations or other appropriate manager appointed by Buyer.

		o	Provide ability for members of Seller's payments banking staff to process batch transactions to the Fiserv Signature Core for the purposes of posting entries and obtaining statement data. If such access is not provided, Buyer shall post entries and create statement copies for Seller.

		o	Seller will be solely responsible for the data and the results of processing batch transactions in the Fiserv Signature Core.

		·	Legal

		o	Provide assistance and cooperation as needed in connection with Seller's implementation of the consent orders relating to the matters set forth in Section 2.04(e) of the Disclosure Schedules (including the Restitution Plans which have been accepted by the Federal Reserve and which received a non-objection from the FDIC) (the "Consent Orders") until the expiration of the period applicable to each Consent Order. The assistance and cooperation shall include the following:

		§	Provide to Seller promptly upon its request such account information, including name, postal address, email address, account balance, transaction detail, web site access, or other information as is necessary for Seller to make restitution payments (including credits for open and active accounts and checks for dormant or closed accounts) as is necessary for Seller to fully implement the Restitution Plans, including any audit, verification procedures required or information requests from the Federal Reserve or FDIC.

		§	Provide Seller such access to information technology personnel, software, data retrieval systems, and vendors as is necessary to implement the Restitution Plans efficiently and cost effectively.

		§	Provide Seller such access to and assistance of the Transferred Employees as is reasonably necessary for Seller to comply with the Consent Orders.

		§	Maintain, establish and modify as required by the Restitution Plans and as otherwise required by the Federal Reserve or the FDIC the web page announcement referenced in Paragraph 7 of the Federal Reserve Consent Order and Paragraph 27 of the FDIC Consent Order. If third party costs are required, Seller shall be solely responsible.

		§	Provide data and information as reasonably requested by Seller in connection with any Consent Order or other legal or regulatory matters to which Seller may be subject, for the duration of the applicable legal matter.

		§	Provide assistance and cooperation as needed to WEX Bank in connection its compliance obligations under the Consent Orders and any other regulatory compliance obligations related to OneAccount.

		o	The service period applicable to the Buyer Transition Services set forth under this "Legal" heading shall begin on the Closing Date and end when the latter of the Federal Reserve and the FDIC determines that restitution is complete pursuant Paragraphs 10 and 34 of the Consent Orders, respectively.

 

 

 

B-1

 

 

		·	Information Technology

		o	Continue to support existing integration between OneDisburse and CashNet (including Single Sign-on and ePayment data presented on OneDisburse).

		o	Provide a secure method of communication between Buyer and Seller.

		o	During the term of the TSA, Seller shall maintain current business continuity services for the primary data center located in New Haven, CT from the backup data center located in Atlanta, GA.

		·	Finance

		o	Continue to provide access to HOBIT (Business Intelligence) to allow retrieval of payments reports (including MMDA Alert Report, MMDA Detail Report, Transaction Report with Account and Date Prompt, Transaction Report with Product Code and Date Prompt, Trial Balance Lookup with Account and Date Prompt, and Trial Balance Lookup with Product Code and Date Prompt).

		o	Provide payment of expenses for Seller's employees through existing OneAccount system. Seller shall reimburse Buyer for any such payments.

		·	Client Operations

		o	Provide clients of Seller's payments division access to the e-Train site (Moodlerooms) to retrieve training materials, software release notes and documents.

Duration of Services

Unless otherwise set forth herein, the service period applicable to the Buyer Transition Services set forth in this Annex B shall begin on the Closing Date and end on the Termination Date.

 

 

  

B-2

 

ANNEX C

 HIGHERONE SECURITY REQUIREMENTS

ACCESS TO HIGHER ONE CONFIDENTIAL INFORMATION

Higher One's Information Security Program is comprised of a number of policies, standards and guidelines, developed with reference to the source documents cited previously, as well as with consideration of the Company's business and regulatory needs.  When referencing the Information Security Program any or all of these policies are included.

Privacy Policy

Overview

Higher One may log user system activity, record building access, monitor Internet usage and use security cameras to monitor building facilities. User's work output, regardless of storage format (e.g., paper, electronic, etc.) is the property of Higher One. The output, and any tools used to generate that output, is subject to review or monitoring by the Company at its discretion. User personal information is not used or disclosed except to comply with laws, and to protect our rights. It is used solely for business purposes including establishing, maintaining or terminating employment or contractual agreements between the user and Higher One.

Standards

Audits or investigations may be conducted to:

		1)	Ensure integrity, confidentiality and availability of information and resources.

		2)	Investigate possible security incidents.

		3)	Ensure conformance to security policies.

		4)	Monitor system or user activity where appropriate.

During an audit, all required data will be provided to the Information Security Office upon request. For the purpose of performing an investigation, any access required will be provided to the Information Security team members for the duration of the investigation. Such access may include:

		1)	User and/or system level access to any computing or communications device.

		2)	Access to information, whether electronic or hard copy, that may be produced, transmitted or stored on Company equipment or premises.

		3)	Access to work areas such as labs, offices, cubicles or storage areas.

		4)	Access to interactively monitor and log traffic on networks.

 

 

 

C-1

 

Password Management Policy

Overview

Higher One's Password Management Policy is directed to ensuring only strong, secure passwords are used on all accounts, systems and equipment. Password standards define the minimum length, composition, aging and re-use parameters, as well as lock out limitations.  Password standards are enforced to protect Company systems, Company and customer data, as well as Higher One's reputation. Password guidelines provide additional information to assist users in protecting passwords and account access.

Standards (General)

All passwords must meet minimum requirements, within the capabilities of the applicable system. Password cracking exercises may be performed on a periodic basis by the Information Security Office. Passwords that are exposed during such an exercise will result in the user being required to change to a more secure password immediately.

Except where otherwise defined or dictated, minimum password requirements are:

		1)	At least 8 (eight) characters in length, where applicable.

		2)	Contain both upper and lower case letters.

		3)	Contain at least one number.

		4)	Contain at least one special character (within the bounds of those special characters supported by the system in question).

		5)	May not contain more than 3 (three) consecutive identical characters.

		6)	System level passwords must expire and be changed no more than every 42 days.

		7)	At a minimum, the prior 13 (thirteen) passwords may not be reused.

		8)	Users must have the ability to change a password at any time.

		9)	Accounts must be locked after at least 5 (five) unsuccessful login attempts.

		10)	User accounts with elevated privileges must have a password that is unique to that account and not the same as lower-privileged account(s) held by the same user.

		11)	Passwords are to be treated as sensitive and confidential information and are not to be shared, written down or stored in an unsecured manner.

		12)	Passwords are not to be conveyed via email.

		13)	Passwords must not be displayed in clear text (e.g., must be masked) while being entered.

		14)	Default vendor or manufacturer accounts and passwords should be changed as soon as reasonably possible.

		15)	If a password is suspected to have been compromised, change the password immediately and report the incident to the IT Operations Support Desk, which will inform the Information Security Office.

		16)	Where Simple Network Management Protocol("SNMP") is used, the community strings must be defined as something other than the standard defaults of "public", "private" and "system", and must be different than the passwords used to log in interactively. A keyed hash must be used where available (e.g., SNMPv2).

		17)	Passwords must be changed in the event of a user's departure.

 

 

 

C-2

 

Guidelines

The guidelines provided herein are intended to assist users in protecting both their passwords, their access and their accounts from unauthorized use. These guidelines constitute established best practices. None of the examples cited below should be used as passwords.

		·	Avoid poor, weak or common passwords such as Welcome123, Password1, or ChangeMe123.

		·	Avoid common words, even if spelled backwards or with the addition of a number, such as secret1, 1secret, or terces.

		·	Avoid patterns of numbers or letters such as aabbcc, qwerty, or 12344321.

		·	Avoid commonly known personal information such as birthdates, addresses, names of family members, friends or pets.

		·	Avoid work-related information such as company names, building sites, etc.

		·	Should not contain common nouns, proper names or dictionary words.

		·	To create a secure but memorable password, consider creating a passphrase based on a song title, affirmation or memorable phrase that contains multiple words. For instance, This May Be One Way To Remember could become the password TmB1w2R! or I saw my favorite band last Friday night! becomes IsmF3lFn!.

Standards (Service Accounts)

Service Accounts are defined as system-level accounts that are not associated with one specific individual, but are used for administration, management, or maintenance of a system or application, or are required by a system or application.  Service Accounts may also be either interactive or non-interactive.

Interactive Service Accounts are defined as those that meet all of the following criteria:

		1)	Are highly privileged (e.g., have root level access on a Linux system, local or domain administrator access on a Microsoft Windows system, sa level access on a Microsoft SQL Server system, sys/system on an Oracle database, etc.).

		2)	Permits interactive logons (e.g., a user can use ssh to open a shell prompt on a Linux system, use Remote Desktop Services to access a desktop on a Microsoft Windows system, may use SQL Studio to perform queries on a Windows system, etc.).

		3)	The account passwords are retained (e.g., stored in Password Safe, Password Manager or some other location for future access).

Non-interactive Service Accounts are defined as those that meet any of the following criteria:

		1)	Are not highly privileged (e.g., do not have root level access on a Linux system, local or domain administrator access on a Microsoft Windows system, sa level access on a Microsoft SQL Server system, sys/system on an Oracle database, etc.).

		2)	Does not permit interactive logons (e.g., a user cannot use ssh to open a shell prompt on a Linux system, use Remote Desktop Services to access a desktop on a Microsoft Windows system, or use SQL Studio to perform queries on a Windows system, etc.).

		3)	The account passwords are not retained (e.g., not stored in Password Safe, Password Manager or some other location for future access). This circumstance applies to accounts where there is no need to use the password in the future and so the password is set to a long random value and not saved.

 

 

 

C-3

 

Service Account standards must meet the criteria outlined in Standards (General) section, with the following exceptions:

		1)	At least 12 (twelve) characters in length.

		2)	Service accounts shall have Deny Logon Locally or comparable attribute set if supported on the operating system.

		3)	Interactive Service Account passwords will expire and must be changed no more than every 90 days.

		4)	Non-interactive Service Account passwords will expire and must be changed no more than every 720 days.

		5)	In the event that the account password cannot be changed or the application vendor recommends against changing the password because it would adversely impact the application, an exception will be documented and approved by the Information Security Officer and that password will be exempt from periodic changes.

Initial Passwords and Password Resets

Where supported by the system in question, initial passwords must be set to a temporary and unique value, and be reset by the user upon first use.

In the event a password must be reset, a temporary and unique value must be provided, and must be reset by the user at the time of successful login.

Identity and Access Policy

Overview

The Identity and Access Policy defines the tasks that principals can perform, resources they can access and defines which activities will be audited for regulatory compliance purposes. Access controls are established, documented and periodically reviewed, based on business needs and external requirements.

Standards

		1)	Access Administration: This area focuses on ensuring authorized user access, and preventing unauthorized user access, to information and information systems. 

		a.	Procedures covering all stages in the life-cycle of user access, from provisioning and modification to de-provisioning.

		b.	Documentation of approval from the hiring Supervisor or System Owner for each user's access, where appropriate.

		c.	Ensuring restricted or sensitive access is not granted until all authorization procedures are completed.

		d.	Special attention to control of privileged ("super-user") access rights.

		2)	Compliance

		a.	Attestation - Confirmation by a reviewing Supervisor or designee that each user's access is consistent with business purposes and with other security controls (e.g., segregation of duties).

		b.	Access Permissions Review - A formal process must be conducted periodically (quarterly) by System Owners to review user access rights to critical systems. This review shall be documented / approved by System Owners and retained by the Information Security Office (as defined below) for audit verification purposes. Each System Owner is accountable for identifying inappropriate access and inactive user access in a timely manner to the Security Administrators.

		c.	Access to non-critical systems will be reviewed based on risk but no less frequently than annually.

 

 

 

C-4

  

User Identity Verification Policy

Overview

Higher One's User Identification Verification Policy contains information and requirements for verifying the identity of a system user when unlocking an account, resetting a password or otherwise assisting with logging in. This policy also defines the systems that are within the scope of the policy.

Standards

		1)	This policy applies to the following systems:

		a.	Active Directory, any domain

		b.	RSA SecurID PIN

		c.	CASHNet/IDC

		d.	LDAP (Corporate and Production)

		e.	Higheronesupport.com

		f.	TPP Applications

		g.	NetPay Applications

		2)	A user's identity must be verified prior to resetting his/her password on any in-scope system.

		a.	If the request is made in person, photo identification is an acceptable means of verifying the user's identity.

		b.	If the request is made by telephone, the user must provide a matching and valid Employee ID which will be verified against records.

		c.	Requests by email will not be accepted, and the user will be instructed to telephone.

		3)	In the event the user cannot provide a valid Employee ID, the user's manager or (if a contractor) employee sponsor can verify the user's identity, after verifying his/her own identity.

Privileged Account Policy

Overview

Privileged accounts are valid credentials used to gain access to information systems. Privileged credentials provide elevated, non-restrictive access to the underlying platform that non-privileged user accounts do not have access to. Root, local administrator, domain administrator and enable passwords are all examples of privileged accounts that have elevated access beyond that of a normal user.

If methods other than using privileged access will accomplish an action, those other methods must be used unless the burden of time or other resources required clearly justifies using privileged access.  In addition, passwords for privileged accounts should be randomized, not memorized by anyone, and changed frequently. Whenever technically possible, gaining and using privileged access should be audited.

Privileged access to information systems is granted only to authorized individuals based on clearly defined and documented business need.

 

 

 

C-5

 

Standards

		1)	System Approval and Authorization

		a.	Providing clarity on what administrative privileges are necessary.

		b.	Minimizing the use of shared administrative accounts.

		c.	Having a method of being able to verify the privileges associated with each account.

		2)	Privileged User ID Activity Logging: All ID creation, deletion, and privilege change activity performed by Systems/Security Administrators and others with privileged user IDs must be securely logged.

		3)	Privileged Account Types

		a.	Domain Administrative Accounts:  These accounts give privileged administrative access across all workstations and servers within a Windows domain. While these accounts are few in number, they provide the most extensive and robust access across the network.

		b.	Emergency Accounts:  These provide unprivileged users with administrative access to secure systems in the case of an emergency and are sometimes referred to as 'firecall' or 'breakglass' accounts. Access to these accounts typically requires managerial approval for security reasons.

		c.	Service Accounts: These can be privileged local or domain accounts that are used by an application or service to interact with the operating system. In some cases, these service accounts have domain administrative privileges depending on the requirements of the application they are being used for. Local service accounts can interact with a variety of Windows components

		d.	Application Accounts: These are accounts used by applications to access databases, run batch jobs or scripts, or provide access to other applications. These privileged accounts usually have broad access to underlying company information that resides in applications and databases.

Remote Access Policy

Overview

Remote Access rules and requirements are designed to minimize the potential exposure to Higher One from damages which may result from unauthorized use of Higher One resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical Higher One internal systems, and fines or other financial liabilities incurred as a result of those losses.

It is the responsibility of Higher One users with remote access privileges to Higher One's corporate network to ensure that their remote access connection is given the same consideration as the user's on-site connection to Higher One. This policy applies to remote access connections used to do work on behalf of Higher One, including reading or sending email and viewing intranet web resources.  This policy covers any and all technical implementations of remote access used to connect to Higher One networks.

 

 

 

C-6

 

Standards

		1)	Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases.

		2)	Authorized Users shall protect their login and password, even from family members.

		3)	All hosts that are connected to Higher One internal networks (including employee owned equipment) via remote access technologies must use up-to-date anti-virus software. Third party connections must comply with requirements as stated in the Third Party Agreement.

		4)	Users must not leave workstations unattended without locking or logging off the system.

		5)	Users must use personal desktop firewall software on any device connecting to Higher One networks or resources.

		6)	Higher One users who wish to implement non-standard Remote Access solutions to the Higher One production network must obtain prior approval from the Information Security Office.

		7)	The use of third-party managed remote access connections such as Webex and Go2MyPC can only be used for remote access in a support situation where personnel are present at both the asset being accessed and the system being used to obtain the remote access.  This type of managed connection is explicitly not to be used to allow a user to remotely access a device which has been left unattended on the Higher One network.

		8)	Higher One Client VPN with the use of two-factor (FOB with Pin/Token plus password) authentication is required to connect to the HigherOne corporate network.

Third-Party/Vendor Access Policy

Overview

Companies or entities with a business relationship with Higher One should only be permitted the least access required to any internal network or application system, based on the business need. The access mechanism may include direct connectivity to Higher One assets, or the exchange of electronic information.

Higher One must actively control third party access to information systems.  Business needs should be considered and a risk assessment must be carried out to determine security implications and control requirements.

This section is not intended to restrict or control access to integrated third-party systems required by Higher One products.

Standards

		1)	Controls and confidentiality clauses must be agreed on and defined in a contract with the third party.

		2)	All third party requests for Higher One data or connections to the Higher One network must be justified by business requirements, assessed for potential risks and control requirements, and then directed to appropriate Higher One management for review and approval.

		3)	All third party connections require approval from the Information Security Office.

 

 

 

C-7

 

		4)	Third-Parties must adhere to all Vendor Management Program requirements.

		5)	Reviews to ensure third-party access is still required and appropriate will be conducted periodically.

		6)	There are three methods allowed for direct connectivity between Higher One and third parties.

		a.	Dedicated circuits - A leased line obtained through a telephony-communication provider.

		b.	Site-to-Site Virtual Private Network (VPN) over the Internet – A two-way encrypted communications session between two networks that protect against eavesdropping by an unauthorized source and provides non-repudiation.

		c.	Client-based VPN

Requirements for Connectivity

		1)	Before connectivity is established with a third party, a risk assessment must be performed as part of the vendor management assessment to validate that there are no high-risk issues involved with connecting to an external entity's network.  A third party must not be immediately trusted and given immediate access to Higher One's network or application system without performing an appropriate level of due diligence.

		2)	Firewalls must restrict third party access to Higher One's network and application systems for which they have a defined business purpose.

		a.	Explicit source and destination IP and ports must be defined in the firewall rules

		b.	Must not be able to access other business partners' networks.

		3)	Firewalls must restrict Higher One's users from unlimited access to the third party network.

		a.	Explicit source and destination IP and ports must be defined in the firewall rules

		b.	Must only be able to access business partners' networks for which the user has a business purpose.

		4)	A list of approved third party connections must be maintained by the Information Security Office.

Data Classification

Overview

A data classification system sorts and labels every resource with its value, importance, sensitivity, cost, and other concerns in order to guide the implementation of security and prescribe processes of management and use. Assigning classification labels, such as public, private, sensitive, internal only, confidential, proprietary, etc., helps workers understand how to use and handle resources properly. Those resources with moderate to high value and sensitivity require greater control, tighter security, and stricter authentication. Often classification can improve the organizations defense against social engineering and other information leakage attacks. If workers know that certain information cannot be communicated via instant message, e-mail, or over the phone, then most socially guided attacks through those mediums will fail.

Asset Inventory

Higher One shall maintain a current inventory of all information assets, including hardware, software licenses and applications. The asset inventory must include at least the following elements:

		1)	A clear definition of each asset, including its business purpose and security classification.

		2)	Location of the asset.

		3)	Whether or not the asset contains personally identifiable customer information or card-related data.

 

 

 

C-8

 

Data Classification and Confidentiality

Higher One business units must classify information to indicate its level of sensitivity. Classifications dictate the priority and necessary degree of protection required to properly secure the information.  Data classification classes are:

		1)	Restricted - The Restricted class applied to business and customer related information requiring the highest level of protection.  If Restricted Data is disclosed, it could result in financial loss, violation of privacy and other laws or Regulations and significant negative publicity.  Disclosure of Restricted Data may require initiating state or federal disclosure requirements. (e.g., PCI, PII, HIPAA)

		2)	Confidential - The Confidential class applies to business and customer related information that requires role-based protection and is sensitive enough to require elaborate controls.  If Confidential Data is disclosed, employees or customers could be negatively impacted, initiating possible state or federal disclosure requirements.

		3)	Private - The Private classification applies to business and customer related information that requires some level of protection but is not sensitive enough to require extensive controls. Disclosure of Private data should be avoided but will have minimal impact.

		4)	Public - The Public class applies to information that has been made available for public distribution through authorized Higher One channels or information that will not cause any damage to Higher One if accidentally disclosed.

Credit Card Information Processing Applications

		1)	All applications dealing with the processing or retrieval of cardholder information, must, where there is not a business need to display full primary account numbers (PAN), mask displayed PAN to no more than the first six (6) and last four (4) digits of the full PAN.

		2)	If the application is designed for a specific purpose in which the full PAN must be displayed, approval must be given by the Information Security Office during the Requirements Phase as described in the SDLC process. In all cases the application must limit the display of the full PAN to the fewest number of users possible.

Credit Card Storage Applications

		1)	All Higher One application systems dealing with the storage of cardholder data must be on an internal network segregated from the demilitarized zone ("DMZ").

		2)	All access to networked storage devices containing cardholder data shall have its authentication communication encrypted.

		3)	The Primary Account Number ("PAN") must be rendered unreadable through one of the following:

		a.	Strong one-way hash functions (hashed indexes) such as Secure Hash Algorithm 1) SHA-1 with salts.

		b.	Truncation.

		c.	Index tokens and pads (pads must be securely stored).

		d.	Strong cryptography, based on industry-tested and accepted algorithms, with proper key management processes and procedures.

 

 

C-9

 

		4)	The PAN must never be stored in clear text in databases, files, or removable media.

		5)	The PAN must not be written to audit logs.

		6)	Full PAN must never be emailed or sent via instant messaging programs.

Technology Equipment Policies

Overview

Desktop, laptops, servers and virtual computers, as well as the software contained thereon, are resources that are provided to Higher One users for the purpose of conducting business on behalf of the Company. Administration, installation and maintenance of technology equipment are the responsibility of the Information Technology departments.

Warning Banners

Overview

A warning banner sets appropriate expectations for users accessing a system or device regarding the appropriate use of the resource, and warnings regarding monitoring of usage or activities while using the resource.

Standards

		1)	Higher One computing systems and devices, where supported by the device, must display a warning banner during the system login process. The message must state that the system must only be used for Higher One business purposes and is subject to monitoring.

		2)	Warning banners must be in a language consistent with the system's interface language.

		3)	The word "Welcome" or any similar language shall not be displayed prior to a successful user login.

Physical and Virtual Workstations

Overview

Desktops, laptops and virtual workstations are provided to users based on job role, need, and are based on company standard hardware configurations.

Standards

In addition to those items detailed in the Acceptable Use Policy,

		1)	Equipment is to be protected from theft or damage, including damage caused by foreign substances, impacts or misuse.

		2)	All laptop computers will be encrypted.

		3)	Online backup accounts will be provided to laptop users to ensure recoverability of data stored locally on the device.

		4)	Ensure that all vendor supplied defaults are changed before the system goes into production.

		5)	All desktops and laptops shall have personal firewall software which users should not be able to disable.

		6)	All desktops and laptops used to remotely access Higher One systems shall have VPN Client software capable of supporting the company's 2-factor authentication solution.

		7)	Workstation Configuration Standards will be reviewed on a periodic basis.

 

 

 

C-10

 

Guidelines

Physical security of computing devices can include the following:

		·	Having actual possession of a computer at all times.

		·	Locking the computer in an unusable state to an object that is immovable.

		·	Never leaving a laptop or other portable computing device unattended in a conference room, hotel room or on an airplane seat, etc.

		·	Locking the device in a hotel safe when traveling.

Server and Network Devices

Overview

The purpose of this policy is to establish standards for the base configuration of internal server and network equipment that is owned and/or operated by Higher One. Effective implementation of this policy will minimize unauthorized access to Higher One proprietary information and technology.

Unsecured and vulnerable servers continue to be a major entry point for malicious threat actors.  Consistent Server installation policies, ownership and configuration management are all about doing the basics well.

Standards (Security)

All internal servers deployed at Higher One must be owned by an operational group that is responsible for system administration. Approved server configuration guides must be established and maintained by IT and each application team, based on business needs and approved by Information Security.

		1)	All servers and network devices should be designated for a single primary purpose where possible.

		2)	All servers and network devices, prior to deployment in the production environment must conform to the Company's System Configuration and Hardening Standards.

		3)	Always use standard security principles of least required access to perform a function.  Do not use root when a non-privileged account will do.

		4)	Ensure that all vendor or manufacturer supplied defaults are changed before the server goes into production.

		5)	Servers storing or processing confidential or restricted information shall have file integrity monitoring software installed.

		6)	File integrity monitoring software shall alert IT personnel to unauthorized modification of critical system or content files. The file integrity monitoring software shall be configured to perform critical file comparisons at least daily and should be logged. Information Security should be alerted to any abnormal activity.

		7)	All servers must have anti-virus software installed.

		8)	Information in the server inventory list must be kept up-to-date.

		9)	Configuration changes for production servers must follow the appropriate change management procedures.

		10)	Access to services should be logged and/or protected through access-control methods such as a web application firewall, if possible.

 

 

 

C-11

 

		11)	Trust relationships between systems are a security risk, and their use should be avoided. Do not use a trust relationship when some other method of communication is sufficient.

		12)	If a methodology for secure channel connection is available (i.e., technically feasible), privileged access must be performed over secure channels, (e.g., encrypted network connections using Secure Shell ("SSH") or Internet Protocol Security "IPSec").

		13)	Servers should be physically located in an access-controlled environment.

		14)	Servers are specifically prohibited from operating from uncontrolled cubicle areas.

		15)	For security, compliance, and maintenance purposes, authorized Information Security personnel may monitor and audit equipment, systems, processes, and network traffic.

Standards (Configuration)

		1)	Operating System configuration should be in accordance with approved System Configuration and Hardening Standards.

		2)	A valid business justification must exist for all deviations from published configuration standards. Deviations require written approval by the Chief Information Officer and must be noted on the asset inventory for the server.

		3)	Services and applications that will not be used must be disabled where practical.

		4)	All servers and network devices must be configured to use an internal authoritative time source to maintain time synchronization with other servers in the environment.

		5)	Server and network device Configuration Standards will be updated as new public standards become available and are approved by the Information Security Office and Information Technology.

Standards (Monitoring)

		1)	All security-related events on critical or sensitive systems must be logged and audit trails saved.

		2)	Security-related events will be reported to Information Security, who will review logs and report incidents to IT management. Corrective measures will be prescribed as needed. Security-related events include, but are not limited to:

		a.	Port-scan attacks.

		b.	Evidence of unauthorized access to privileged accounts.

		c.	Anomalous occurrences that are not related to specific applications on the host.

Cellular Device Policy

Overview

The Cellular Device Policy applies to any device that uses a wireless cellular network for communication, whether the device is supplied by Higher One or personally owned by the employee and used for business-related purposes.  This policy applies to, but is not limited to, all devices and accompanying media that fit the following device classifications:

		1)	Tablets

		2)	Mobile/Cellular/Smart Telephones

		3)	Mobile Broadband devices (MiFis)

Standards

		1)	IT reserves the right to refuse the ability to connect mobile devices to the Higher One infrastructure.

Higher One's Cellular Device Policy can be found on the ADP portal under the heading Resources > Tools/References.

 

 

 

C-12

 

Equipment Disposal

Proper disposal of technology equipment is environmentally responsible and often required by law. To ensure that Higher One's electronic data, which may be stored on various types of storage media, is secured, all storage media must be completely erased or destroyed prior to release for disposal.

Standards

		1)	All information assets or office equipment which may contain a storage media component is in scope or this policy. This includes such items as computer workstations, servers, storage arrays, fax machines, printers, and copiers.

		2)	All forms of electronic media (e.g., fixed hard disks, flash memory, external drives, CDs, DVDs, tapes, USB drives) are within the scope of this policy.

		3)	At the time an in scope device or media is decommissioned or replaced, the item shall be destroyed, disabled or disposed of using methods and timing consistent with Higher One's Record Retention policies, any applicable retention laws and with due consideration for any litigation hold requirements currently in force.

		a.	Hard drives will be erased to Department of Defense standards (DoD 5220.22M) or

		b.	Physically destroyed by drilling or shredding.

		4)	When a computer workstation is transferred to a new user, the storage media will be:

		a.	Replaced, if under a litigation hold, with the original component stored as per Higher One's procedures.

		b.	Reformatted, if not subject to litigation hold.

		5)	The Facilities department will ensure that vendors remove any storage media contained within copiers, printers and fax machines prior to removing any such item from Higher One's premises.

		6)	Information Technology will maintain:

		a.	Procedures for the proper erasure of data and/or destruction of storage media.

		b.	Procedures for secure storage of media prior to destruction or disposal.

Software Installation Policy

Overview

Allowing users to install software on company computing devices opens the organization up to unnecessary exposure to risks such as the introduction of malware from infected installation files or software, unlicensed software, and programs which can be used to hack the organization's network.

Standards

		1)	Users may not install software on Higher One's computing devices operated within the Higher One network.

		2)	Software must be selected from an approved software list, maintained by the Information Technology department, unless no selection on the list meets the requestor's need.

		3)	Requests for software installations must first be approved by the requestor's manager and then submitted to the IT Support Desk in writing.

		4)	Any requests for software not on the approved list must be reviewed and approved by Information Technology and Information Security before purchase or installation.

The Information Technology Department will obtain and track the licenses and perform the software installation.

16873\75\3394687.9

 

 

 

 

C-13

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00259-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00259-of-00352.parquet"}]]