SECOND AMENDED AND RESTATED MASTER SERVICE AGREEMENT AMONG POPULAR, INC., BANCO POPULAR DE PUERTO RICO, AND EVERTEC GROUP, LLC AND ITS SUBSIDIARIES DATED AS OF JULY 1, 2022

Exhibit 99.1

EXECUTION VERSION

SECOND AMENDED AND RESTATED

MASTER SERVICE AGREEMENT

AMONG

POPULAR, INC.,

BANCO POPULAR DE PUERTO RICO,

AND

EVERTEC GROUP, LLC AND ITS SUBSIDIARIES

DATED AS OF JULY 1, 2022

TABLE OF CONTENTS

-i-

-ii-

-iii-

EXHIBITS

Exhibit A – Intentionally Omitted

Exhibit B – Services and Fees

Exhibit C – Service Level Agreement – General Terms and Conditions

Exhibit D – Strategic Clients

Exhibit E – Intentionally Omitted

Exhibit F – Outsourcing Policies and Procedures

Exhibit G – Data Protection and Privacy – Minimum Data Safeguards for Popular Infrastructure

Exhibit H – Shortfall Payments and Bi-Annual True-Up Calculation

-iv-

This Second Amended and Restated Master Service Agreement (the “Master Agreement”) is made as of July 1, 2022 (the “Effective Date”), among Popular, Inc. (“Popular” or the “COMPANY”), a corporation organized under the laws of the Commonwealth of Puerto Rico, Banco Popular de Puerto Rico (“BPPR” and, together with Popular, the “Popular Parties”), a bank organized under the laws of the Commonwealth of Puerto Rico, and Evertec Group, LLC, a limited liability company organized under the laws of the Commonwealth of Puerto Rico, and its Subsidiaries (hereinafter referred to as “EVERTEC”).

WITNESSETH

WHEREAS, COMPANY, acting through its Subsidiaries, is a financial services provider based in Puerto Rico with operations in Puerto Rico, the United States and the Caribbean;

WHEREAS, EVERTEC is in the business of, among other things, providing data processing, application processing, check imaging, transmission, telecommunications, credit and debit card transaction processing, and related operational, technical, and consulting services, and such other services as EVERTEC may engage in from time to time;

WHEREAS, Popular and EVERTEC previously entered into a Master Service Agreement on April 1, 2010 (the “April 2010 MSA”) and an Amended and Restated Master Service Agreement on September 30, 2010 (the “September 2010 MSA”);

WHEREAS, the Popular Parties and EVERTEC have entered into that certain Asset Purchase Agreement, dated as of February 24, 2022 (the “Asset Purchase Agreement”), pursuant to which BPPR is, contemporaneously with entering into this Master Agreement, acquiring a portion of the business of Evertec, Inc., a corporation organized under the laws of the Commonwealth of Puerto Rico and the ultimate parent entity of EVERTEC (“EVERTEC Parent”);

WHEREAS, the applicable Popular Parties and EVERTEC are simultaneously on the date hereof amending and restating the Amended and Restated ATH Network Participation Agreement, dated as of September 30, 2010 (as amended and restated as of the date hereof, the “ATH Network Agreement”), the Amended and Restated Independent Sales Organization Sponsorship and Services Agreement, dated as of September 30, 2010 (as amended and restated as of the date hereof, the “ISO Agreement”), the Technology Agreement dated as of September 30, 2010 (as amended and restated as of the date hereof, the “Technology Agreement”), and certain other documents; and

WHEREAS, the Popular Parties and EVERTEC desire to amend and restate the September 2010 MSA in order to, among other things and as further described in the terms of this Master Agreement, provide for certain changes to services provided under and revisions to the terms of the September ▇▇▇▇ ▇▇▇.

NOW THEREFORE, in consideration of the payments to be made and services to be performed hereunder, upon the terms and subject to the conditions set forth in this Master Agreement and intending to be legally bound, the parties hereto agree to the following terms and conditions:

ARTICLE ONE– GENERAL PROVISIONS

1.1 Definitions. Capitalized terms not otherwise defined herein will have the meanings set forth in this Section 1.1:

-2-

-3-

(i) information received from or concerning any Third Party (such as Clients, customers or suppliers);

(ii) product or services information concerning any of COMPANY’s, BPPR’s (or one of their respective Subsidiary’s) or EVERTEC’s research, or products or services being provided or developed, algorithms, supplier or vendor information, plans, ideas, drawings, specifications, documentation, quality guidelines, and analyses of strengths or weaknesses of each product or service;

(iii) trade secrets, source code and object code, other confidential Intellectual Property, technical and technological information, including designs, processes, methods, technical specifications, drawings, prototypes, troubleshooting guidelines, formulas, data, files, performance characteristics, computer software information and related documentation, databases, programs, systems engineering, research and development plans, disks and other storage media, drawings, notes, proposals, reports, photographs, hardware, card files and recordings;

(iv) financial information, such as overhead costs, profit margins, banking and financing data, budgeting data and reports, and pricing policies;

(v) organizational information, information concerning the utilization of facilities, merger, acquisition and expansion information, equipment utilization information;

(vi) marketing and sales information, such as marketing and sales techniques and data, identification and authorizing source, account status and ability to pay, product development and delivery schedules, transportation and logistical requirements, market research and forecasts, strategic planning, and marketing and advertising plans, techniques and budgets;

(vii) COMPANY’s, BPPR’s (or one of their respective Subsidiary’s) or EVERTEC’s overall strategies, the specific programs and strategies utilized by COMPANY, BPPR (one of their respective Subsidiaries) or EVERTEC; and the success or lack of success of those programs and strategies; and

(viii) Personal Data.

-4-

For the avoidance of doubt, Confidential Information includes, with respect to each party to this Master Agreement, such party’s Data Protection Program (including the Data Safeguards established pursuant to such Data Protection Program), its Business Continuity Plan, proprietary non-public materials with respect to EVERTEC’s physical security systems, access control systems, recovery equipment and techniques and all reports and information regarding the Services other than reports and information that are specifically designated as public. For the avoidance of doubt, COMPANY’s and BPPR’s Confidential Information includes all BPPR Data. EVERTEC’s Confidential Information shall not include any (1) Intellectual Property, books and records or other information or materials acquired pursuant to the Asset Purchase Agreement (except to the extent that any books and records are designated as confidential information of EVERTEC pursuant to the Asset Purchase Agreement), or (2) modifications, enhancements or derivative works based on such Intellectual Property in the immediately preceding clause (1).

-5-

-6-

(i) merger, consolidation or other business combination of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries that results in the stockholders of EVERTEC (or such Subsidiary or Subsidiaries) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries or the surviving entity thereof, as applicable, immediately before the consummation of such transaction or a series of related transactions, holding, directly or indirectly, less than 50% of the voting power of EVERTEC (or such Subsidiary or Subsidiaries) or any such successor, other entity or surviving entity, as applicable, immediately following the consummation of such transaction or series of related transactions; provided that this clause (i) shall not be deemed applicable to any merger, consolidation or other business combination, if, as a result of any such merger, consolidation or other business combination, no Person or Group of Persons that had not had “control” of EVERTEC immediately prior to such transaction, as such term is defined under the Bank Holding Company Act of 1956, as amended, shall have obtained such “control”;

-7-

(ii) Transfer (other than in the form of a pledge, hypothecation or similar grant of a security interest only and which shall not involve the grant of a proxy or other right with respect to the voting of such equity), in one or a series of related transactions, of equity representing 50% or more of the voting power of EVERTEC (or any Subsidiary or Subsidiaries that alone or together represent all or substantially all of EVERTEC’s consolidated business at that time) or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries to a Person or Group of Persons;

(iii) transaction in which a majority of the board of directors or equivalent governing body of EVERTEC (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) immediately following or as a proximate cause of such transaction is comprised of persons who were not members of the board of directors or equivalent governing body of EVERTEC (or such successor or other entity) immediately prior to such transaction; or

(iv) sale or other disposition in one or a series of related transactions of all or substantially all of the assets of EVERTEC and its Subsidiaries (or any successor or other entity holding all or substantially all the assets of EVERTEC and its Subsidiaries) to a Person who is not an Affiliate of EVERTEC at such time.

-8-

-9-

-10-

-11-

-12-

-13-

-14-

1.2 Survival. Provisions relating to limitation of liability, indemnity, payment, transition services and other provisions that by their nature are intended to survive shall survive the termination or expiration of this Master Agreement.

1.3 Relationship between the Parties. The parties hereto are independent contractors, and this Master Agreement will not be construed in any way as establishing a partnership, joint venture, or express or implied agency relationship between or among them.

1.4 Non-Exclusive. Except as otherwise set forth herein or agreed to by the parties in writing, the parties hereto acknowledge that this Master Agreement is not exclusive and nothing contained herein will be construed to create an exclusive relationship between EVERTEC, on the one hand, and COMPANY, BPPR, or any of their respective Subsidiaries, on the other. As such, EVERTEC will not be limited in entering into similar agreements with other Persons to provide the same or similar services.

-15-

1.5 Assignment.

(a) Other than a Permitted Assignment pursuant to Section 1.5(b) or (c), this Master Agreement may not be assigned by any party without the prior written consent of the other parties; provided, that any party may assign its rights, duties and obligations under this Master Agreement to its financing sources solely in connection with the granting of a security interest and the enforcement of all rights and remedies that the assigning party has against the other party under this Master Agreement, subject to the claims, defenses and rights, including rights of set off, that such other party may have against the assigning party.

(b) Assignment to Subsidiaries. EVERTEC may assign any of its rights, duties or obligations to a direct or indirect wholly-owned Subsidiary of EVERTEC (an “Assignee Sub”) if (i) such Assignee Sub is identified by EVERTEC to COMPANY and BPPR at least 20 Business Days prior to the consummation of the proposed assignment; (ii) (A) such proposed assignment is legally required in order for EVERTEC to provide to COMPANY, BPPR or their respective Subsidiaries, in the country, state, territory or other jurisdiction in which the Assignee Sub is organized, the specific services to be performed pursuant to the assignment of this Master Agreement, and only (x) to the extent of such legal requirement and (y) if EVERTEC provides a written opinion of qualified counsel that opines that such legal requirement is applicable and is based upon reasonable assumptions with respect to such legal requirement or (B) COMPANY has provided its prior written consent, such consent not to be unreasonably delayed, withheld or conditioned; (iii) such Assignee Sub will be Solvent immediately after and giving effect to such proposed assignment and COMPANY is reasonably satisfied with the terms and conditions of the proposed assignment; (iv) COMPANY is a third-party beneficiary to the assignment agreement, which is in form and substance that is reasonably satisfactory to COMPANY, and which provides that the Assignee Sub’s rights under the assignment agreement will be terminated if the Assignee Sub ceases to be a wholly-owned Subsidiary, directly or indirectly, of EVERTEC and (v) EVERTEC remains fully liable with respect to the performance of all its obligations under this Master Agreement and EVERTEC guarantees the performance of all of the obligations of EVERTEC to COMPANY assumed by Assignee Sub under this Master Agreement, which guarantee provides that, for the avoidance of doubt, after any termination of the proposed assignment, EVERTEC shall continue to be obligated with respect to any obligation undertaken by Assignee Sub prior to such termination.

(c) Assignment to Third Parties. EVERTEC may assign all of its rights, duties and obligations (or those rights, duties and obligations arising after the effectiveness of the assignment) in a transaction with a third-party assignee (an “Asset Acquirer”) if (i) such Asset Acquirer is identified by EVERTEC to COMPANY and BPPR at least 30 Business Days prior to the consummation of the proposed assignment; (ii) such Asset Acquirer (A) acquires at least 90% of the consolidated gross assets (excluding cash) of EVERTEC and its Subsidiaries and (B) assumes at least 90% of the consolidated gross liabilities (excluding Indebtedness) of EVERTEC and its Subsidiaries (including the assignment and assumption of all commercial agreements between EVERTEC or any of its Subsidiaries, on the one hand, and COMPANY, BPPR or any of their respective Subsidiaries, on the other hand) through one legal entity;

-16-

(iii) neither the Asset Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from Puerto Rico in excess of $50 million unless none of them has a physical presence in Puerto Rico that is used to conduct any such business; (iv) the Asset Acquirer will be Solvent immediately after and giving effect to such proposed assignment; and (v) EVERTEC reasonably believes that the Asset Acquirer, after completion of the proposed purchase and assumption transaction, will be capable of providing the Services at the level of service required under this Master Agreement.

(d) Cooperation. EVERTEC shall use its Best Efforts to cooperate with COMPANY and BPPR in evaluating whether any proposed assignment pursuant to this Section 1.5 would be in compliance with the requirements of the provisions contained in this Section 1.5, including the ability of Assignee Sub or Asset Acquirer, as applicable, to comply with the terms of this Master Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed assignment other than information that would create any potential liability under applicable Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(e) Notice of Objection. COMPANY or BPPR shall notify EVERTEC in writing within 15 Business Days following receipt of EVERTEC’s notice of the proposed assignment of any objection to any proposed assignment to an Assignee Sub or Asset Acquirer unless EVERTEC has failed to satisfy its obligations pursuant to Section 1.5(d) and COMPANY or BPPR asserts such failure prior to the expiration of the 15 Business Day objection period, in which case such 15 Business Day period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 1.5(d). If BPPR or COMPANY fails to timely object to such proposed assignment (taking into account any tolling of the 15 Business Day objection period), it shall be deemed to have consented to such proposed assignment.

(f) Invalidity of Impermissible Assignments. Any attempted or purported assignment in violation of this Section 1.5 hereof shall be null and void and the assignee’s rights assigned pursuant to any assignment made in compliance with this Section 1.5 will terminate in the event and to the extent of the termination of this Master Agreement.

(g) BPPR Asset Transfer. If BPPR or any of its Subsidiaries transfers, in a single transaction or series of related transactions (including in a merger, business combination, reorganization, or similar transaction (including by operation of law)) 50% or more of BPPR’s consolidated assets in the Region as of the time of transfer, or assets that generate 50% or more of BPPR’s consolidated revenues in the Region for the full twelve-month period ending at the time of transfer, to any Person, then BPPR shall assign (or cause its applicable Subsidiaries to assign) to such Person its rights, duties and obligations under this Master Agreement in respect of the Services provided to the applicable transferors and shall cause such Person to assume its liabilities under this Master Agreement in respect of the Services provided to the applicable transferor. For the avoidance of doubt, no such assignment shall relieve COMPANY, BPPR or any of their respective Subsidiaries of their obligations under this Master Agreement to the extent COMPANY, BPPR or any of their respective Subsidiaries survive any such sale of assets, merger, business combination, reorganization, or similar transaction.

-17-

1.6 Binding Effect. This Master Agreement and all the provisions hereof will be binding upon and inure to the benefit of the parties hereto and their respective successors and permitted assigns. The parties hereto intend that this Master Agreement will not benefit or create any right or cause of action in, or on behalf of, any Person other than the parties hereto.

1.7 No Third Party Beneficiaries. Each party intends that this Master Agreement will not benefit, or create any right or cause of action in or on behalf of, any Person other than COMPANY, BPPR, and their respective Subsidiaries, and EVERTEC.

1.8 Entire Agreement. This Master Agreement, the Asset Purchase Agreement, the Technology Agreement and the other Ancillary Agreements (as such term is defined in the Asset Purchase Agreement) contain the entire understanding of all agreements between the parties hereto with respect to the subject matter hereof and supersede any prior agreement or understanding, oral or written, pertaining to any such matters, which other agreements or understandings will be of no force or effect for any purpose. This Master Agreement may not be amended or supplemented in any manner except by mutual agreement of the parties and as set forth in a writing signed by the parties hereto or their respective permitted successors in interest.

1.9 Interpretation.

(a) The general terms and conditions of this Master Agreement and the Exhibits, Addenda, and Schedules made a part hereof from time to time will be interpreted as a single document. However, in the event of a conflict between the general terms and conditions of this Master Agreement and the terms of any Exhibit, Addendum or Schedule hereto, then the terms of the Exhibits, Addenda, and Schedules will prevail and control the interpretation of this Master Agreement with respect to the subject matter of the applicable Exhibits, Addenda, and/or Schedules; provided, however, that the specific provisions of each SOW and other written instructions listed in Schedule 3 to Exhibit B relating to the term and termination of such SOW and other written instructions shall be governed in accordance with Schedule 3 to Exhibit B. Furthermore, in the event of any conflict or inconsistency between this Master Agreement and any other document referenced herein (including the EVERTEC Security Requirements), regarding the interpretation of the terms of this Master Agreement, this Master Agreement together with its Exhibits, Addenda, and Schedules will prevail and control.

(b) For purposes of this Master Agreement: (i) “include”, “includes” or “including” shall be deemed to be followed by “without limitation”; (ii) “hereof”, “herein”, “hereby”, “hereto” and “hereunder” shall refer to this Master Agreement as a whole and not to any particular provision of this Master Agreement; (iii) “extent” in the phrase “to the extent” shall mean the degree to which a subject or other item extends and shall not simply mean “if”; (iv) “dollars” and “$” shall mean United States dollars; (v) the singular includes the plural and vice versa; (vi) reference to a gender includes the other gender; (vii) “any” shall mean “any and all”; (viii) “or” is used in the inclusive sense of “and/or”; (ix) reference to any agreement, document or instrument means such agreement, document or instrument as amended, supplemented, modified and in effect from time to time in accordance with its terms; and (x) reference to any statute or regulation means such statute or regulation as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder.

-18-

1.10 Severability. Any term or provision of this Master Agreement which is held by a court of competent jurisdiction or as the result of an arbitration proceeding pursuant to Section 1.14, to be invalid or unenforceable in any jurisdiction shall, as to that jurisdiction, be ineffective to the extent of such invalidity or unenforceability without rendering invalid or unenforceable the remaining terms and provisions of this Master Agreement or affecting the validity or enforceability of any of the terms or provisions of this Master Agreement in any other jurisdiction; provided that this Section 1.10 shall not apply if such severability would materially and adversely affect the economic benefits of the parties resulting from this Master Agreement. Upon a determination that any term or other provision is invalid, illegal, or unenforceable, the parties hereto shall negotiate in good faith to modify this Master Agreement so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that this Master Agreement be consummated as originally contemplated to the greatest extent possible.

1.11 Waiver. The tardiness or failure by any of the parties hereto in exercising any right or privilege pursuant to this Master Agreement will not operate as a waiver thereof, nor will the exercise of any right by any party serve as an obstacle to the exercise of any other rights, powers or privileges, or any portion thereof. The waiver of any breach of any provision under this Master Agreement by any party will not be deemed to be a waiver of any preceding or subsequent breach under this Master Agreement. No such waiver will be effective unless in writing.

1.12 Governing Law. This Master Agreement will be governed by and interpreted in accordance with the laws of the Commonwealth of Puerto Rico applicable to contracts made and entirely to be performed therein, without regard to the place of performance hereunder.

1.13 Trial by Jury. The parties hereby mutually agree that no party, nor any permitted assignee, successor, heir or Representative thereof, will seek a jury trial in any lawsuit, proceeding, counterclaim, or any other litigation procedure based upon or arising out of this Master Agreement, or any related agreement or instrument among the parties. None of the parties will seek to consolidate any such action, in which a jury trial has been waived, with any other action in which a jury trial has not been waived. The provisions of this Section 1.13 have been fully negotiated by the parties. The waiver contained herein is irrevocable, constitutes a knowing and voluntary waiver, and will be subject to no exceptions.

1.14 Dispute Resolution; Arbitration. Except as otherwise provided in writing with respect to EVERTEC’s failure to achieve or maintain a Service Level (as such term is defined below), or except as may otherwise be agreed to in writing among the parties, any dispute, controversy or claim between EVERTEC, on the one hand, and any of the Popular Parties or their respective Subsidiaries, on the other, or against any Representative of one of the parties, related to this Master Agreement, and any dispute or claim related to the relationship or duties contemplated hereunder, including the validity of this Section 1.14 (a “Dispute”) will be resolved in accordance with this Section 1.14. Each party will give written notice (a “Notice of Dispute”) to the others of any Dispute claimed by it within thirty (30) days of learning of the cause of such a Dispute. The Notice of Dispute will include a reasonable description of the basis of the Dispute, including, (i) the specific charge or charges being disputed, (ii) if available and/or applicable, the supporting documentation that is reasonably required for verification of the charge or charges, and (iii) any amounts being withheld. Following delivery of a Notice of Dispute, a Representative of each party will meet and will attempt in good faith to resolve the Dispute. Any Dispute that remains

-19-

unresolved for more than twenty (20) days after the receipt of a Notice of Dispute shall be referred to designated representatives of the parties hereto who shall negotiate in good faith to resolve such dispute (the “Resolution Forum”). If a Dispute is not resolved in the Resolution Forum, the Dispute shall be submitted to the consideration of a representative from the senior management of EVERTEC who shall be identified in a written notice delivered to the Popular Parties from time to time, the Chief Operating Officer, the Chief Financial Officer or the Chief Information Officer of BPPR and the Chief Operating Officer or the Chief Financial Officer of COMPANY. Any Disputes that may remain unresolved for more than ninety (90) days following the receipt of a Notice of Dispute may be referred to binding arbitration at the request of any party upon written notice to the other. Such arbitration proceeding will be administered by the American Arbitration Association in accordance with the then-current Commercial Arbitration Rules and will be aired in the Commonwealth of Puerto Rico. The arbitration will be governed by the United States Arbitration Act, 9 U.S.C. §§ 1-16 to the exclusion of any provision of state law inconsistent therewith or which would produce a different result. A panel of three neutral arbitrators will determine the Dispute of the parties and render a final award in accordance with the applicable substantive law. If the Dispute is between EVERTEC, on the one hand, and one or both of the Popular Parties and their respective Subsidiaries, on the other hand, each of EVERTEC and the Popular Parties shall select one neutral arbitrator and, unless those parties agree on a third neutral arbitrator, such two arbitrators shall select the third arbitrator (subject to such limitations, if any, mutually agreed by those parties). If the Dispute is between the Popular Parties, then each of the Popular Parties shall select one neutral arbitrator and, unless those parties agree on a third neutral arbitrator, such two arbitrators shall select the third arbitrator (subject to such limitations, if any, mutually agreed by those parties). Strict confidentiality will govern the arbitration proceedings, including all information submitted to the arbitrators and the decision or award entered by the arbitrators. Any court having jurisdiction may enter judgment upon the award rendered by the arbitrators. The terms hereof will not limit any obligation of a party to defend, indemnify or hold harmless another party against court proceedings or other Losses. The procedures specified in this Section 1.14 will be the sole and exclusive procedures for the resolution of Disputes among the parties arising out of or relating to this Master Agreement; provided, however, that a party may request temporary remedies in a court of law to maintain the status quo or to protect goods or property until the arbitration has initiated and the selected arbitrators have had the opportunity to resolve the request for temporary relief. Each party is required to continue to perform its obligations under this Master Agreement pending final resolution of any Dispute arising out of or relating to this Master Agreement, unless to do so would be impossible or impracticable under the circumstances.

1.15 Cumulative Remedies. Except as otherwise expressly provided, all rights and remedies provided for in this Master Agreement will be cumulative and in addition to and not in lieu of any other rights and remedies available to any party at law, in equity or otherwise and will not serve to exclude the exercise of any right or remedy provided by law.

-20-

1.16 Subcontracting the Services.

(a) EVERTEC shall provide COMPANY and BPPR with the written notice required below in this Section 1.16(a) prior to outsourcing, delegating or subcontracting the performance of any part of the Services to a Third Party vendor, including any Third Party computer programmers, software developers or Data Center, collocation, hosting or cloud service providers (each, a “Subcontractor”), to the extent such Subcontractor would store, process, transport or otherwise have access to BPPR Data or other Confidential Information or Intellectual Property of COMPANY or BPPR or their respective Subsidiaries (a Subcontractor with such access, including those who perform Data Processing of Personal Data or provide Data Center services, a “Data Subcontractor”), except to the extent such Data Subcontractor is in use by EVERTEC as of the Effective Date. The Data Subcontractors used by EVERTEC as of the Effective Date are listed in Schedule 1.16. For the avoidance of doubt, such information related to EVERTEC’s Data Centers, Data Subcontractors and Subcontractors shall be considered EVERTEC Confidential Information and EVERTEC may otherwise engage Subcontractors who are not Data Subcontractors without the obligation to inform COMPANY or BPPR, as applicable, subject to the terms of this Master Agreement and to applicable Legal Requirements. EVERTEC agrees that, prior to assigning a Data Subcontractor under this Master Agreement: EVERTEC must (i) provide COMPANY and BPPR with at least 180 days’ written notice for Data Subcontractors that will perform Services at a new Data Center and at least 30 days’ written notice for all other Data Subcontractors (or such shorter period as may be necessary to assign a Data Subcontractor in order to remedy an Incident or other similar emergency event); (ii) within 10 days of a request from COMPANY or BPPR, provide COMPANY or BPPR the information described in Section 1.16(c) to evaluate the proposed Data Subcontractor during the applicable notice period provided above; and (iii) comply with the outsourcing policies and procedures set forth in Exhibit F (the “Outsourcing Policy”) and applicable Legal Requirements relating to the outsourcing of services. Without limiting the foregoing, prior to the commencement of any work by any Data Subcontractor, EVERTEC must: (i) perform the necessary due diligence to manage related vendor risks and ensure it only assigns Subcontractors that (A) are qualified industry vendors that EVERTEC reasonably believes to be competent, (B) meet or exceed any requirements as may be required under applicable Legal Requirements and (C) have the requisite skills to perform the subcontracted obligations; (ii) enter into written agreements that bind the Data Subcontractors to data security and confidentiality obligations no less stringent than to those herein; and (iii) monitor its Subcontractor’s performance to ensure it is consistent and compliant with all the requirements of the Outsourcing Policy.

(b) EVERTEC shall monitor its Data Subcontractors’ performance to ensure such performance is consistent and compliant with all the applicable requirements of this Master Agreement and the Outsourcing Policy. Notwithstanding the foregoing, EVERTEC shall remain exclusively and fully responsible and liable towards COMPANY, BPPR, and their respective Subsidiaries for the due performance of such Services, compliance with this Master Agreement, and any gross negligence, fraud or willful misconduct by such Subcontractors (including any Fourth Party) and there shall be no direct relationship whatsoever between COMPANY, BPPR, or their respective Subsidiaries, on the one hand, and such Subcontractors or Fourth Parties, on the other, solely by virtue of this Master Agreement.

(c) Subject to Section 1.16(f), at COMPANY’s or BPPR’s request, upon reasonable advance written notice, EVERTEC will provide COMPANY or BPPR with copies of any documents in EVERTEC’s possession that are related to EVERTEC’s due diligence and risk analysis of its Data Subcontractors; provided, that (i) such requests shall be conducted in such a manner as not to interfere with the normal operations of EVERTEC’s business, (ii) disclosure of such information by EVERTEC shall be subject to, and limited by, applicable Legal Requirements, (iii) EVERTEC may redact from such copies information related solely to EVERTEC or customers other than COMPANY, BPPR or their respective Subsidiaries and (iv) EVERTEC shall not be obligated to provide any information if doing so would reasonably be expected to result in the waiver of any attorney-client or other legal privilege.

-21-

(d) EVERTEC represents that its vendor risk management policies and procedures include commercially reasonable audit rights with respect to its Data Subcontractors.

(e) If a Data Subcontractor uses or permits another party (a “Fourth Party”) to store, transport, process otherwise access Personal Data or Confidential Information or Intellectual Property of COMPANY, BPPR, or their respective Subsidiaries, EVERTEC will comply with this Section 1.16 with respect to such Fourth Party, subject to Section 1.16(f).

(f) If there are terms in EVERTEC’s contracts existing as of the Effective Date with its Data Subcontractors that limit EVERTEC’s rights to provide the information requested by COMPANY or BPPR under Section 1.16(c) or (e), EVERTEC will use Best Efforts to obtain the right to provide the requested information but will not be in breach of this Master Agreement to the extent it is unable to do so as a result of such contract terms. If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.

1.17 Non-solicitation.

(a) Each party agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the end of the Transition Period, without the prior written consent of the other party, such party shall not, and it shall cause its Subsidiaries not to, directly or indirectly, (i) induce or encourage any employee of the other party to terminate his or her employment with the other party or (ii) solicit for employment or any similar arrangement any employee of the other party; provided that such party and its Subsidiaries shall not be restricted from (A) accepting referrals for employment made by a placement agency or employment service so long as such placement agency or employment service has not targeted employees of the other party, (B) making any general advertisement not targeted at employees of the other party appearing in a newspaper, magazine, Internet sites or trade publication, (C) soliciting any person who has not been an employee of the other party for at least one hundred eighty (180) days prior to being solicited or hired by such party or its Subsidiaries and whom neither the other party nor any of its Subsidiaries, subject to clauses (A) and (B) of this proviso, have solicited over such 180-day period, or (D) soliciting any person who the other party or its Subsidiaries are permitted to solicit under the Asset Purchase Agreement in accordance with the terms thereof.

(b) Each of COMPANY and BPPR agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the end of the Transition Period, without the prior written consent of EVERTEC, such party shall not, and it shall cause its Subsidiaries not to, directly or indirectly, hire or assist any other Person in hiring any Restricted Employee; provided that COMPANY, BPPR and their Subsidiaries shall not

-22-

be restricted from hiring any person who has not been an employee of the other party for at least one hundred eighty (180) days prior to being solicited or hired by such party or its Subsidiaries and whom neither the other party nor any of its Subsidiaries, subject to clauses (A) and (B) of the proviso in clause (a) above, have solicited over such 180-day period. For purposes of this Section 1.17(b), “Restricted Employee” means any employee of the following EVERTEC groups or divisions: Business Solutions division, Payment Services division, Information Technology and Quality and Change Management groups within EVERTEC’s Information Technology and Operations division, and Information Security division (including any functional successor thereto).

(c) EVERTEC agrees that, during the period commencing on the execution of this Master Agreement and ending upon the one (1) year anniversary of the expiration or termination of this Master Agreement, without the prior written consent of COMPANY, EVERTEC shall not, and it shall cause its Affiliates not to, directly or indirectly, hire or assist any other Person in hiring any Restricted Employee; provided that EVERTEC shall not be restricted from hiring any person who has not been an employee COMPANY, BPPR or any of its Affiliates for at least one hundred eighty (180) days prior to being solicited or hired by EVERTEC or its Affiliate and whom neither EVERTEC nor any of its Affiliates, subject to clauses (A) and (B) of the proviso in clause (a) above, have solicited over such 180-day period. For purposes of this Section 1.17(c), “Restricted Employee” means (A) any employee of COMPANY or BPPR’s Digital Banking and Payment Division, Information Technology Division and Cybersecurity Division (including any functional successor thereto); and (B) any former employee of EVERTEC that is hired by COMPANY, BPPR or their Subsidiaries in connection with solicitations permitted under the Asset Purchase Agreement.

1.18 Prohibition on Publicity. Neither EVERTEC nor the Popular Parties (or their respective Subsidiaries) may advertise or promote using the name or description of the other parties or party, respectively, without in each instance the express written consent of EVERTEC or the Popular Parties, as applicable.

1.19 Business Days and Legal Holidays. Except as expressly agreed to otherwise for a particular Service, in the event that any action, payment, or time period, under this Master Agreement is scheduled to occur on or becomes due on a day that is a Legal Holiday, such action, payment or time period will be performed and/or expire, as applicable, on the next Business Day immediately following the Legal Holiday.

1.20 Notices. Except as expressly agreed to otherwise for a particular Service, all notices, requests, demands, consents and other communications given or required to be given under this Master Agreement and under the related documents will be in writing and may be given in any manner described below to the address or number set out below, and shall be deemed effective as follows: (a) if delivered personally to the Person designated below, (b) when the same is actually received, if sent by express overnight courier service, with charges prepaid and return receipt requested, or (c) if sent by email, if notice of nondelivery is not received, (i) at or prior to 5:00 pm local time of the recipient on a Business Day, on that Business Day or (ii) later than 5:00 pm local time of the recipient, on the next succeeding Business Day; provided notices of default, non-renewal or termination must be delivered personally or by courier as provided in Sections 1.20(a) or (b); provided further that all such notices, requests, demands, consents and other communications shall be accompanied by an email notification.

-23-

To EVERTEC:

Evertec, Inc.

Cupey ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇, ▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇▇▇▇ 1.3

▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇

Facsimile: ▇▇▇-▇▇▇-▇▇▇▇

Email: ▇▇▇▇.▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇.▇▇▇

Attention: ▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇▇, General Counsel and Executive Vice President of

Corporate Development

To the Popular Parties:

Popular, Inc.

▇▇ ▇▇▇ ▇▇▇▇▇▇

▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇-▇▇▇▇

Email: ▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇

Attention: ▇▇▇▇ ▇ ▇▇▇▇▇▇▇ Tio, Executive Vice President and Chief Legal Officer

Any party hereto may change its address or contact details from time to time by giving notice to that effect as provided in this Master Agreement.

1.21 Incorporation. All Exhibits, Addenda, Schedules, certificates, agreements and other documents attached hereto and to which reference is made herein are incorporated by reference as if fully set forth herein.

1.22 Headings. The headings used in this Master Agreement are inserted for purposes of convenience of reference only and will not limit or define the meaning of any provisions of this Master Agreement.

1.23 Language. This Master Agreement has been executed in the English language and all Exhibits, Addenda, and Schedules to this Master Agreement shall be in English, except that any Addenda in effect prior to the date hereof may be in Spanish.

1.24 Counterparts. This Master Agreement may be executed in counterparts, each of which when so executed shall be deemed to be an original and all of which when taken together shall constitute one and the same instrument. Any signature to this Master Agreement may be delivered by facsimile, electronic mail (including pdf) or any electronic signature complying with the U.S. federal ESIGN Act of 2000 or the New York Electronic Signature and Records Act or other transmission method and any counterpart so delivered shall be deemed to have been duly and validly delivered and be valid and effective for all purposes to the fullest extent permitted by applicable Legal Requirements. For the avoidance of doubt, the foregoing also applies to any amendment, extension or renewal of this Master Agreement and any Addenda, Schedule, SOW or other document to be executed by the parties pursuant hereto or thereto.

-24-

1.25 Representations and Warranties. EVERTEC, COMPANY and BPPR each represent and warrant that (i) it has the power and authority to grant the rights and perform the obligations to which it commits herein; (ii) the execution of this Master Agreement by the person representing it will be sufficient to render this Master Agreement binding upon it; (iii) neither its performance hereunder nor the exercise by the other parties of rights granted by the warranting party hereunder will violate any applicable Legal Requirements, or the legal rights of any Third Parties, or the terms of any other agreement to which the warranting party is or becomes a party; and (iv) it has and will maintain an adequate system of internal controls and procedures for financial reporting. Each party is separately responsible for ensuring that its performance and grant of rights do not constitute any such violation during the Term. Each of the foregoing representations and warranties and any other representations and warranties made throughout this Master Agreement will be deemed provided by the parties on the Effective Date hereof and will be continuous in nature throughout the Term.

1.26 Specific Performance. COMPANY and EVERTEC agree that if an act or omission of one of the Popular Parties or any of their respective Subsidiaries, on the one hand, or EVERTEC, on the other hand, results in a breach of Section 1.5 (Assignment), Section 1.17 (Non-solicitation), Section 1.18 (Prohibition on Publicity), Section 1.31 (EVERTEC Change of Control), Section 2.9 (Non-Circumvention Covenants), Section 2.10 (Non-Compete Covenants), Article Five (Confidentiality, Privacy & Data Protection), Article Six (Security, BPPR Data & Records), Article Eight (Regulatory Compliance, Audit & Service Reviews) or Section 9.5 (Transition Assistance), EVERTEC or the Popular Parties, as applicable, will be irreparably damaged, no adequate remedy at law would exist and damages would be difficult to determine, and that EVERTEC or one of the Popular Parties, as applicable, shall be entitled to an injunction or injunctions to prevent such breach, and to specific performance of the terms of the aforementioned Sections and Articles as the case may be, in addition to any other remedy at law or equity, without having to post bond or any financial undertaking. By listing the provisions above the Parties are not intending to limit either Party’s right to seek injunctive relief, specific performance or other equitable remedies under applicable Legal Requirements.

1.27 Limitation of Actions. No action, regardless of form, arising out of any claimed breach of this Master Agreement or the Services provided hereunder, may be brought by any party more than two (2) years after such party has obtained actual knowledge of the cause of action or after the statute of limitations prescribed by Puerto Rico law, whichever is less.

1.28 Release of Existing Claims. Each party hereto, on behalf of itself, its Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Releasing Parties”), hereby generally, completely and irrevocably releases and discharges each other party hereto and all of such other party’s Affiliates and Subsidiaries (and each of their respective Representatives), including any successors and assigns of the foregoing (in such capacity, the “Released Parties”), of and from any and all claims, demands, debts, liabilities, contracts, obligations, accounts, suits, torts, causes of action, Disputes, or claims for relief of whatever kind or nature (other than Third Party claims) solely to the extent arising out of facts, circumstances or occurrences which were known or reasonably should have been known to the Releasing Parties, both at law and equity, which the Releasing Parties ever had, now has, or may have (including attorneys’ fees and costs incurred) relating to, resulting from or arising out of the Released Parties’ breach of any representations, warranties or covenants under

-25-

the September 2010 MSA or the April 2010 MSA; provided, that, this Section 1.28 shall not apply with respect to (i) any rights that cannot be waived under applicable Legal Requirements, (ii) the continuation on or after the Effective Date of any act or omission that commenced prior to the Effective Date, to the extent that such continuation of such act or omission following the Effective Date constitutes a breach of any representations, warranties or covenants under this Master Agreement, or (iii) any act or omission that commenced following the Effective Date which results in a breach of any representations, warranties or covenants under this Master Agreement. The Releasing Parties represent and warrant that they are respectively the sole and lawful owners of, and have not assigned or transferred to any Third Party, all rights, title and interest in and to all released matters referred to in this Section 1.28.

1.29 Additional Assurances. The parties covenant and agree that subsequent to the execution and delivery of this Master Agreement and without any additional consideration, each will execute and deliver any further legal instruments and perform any acts that are or may become necessary to effectuate the purposes of this Master Agreement.

1.30 No BPPR Guarantee. The parties acknowledge and agree that notwithstanding anything to the contrary contained in this Master Agreement, BPPR is party to this Master Agreement only to the extent that it receives Services from EVERTEC, and BPPR shall be liable to EVERTEC only for the performance of its (and its Subsidiaries’) duties, obligations and payments under this Master Agreement. BPPR shall not guarantee or otherwise be liable for the performance of any duties, obligations or payments of any of BPPR’s Affiliates (other than BPPR itself and BPPR’s Subsidiaries) or for the performance of any duties, obligations or payments of COMPANY or COMPANY’s Subsidiaries arising under this Master Agreement.

1.31 EVERTEC Change of Control.

(a) EVERTEC Change of Control. COMPANY and BPPR shall have the right, subject to Section 1.31(c), to terminate this Master Agreement up to thirty (30) days following the later of (i) the occurrence of an EVERTEC Change of Control or (ii) the date on which EVERTEC provides COMPANY and BPPR written notice that an EVERTEC Change of Control has occurred or is likely to occur (provided that if EVERTEC has not satisfied its obligations pursuant to Section 1.31(b) and that COMPANY or BPPR asserts such failure prior to the expiration of the thirty (30)-day period then such thirty (30)-day period shall be tolled until EVERTEC satisfies its obligations under Section 1.31(b) and provided further that if an EVERTEC Change of Control occurs, and EVERTEC fails to provide COMPANY and BPPR written notice thereof within thirty (30) days thereof, then COMPANY and BPPR shall have an unqualified right to terminate this Master Agreement), unless (w) the Person or Group of Persons proposing to engage in such proposed EVERTEC Change of Control transaction (the “Control Acquirer”) is identified to COMPANY by EVERTEC at least thirty (30) Business Days prior to such proposed EVERTEC Change of Control; (x) neither the Control Acquirer nor any of its Affiliates is engaged, directly or indirectly, in the banking, securities, insurance or lending business, from which they derive aggregate annual revenues from Puerto Rico in excess of $50 million unless none of them has a physical presence in Puerto Rico that is used to conduct any such business; (y) EVERTEC (or its successor, as applicable) will be Solvent immediately after and giving effect to such proposed EVERTEC Change of Control; and (z) EVERTEC (or its successor, as applicable), after the proposed EVERTEC Change of Control, will be capable of providing the Services at the level of service that is required under this Master Agreement.

-26-

(b) Cooperation. EVERTEC shall use its Best Efforts to cooperate with COMPANY and BPPR in evaluating whether any proposed EVERTEC Change of Control would be in compliance with the requirements of this Section 1.31 including the ability of EVERTEC (or its successor, as applicable) to comply with the terms of this Master Agreement, including, in each case, by providing any non-confidential information regarding the purposes and plans in connection with such proposed EVERTEC Change of Control other than information that would create any potential liability under Legal Requirements, violate any confidentiality obligation, or that reasonably would be expected to result in the waiver of any attorney-client privilege.

(c) Notice of Objection. If EVERTEC provides at least 30 days’ written notice to COMPANY and BPPR prior to an EVERTEC Change of Control, BPPR and/or COMPANY shall notify EVERTEC in writing within 15 Business Days following receipt of EVERTEC’s notice of the proposed EVERTEC Change of Control of any objection to any proposed EVERTEC Change of Control on the basis that it does not satisfy the criteria set forth in clauses (w) through (z) of Section 1.31(a) (unless EVERTEC has failed to satisfy its obligations pursuant to Section 1.31(b) and COMPANY or BPPR asserts such failure prior to the expiration of the 15 Business Day objection period, in which case such 15 Business Day objection period shall be tolled until EVERTEC satisfies its obligations pursuant to Section 1.31(b)). If BPPR or COMPANY fails to timely object to such proposed EVERTEC Change of Control (taking into account any tolling of the 15 Business Day objection period), it shall be deemed to have consented to such proposed EVERTEC Change of Control and waived its right of termination under Section 1.31(a).

ARTICLE TWO– THE SERVICES

2.1 Services.

(a) EVERTEC will provide to COMPANY, BPPR, and their respective Subsidiaries the Services which are listed in Exhibit B, attached hereto, including the additional descriptions of certain of such Services in the document Rate Matrix and Printing & Distribution included as Schedule 1 to Exhibit B.

(b) None of the Services shall be subject to any exclusivity. COMPANY, BPPR, and their respective Subsidiaries may use a Third Party to provide any of the Services and COMPANY, BPPR, and their respective Subsidiaries may perform any of the Services themselves or through their Subsidiaries, irrespective of whether any such Service has been terminated in whole or in part. To the extent there are exclusivity terms included in a Service Addendum or SOW existing as of the Effective Date, those exclusivity terms shall not apply after the Effective Date. To the extent there are minimum commitments or termination fees included in a Service Addendum or SOW as of the Effective Date, those termination fees and minimum commitments shall not apply after the Effective Date other than under the Statement of Work for Amazon Connect ACD and IVR Services dated November 3, 2021, as amended.

-27-

(c) If COMPANY or BPPR performs itself, or retains a third party to perform, any services that interface or interact with the Services, or that are or formerly were, part of the Services, EVERTEC will, at COMPANY or BPPR’s cost, cooperate and coordinate with COMPANY and BPPR or such third party as reasonably required for COMPANY and BPPR or the third party to perform such services. EVERTEC’s cooperation and coordination with COMPANY, BPPR and any such third party will include, as applicable: (i) providing reasonable access to the equipment and software used in providing the Services via API or other reasonable method agreed by the parties (subject to any applicable EVERTEC Security Requirements); (ii) providing such reasonable information regarding the operating environment, system constraints and other operating parameters as a person with reasonable commercial skills and expertise would find reasonably necessary for COMPANY and BPPR or the third party to perform its work; (iii) providing access to BPPR Data stored by EVERTEC; and (iv) reasonably cooperating and participating in meetings to identify the causes of incidents and problems and to agree on action plans to resolve them; provided that EVERTEC shall have sole discretion to deny any party from performing programming services on or accessing the source code of applications owned or licensed by EVERTEC. COMPANY or BPPR, as applicable, shall (and shall require any such third party engaged by COMPANY or BPPR to) comply with EVERTEC Security Requirements and with the other applicable terms of this Master Agreement when accessing EVERTEC’s systems in connection with this Section 2.1(c). Subject to Section 4.5, COMPANY or BPPR will reimburse EVERTEC for any Losses incurred by EVERTEC in connection with any unauthorized access or intrusion to EVERTEC’s Systems, or any Disabling Device introduced to EVERTEC’s Systems, as a result of a breach of this Master Agreement, failure to comply with the EVERTEC Security Requirements, gross negligence, fraud or willful misconduct of COMPANY, BPPR or any such third party in connection with its access to EVERTEC’s Systems pursuant to this Section 2.1(c).

(d) If EVERTEC and the Popular Parties, or any of their respective Subsidiaries, agree from time to time upon terms and prices for certain Services, then EVERTEC, on the one hand, and the Popular Parties or any of their appropriate respective Subsidiaries, on the other hand, will execute a separate addendum (each, a “Service Addendum”) setting forth the mutually agreed upon terms and prices for such Services. Each such Service Addendum will be incorporated and, to the extent not incompatible with the terms of such Service Addendum, will be subject to the terms and conditions of this Master Agreement. Nothing herein will be interpreted as imposing an obligation upon EVERTEC to develop new Services, or upon COMPANY, BPPR, or any of their respective Subsidiaries to acquire any additional Services from EVERTEC. The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, the pricing with respect to any and all Services will be set forth in Exhibit B, which will serve as a master list of the Services and corresponding pricing. The parties agree that Exhibit B will be reviewed and updated on an ongoing basis following the Effective Date hereof. Any changes to Exhibit B shall be agreed to by both parties by executing an amended and restated Exhibit B clearly denoting the date any such changes become effective; provided that EVERTEC may amend Exhibit B upon notice to, but without the consent of, the Popular Parties in order to reflect the price adjustments provided in Section 3.1(b), or any change, modification, enhancement or upgrade of the Services permitted pursuant to Section 2.1(b), but for the avoidance of doubt subject to the consent requirements of Sections 2.6 and 2.7.

(e) The Service Addenda set forth in Schedule 2 to Exhibit B are hereby incorporated into this Master Agreement by this reference.

-28-

(f) Each Statement of Work (“SOW”) pursuant to which EVERTEC provides Services(s) to COMPANY, BPPR, and/or their respective Subsidiaries as of the date hereof (except for any SOW that relates to a non-recurring definitive project) is set forth in Schedule 3 to Exhibit B and is hereby incorporated into this Master Agreement.

(g) Each SOW to be entered into after the date of this Master Agreement, pursuant to which EVERTEC shall provide Services(s) to COMPANY, BPPR, and/or their respective Subsidiaries after the date hereof shall be set forth in Schedule 4 to Exhibit B and shall be incorporated into this Master Agreement.

2.2 Annual Minimums.

(a) The Popular Parties agree to minimum annual service revenue (the “Annual Minimum”) for all Services under this Master Agreement, payable on a monthly basis in an amount not to exceed the amounts described below (the “Monthly Benchmark”) and subject to adjustment in accordance with this Section 2.2 and pro-ration in the case of any partial months, as follows:

(i) with respect to the period from the Effective Date through September 30, 2025, the Monthly Benchmark shall be $14,166,667 (for clarity, based on an Annual Minimum equal to $170,000,000);

(ii) with respect to the period from October 1, 2025 through September 30, 2026, the Monthly Benchmark shall be $13,750,000 (for clarity, based on an Annual Minimum equal to $165,000,000); and

(iii) with respect to the period from October 1, 2026 through September 30, 2028, the Monthly Benchmark shall be $13,333,333 (for clarity, based on an Annual Minimum equal to $160,000,000).

(b) Shortfall Payments and Cap. If Covered Revenue for a particular month during the periods referenced in Section 2.2(a) is less than the applicable Monthly Benchmark, then EVERTEC will include the amount of such shortfall on the invoice for the relevant month (prorated for partial months during the Initial Term) (a “Shortfall Payment”); provided, however, that Shortfall Payments shall be invoiced solely to the extent that they would not result in the sum of (x) Covered Revenue with respect to the period from January 1 of the calendar year in which the invoice was given through the invoice date and (y) aggregate Shortfall Payments previously invoiced during such period exceeding aggregate Monthly Benchmarks with respect to such period.

(c) True-Up. If the sum of (x) the Covered Revenue plus (y) the aggregate Shortfall Payments made for the period beginning January 1 and ending June 30 or the period beginning July 1 and ending December 31 (each a “True-Up Calculation Period”) exceeds the aggregate Monthly Benchmarks for the True-Up Calculation Period, EVERTEC shall refund to the Popular Parties an amount equal to the sum of the amounts referred to in clauses (x) and (y) of

-29-

this sentence minus the aggregate Monthly Benchmarks for the True-Up Calculation Period (the “Bi-Annual True-Up”); provided, however, that the Bi-Annual True-Up shall be capped at an amount equal to the aggregate Shortfall Payments made for the applicable True-Up Calculation Period; provided, further, that the Shortfall Payments and Bi-Annual True-Up shall be calculated consistently with the illustrative calculation included as Exhibit H hereto. EVERTEC will deliver its proposed calculation of any Bi-Annual True-Up (including if such amount would equal $0, based on EVERTEC’s proposed calculation) not later than thirty (30) days following the end of each True-Up Calculation Period and will provide the Popular Parties with such supporting information for such calculation as the Popular Parties may reasonably request. The amount of any Bi-Annual True-Up, as calculated by the Popular Parties in good faith taking into account EVERTEC’s proposed calculation, will be applied as a credit against any amounts due to EVERTEC under this Master Agreement; provided, after June 30, 2028, and following any termination of this Master Agreement, the Popular Parties may elect to receive the Bi-Annual True-Up as a cash payment rather than a credit in which case EVERTEC will make such cash payment within thirty (30) days of a request from the Popular Parties. The amount of any Bi-Annual True-Up shall be subject to the fee dispute provisions set forth in this Master Agreement.

(d) Excluded and Imputed Revenue. “Covered Revenue” means, with respect to any period, the sum of all amounts payable to EVERTEC in connection with the Popular Parties’ receipt of Services or purchases from EVERTEC of other products or services under this Master Agreement; provided, however, that Covered Revenue shall be subject to adjustment as follows:

(i) The following amounts will be excluded in the calculation of Covered Revenue (i.e., such amounts will be disregarded in determining whether the Monthly Benchmark is met with respect to any particular month and in determining whether the Annual Minimum has been met):

(ii) The following amounts will be included in the calculation of Covered Revenue (i.e., such amounts will be deemed to have been paid to EVERTEC in determining whether the Monthly Benchmark is met with respect to any particular month):

-30-

(iii) The Monthly Benchmarks and the Annual Minimum are exclusive of taxes required to be paid by the Popular Parties in accordance with this Master Agreement.

-31-

(iv) The amount of any Service Level Agreement Credits will not alter the Monthly Benchmark for any month for purposes of the calculations in this Section 2.2. For the sake of clarity, credits under this Master Agreement, including any ordinary course Service Level Agreement Credits and Bi-Annual True-Ups and the credit delivered at the closing of the transactions contemplated under the Asset Purchase Agreement in accordance with Section 1.7 of the Asset Purchase Agreement, will be counted on a dollar-for-dollar basis toward the Monthly Benchmarks.

2.3 Service Personnel.

(a) EVERTEC agrees that it will (i) assign qualified, adequately trained, and efficient Personnel to the performance of the Services and (ii) cause such Personnel to use their Best Efforts to discharge EVERTEC’s obligations under this Master Agreement in an efficient and timely manner and to exercise reasonable care in performing the Services, subject to the terms, conditions and prices established in the corresponding Service Addendum or Statement of Work.

(b) EVERTEC shall provide reasonable access, if requested by the Popular Parties, to the relevant Personnel.

2.4 Service Level Agreement.

(a) The Services will be rendered in a commercially reasonable manner, in accordance with (i) the performance standards and service levels applicable to the particular Service in question and generally accepted industry practices and procedures used in performing services of a like-kind to the Services, but no less than with the same degree of care and diligence practiced prior to the Effective Date and (ii) unless agreed to otherwise in writing by the parties, the general terms and conditions and performance standards (“Service Levels”) in the Service Level Agreement attached hereto as Exhibit C (together with Schedule 1 to Exhibit C, the “Service Level Agreement”), which is incorporated into this Master Agreement by reference.

(b) Furthermore, the parties agree that EVERTEC’s performance levels and procedures for Services shall, unless otherwise mutually agreed to by the parties, be no less than the performance levels and procedures prior to the Effective Date or, to the extent any such Services were not provided to COMPANY, BPPR, and their respective Subsidiaries prior to the Effective Date, such Services shall be provided at Service Levels that are at least consistent with then prevailing industry standards.

(c) The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, if the Service is subject to Service Levels, such Service Levels will be set forth in Schedule 1 of the Service Level Agreement which will serve as a master list of all Service Levels applicable to the Services COMPANY, BPPR, and their respective Subsidiaries receive hereunder. The parties agree that Schedule 1 will be reviewed and updated on an ongoing

-32-

basis following the Effective Date. Any changes to the Service Levels set forth in Schedule 1 shall be agreed to by the parties by executing an amended and restated Schedule 1 clearly denoting the date any such changes become effective. The parties agree that they shall negotiate in good faith with respect to any disputes arising from the updating of Schedule 1.

2.5 Reports and Errors.

(a) COMPANY and BPPR will be responsible for reviewing and reconciling, the reports, statements, files, and any notice, correspondence or communication (collectively, the “Reports”) it or its Subsidiaries receives from EVERTEC and each of COMPANY and BPPR agrees to exercise Best Efforts to do so in a commercially reasonable time period taking into account any deadlines imposed by any Legal Requirements.

(b) Each of COMPANY and BPPR shall exercise Best Efforts to detect and inform EVERTEC in writing of any errors and/or discrepancies (“Errors”) in the Reports received from EVERTEC within a commercially reasonable time period taking into account any deadlines imposed by any Legal Requirements.

(c) The notice given by COMPANY or BPPR to EVERTEC shall specify and describe the Errors detected by COMPANY or BPPR, as the case may be, and the parties shall use their respective Best Efforts and cooperate with each other to obtain and/or provide to each other any available information that may be necessary, relevant and/or useful to identify the cause of any Errors and correct and resolve such Errors.

(d) EVERTEC shall exercise Best Efforts to correct, resolve and/or reprocess the Errors reported to EVERTEC by COMPANY or BPPR within a commercially reasonable time period.

(e) Any party may require that any controversy related to or arising under the provisions of this Section 2.5 be processed as a Dispute pursuant to Section 1.14, but in such case the Dispute shall be immediately addressed by each party’s Representative negotiating in good faith without having to comply with the Notice of Dispute and time periods set forth in Section 1.14.

2.6 Specifications for Services.

(a) Based on COMPANY’s and BPPR’s instructions, EVERTEC will establish the processing parameter settings, features and options (collectively, the “Specifications”) for the Services that will apply to COMPANY, BPPR, and their respective Subsidiaries (including all control and verification mechanisms utilized in each processing function related to the Services).

(b) The parties agree that unless otherwise agreed to in writing by the parties, the Specifications will be derived from or in compliance with the respective terms and conditions established or documented by the parties using means such as, but not limited to: (i) electronic systems used to register service requests; (ii) operational manuals of COMPANY, BPPR, or their respective Subsidiaries provided to EVERTEC; (iii) SOWs; (iv) service standard forms

-33-

provided by COMPANY and/or BPPR to EVERTEC; and (v) any other written instructions that may be provided by COMPANY or BPPR to EVERTEC from time to time; provided, that in the event any Specification is documented by the parties pursuant to clauses (i) – (v) in this Section 2.6(b) and such Specification relates to a recurring Service (as opposed to a definitive project), Exhibit B shall be amended to include such Specification and the corresponding fee agreed to by the parties.

(c) Changes to Specifications:

(i) To the extent a particular Service is provided solely to COMPANY, BPPR, and their respective Subsidiaries (and not to EVERTEC’s other customers), EVERTEC will disclose to COMPANY, and COMPANY will have a reasonable period of time to approve, all Specifications and modifications thereof before their activation in the production environment. If the Specifications or modifications are required by Legal Requirements, and COMPANY does not approve or provide alternative Specifications or modifications to EVERTEC, EVERTEC will not be responsible for any failure of such Service to comply with the applicable Legal Requirements.

(ii) In cases where EVERTEC makes a change to Specifications for Services provided to EVERTEC’s other customers, or in order to comply with this Master Agreement or Legal Requirements applicable to EVERTEC, EVERTEC will provide COMPANY and BPPR with reasonable prior written notice of the change and meet with COMPANY to address any concerns COMPANY may have about the change.

(iii) EVERTEC will perform system processing and provide the Services in accordance with the Specifications.

(d) Should the Specifications call for the use of software owned by or under license to EVERTEC, or should EVERTEC be required to procure hardware, software or other items in order to perform the Services in accordance with the Specifications, (i) COMPANY, BPPR, or one of their respective Subsidiaries may subscribe to a separate license agreement for such software; and/or (ii) without limiting EVERTEC’s responsibilities or liabilities under this Master Agreement, EVERTEC will pass through and assign to COMPANY, BPPR, or one of their respective Subsidiaries all warranties provided by the manufacturer(s) and/or licensor(s) of such items; provided, however that all disclaimers and/or limitations of liabilities relating to such software, hardware or other items will be deemed extended to include EVERTEC.

2.7 Modifications to Services.

(a) Subject to Section 8.2, EVERTEC reserves the right to change, modify, enhance or upgrade the manner in which it renders the Services, at any time, provided, however, that any change, modification, enhancement or upgrade does not adversely affect the functionality of the Services, the fees for such Service or the agreed upon Service Levels, as applicable, and provided that (i) EVERTEC provides written notice of such modification to COMPANY and BPPR at least forty-five (45) days prior to implementation of any such change, modification, enhancement or upgrade, (ii) such notice describes in reasonable detail the change, modification, enhancement or upgrade to be made by such modification and EVERTEC promptly answers any reasonable inquiries of COMPANY, BPPR, or one of their respective Subsidiaries regarding such

-34-

change, modification, enhancement or upgrade and (iii) neither COMPANY nor BPPR delivers a written notice to EVERTEC prior to such implementation that it reasonably believes that such change, modification, enhancement or upgrade would be likely to adversely affect its or one of its Subsidiaries’ compliance with applicable Legal Requirements.

(b) Any change, modification, enhancement or upgrade requested or required by COMPANY or BPPR that is not a Mandatory Enhancement or a Supplemental Mandatory Enhancement (a “Requested Enhancement”) will require written notice to EVERTEC. Upon receipt of such notice, EVERTEC will exercise Best Efforts to prepare and present to COMPANY or BPPR, as soon as possible, a written estimate of the costs for the Requested Enhancement and any adjustment in fees that may be necessary as a result thereof. EVERTEC’s Best Efforts will take into consideration the business needs of COMPANY, BPPR, and their respective Subsidiaries and any timeframes for implementation related thereto. COMPANY, BPPR, and their respective Subsidiaries may decide that the Requested Enhancement will not be developed by EVERTEC and this Master Agreement will continue in full force in effect under the then current terms and conditions, and COMPANY, BPPR, and their respective Subsidiaries shall, notwithstanding anything to the contrary contained in this Master Agreement but subject to the terms and conditions of the Technology Agreement, be permitted to develop such Requested Enhancement themselves or engage a Third Party, in each case at no cost or expense to EVERTEC. Following the completion of such development, EVERTEC shall, if requested by COMPANY or BPPR, cooperate in good faith and otherwise use its Best Efforts to implement the Requested Enhancement at the then present rates in Exhibit B. If implementation of the Requested Enhancement results in a material increase in costs to EVERTEC as opposed to the provision of the applicable Service without such Requested Enhancement, (i) EVERTEC will provide COMPANY and BPPR with a reasonably detailed explanation of the incremental costs for implementing and operating such Requested Enhancement and (ii) any adjustments to the fees necessary to address such incremental costs shall be agreed among the parties in good faith.

(c) Without limiting the terms in Sections 2.7(a) and (b), if EVERTEC intends to replace any product used to provide the Services under this Master Agreement with an alternate product, EVERTEC will provide COMPANY and BPPR with at least 180 days’ notice of the replacement.

2.8 Mandatory Enhancements.

(a) Subject to Section 8.2 and the remainder of this Section 2.8, EVERTEC will provide changes, modifications, enhancements or upgrades to the Services to ensure that those Services permit COMPANY, BPPR, or their respective Subsidiaries to comply with mandatory changes in COMPANY’s, BPPR’s, or their respective Subsidiaries’ applicable Legal Requirements, including as requested by COMPANY, BPPR or their respective Subsidiaries (the “Mandatory Enhancements”).

(b) EVERTEC shall notify COMPANY and BPPR of its intention to implement a Mandatory Enhancement as soon as practicable following EVERTEC’s becoming aware of such Mandatory Enhancement and, in the 30 days following such notice, shall (i) consult with COMPANY and BPPR, as well as other EVERTEC customers affected by the relevant Mandatory Enhancement, regarding the interpretation of the relevant Legal Requirements as well as

-35-

the strategy for implementation of the Mandatory Enhancement and (ii) provide an initial estimate of the potential applicable costs. If the Mandatory Enhancement is to be funded or used exclusively by or for COMPANY or BPPR or their Affiliates (an “Exclusive Mandatory Enhancement”), the Mandatory Enhancement will reflect COMPANY and BPPR’s interpretation and requirements for the Mandatory Enhancement. If the Mandatory Enhancement is not an Exclusive Mandatory Enhancement, the design and implementation of the Mandatory Enhancement shall be based on EVERTEC’s reasonable interpretation of any relevant Legal Requirement applicable to EVERTEC (taking into account input from COMPANY and BPPR) and its understanding of the Services affected thereby.

(c) EVERTEC may charge COMPANY or BPPR at the time and material rates set forth in Exhibit B, as applicable, for development hours expended on Mandatory Enhancements for COMPANY, BPPR, or any of their respective Subsidiaries on a prorated basis. The costs will be proportionately allocated among EVERTEC’s affected customers. Any such charges shall be disclosed to COMPANY and BPPR as soon as reasonably possible following the consultations described in Section 2.8(b), including a description of how they are to be calculated and allocated among COMPANY, BPPR, and their appropriate respective Subsidiaries, on the one hand, and EVERTEC’s other affected customers, on the other. If (i) COMPANY, BPPR or any applicable Subsidiary thereof inform EVERTEC in writing that they are not subject to the Legal Requirement that is the subject of a given Mandatory Enhancement within 30 days following EVERTEC’s notice in clause (b) above, or (ii) COMPANY or BPPR elect not to use the Mandatory Enhancement by provision of written notice within 45 days following EVERTEC’s notice in clause (b) above, COMPANY, BPPR, and their appropriate respective Subsidiaries shall not be charged any development fees for such enhancement and EVERTEC may determine, in its sole discretion, to not make such enhancement available to COMPANY, BPPR and their Subsidiaries.

(d) In the event that COMPANY, BPPR, or any of their respective Subsidiaries requests other changes, modifications, enhancements or upgrades to the Services that are different from or in addition to, but requested in connection with, Mandatory Enhancements (the “Supplemental Mandatory Enhancements”), then, provided EVERTEC agrees to make such changes, modifications, enhancements or upgrades (which agreement shall not be unreasonably delayed, withheld or conditioned), COMPANY, BPPR, or any of their respective Subsidiaries that request a Supplemental Mandatory Enhancement shall be charged a development fee at the time and material rates specified in Exhibit B, as applicable.

(e) EVERTEC may charge COMPANY, BPPR, or any of their respective Subsidiaries that request a Supplemental Mandatory Enhancement an ongoing usage fee for any new Service resulting from (i) Mandatory Enhancements (provided that if such Mandatory Enhancements are provided to EVERTEC’s other customers, such charges may be imposed solely to the extent charged to such other customers), or (ii) Supplemental Mandatory Enhancements.

(f) For the avoidance of doubt, COMPANY, BPPR, or any of their respective Subsidiaries can develop themselves or use a Third Party for any Requested Enhancement, Mandatory Enhancement or a Supplemental Mandatory Enhancement; subject to and in accordance with Section 2.1(c).

-36-

2.9 Non-Circumvention Covenants.

(a) EVERTEC agrees that it shall not, and shall cause its Affiliates not to, directly initiate or procure any negotiations or contacts with any Client of COMPANY, BPPR, or any of their respective Subsidiaries that are designed or intended to:

(i) induce, cause, or propose to any such Client to terminate any of the accounts and/or any other business relationships such Client may have directly with COMPANY, BPPR, or any of their respective Subsidiaries (including accounts or relationships for which COMPANY, BPPR, or any of their respective Subsidiaries shall have engaged EVERTEC to provide any of the Services), or

(ii) induce, cause, or propose to any Client of COMPANY, BPPR, or any of their respective Subsidiaries to (A) reduce or curtail the amount or type of services or goods that COMPANY, BPPR, or any of their respective Subsidiaries provides or sells to such Client, (B) reduce the amount of business with, prices paid by, or revenue from, a Client or (C) to seek to transfer such accounts and/or business relationships from COMPANY, BPPR, or their respective Subsidiaries to another Person.

(b) The Popular Parties agree that they shall not, nor cause any of their respective Subsidiaries to, directly initiate or procure any negotiations or contacts with any of EVERTEC’s clients to which EVERTEC provides services that are substantially similar to the Services provided to the Popular Parties under this Master Agreement or any service providers of EVERTEC identified on Schedule 2.9 with respect to the application(s) listed for each such service provider in Schedule 2.9 that are designed or intended to:

(i) induce, cause, or propose to any such client or service provider to terminate any of the accounts and/or any other business relationships such client or service provider may have directly with EVERTEC, or

(ii) induce, cause, or propose to any such client or service provider of EVERTEC to (A) reduce or curtail the amount or type of services or goods that EVERTEC provides or sells to such client or receives from such service provider, (B) reduce the amount of business with, prices paid to, or revenue from, a client, (C) reduce the amount of business with, or increase the prices paid to a service provider, or (D) seek to transfer such accounts and/or business relationships from EVERTEC to another Person;

(iii) provided, that the mere fact that COMPANY, BPPR, or one of their respective Subsidiaries shall have engaged EVERTEC to provide any of the Services to its Clients will not cause such Clients to be considered “clients” or “accounts” and/or “business relationships” of EVERTEC for purposes of this Section 2.9.

(c) Nothing in this Section 2.9 shall be interpreted to preclude or prevent either party from (i) distributing marketing materials on its products and services to the general public; (ii) engaging one or more third parties to provide services to such party in connection with a transition or termination of the Services or services provided under other agreements between the parties; or (iii) responding to requests for products and services from the other party’s respective

-37-

clients or other Persons, but, in the case of EVERTEC, subject to the limitations imposed under Section 2.10(a). In addition, nothing in paragraphs (a) or (b) of this Section 2.9 shall be interpreted to preclude or prevent EVERTEC from entering into any agreement with a Person in the same industry or a similar industry which offers similar products or services as COMPANY (a “Competitor”) pursuant to which such Competitor will provide to its clients any one or more services similar to the Services; provided, however, that EVERTEC in its dealings with such Competitor shall at all times comply with its confidentiality obligations under this Master Agreement. The provision of services pursuant to the ISO Agreement or pursuant to an exception expressly set forth in the ISO Agreement will not be deemed a breach of this provision.

(d) Neither party shall instruct or intentionally procure a third party to take actions that would, if taken by such party directly, violate this Section 2.9.

2.10 Non-Compete Covenants.

(a) Notwithstanding the provisions of Section 2.9, EVERTEC agrees that, without COMPANY’s, or its relevant Subsidiary’s, prior written consent, it shall not offer, provide or market any of the Restricted Payment Processing Services (as defined below) to any of the Strategic Clients (as defined below). With respect to Restricted Payment Processing Services for which COMPANY or its relevant Subsidiaries have provided such written consent, the parties agree that they shall cooperate with each other to provide, offer and market the Restricted Payment Processing Services to Strategic Clients. In the event that BPPR ceases to offer a service included in the definition of “Restricted Payment Processing Services” to a Strategic Client, such service shall no longer be included in the list of Restricted Payment Processing Services with respect to such Strategic Client, and EVERTEC shall be permitted to offer such service to such Strategic Client without any restriction. In the event that BPPR offers any service not provided by EVERTEC that has features and functionalities that are materially similar to those of any service included in the definition of “Restricted Payment Processing Services” to any of its clients, such service shall no longer be included in the list of Restricted Payment Processing Services and EVERTEC shall be permitted to offer such service without any restriction.

(b) For purposes of this Section 2.10(b):

(i) “Restricted Payment Processing Services” means the payment processing services offered by COMPANY, BPPR, or one of their respective Subsidiaries to Clients as of the Effective Date, and that are listed below:

-38-

(ii) “Strategic Clients” means the Clients listed in Exhibit D hereto, which shall be subject to the provisions of this Section 2.10 so long as such Clients maintain an account and/or business relationship with COMPANY, BPPR, or one of their respective Subsidiaries. Exhibit D may be amended only with the prior written consent of COMPANY and EVERTEC.

2.11 Equipment and Other Resources.

(a) EVERTEC will retain all right, title or interest in any EVERTEC equipment supplied to COMPANY, BPPR, or any of their respective Subsidiaries as part of the Services (“EVERTEC Equipment”), and no ownership rights in such EVERTEC Equipment will transfer to COMPANY, BPPR, or any of their respective Subsidiaries. COMPANY, BPPR, and their respective Subsidiaries will, as applicable, provide a suitable and secure environment, free from environmental hazards, and electric power for such EVERTEC Equipment located in premises operated or controlled by COMPANY, BPPR, or one of their respective Subsidiaries, and will keep EVERTEC Equipment free from all liens, charges, and encumbrances. COMPANY, BPPR, and their respective Subsidiaries, as applicable, will bear the risk of loss of or damage to EVERTEC Equipment (ordinary wear and tear excepted) from any cause except to the extent caused by EVERTEC or its suppliers. COMPANY, BPPR, and their respective Subsidiaries agree that they will not remove, relocate, modify, or interfere with EVERTEC Equipment, or attach EVERTEC Equipment to non-EVERTEC equipment without prior written authorization from EVERTEC.

(b) Title to and risk of loss of any equipment purchased from EVERTEC will pass to COMPANY, BPPR, or their respective Subsidiaries as of delivery, upon which date EVERTEC will have no further obligations of any kind with respect to such purchased equipment, except as set forth in a document executed by the appropriate parties.

(c) All ownership or leasehold interest in a party’s facilities, and associated equipment used in connection with the Services, will at all times remain with that party.

-39-

(d) If any equipment, software or other COMPANY Third Party Intellectual Property or other Intellectual Property of COMPANY, BPPR, or any of their respective Subsidiaries (“COMPANY Resources”) is made available by COMPANY or BPPR to EVERTEC under this Master Agreement: (i) COMPANY, BPPR, or their appropriate respective Subsidiaries, hereby grants EVERTEC a non-transferable and non-exclusive license to use such COMPANY Resources solely in the manner necessary to provide the Services under this Master Agreement, subject to any restrictions and other terms in the BPPR Pass Through Licenses or that otherwise may be provided in this Master Agreement or by COMPANY or BPPR to EVERTEC in writing; and (ii) EVERTEC will not use or access the COMPANY Resources for any purpose other than providing the Services under this Master Agreement.

2.12 Import/Export Control.

(a) The parties acknowledge that equipment, products, software, and technical information (including technical assistance and training) provided under this Master Agreement may be subject to import or export laws, conventions or regulations, and any use or transfer of the equipment, products, software, and technical information must be in compliance with all such laws, conventions and regulations. The parties will not use, distribute, transfer, or transmit the equipment, products, software, or technical information (even if incorporated into other products) except in compliance with such laws, conventions and regulations. If requested by either party, the other party agrees to sign written assurances and other documents as may be required to comply with such laws, conventions and regulations.

(b) In the event any necessary import or export license cannot be obtained within six (6) months after making an application, no party will have further obligations with respect to providing or purchasing and, if applicable, COMPANY, BPPR, or one of their respective Subsidiaries will return the equipment, products, software, or technical information that is the subject matter of the unsuccessful application.

2.13 Contingency Planning.

(a) Each party acknowledges that it is responsible for maintaining in effect at all times during the Term appropriate Business Continuity Plans for their respective Systems, personnel, and operations in compliance with applicable Legal Requirements and Industry Standards.

(b) EVERTEC represents and warrants that it:

(i) has, as of the Effective Date, and shall at all times during the Term maintain updated Business Continuity Plans designed to minimize the risks associated with an Event affecting EVERTEC’s ability to continue to provide the Services in compliance with this Master Agreement;

(ii) will implement its applicable Business Continuity Plans upon the occurrence of an Event; and

-40-

(iii) shall resume the affected Services within the Recovery Time Objectives and Recovery Point Objectives established as of the Effective Date, including those provided in Disaster Recovery Services Addendum or other applicable SOWs and Schedules, or as may subsequently be agreed to between the parties for the Services.

(c) EVERTEC may continue using its alternate site in Puerto Rico solely for Services covered by that site as of the Effective Date until the parties agree in an SOW to migrate those Services to another site outside of Puerto Rico. EVERTEC will use alternate sites located outside of Puerto Rico for any additional Services added to the Business Continuity Plan.

(d) The Business Continuity Plans must include a Disaster Recovery Plan and a Disaster Recovery Strategy. Such Business Continuity Plans must address, at a minimum, responsibilities and required skills for Personnel and Third Party service providers; solutions to foreseeable disruptions, including those emanating from cyber threats; escalation thresholds; immediate steps to protect Personnel and customers and minimize damage; prioritization and procedures to recover functions, services, and processes; critical information protection (e.g., physical, electronic, hybrid, and use of off-site storage); logistical arrangements (e.g., housing, transportation, or food) for Personnel at the recovery locations; network equipment, connectivity and communication needs, including entity-owned and personal mobile devices; Personnel at alternate Data Center sites, including arrangements for those permanently located at the alternate Data Center facility; remote access from home; scope and frequency of testing; and resumption of a normalized state for business processes.

(e) EVERTEC will review and, if necessary to reflect changes in the Services and to remain in compliance with the requirements in this Master Agreement, update its Business Continuity Plans at least once each year. Such updates shall (i) take into account any audits and test results, as well as changes to applicable Legal Requirements and Industry Standards; and (ii) not increase RTO or RPO times without BPPR’s prior written consent.

(f) EVERTEC will provide BPPR with a summary of its Business Continuity Plans in effect on the Effective Date and will promptly provide BPPR with an updated summary upon any amendment thereof. Upon request, EVERTEC will also provide BPPR with access to the full Business Continuity Plans for review on-site or via another secure method agreed by the parties. Without BPPR’s prior written consent, EVERTEC will not make any amendments to its Business Continuity Plans that adversely affect BPPR’s rights under this Master Agreement or the Recovery Time Objectives or Recovery Point Objectives agreed to with BPPR.

(g) EVERTEC will test the operability of its Business Continuity Plans, including all Systems and operations that support the Services, in the main and alternate Data Center sites, as well as the integrity of its applicable backup processes, at least once each year. Within thirty (30) days after any Business Continuity Plan tests are conducted, EVERTEC will provide a summary of the results to BPPR; provided that (i) provision of such summary by EVERTEC shall be subject to, and limited by, applicable Legal Requirements, (ii) EVERTEC may redact from such results information relating to EVERTEC’s internal business or to EVERTEC’s other customers (to the extent the information does not also relate to COMPANY or BPPR), and (iii) EVERTEC shall not be obligated to provide any information if doing so would reasonably be expected to result in the waiver of any attorney-client or other legal privilege.

-41-

(h) Upon COMPANY’s or BPPR’s reasonable request, EVERTEC shall make available to COMPANY or BPPR one or more Representatives who are knowledgeable about the Business Continuity Plans to respond to questions concerning EVERTEC’s Business Continuity Plans, the manner in which they are tested and the manner in which they would be implemented in an Event. In the event that COMPANY or BPPR determines that applicable Legal Requirements require additional disaster recovery services or modifications to EVERTEC’s existing Business Continuity Plans, EVERTEC agrees to cooperate with COMPANY and BPPR in assuring that its Business Continuity Plans comply with applicable Legal Requirements in accordance with Sections 8.1 and 8.2.

(i) In addition to its own Business Continuity Plans, EVERTEC shall verify that its Data Subcontractors have documented plans providing appropriate terms for the implementation, maintenance and performance of their own business continuity and disaster recovery efforts related to the portion of the Services they provide and use Best Efforts to ensure that such plans are tested at least annually.

(j) If the Services or any portion thereof are affected by an Event, EVERTEC will notify BPPR’s designated authorized representative as soon as practicable (and in any event within the timeframe required in the applicable SOW or Schedule or otherwise agreed with BPPR) after the activation of its Business Continuity Plan(s). If an Event gives rise to a business interruption that renders EVERTEC unable to provide the Services, or a critical portion thereof, and such interruption is expected to remain, or remains, unresolved for longer than the applicable RTO for the relevant Service BPPR may, in addition to other remedies provided in this Master Agreement, procure such Service from a Third Party without penalty, and upon request, EVERTEC will provide its cooperation in the transfer of the related activities and databases to another service provider without cost to BPPR for the duration of such business interruption.

2.14 Procedures Manual.

(a) Subject to Sections 2.14(b), 2.14(c) and 2.14(d), EVERTEC will prepare and maintain a current set of documents that describe how EVERTEC provides, and COMPANY, BPPR and their Subsidiaries receive, the Services provided under this Master Agreement, and how the Services are integrated with COMPANY’s, BPPR’s and their Subsidiaries’ Systems and processes (including escalation procedures and contacts, applicable processing schedules, operations processes and manuals, user guides, applicable Specifications, equipment and software used and knowledge repositories) (collectively, the “Procedures Manual”).

(b) To the extent components of the Procedures Manual do not exist as of the Effective Date, EVERTEC will create them either as a project under an SOW or as part of the Transition Assistance provided under Section 9.5, in each case at COMPANY’s or BPPR’s cost. COMPANY or BPPR may request updates to the Procedures Manual on an annual basis pursuant to an SOW.

(c) EVERTEC will provide COMPANY and BPPR with the Procedures Manual during any applicable Transition Period and otherwise upon request during the Term.

-42-

(d) With respect to proprietary EVERTEC applications, EVERTEC will provide information about how COMPANY and BPPR use the products and receive the Services (e.g., configurations, integrations, escalation procedures, and rules specific to COMPANY and BPPR) but will not be required to provide Proprietary Application Information. “Proprietary Application Information” means Confidential Information about EVERTEC’s internal processes and procedures, software code, or other proprietary service delivery materials, in each case as they relate to proprietary EVERTEC applications.

ARTICLE THREE– PAYMENT FOR SERVICES

3.1 Fees.

(a) In consideration for EVERTEC providing COMPANY, BPPR, and their respective Subsidiaries the Services, each of COMPANY and BPPR agrees to pay, or cause one of its respective Subsidiaries to pay, EVERTEC the corresponding fees set forth in Exhibit B, subject to adjustment as set forth in Section 3.1(b). The parties agree that regardless of whether a Service is set forth in a Service Addendum or not, the pricing relative to any and all Services will be set forth in Exhibit B, which will serve as a master list of the Services and corresponding pricing. The parties agree that Exhibit B will be reviewed and updated on an ongoing basis following the Effective Date hereof. Any changes to the fees set forth in Exhibit B (other than the adjustments described in Section 3.1(b)) shall be agreed to by both parties by executing an amended and restated Exhibit B clearly denoting the date any such changes become effective.

(b) The fees set forth in Exhibit B shall be adjusted annually as follows:

(i) on September 30 of each of 2022, 2023, 2024 and 2025, the fees will be adjusted for changes in the CPI in the prior twelve (12) months; provided that the fee adjustment cannot be negative, nor can it exceed one and one half percent (1.5%) per annum; and

(ii) on September 30 of any year thereafter, the fees will be adjusted based on the following formula: any changes in the CPI in the prior twelve (12) months less 2%; provided that the fee adjustment cannot be negative, nor can it exceed two percent (2%) on any given year.

(c) Notwithstanding anything in this Master Agreement to the contrary, (i) fees charged under the ATH Network Agreement shall be subject to CPI adjustments under such agreement and not under Section 3.1(b), it being understood, for clarity, services provided under the ATH Network Agreement shall not be included on Exhibit B, and (ii) no adjustment pursuant to Section 3.1(b) shall apply to fees charged with respect to any Service that has been provided for less than twelve (12) months prior to the applicable annual adjustment under this Master Agreement unless otherwise agreed to in writing.

-43-

(d) All fees set forth in Exhibit B or elsewhere in this Master Agreement or an SOW will be reduced by ten percent (10%) from their then current amounts effective October 1, 2025, unless an applicable SOW executed after the Effective Date specifically states that will not be subject to this adjustment. For clarification, the reduced fees will remain subject to the adjustments set forth in Section 3.1(b)(ii) above in subsequent years.

3.2 Terms of Payment. EVERTEC will send an invoice directly to COMPANY, on or before the fifteenth (15^th) day of the month following the month in which the Services are rendered, reflecting the fees and other charges to COMPANY, BPPR, and their respective Subsidiaries for the preceding month. COMPANY, BPPR, or one of their respective Subsidiaries, as stated on the invoice, will pay to EVERTEC all undisputed amounts due under this Master Agreement within thirty (30) days from the date of receipt of the invoice, unless otherwise agreed to by the parties for a particular Service in writing. Any undisputed amount due under this Master Agreement that is not paid when due will thereafter bear interest at an annual rate of interest equal to one and a half percent (1.5%), but in no event shall exceed the maximum rate of interest allowed under any Legal Requirement. COMPANY and BPPR agree that, if any properly submitted invoice remains unpaid and undisputed for a period exceeding sixty (60) days, EVERTEC may (i) refuse to provide the Services until such time as all past due amounts are paid in full or (ii) terminate this Master Agreement in accordance with and subject to Section 9.2(a)(ii).

3.3 Services Rendered during Legal Holidays. Unless agreed to otherwise in writing, upon request of COMPANY or BPPR, and provided EVERTEC has available resources to comply therewith, EVERTEC will provide the Services to COMPANY, BPPR, and their respective Subsidiaries during Legal Holidays for the fees set forth in Exhibit B or the corresponding Service Addendum, as applicable.

3.4 Additional Services. If COMPANY, BPPR, or one of their respective Subsidiaries’ fail to perform their respective responsibilities under this Master Agreement, EVERTEC will promptly notify COMPANY and BPPR of the failure. If COMPANY and BPPR do not remediate the failure after receiving such notice, EVERTEC may charge COMPANY and BPPR for out-of-pocket costs EVERTEC is required to incur to perform services over and above the Services listed in Exhibit B of this Master Agreement as a result of COMPANY and BPPR’s failure (e.g., costs for computer and personnel time, equipment, supplies, and other items). EVERTEC will obtain COMPANY or BPPR written approval prior to incurring any such expenses; provided that until such approval is obtained EVERTEC shall not be responsible for performing any of the affected Services.

3.5 Out-of-pocket and Third Party Expenses. With COMPANY’s or BPPR’s prior written approval, additional costs related to delivery and/or collection, telecommunications (other than the telecommunication installation and maintenance services set forth in Exhibit B) or other incidental services, as well as necessary and reasonable services to be provided through EVERTEC by Third Parties, for COMPANY, BPPR, or one of their respective Subsidiaries’ benefit, incurred during the Term and that are not contemplated in any of the established fees, costs, or charges, will be paid by COMPANY, BPPR, or one of their respective Subsidiaries, as applicable, when invoices and related documents are duly presented. All such out-of-pocket or Third Party charges and administration costs related to the Services will be billed by EVERTEC to COMPANY, BPPR, or one of their respective Subsidiaries at an amount equal to cost; provided that to the extent COMPANY, BPPR, or one of their respective Subsidiaries sets forth any limitations on such charges and costs, COMPANY, BPPR, and their respective Subsidiaries shall not be billed for amounts in excess of such limitations.

-44-

3.6 Taxes. EVERTEC will be solely responsible for the payment of any income tax, gross receipt tax or municipal license tax related to the fees and charges paid by the Popular Parties under this Master Agreement. If the Popular Parties are required by any Legal Requirements to withhold taxes on the fees and charges paid to EVERTEC, the Popular Parties will deduct such taxes and pay them to the appropriate taxing authority unless EVERTEC provides evidence of an exemption or waiver. The Popular Parties will provide EVERTEC proof of payment of the taxes attributable to the Services rendered under this Master Agreement as provided by applicable Legal Requirements. Notwithstanding the foregoing, the Popular Parties’ failure to withhold any applicable taxes, in whole or in part, will not relieve EVERTEC of its responsibility to pay any such taxes when due. The Popular Parties will be responsible for the payment of sales and use taxes, value added, and any other tax as provided by applicable law or regulation and related to the fees and charges paid to EVERTEC. When applicable, EVERTEC will include such sales and use taxes, or any other applicable tax, as a separate line item on all applicable invoices.

3.7 Disputed Charges; Requests for Information.

(a) Each of COMPANY, BPPR, and their respective Subsidiaries may withhold payment of specific charges within a given invoice that it in good faith disputes or for which it may require additional information from EVERTEC to verify the amounts being charged, provided that COMPANY, BPPR, or such Subsidiary delivers to EVERTEC a written statement on or before the date in which such payment is due, describing in reasonable detail (i) the specific charge or charges being disputed and the basis of the dispute, (ii) if applicable, the supporting documentation that is reasonably required for verification of the charge or charges, and (iii) the amount being withheld.

(b) A charge will be deemed “undisputed” if COMPANY, BPPR, and their respective Subsidiaries do not deliver the aforementioned written statement within the time period provided in this Section 3.7.

(c) Notwithstanding the foregoing, the parties will have the right to review invoices generated hereunder and claim any under charged or over paid amounts. The parties shall make any such claims within one hundred and twenty (120) days following the date of the invoice.

(d) Any Dispute related to the charges or fees payable under this Master Agreement, if not settled by the parties, shall be resolved in accordance with Section 1.14 hereof.

3.8 Supporting Documentation. EVERTEC will maintain, at its sole cost, supporting documentation for the amounts billable to, and payments made by, COMPANY, BPPR, and their respective Subsidiaries hereunder in accordance with its practices prior to the Effective Date and applicable record retention requirements. COMPANY and BPPR will have the right to request supporting documentation of any invoice submitted, paid or disputed, at any time, and EVERTEC agrees to cooperate by providing such the supporting documentation at no cost. For the sake of clarity, invoices may only be disputed during the time period provided in Section 3.7.

-45-

3.9 No Right to Set-Off. COMPANY, BPPR, and their respective Subsidiaries shall pay to EVERTEC the full amount of undisputed charges and any disputed charges that are resolved in favor of EVERTEC and other amounts required to be paid by COMPANY, BPPR, and their respective Subsidiaries under this Master Agreement and COMPANY, BPPR, and their respective Subsidiaries shall not set-off, counterclaim or otherwise withhold any amount owed or claimed to be owed to EVERTEC under this Master Agreement on account of any obligation owed by EVERTEC or any of its Subsidiaries, whether or not such obligation has been finally adjudicated, settled or otherwise agreed upon in writing.

3.10 Core API Layer SOW

(a) The parties agree as follows, notwithstanding anything in this Master Agreement to the contrary:

(i) Twenty percent (20%) of all fees otherwise payable to EVERTEC pursuant to the Core API Layer SOW shall be withheld until EVERTEC has delivered 100% of all Core Banking APIs (as defined in the Core API Layer SOW), has completed all database integrations required under the Core API Layer SOW, and has exposed all APIs required to be exposed on the Amazon Web Services environment as required thereunder, and BPPR has received a certification from a mutually agreed third-party regarding the delivery of 100% of all Core Banking APIs (the “Core API Completion”). If the Core API Completion has not occurred on or prior to the Core API Deadline, then (A) thirty five percent (35%) of any fees otherwise payable pursuant to the Core API Layer SOW after the Core API Deadline shall be withheld until the Core API Completion. Any amount withheld by BPPR in accordance with this Section 3.10(a)(i) shall not exceed $500,000 and will be paid by BPPR promptly following the Core API Completion.

(ii) Subject to Section 3.10(c), if the Core API Completion has not occurred on or prior to the Core API Deadline, then BPPR shall be entitled to be paid the following amounts from EVERTEC, each of which amounts shall begin accruing with the month immediately following the month in which the Core API Deadline occurs: (x) fifty thousand dollars ($50,000) for each of the first three (3) months; (y) one hundred thousand dollars ($100,000) for each of fourth (4th) through sixth (6th) months; and (z) one hundred fifty thousand dollars ($150,000) for each month thereafter. Any amount which BPPR is entitled to be paid in accordance with this Section 3.10(a)(ii) will be applied as a credit against any amounts due to EVERTEC under this Master Agreement; provided, that after June 30, 2028, and following any termination of this Master Agreement, BPPR may elect to receive such amount as a cash payment rather than a credit in which case EVERTEC will make such cash payment within thirty (30) days of a request from BPPR.

-46-

(b) The Popular Parties’ rights under this Section 3.10 are in addition to, and shall in no way limit, the Popular Parties’ termination rights under Section 9.3(d)(i) in connection with a failure to meet the Core API Deadline. In no event shall the Popular Parties’ exercise of its rights under this this Section 3.10 or Section 9.3(d)(i) diminish or waive in any manner Popular Parties’ rights under the Core API Layer SOW or EVERTEC’s obligations thereunder.

-47-

3.11 Phase 2 SOW. Each party shall use commercially reasonable efforts to complete, execute and deliver the Phase 2 SOW as promptly as practicable after the date hereof and in any case within sixty (60) days after the date hereof. All out-of-pocket and internal costs incurred by the parties in connection with the Phase 2 SOW shall be borne fifty percent (50%) by the Popular Parties and fifty percent (50%) by EVERTEC.

ARTICLE FOUR– DISCLAIMER OF WARRANTIES & LIMITED LIABILITY

4.1 DISCLAIMER OF WARRANTIES. EXCEPT AS EXPLICITLY PROVIDED IN THIS MASTER AGREEMENT (INCLUDING IN ANY SERVICE ADDENDUM OR EXHIBIT):

-48-

4.2 Reliance on COMPANY Provided Data. In performing the Services, EVERTEC will be entitled to rely upon the data, information, instructions, or Specifications provided by COMPANY, BPPR, and their respective Subsidiaries and, therefore, will not be liable to COMPANY, BPPR, and their respective Subsidiaries in the same accord as set forth herein as a limitation of liability, should EVERTEC perform in accordance with such data, information or instructions received from COMPANY, BPPR, and their respective Subsidiaries. If any error results from incorrect input supplied by COMPANY, BPPR, and their respective Subsidiaries, COMPANY, BPPR, and their appropriate respective Subsidiaries will be responsible for discovering and reporting such error and supplying the data necessary to correct such error to EVERTEC, in which case, EVERTEC will exercise Best Efforts to correct the error at COMPANY, BPPR, and their appropriate respective Subsidiaries’ sole expense.

4.3 Force Majeure.

(a) Subject to Section 4.3(b) below, neither party will be liable under this Master Agreement as a result of any delay or failure in the performance of its obligations (except for payment of money) to the extent such performance is prevented, frustrated, hindered or delayed as a result of an extraordinary event that is beyond the party’s reasonable control, including strikes, shortages, riots, fires, floods, storms, hurricanes, epidemics, pandemics, earthquake, acts of God, hostilities or other similar events or disasters, and actions taken by Governmental Authorities in response thereto (including any quarantine, ‘shelter in place,’ ‘stay at home,’ shut down, closure, sequester or similar Legal Requirement); provided, that the non-performing party is without material fault in causing such delay or failure (a “Force Majeure Event”).

(b) This Section 4.3 exclusion of liability will only apply if, and to the extent, the party experiencing the Force Majeure Event exercises Best Efforts to mitigate and minimize the impact of the event on its obligations and follows its Business Continuity Plan, if applicable. The non-performing party will be excused from performance of the obligations so affected (including any obligations with respect to applicable Service Levels) for as long as such circumstances prevail, and the non-performing party continues to use Best Efforts to recommence performance.

(c) In the event of an occurrence of a Force Majeure Event, the affected party shall give notice of suspension to the other party’s designated authorized representative as soon as reasonably practicable after the activation of the Business Continuity Plan or of becoming aware of such Force Majeure Event, stating the date and extent of such suspension and the cause thereof, and the affected party shall resume the performance of such obligations as soon as reasonably practicable after the removal of such cause. If a Force Majeure Event lasts more than fourteen (14) days, BPPR shall (i) not be required to pay for Services it does not receive; and (ii) be entitled to seek (at BPPR’s own expense) an alternative service provider on a temporary basis with respect to any Service(s) that EVERTEC is unable to provide. EVERTEC shall support such temporary transition. COMPANY and BPPR may terminate any Service upon notice to EVERTEC if EVERTEC is unable to provide the Service for more than 30 days as a result of a Force Majeure Event.

-49-

4.4 Systems and/or Services Not Provided by EVERTEC. To the extent COMPANY, BPPR, or their respective Subsidiaries perform any services themselves or use their own software, hardware, communications devices, Internet services, e-mail systems or other systems or, in the alternative, retain Third Parties to provide such services and systems, the parties acknowledge and agree that terms of this Master Agreement will not be deemed to impose on EVERTEC any obligation to obtain from owners of such systems any licenses or agreements that are necessary in order for EVERTEC to interface the Services with such systems. Nor will EVERTEC have any responsibility or liability in connection with such services or systems not provided by EVERTEC. COMPANY, BPPR, or their respective Subsidiaries will be solely responsible for the installation, operation, maintenance, use, and compatibility of such systems and services. In the event that such systems or services impair COMPANY, BPPR, and their respective Subsidiaries’ use of any Services: (a) COMPANY, BPPR, and their respective Subsidiaries will nonetheless be liable for payment for such Services provided by EVERTEC, and (b) any Specifications generally applicable to the Services will not apply to the extent they are affected by such impairment.

4.5 LIMITATION OF LIABILITY.

(a) EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, EVERTEC AND ITS SUBSIDIARIES SHALL NOT BE LIABLE TO COMPANY, BPPR, OR ANY OF THEIR RESPECTIVE AFFILIATES PURSUANT TO THIS MASTER AGREEMENT FOR (1) ANY SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, REMOTE OR SPECULATIVE DAMAGES OR LOSSES, INCLUDING LOSS OF PROFITS OR ANTICIPATED PROFITS, OR ROYALTIES, INCLUDING ANY SUCH DAMAGES OR LOSSES THAT ARISE IN CONNECTION WITH ANY LOST DATA, OR (2) ANY OTHER BUSINESS OR OTHER ECONOMIC LOSS ARISING FROM OR RELATED TO ANY EQUIPMENT OR SOFTWARE OR ANY SERVICES, INCIDENTAL OR OTHERWISE, PROVIDED BY THIRD PARTIES (EXCEPT THOSE SERVICES PROVIDED BY A CONTRACTOR OR A SUBCONTRACTOR OF EVERTEC UNDER SECTION 1.16), OR (3) ANY THIRD PARTY CLAIM (EXCEPT AS OTHERWISE PROVIDED IN ARTICLE SEVEN, ARTICLE TEN, OR ANY OTHER INDEMNIFICATION OBLIGATIONS IN THIS MASTER AGREEMENT), IN EACH CASE (I) WHETHER FOR, AMONG OTHER THINGS, SUCH PARTY’S NEGLIGENCE OR MISCONDUCT, BREACH OF WARRANTY OR ANY OBLIGATION ARISING THEREFROM; (II) WHETHER LIABILITY IS ASSERTED IN, AMONG OTHER THINGS, CONTRACT OR TORT (INCLUDING NEGLIGENCE AND STRICT PRODUCT LIABILITY); (III) WHETHER OR NOT FORESEEABLE; AND (IV) WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE.

(b) EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE, COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES SHALL NOT BE LIABLE TO EVERTEC OR ITS AFFILIATES PURSUANT TO THIS MASTER AGREEMENT FOR (1) ANY SPECIAL, EXEMPLARY, PUNITIVE, CONSEQUENTIAL, REMOTE OR SPECULATIVE DAMAGES OR LOSSES, INCLUDING LOSS OF PROFITS OR ANTICIPATED PROFITS, OR ROYALTIES, INCLUDING ANY SUCH DAMAGES OR LOSSES THAT ARISE IN CONNECTION WITH ANY LOST DATA; (2) ANY OTHER BUSINESS OR OTHER ECONOMIC LOSS, IN EACH CASE, ARISING FROM OR RELATED TO ANY EQUIPMENT OR SOFTWARE NOT PROVIDED BY COMPANY, BPPR, OR THEIR

-50-

RESPECTIVE SUBSIDIARIES, OR ANY SERVICES, INCIDENTAL OR OTHERWISE, PROVIDED BY THIRD PARTIES (EXCEPT THOSE SERVICES PROVIDED BY A CONTRACTOR OR SUBCONTRACTOR OF COMPANY, BPPR OR THEIR SUBSIDIARIES), OR (3) ANY THIRD PARTY CLAIM (EXCEPT AS OTHERWISE PROVIDED IN ARTICLE TEN OR ANY OTHER INDEMNIFICATION OBLIGATIONS IN THIS MASTER AGREEMENT), IN EACH CASE, (I) WHETHER FOR, AMONG OTHER THINGS, SUCH PARTY’S NEGLIGENCE OR MISCONDUCT, BREACH OF WARRANTY OR ANY OBLIGATION ARISING THEREFROM; (II) WHETHER LIABILITY IS ASSERTED IN, AMONG OTHER THINGS, CONTRACT OR TORT (INCLUDING NEGLIGENCE AND STRICT PRODUCT LIABILITY); (III) WHETHER OR NOT FORESEEABLE; AND (IV) WHETHER OR NOT SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE.

(c) EXCEPT FOR WILLFUL MISCONDUCT OR GROSS NEGLIGENCE OR TO THE EXTENT OTHERWISE PROVIDED UNDER ANY APPLICABLE LEGAL REQUIREMENTS, EACH PARTY’S LIMIT OF LIABILITY UNDER THIS MASTER AGREEMENT WILL BE AN AGGREGATE ANNUAL LIMIT EQUAL TO THE AMOUNT OF PAYMENTS MADE TO EVERTEC BY COMPANY, BPPR, AND THEIR RESPECTIVE SUBSIDIARIES FOR THE SERVICE FOR WHICH THE LIABILITY RELATES DURING THE TWELVE MONTHS PRIOR TO THE ACT, OMISSION OR EVENT THAT GIVES RISE TO THE CLAIM FOR LIABILITY (THE “GENERAL LIABILITY CAP”). NOTWITHSTANDING THE FOREGOING, FOR (X) LOSSES RELATED TO BREACHES OF CONFIDENTIALITY, PRIVACY AND DATA PROTECTION OBLIGATIONS UNDER THIS MASTER AGREEMENT AND THE ATH NETWORK AGREEMENT AND (Y) BPPR DATA BREACH COSTS (AS DEFINED IN THE ISO AGREEMENT), EACH PARTY’S LIMIT OF LIABILITY WILL BE AN AGGREGATE ANNUAL LIMIT EQUAL TO THE GREATER OF (I) THE APPLICABLE GENERAL LIABILITY CAP MULTIPLIED BY FIVE, AND (II) $50,000,000 (AS APPLICABLE, THE “DATA CAP”).

(d) NOTHING IN THIS MASTER AGREEMENT SHALL EXCLUDE OR LIMIT EITHER PARTY’S LIABILITY: (I) FOR DEATH OR PERSONAL INJURY CAUSED BY SUCH PARTY’S NEGLIGENCE; OR (II) FOR INDEMNIFICATION OBLIGATIONS FOR CLAIMS OF INTELLECTUAL PROPERTY INFRINGEMENT PURSUANT TO ARTICLE SEVEN OF THIS MASTER AGREEMENT EXCEPT TO THE EXTENT SUCH A CLAIM ARISES DUE TO ACTS OR OMISSIONS OF A THIRD PARTY UNDER AN EVERTEC PASS THROUGH LICENSE, IN WHICH CASE EVERTEC’S LIABILITY TO BPPR OR COMPANY OR ANY OF THEIR RESPECTIVE AFFILIATES SHALL NOT EXCEED THE AMOUNTS ALLOCATED TO COMPANY AND BPPR PURSUANT TO SECTION 7.4(C).

(e) EACH PARTY AGREES THAT (1) AMOUNTS PAID IN CONNECTION WITH THE DEFENSE OF THIRD PARTY CLAIMS, (2) AMOUNTS PAYABLE TO A THIRD PARTY PURSUANT TO COURT ORDER OR A SETTLEMENT ENTERED INTO IN ACCORDANCE WITH THE PROVISIONS OF THIS MASTER AGREEMENT; AND (3) FINES OR PENALTIES PAID TO A GOVERNMENTAL AUTHORITY, IN EACH CASE, IN CONNECTION WITH INDEMNIFICATION OBLIGATIONS WITH RESPECT TO THIRD PARTY CLAIMS UNDER ARTICLES SEVEN AND TEN ARE DEEMED TO BE DIRECT DAMAGES AND ARE NOT SUBJECT TO THE EXCLUSIONS IN SECTIONS 4.5(A) AND 4.5(B).

-51-

(f) NOTWITHSTANDING ANY OTHER PROVISION OF THIS MASTER AGREEMENT, EVERTEC SHALL BE RESPONSIBLE FOR ALL REASONABLE AND CUSTOMARY OUT OF POCKET COSTS AND EXPENSES INCURRED BY COMPANY AND BPPR AND THEIR RESPECTIVE SUBSIDIARIES ARISING OUT OF OR IN CONNECTION WITH ANY BREACH OF THE CONFIDENTIALITY OR PRIVACY OR DATA PROTECTION PROVISIONS OF THIS MASTER AGREEMENT, OR CAUSED BY EVERTEC’S FRAUD, WILLFUL MISCONDUCT OR GROSS NEGLIGENCE (“REASONABLE AND CUSTOMARY COSTS”); PROVIDED THAT SUCH COSTS SHALL BE SUBJECT TO THE DATA CAP AS SET FORTH IN SECTION 4.5(C) ABOVE. REASONABLE AND CUSTOMARY COSTS MAY INCLUDE THE FOLLOWING COSTS AND EXPENSES ASSOCIATED WITH ADDRESSING AND RESPONDING TO AN INCIDENT AND EACH SHALL BE TREATED AS DIRECT DAMAGES UNDER THIS SECTION 4.5: (I) PREPARATION AND MAILING OR OTHER TRANSMISSION OF NOTIFICATIONS TO AFFECTED INDIVIDUALS; (II) PREPARATION AND MAILING OR OTHER TRANSMISSION OF ANY OTHER COMMUNICATIONS TO CUSTOMERS, AGENTS, REGULATORS, LAW ENFORCEMENT AGENCIES OR OTHERS; (III) ESTABLISHMENT OF A CALL CENTER OR OTHER COMMUNICATIONS PROCEDURES IN RESPONSE TO SUCH VIOLATION (E.G., CUSTOMER SERVICE FAQS, TALKING POINTS AND TRAINING); (IV) COMMERCIALLY REASONABLE PUBLIC RELATIONS AND OTHER SIMILAR CRISIS MANAGEMENT SERVICES; (V) REASONABLE LEGAL AND ACCOUNTING FEES AND EXPENSES ASSOCIATED WITH INVESTIGATION OF AND RESPONSE TO SUCH EVENT; (VI) COSTS FOR COMMERCIALLY REASONABLE CREDIT REPORTING, CREDIT MONITORING, IDENTITY PROTECTION OR OTHER SIMILAR PRODUCTS AND SERVICES; (VII) CONDUCTING FORENSIC REVIEWS TO IDENTIFY THE CAUSE AND IMPACT OF THE INCIDENT, TO THE EXTENT COMPANY OR BPPR IS PERMITTED TO DO SO UNDER THIS MASTER AGREEMENT; (VIII) ADDITIONAL COMPUTER PROGRAMMING REQUIRED TO IDENTIFY OR PROTECT AFFECTED INDIVIDUALS OR OTHERWISE AS A RESULT OF THE INCIDENT; (IX) REMEDIATION ACTIVITIES REQUIRED BY A GOVERNMENTAL OR REGULATORY AUTHORITY; (X) CHARGES AND FINES ASSESSED OR IMPOSED BY PAYMENT CARD COMPANIES, INCLUDING UPON THE DATA SUBJECTS WHOSE PERSONAL INFORMATION WAS COMPROMISED AS A RESULT OF THE BREACH; (XI) GOVERNMENT FINES OR PENALTIES IMPOSED BY A GOVERNMENTAL OR REGULATORY AUTHORITY.

(g) Each party hereby waives any claim that this Section 4.5 deprives it of an adequate remedy or cause this Master Agreement to fail of its essential purpose.

ARTICLE FIVE– CONFIDENTIALITY, PRIVACY & DATA PROTECTION

5.1 Confidential Information.

(a) The parties acknowledge that in the course of their dealings each may receive (the “Receiving Party”) Confidential Information of the other party (the “Disclosing Party”). As such, the parties are willing to share such Confidential Information provided that the Receiving Party protects the Confidential Information of the Disclosing Party pursuant to the terms of this Master Agreement, and the Disclosing Party will remain the proprietor of the Confidential Information and any derivative thereof.

-52-

(b) Confidential Information (other than Intellectual Property and Personal Data, which will always be deemed to be Confidential Information) will not include information that the Receiving Party can reasonably demonstrate:

(c) In any dispute with respect to these exclusions, the burden of proving that information is not Confidential Information will be on the party making such assertion.

5.2 Protection of Confidential Information.

(a) The Receiving Party agrees to protect and hold all Confidential Information in strict confidence and protect all Confidential Information from unauthorized and/or inadvertent access, use, destruction or disclosure in full compliance with this Master Agreement and all applicable Legal Requirements and Industry Standards, including by implementing, maintaining and enforcing appropriate data and Systems security.

-53-

(b) Unless in receipt of a specific written exemption from the Disclosing Party or required by applicable Legal Requirements, the Receiving Party will not:

(c) The prohibition against the disclosure of Confidential Information includes disclosing the substance of the negotiations of this Master Agreement and the existence and/or the terms and conditions thereof, as well as the fact that any similarity exists between the Confidential Information and information independently developed by another Person or entity, and the parties understand that such similarity does not excuse it from abiding by its covenants or other obligations under this Master Agreement.

(d) The Receiving Party will be fully liable for the acts and omissions of its Representatives to whom it discloses the Confidential Information.

5.3 Security of Personal Data.

(a) To effect the purposes of this Master Agreement, COMPANY, BPPR, or one of their respective Subsidiaries may from time to time provide EVERTEC with Personal Data in order for EVERTEC to provide the Services. EVERTEC shall comply with all Legal Requirements (including Legal Requirements regarding the protection, privacy and confidentiality of Personal Data) applicable to EVERTEC’s use, storage and other processing (including Data Processing) of Personal Data.

-54-

(b) EVERTEC agrees to take commercially reasonable actions in accordance with applicable Industry Standards to protect the confidentiality, integrity, availability and resilience of its Systems and to ensure that availability of and access to Personal Data can be restored in a timely manner after an Incident. EVERTEC’s responsibilities in this regard include regularly assessing and evaluating, in accordance with applicable Industry Standards and Legal Requirements, the effectiveness of the technical and organizational measures adopted by it. In furtherance thereof, EVERTEC shall be responsible for establishing, maintaining and implementing a Data Protection Program.

(c) In furtherance, and not in limitation, of its other obligations under this Master Agreement, and to maintain the protection and privacy of the Personal Data, EVERTEC shall: (i) not disclose any Personal Data to any Third Party other than Data Subcontractors appointed pursuant to Section 1.16; (ii) limit access to the Personal Data to its employees, Representatives and Data Subcontractors who have a need-to-know such Personal Data after adequately informing such Persons of the confidential nature of the Personal Data and in each case subject to appropriate Role-Based Access Controls (which controls (A) will be based on least privilege access principles; (B) EVERTEC will document and provide to COMPANY; (C) will be subject to COMPANY approval if they relate to access to BPPR Infrastructure; and (D) will give COMPANY approval rights over individual authorizations if they relate to access to BPPR Infrastructure); (iii) use the Personal Data only for purposes of carrying out its obligations hereunder; (iv) give prompt notification to BPPR or COMPANY, as applicable, of any unauthorized or inadvertent actual or reasonably suspected disclosure of Personal Data or of actual or reasonably suspected breaches involving the disclosure of Personal Data, as provided in Section 5.3(e); (v) upon request of COMPANY, BPPR, or one of their respective Subsidiaries promptly return or destroy all Personal Data, including all copies thereof except for copies necessary to comply with applicable Legal Requirements and records retention, including the requirements in Section 6.4 (provided that following completion of such request EVERTEC shall not be required to provide any Services that require the use of such Personal Data); and (vi) implement all reasonable security measures in accordance with applicable Industry Standards designed to (a) ensure the security, integrity and confidentiality of Personal Data, (b) protect against any anticipated threats or hazards to the security or integrity of Personal Data, and (c) protect against unauthorized access to or use of Personal Data.

(d) Data Protection Program.

(i) EVERTEC acknowledges that EVERTEC and the Popular Parties are subject to Legal Requirements and other guidelines regarding the implementation of security measures to safeguard the security and privacy of Personal Data.

(ii) Without limiting Section 5.2, EVERTEC represents and warrants to COMPANY, BPPR, and their respective Subsidiaries that it has in place, and hereby undertakes to, at all times during the Term, maintain and implement the following in accordance with Industry Standards (the “Data Protection Measures”): (A) a Data Protection Program that includes administrative, technical and physical safeguards to protect the security, privacy, confidentiality, availability and integrity of Personal Data in accordance with applicable Legal Requirements and Industry Standards; (B) an Incident Response Program that provides for the Breach Notification Procedures set forth in Section 5.3(e) below; and (C) a vulnerability monitoring and patching program.

-55-

(iii) With respect to all Services that EVERTEC provides within BPPR Infrastructure, such Data Protection Measures shall also satisfy, at a minimum, the Minimum Data Safeguards set forth in Exhibit G. With respect to all Services that EVERTEC provides outside BPPR Infrastructure, such Data Protection Measures shall also satisfy, at a minimum, the EVERTEC Measures. EVERTEC represents and warrants that it (A) has made available to COMPANY and BPPR via on-site review or other secure means of transmission its Data Protection Program, Incident Response Program and descriptions of its other Data Protection Measures (collectively, the “EVERTEC Measures”); (B) will comply with these programs and measures and (C) will upon request provide the same for review on-site or via other secure method agreed by the parties.

(iv) EVERTEC shall not make any changes to its Data Protection Program, Incident Response Program or other Data Protection Measures in any manner that would degrade or weaken the controls thereunder, or that would otherwise have an adverse effect on the protections provided to BPPR Data, without the prior written consent of COMPANY or BPPR.

(e) Incident Response Program.

(i) Without limiting Section 5.2(a), EVERTEC represents and warrants to COMPANY and BPPR that it has implemented, and hereby undertakes to maintain and update, a comprehensive response program that includes processes and procedures (including notification procedures to Affected Persons) designed to address incidents of unauthorized access involving Personal Data in accordance with applicable Legal Requirements and Industry Standards.

(ii) If EVERTEC becomes aware of an Incident, to the extent it is not prohibited by applicable Legal Requirements, EVERTEC agrees to:

-56-

-57-

(f) Data Processing. The parties acknowledge that for the purposes of applicable Legal Requirements, BPPR is the Controller and EVERTEC is the Processor of Personal Data. Personal Data must be processed by EVERTEC in compliance with BPPR’s documented instructions that are provided in accordance with this Master Agreement or any applicable SOW or Schedule (“BPPR Instructions”) and in accordance with this Master Agreement and applicable Legal Requirements. If EVERTEC reasonably believes, based on the advice of counsel, that any BPPR Instruction violates applicable Legal Requirements, EVERTEC shall so notify BPPR. In accordance with BPPR Instructions, EVERTEC shall promptly notify BPPR if EVERTEC receives a request from any Person to exercise their rights under the applicable Legal Requirements including the right of access, rectification, restriction of Data Processing, erasure (such as the right to be forgotten), data portability, or objection to any Data Processing. EVERTEC shall use Best Efforts to provide assistance to BPPR, at BPPR’s cost, in responding to such requests within the time specified under the applicable Legal Requirements.

(g) Upon request, EVERTEC shall promptly provide to COMPANY, BPPR, and any internal or external auditor reasonably designated by COMPANY or BPPR, under applicable confidentiality obligations, (i) a copy of the aforementioned Data Protection Measures and (ii) reasonable documentation as to EVERTEC’s compliance with BPPR Instructions.

-58-

(h) For the sake of clarity, the parties acknowledge and agree that to the extent changes to EVERTEC’s Data Protection Measures are required due to changes in Legal Requirements that are applicable to COMPANY, BPPR or their Subsidiaries but not to EVERTEC, such changes shall be considered Mandatory Enhancements pursuant to Section 2.8 and the costs shall be allocated accordingly.

(i) Without limiting EVERTEC’s other notice obligations under this Master Agreement, EVERTEC will notify the Chief Information Security Officer at COMPANY and BPPR at ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇ with copy to ▇▇▇▇.▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇ and by phone at ▇▇▇-▇▇▇-▇▇▇▇ (or any replacement contact information provided in writing by COMPANY or BPPR to EVERTEC): (A) as soon as possible after determining a computer-security incident (as defined in 12 C.F.R. 225.301) has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, any System for four or more hours or (B) as otherwise required by Legal Requirements.

5.4 Required Disclosures.

(a) In the event that the Receiving Party or any Representative of the Receiving Party is requested or required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit, or if the Receiving Party or any Representative of the Receiving Party reasonably believes, upon the advice of counsel, that it is required by any Legal Requirement or any action, proceeding, subpoena, investigation, inquiry or audit to disclose Confidential Information, the Receiving Party will, to the extent allowable under applicable Legal Requirements, give immediate verbal and written notification of the Legal Requirement or action, proceeding, subpoena, investigation, inquiry or audit to the Disclosing Party and, to the extent allowable under applicable Legal Requirements and at the expense of the Disclosing Party, hold the Confidential Information confidential while the Disclosing Party seeks a protective order.

(b) In addition to the foregoing, a Receiving Party or its Representatives may provide the Confidential Information to a Governmental Authority with supervisory authority over such Receiving Party or its Affiliates if (i) such information is required under Legal Requirements to be filed with or disclosed to any such Governmental Authority, (ii) such information is requested by such a Governmental Authority or the Receiving Party determines based on advice of counsel (which may be in-house counsel) that it is necessary or appropriate to provide such Confidential Information to a Governmental Authority, (iii) the Receiving Party’s counsel (which may be in-house counsel) advises that such disclosure is required in order to comply with applicable Legal Requirements or (iv) such Governmental Authority is a banking regulator; provided in each case, that the Receiving Party shall have, where applicable, taken such reasonable steps to protect the confidentiality of such information as the Receiving Party takes with respect to the protection of its own comparable confidential information in such circumstances.

5.5 Remedies. The Receiving Party acknowledges and agrees that it would be difficult to fully compensate the Disclosing Party for damages resulting from the breach or threatened breach of the foregoing provisions and, accordingly, that, in addition to any other remedies that may be available, in law, at equity or otherwise, the Disclosing Party will be entitled to seek injunctive relief, including temporary restraining orders, preliminary injunctions and permanent injunctions, to enforce such provisions without the necessity of proving actual damages or posting

-59-

a bond or any other security. This provision with respect to injunctive relief will not, however, diminish the Disclosing Party’s right to claim and recover damages. Notwithstanding anything in this Master Agreement to the contrary, nothing shall limit or restrict the ability of a Receiving Party to disclose Confidential Information to banking regulators having jurisdiction over such Receiving Party.

5.6 Term of Obligation. Unless otherwise agreed in writing, the parties’ obligations under this Article Five will survive this Master Agreement for a period of three (3) years following termination hereof. Upon termination of this Master Agreement for any reason, the Receiving Party’s rights to possession and use of any Confidential Information in connection with the performance of its obligations hereunder or otherwise will terminate.

5.7 Destruction. Upon the Disclosing Party’s request, the Receiving Party will promptly destroy in a secure manner following Industry Standards all Confidential Information and all copies thereof, including physical copies and copies embedded in computer files, extracts from computer files and analyses or other material based upon the Confidential Information (provided that following such request the Receiving Party shall not be required to perform any obligations under this Master Agreement that require the use of such Confidential Information). Should the Disclosing Party request evidence of the destruction of any such Confidential Information, the Receiving Party will promptly (and in all cases within thirty (30) days of such request or such other time as agreed to between the parties; provided that EVERTEC shall use Best Efforts to provide within ten (10) days) submit an attestation executed by an authorized officer of the receiving party certifying that any such Confidential Information has been destroyed. If COMPANY or BPPR receives an individual’s request to delete Personal Data, COMPANY or BPPR may direct EVERTEC to delete such information (the “Direction”), in which case, EVERTEC shall delete such information without undue delay and certify to COMPANY or BPPR, as applicable, in writing that it has complied with the Direction (and following completion of such request EVERTEC shall not be required to provide any Services that require the use of such Personal Data). Notwithstanding the foregoing, the Receiving Party may, after informing the Disclosing Party, retain copies of the Confidential Information: (i) to comply with applicable Legal Requirements; or (ii) for purposes of record retention, backup records or audit requirements, including as set forth in Section 6.4); provided, however, that the confidentiality obligations (including destruction and certification) hereunder will survive with respect to any retained Confidential Information.

ARTICLE SIX– SECURITY, BPPR DATA & RECORDS

6.1 Authorized Persons. Each party will designate one or more individuals (hereinafter, “Authorized Persons”) so that as to the specific Service, the Authorized Person can (1) coordinate the Services, Data Processing or other transactions on behalf of such party; (2) receive information from the other party related to the operation of the Service, including any COMPANY-, BPPR- or EVERTEC-provided access code; and (3) give written instructions or inform the other party about any action or request for action by such party.

-60-

6.2 Security Measures.

(a) The parties warrant that they have adopted, and will assume responsibility for complying with, security measures reasonably required (including under applicable Industry Standards and Legal Requirements) for the protection of access to their Systems and to the Services by their Representatives and Authorized Persons. As such, the parties warrant that they have established a Data Protection Program in accordance with Legal Requirements to minimize the risk of unauthorized access and agree that they will take the necessary measures to maintain the confidentiality of the security procedures and any access codes, passwords, instructions or security equipment.

(b) EVERTEC will monitor, review and update the Data Protection Measures no less than annually to ensure compliance with this Master Agreement. EVERTEC agrees that, as may be relevant to its Services, the Data Protection Measures will, among other things: (i) take into account audit results, privacy and security risks, threats or changes in applicable Legal Requirements and Industry Standards; and (ii) be timely corrected with respect to any element thereof which could reasonably be expected to pose a threat to the protection of BPPR Data. During the Term, EVERTEC will not modify any component of the Data Protection Measures or discontinue any Data Safeguards, in each case in a manner that would degrade or adversely impact the protections in place with respect to BPPR Data, without COMPANY’s or BPPR’s consent.

(c) EVERTEC and its Affiliates (as applicable) shall at all times (x) use Best Efforts to maintain their Systems free from all Disabling Devices that may disrupt, damage or interfere with COMPANY’s, BPPR’s, and their respective Subsidiaries’ (as applicable) network and/or telecommunication facilities and (y) act in accordance with Industry Standards and the provisions of this Agreement to prevent any Incident. EVERTEC and its Affiliates (as applicable) agree to (1) perform penetration tests annually and as otherwise required by the Data Protection Program of EVERTEC’s or any of its Affiliates’ (as applicable) networks and Systems where BPPR Data is processed, transmitted or stored and (pursuant to the frequency established in the Data Protection Program) web-applications through which BPPR Data is accessed (collectively “Penetration Tests”); and, within thirty (30) days following completion of each Penetration Test, share a summary of any such tests that are relevant to the Popular Parties (provided that (i) disclosure of such results by EVERTEC shall be subject to, and limited by, applicable Legal Requirements; (ii) EVERTEC may redact from such results information relating solely to EVERTEC’s internal business or solely to EVERTEC’s other customers, provided that this clause (ii) shall not give EVERTEC any right to redact any information relating to EVERTEC’s provision of the Services to COMPANY, BPPR, or their respective Subsidiaries; and (iii) if the critical vulnerability is identified during the Penetration Test EVERTEC will notify COMPANY and BPPR of the vulnerability within fifteen (15) days); (2) maintain an alert status regarding the security of their computing Systems, including all vulnerabilities and security patches or corrective actions, by subscribing to an industry-recognized service, such as CERT or CIAC; (3) permit COMPANY and BPPR to review EVERTEC’s patch and vulnerability programs in connection with an Audit under Section 8.4; and (4) provide COMPANY and BPPR with written certification documentation showing the remediation status of any security issues identified in such assessments on a monthly basis for critical and high risk issues and upon request from COMPANY or BPPR for medium and low risk issues. Should EVERTEC’s or any of its Affiliates’ (as applicable) assessment reveal inappropriate or inadequate security of their Systems that are used to store BPPR

-61-

Data or otherwise provide Services based on the applicable Industry Standard requirements for security, without compensating controls, COMPANY, BPPR, or any of their respective Subsidiaries (as applicable) may, in addition to any other remedies they may have, remove EVERTEC’s or any of its Affiliates’ (as applicable) access to COMPANY’s, BPPR’s, or any of their respective Subsidiaries’ (as applicable) own Systems until EVERTEC or its Affiliates (as applicable) comply with the standards set forth in this Section 6.2(c) and provide reasonable assurance (including reasonably requested evidence) of such compliance. Additionally, EVERTEC and its Affiliates will permit COMPANY and BPPR or their designated Third Party to conduct Penetration Tests on network components and Systems used exclusively for COMPANY or BPPR and that are located in COMPANY or BPPR’s service network within EVERTEC, subject to the provisions set forth on Schedule 6.2(c).

(d) If a network connection is established between any System of COMPANY, BPPR, or one of their respective Subsidiaries, on the one hand, and the Systems of EVERTEC, or one of its Affiliates, on the other hand, COMPANY, BPPR, and their respective Subsidiaries (as applicable) shall at all times (i) use Best Efforts to maintain their computing environment connected to EVERTEC’s or its Affiliates’ (as applicable) Systems free from all Disabling Devices and (ii) act in accordance with this Agreement and Industry Standards to prevent any Incident, in each case, that may disrupt, damage or interfere with EVERTEC’s or its Affiliates’ (as applicable) Systems (including complying with all applicable EVERTEC Security Requirements). If EVERTEC reasonably suspects that any System of COMPANY, BPPR or their respective Subsidiaries is the source of any Disabling Device, unauthorized access or other Incident that may reasonably be expected to adversely impact EVERTEC or EVERTEC’s other customers in any material respect, EVERTEC shall be entitled to suspend connectivity to such System until the issue has been mitigated; provided that EVERTEC promptly notifies COMPANY and BPPR of the issue in advance and provides a reasonable opportunity for them to remediate the issue unless EVERTEC reasonably determines that immediate suspension is required in order to prevent material harm to EVERTEC or its other customers. EVERTEC shall not be responsible for the performance of Services to the extent they are impacted by any such suspension permitted under this Section 6.2(d).

(e) Each party’s and their respective Affiliates’ Authorized Persons agree to comply with all of the other party’s requirements in relation to the security of their respective computing environments and Authorized Locations, including any subsequently agreed security plan or information processing requirements that may be embodied in any Service Addendum. Each party and their appropriate respective Affiliates will execute all documents generally required by the other party for access to such other party’s computing environment and Authorized Locations. Further, if any Authorized Person of any party or their respective Affiliates, at any time during the Term, is granted remote access or connection to the other party’s network, or is telecommuting in any capacity, then such person will be subject to such other party’s applicable additional data security requirements.

(f) Should the Services require access codes or other identification methods to gain access, each party will immediately notify the appropriate other party or parties in writing of any change of Authorized Person or the scope of his/her authority. Until such notification is received, each party may accept, without further inquiry, all declarations, instructions or representations made or issued by the Authorized Person. Furthermore, the parties will not assume responsibility, explicitly or implicitly, for questioning or verifying with the other parties whether the Person who uses or has access to the Service is in fact the Authorized Person or if he/she is acting in accordance with another party’s internal policies and procedures.

-62-

(g) Data Centers

(i) EVERTEC will perform the Services at all times during the Term from the Data Center locations and with the hosting or collocation Data Subcontractors that have been disclosed to COMPANY and BPPR as of the Effective Date, in accordance with Section 1.16, or in an applicable subsequent Service Addendum.

(ii) EVERTEC may not change Data Center locations or any hosting or collocation Subcontractor without providing notice to COMPANY and BPPR in accordance with Section 1.16.

(iii) Notwithstanding anything to the contrary in this Master Agreement, EVERTEC may not host or otherwise store BPPR Data at any Data Center outside the United States.

(iv) EVERTEC shall bear the cost of any incremental expenses incurred as a result of a change in Data Center location or Subcontractor that has not been requested by COMPANY or BPPR.

(h) If any software licensed by COMPANY, BPPR or their Subsidiaries that EVERTEC is required to host or operate as part of the Services is no longer supported and EVERTEC reasonably determines that continuing to host or operate such software poses a material security risk to any System of EVERTEC, EVERTEC shall promptly notify the Popular Parties of the same and the parties will work together in good faith to develop and execute a plan to remediate the security risk (which may include upgrading the software, segregating Systems or removing the affected Services from the scope of this Master Agreement).

6.3 Ownership of BPPR Data.

(a) Each of COMPANY, BPPR, and their respective Subsidiaries will remain the sole and exclusive owner of all BPPR Data, regardless of whether such data is maintained in physical, electronic or digital format or any other format, storage or processing device. All BPPR Data will, however, be subject to regulation and examination by the appropriate auditors and Governmental Authorities at the Authorized Locations to the same extent as if such information were on COMPANY, BPPR, or their respective Subsidiaries’ premises. EVERTEC will notify COMPANY, BPPR, and their respective Subsidiaries as soon as reasonably possible of any formal request by any Governmental Authority to examine such information maintained by EVERTEC. COMPANY, BPPR, and their respective Subsidiaries agree that EVERTEC is authorized to provide all such information when properly required to do so by a Governmental Authority, subject to the provisions of Section 5.3(a). EVERTEC acknowledges that it will not have or acquire any rights in or to any BPPR Data or Confidential Information upon termination of this Master Agreement.

-63-

(b) EVERTEC will, subject to its internal control and security procedures, permit each of COMPANY, BPPR, and their respective Subsidiaries to have or obtain (by physical, electronic, digital or other means) access to its BPPR Data, including where appropriate, access through COMPANY, BPPR, or their respective Subsidiaries’ computer terminals and equipment. EVERTEC will furnish COMPANY, BPPR, and their respective Subsidiaries with such written instructions, manuals or other documentation as will be necessary to such operation and access by COMPANY, BPPR, and their respective Subsidiaries.

6.4 Records Retention.

(a) Each party will maintain its respective records related to the Services in a proper, complete and accurate fashion, and in compliance with all Legal Requirements applicable to each of them and in the case of EVERTEC with the requirements provided in Section 6.4(b).

(b) EVERTEC will retain all BPPR Data, transactions data and records for the duration of the retention periods in accordance with the longer of (i) the retention periods in effect in practice as of the Effective Date; (ii) relevant Statement of Work or (iii) as established by COMPANY or BPPR following the date of this Master Agreement by written notice to EVERTEC.

(c) COMPANY and BPPR acknowledge that any new retention periods or changes in existing retention periods requested by COMPANY or BPPR after the Effective Date may result in commercially reasonable additional charges and/or increases in the Service fees as provided under Section 2.7(b).

6.5 Data Backup. Except as may be specifically provided in a Service Addendum or Statement of Work, EVERTEC:

(a) subject to EVERTEC’s obligations under Section 5.7, EVERTEC will maintain a backup of BPPR Data that is in a production environment in accordance with the backup practices used as of the Effective Date, which at a minimum must support the Recovery Point Objectives for the applicable Service (in physical or other electronic or digital media), from which lost or damaged items or data can be reconstructed within the Recovery Point Objectives established for the Services;

(b) shall periodically identify all facilities and Data Centers where BPPR Data will be at rest or backed-up or where Data Processing will take place, and

(c) shall, at its own cost and expense (subject to the Data Cap), reconstruct any BPPR Data or reports destroyed, lost or otherwise rendered unusable due to any breach of this Master Agreement or gross negligence or willful misconduct by EVERTEC or its Representatives.

ARTICLE SEVEN – INTELLECTUAL PROPERTY

7.1 Title. To the extent EVERTEC uses its own Intellectual Property to provide the Services under this Master Agreement, EVERTEC warrants that it is the owner of all right, title, and interest in and to such Intellectual Property, and neither such Intellectual Property nor the authorized use thereof, to EVERTEC’s best knowledge, infringes any Intellectual Property right,

-64-

or other proprietary right, of any other Person. As such, the parties agree that, subject to the applicable Legal Requirements and to existing agreements with Third Parties, or except as otherwise expressly agreed to between the parties in writing, EVERTEC is and will remain the owner of its Intellectual Property and all derivative works based thereon (which, for the avoidance of doubt, shall not include any Intellectual Property that is transferred pursuant to the Asset Purchase Agreement) or derivative works based thereon developed by or on behalf of BPPR or its Subsidiaries) and that no title to or ownership of EVERTEC’s Intellectual Property or any part thereof is hereby granted to COMPANY, BPPR, or their respective Subsidiaries. Should EVERTEC use Third Party Intellectual Property to provide the Services, then EVERTEC warrants that it is duly licensed or otherwise has the right to use such Third Party Intellectual Property to provide the Services. The parties agree that, subject to the applicable Legal Requirements and to existing agreements with Third Parties, or except as otherwise expressly agreed to among the parties in writing, each of COMPANY, BPPR, and their respective Subsidiaries is and shall remain as the owner of its Intellectual Property, and all derivative works based thereon.

7.2 General. Each party acknowledges that (a) in providing the Services to COMPANY, BPPR, and their respective Subsidiaries, EVERTEC is not transferring any right, title or interest in EVERTEC’s Intellectual Property, or any part or component thereof, to COMPANY, BPPR, or their respective Subsidiaries, provided that, for clarity, the foregoing will not limit anything to the contrary in the Asset Purchase Agreement; and (b) in receiving the Services, COMPANY, BPPR, and their respective Subsidiaries are not granting any right, title or interest in their respective Intellectual Property, or any part or component thereof, to EVERTEC or its Subsidiaries.

7.3 Developments.

(a) Except as otherwise agreed to in writing, any services, technology, processes, methods, software and/or enhancements to EVERTEC Intellectual Property or any EVERTEC Third Party Intellectual Property used or developed for purposes of delivering the Services (collectively, the “IP Developments”), whether developed solely by EVERTEC or jointly by EVERTEC and any other party, including any IP Developments requested or suggested by COMPANY, BPPR, or their respective Subsidiaries or a Client, will be the sole property of EVERTEC and will not be considered “works-made-for-hire”; provided, however, that the foregoing shall not constitute a grant in, to or under any right, title or interest any Intellectual Property, or any part or component thereof, of the COMPANY, BPPR, or their respective Subsidiaries, to EVERTEC or any other party. Except as otherwise agreed to in writing, COMPANY, BPPR, and their respective Subsidiaries will not acquire any ownership right, Intellectual Property right, claim or interest in EVERTEC’s Intellectual Property, including as to any IP Developments. To the extent COMPANY or BPPR or one of their respective Subsidiaries does nevertheless acquire such ownership right, Intellectual Property right, claim or interest, each of COMPANY and BPPR hereby assign (and shall cause its applicable Subsidiaries to assign) all of its right, title and interest in and to the IP Developments to EVERTEC.

(b) The parties agree that any enhancements or other modifications to or derivative works of COMPANY Intellectual Property or COMPANY Third Party Intellectual Property, whether developed solely by EVERTEC or jointly by EVERTEC and any other party in connection with the provision of the Services or otherwise will be the sole property of COMPANY,

-65-

BPPR, or one of their respective Subsidiaries and will be considered “works-made-for hire”. Except as otherwise agreed to in writing, EVERTEC will not acquire any ownership right, Intellectual Property right, claim or interest in COMPANY Intellectual Property or COMPANY Third Party Intellectual Property. To the extent EVERTEC acquires any ownership right, Intellectual Property right, claim or interest in any enhancements to COMPANY Intellectual Property or COMPANY Third Party Intellectual Property, EVERTEC hereby assigns (and shall cause its applicable Subcontractors to assign) all of its right, title and interest in and to such enhancements and other materials to COMPANY, BPPR, or one of their respective Subsidiaries, as applicable.

(c) Except as otherwise agreed to in writing, any Intellectual Property created or developed by EVERTEC as an independent product will be EVERTEC Intellectual Property and the sole property of EVERTEC and will not be considered a “work-made-for-hire”.

(d) EVERTEC hereby grants to COMPANY, BPPR, and their respective Subsidiaries, a perpetual, irrevocable, non-exclusive, sublicensable, worldwide, paid-up right and license to access, use, copy, maintain, modify, enhance, perform, display, distribute and create derivative works of any EVERTEC Intellectual Property and EVERTEC Third Party Intellectual Property that EVERTEC includes in (i) the Procedures Manual or (ii) in any enhancements or modifications to or derivative works of the COMPANY Intellectual Property or COMPANY Third Party Intellectual Property.

(e) “EVERTEC Third Party Intellectual Property” means Third Party Intellectual Property that is licensed and made available under this Master Agreement by EVERTEC. “COMPANY Third Party Intellectual Property” means Third Party Intellectual Property that is licensed and made available under this Master Agreement by COMPANY or BPPR or any of their respective Subsidiaries.

7.4 Intellectual Property Infringement.

(a) Subject to Section 7.4(d), EVERTEC agrees to defend, indemnify and hold harmless COMPANY, BPPR, and their Affiliates and Subsidiaries and their respective Representatives, Third Party information providers, Subcontractors and permitted assigns and successors in interest (“IP Indemnified Parties”) from and against all Losses incurred or suffered by, or asserted against, such IP Indemnified Party directly or indirectly in relation to or arising from any claim, action or other proceeding from a Third Parties alleging that any of the Services or EVERTEC’s or its Affiliates’ Systems or Intellectual Property, or the use thereof by or on behalf of the IP Indemnified Party, infringes or misappropriates any Intellectual Property right of a Third Party.

(b) If EVERTEC receives notice of an infringement claim or otherwise concludes that the Services or its or its Affiliates’ Intellectual Property, or the use thereof by or on behalf of the COMPANY, BPPR, and their respective Subsidiaries, may infringe the proprietary rights (including Intellectual Property rights) of a Third Party, EVERTEC may in its sole discretion (i) procure the right for COMPANY, BPPR, and their respective Subsidiaries to continue using the affected Service or Intellectual Property; (ii) modify the affected Service or Intellectual Property to make it non-infringing; or (iii) replace the affected Service or Intellectual Property with a functional equivalent without substantial degradation in functionality, utility or performance.

-66-

(c) If EVERTEC receives notice of an infringement claim against an IP Indemnified Party related to an EVERTEC Pass Through License, if requested by BPPR or COMPANY, EVERTEC shall use Best Efforts to pursue its rights, if any, for indemnification or other monetary remedies against the applicable Third Party licensor in accordance with the terms set forth in the EVERTEC Pass Through License. Monetary awards actually received by EVERTEC, less the amount of all fees, claims, costs and expenses (including attorneys’ fees) incurred by EVERTEC in connection with pursuing such claim against a Third Party provider for infringement, shall be allocated between EVERTEC and its other customers, on the one hand, and the COMPANY, BPPR and their respective Subsidiaries, on the other, in proportion to the damages and costs sustained by such party due to the EVERTEC Pass Through License.

(d) EVERTEC will have no liability for any claim of infringement and thus no obligation to defend and indemnify COMPANY, BPPR, and their respective Subsidiaries under this Section 7.4 if such infringement claim is based on (i) COMPANY, BPPR, and their respective Subsidiaries’ use of a superseded or altered (other than alterations by or on behalf of, or with the written authorization or instruction of EVERTEC) release of the affected Service or Intellectual Property or any portion thereof, including COMPANY, BPPR, and their respective Subsidiaries’ failure to use updates or new releases made available by EVERTEC but only to the extent that such claim would have been avoided but for such failure; (ii) any modification by COMPANY, BPPR, and their respective Subsidiaries or a Third Party to the affected Service or Intellectual Property, but only to the extent that such claim would have been avoided, but for such modification; (iii) COMPANY, BPPR, and their respective Subsidiaries’ use of the affected Service or Intellectual Property in violation of this Master Agreement; (iv) COMPANY, BPPR, and their respective Subsidiaries’ use, operation or combination of the affected Service or Intellectual Property with information, software, specifications, instructions, data, materials or items not supplied or approved by EVERTEC, but only to the extent that such claim would have been avoided but for such combined use; or (v) use of the affected Service or Intellectual Property in a manner in violation of, or not as intended by, the accompanying and provided documentation.

(e) Furthermore, EVERTEC’s obligation to defend COMPANY, BPPR, and their respective Subsidiaries under this Section 7.4 is subject to all of the following conditions: (i) COMPANY, BPPR, or their respective Subsidiaries must notify EVERTEC promptly in writing after the claim is asserted or threatened (provided the failure of COMPANY, BPPR or a Subsidiary to so notify EVERTEC will relieve EVERTEC of its obligations under this Section 7.4 only to the extent that EVERTEC can demonstrate damages attributable to such failure); (ii) COMPANY, BPPR, or their respective Subsidiaries must give EVERTEC sole control over its defense or settlement; and (iii) COMPANY, BPPR, and their respective Subsidiaries do not formally and publicly take a legal position that is adverse to EVERTEC’s defense of such claim. COMPANY, BPPR, or their respective Subsidiaries must provide EVERTEC with reasonable assistance in defending the claim for which EVERTEC will reimburse COMPANY, BPPR, and their respective Subsidiaries for any reasonable out-of-pocket expenses that COMPANY, BPPR, or their respective Subsidiaries incur in providing such assistance.

-67-

(f) COMPANY and BPPR agree to notify EVERTEC promptly in writing if any other type of Third Party claim is brought against COMPANY, BPPR, or their respective Subsidiaries regarding EVERTEC’s Intellectual Property. EVERTEC may, at its option, choose to treat these claims as being covered by this Section 7.4.

(g) This Section 7.4 states EVERTEC’s entire liability and COMPANY’s and BPPR’s exclusive remedies with respect to any Third Party infringement and trade secret misappropriation claims with respect to the Services; provided, however, that the foregoing shall not limit any right of the COMPANY or BPPR, or their respective Affiliates, pursuant to the Asset Purchase Agreement or any ancillary agreement thereto (excluding this Master Agreement).

ARTICLE EIGHT– REGULATORY COMPLIANCE, AUDIT & SERVICE REVIEWS

8.1 Compliance.

(a) EVERTEC acknowledges that EVERTEC will be solely responsible for monitoring and interpreting (and for complying with) Legal Requirements applicable to EVERTEC, and as such, hereby warrants that EVERTEC will comply with applicable Legal Requirements, present and future, relating to the conduct and operation of its business.

(b) COMPANY and BPPR acknowledge that each of COMPANY and BPPR will be solely responsible for monitoring and interpreting (and for complying with, to the extent such compliance requires no action by EVERTEC) Legal Requirements applicable to COMPANY and its Subsidiaries and BPPR and its Subsidiaries, as applicable, and as such, hereby warrants that it and its Subsidiaries will comply with all applicable Legal Requirements, present and future, relating to the conduct and operation of its or such Subsidiaries’ business.

(c) EVERTEC represents that it has, and at all times during the Term will, at its own expense, maintain any and all licenses, permits, approvals, certificates, endorsements and authorizations required by any professional association or the applicable Governmental Authorities that are required for it to provide the Services for the benefit of COMPANY and BPPR. Upon thirty (30) days prior written notification to EVERTEC, COMPANY and BPPR shall have the right to inspect copies of all such licenses, permits, approvals, certificates, endorsements or authorizations.

8.2 Legal Requirements.

(a) COMPANY and BPPR shall be responsible for monitoring and interpreting (and for complying with, to the extent such compliance requires no action required to be undertaken by EVERTEC pursuant to this Master Agreement) the Legal Requirements applicable to them. COMPANY and BPPR may, as part of the instructions used to establish the Specifications, include requirements that they deem necessary in order to comply with applicable Legal Requirements, and EVERTEC will select the technical parameters within EVERTEC’s Systems that will apply to COMPANY, BPPR, and their respective Subsidiaries. EVERTEC shall be responsible for determining that such selections are consistent with COMPANY’s or BPPR’s instructions, as applicable. COMPANY and BPPR, as applicable, shall be responsible for determining that the instructions provided to EVERTEC are consistent with the Legal Requirements and with the terms and conditions of any agreements between COMPANY, BPPR, and their respective Subsidiaries and its Clients.

-68-

(b) Subject to Sections 8.1 and 8.2(a), at the expense of COMPANY and BPPR, EVERTEC shall work with COMPANY and BPPR in developing Systems and implementing Specifications for the Services to enable COMPANY, BPPR, and their respective Subsidiaries to comply with Legal Requirements applicable to the Services being provided by EVERTEC to COMPANY, BPPR, and their respective Subsidiaries.

(c) The parties acknowledge and agree that the performance of the Services may be subject to regulation by Governmental Authorities.

(d) Upon the request and expense of COMPANY and BPPR, EVERTEC will take all commercially reasonable steps to cooperate in good faith with COMPANY and BPPR in any investigations, reports (including, any suspicious activity reports), filings or other documents or actions COMPANY or BPPR may take or complete to comply with applicable federal anti-money laundering and bank secrecy laws and regulations.

8.3 BSA/AML/OFAC. EVERTEC represents and warrants that it (a) is in compliance with the Office of Foreign Assets Control sanctions and regulations promulgated under the authority granted by the Trading with the Enemy Act, 12 U.S.C. § 95 (a) et seq., the International Emergency Economic Powers Act, 50 U.S.C. § 1701, et seq.; and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, as each may be amended from time to time and all rules and regulations promulgated thereunder applicable to EVERTEC and (b) is not: (i) listed in the Annex to, or otherwise subject to the provisions of, that certain Executive Order No. 13224 on Terrorist Financing, effective September 24, 2001, and relating to Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten to Commit or Support Terrorism; and/or (ii) named as a “specifically designated national (SDN)” on the most current list published by the U.S. Treasury Department Office of Foreign Assets Control. EVERTEC further represents that it will not act directly or indirectly, in contravention of any applicable anticorruption or anti-money laundering law.

8.4 Audit.

(a) Each of the parties agrees that it will keep current and accurate books of accounts and records, in accordance with its standard operating procedures, with respect to the transactions effected pursuant to this Master Agreement. During the Term, each party shall permit the other party’s designated auditors and Governmental Authorities to review its books and records with respect to such transactions, upon prior written notice, during normal business hours.

(b) EVERTEC, COMPANY, and BPPR acknowledge and agree that the performance of the Services may be subject to regulation by Governmental Authorities. EVERTEC agrees to use Best Efforts to cooperate with any audit or examination of the Services or COMPANY, BPPR, or their respective Subsidiaries, whether by a Governmental Authority or internal or external auditors of COMPANY, BPPR, or their respective Subsidiaries (“Audit”). Except for Audits required to be conducted by a Governmental Authority or by Legal Requirement, and for Audits conducted to verify remediation of a material breach of any provision of this Master

-69-

Agreement uncovered in a previous Audit (a “For Cause Audit”), no more than one Audit shall be conducted in any twelve-month period. Furthermore, EVERTEC agrees to provide any information or material lawfully and reasonably requested during an Audit, and permit such auditing parties to inspect or audit EVERTEC with respect to its provision of the Services; provided, however, that (i) each of COMPANY and BPPR agrees to reimburse EVERTEC for all reasonable costs incurred by EVERTEC to fulfill Audit requests from COMPANY, BPPR or its Subsidiaries under this Section 8.4b) (other than For Cause Audits); (ii) prior to reviewing any such information or material provided by EVERTEC, any Third Party (other than a Governmental Authority) shall execute a customary confidentiality agreement with EVERTEC; and (iii) nothing in this Section 8.4 shall require EVERTEC to provide information that would be expected to result in the waiver of any attorney-client or other legal privilege or disclosure of the confidential information of EVERTEC’s other customers that is not related to COMPANY or BPPR or their Subsidiaries. COMPANY or BPPR requests for detail to support invoices or copies of any policies, procedures, summaries, audit reports or other information or access that EVERTEC is required to provide under this Master Agreement (including under Section 9.3) will not be considered “Audits” for purposes of the frequency limitation and cost reimbursement provisions above.

(c) In connection with each Audit, EVERTEC will provide COMPANY, BPPR, and their respective Subsidiaries and auditors, upon COMPANY’s or BPPR’s written request, at a time, frequency and place reasonably agreed to between the parties, with access to Personnel and information relating to the Services to permit COMPANY, BPPR, and their respective Subsidiaries and auditors to (w) review EVERTEC’s performance of Services; (x) validate EVERTEC’s compliance with this Master Agreement; (y) comply with applicable Legal Requirements; and (z) conduct third party management and oversight discussions with management and personnel of EVERTEC concerning the status and conduct of Services and work being performed under this Master Agreement. EVERTEC’s obligation in this regard will include providing to COMPANY and BPPR the following reports (each, an “Audit Report”) on an annual basis:

(i) Service Center Review reports (as further described in Section 8.7);

(ii) Business Continuity Plan and business resumption test results (as further described in Section 2.13);

(iii) Data Protection Program documentation (as further described in Section 5.3(f);

(iv) Penetration Tests (as further described in Section 6.2(c));

(v) vulnerability and patch management implementation reports; and

(vi) responses to vendor questionnaires and other standardized information gathering requests.

(d) To the extent directed by a Governmental Authority or required by a Legal Requirement, EVERTEC and its Affiliates will provide COMPANY and BPPR or their respective Subsidiaries or auditors with access to their facilities and Systems and related Personnel to address the request from the Governmental Authority or comply with the Legal Requirement.

-70-

(e) To the extent an Audit reveals areas of material concern to COMPANY or BPPR, the parties will agree on a plan to address the deficiency in an adequate and timely manner, it being agreed that the costs of implementing any aspect of such plan shall be borne by EVERTEC to the extent that the deficiency is attributable to actions or omissions on the part of EVERTEC or any Subcontractor. EVERTEC will promptly execute any such plan and track and report on its activities and results obtained under the plan until the parties agree the area of concern has been remediated.

8.5 IT Infrastructure Network Diagram. Upon COMPANY’s or BPPR’s written request, EVERTEC will provide a network diagram that outlines EVERTEC’s information technology network infrastructure and all equipment used in relation to the fulfillment of its obligations under this Master Agreement.

8.6 Data Flow Diagram. Upon COMPANY’s or BPPR’s written request, EVERTEC will provide a graphical representation of the flow of electronic BPPR Data within and between network segments and information systems as well as across an institution’s perimeter up to Third Parties, if applicable (“DFD”). A DFD must capture the main components of an information system, how data moves in and out of the system, protection layers (encryption) applied to data in its different states, user interaction points and their functions, and external and internal network dependencies such as Third Party or fourth party connections or services.

8.7 Service Center Reviews.

(a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct an examination of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with applicable Industry Standards and applicable Legal Requirements. In addition to IT operations and application controls, the Firm should complete an examination of EVERTEC’s controls related to security, availability, processing integrity, confidentiality or privacy. The aforesaid examinations shall be conducted for the relevant System and organization controls (“SOC 1” and “SOC 2”) criteria in accordance with Statement on Standards for Attestation Engagements no. 18 (“SSAE 18”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”).

(i) The SOC 1 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of nine (9) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR on or before December 15 of such year. EVERTEC management will provide a bridge letter for the remaining period of the calendar year that is not covered by the SOC 1 Type II report no later than January 31^st of the following year.

(ii) The SOC 2 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of twelve (12) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR by February 15 of the following year.

-71-

(iii) All such Service Center Reviews shall be deemed to be EVERTEC’s Confidential Information hereunder, provided that EVERTEC shall promptly share such Service Center Reviews with BPPR upon request. EVERTEC may redact information from any Service Center Reviews shared with BPPR if and solely to the extent necessary to protect the confidential information of other customers of EVERTEC or the information of EVERTEC that is not related to either BPPR or EVERTEC’s provision of Services to BPPR.

(iv) Additionally, EVERTEC will use its Best Efforts to obtain and provide to COMPANY and BPPR SOC 1 and 2 Type II reports or other equivalent control reports for each Data Subcontractor that stores, transfers or processes Personal Data. If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.

(b) EVERTEC will review the scope of the Service Center Review to be conducted by the Firm on an annual basis with BPPR and incorporate reasonable input and additional requirements reasonably requested by BPPR. If BPPR requires additional scope in a Service Center Review that is (i) incremental to the scope in EVERTEC’s standard Service Center Review; and (ii) solely attributable to BPPR (and not to be shared with any other EVERTEC customers) (“Incremental BPPR Requirements”), BPPR will reimburse EVERTEC for any additional amounts payable by EVERTEC to the Firm to include the Incremental BPPR Requirements.

(c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all reasonable actions necessary to comply with such recommendations on a timeline that will take into account the nature and materiality of the recommendations. Upon request, EVERTEC will advise COMPANY and BPPR on its progress in completing such actions.

(d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.

(e) For all other requests by COMPANY or BPPR to review all or a portion of the Services and EVERTEC’s operation controls relating thereto, outside the scope of an Audit or SSAE 18, the parties will agree in writing to the terms and conditions applicable to such review, including the scope of the review and any expenses related thereto. If, at any time, whether or not

-72-

in connection with the Service Center Review, EVERTEC becomes aware of a significant issue of concern related to the operational and application controls operating at EVERTEC for the Services provided to the COMPANY, BPPR, or any of its respective subsidiaries, EVERTEC shall promptly notify and subsequently meet with COMPANY or BPPR in an effort to address such concern.

ARTICLE NINE– TERM & TERMINATION

9.1 Term. This Master Agreement will commence on the Effective Date and will end on September 30, 2028 (the “Initial Term”), unless earlier terminated in accordance with the provisions of this Master Agreement.

9.2 Termination for Cause.

(a) This Master Agreement or any of the Services, individually or collectively, may be terminated by either the Popular Parties, on the one hand, or EVERTEC, on the other, if the other party or parties (as applicable):

(i) commits a Material Breach of this Master Agreement (or series of breaches that together constitute a Material Breach), which breach is not cured within thirty (30) days following receipt of notice specifying the nature and extent of such breach; provided, however, that if such breach is not reasonably susceptible of cure within such thirty (30) day period, such period will be extended and the party will not be in default hereunder so long as it commences such cure within such thirty (30) day period and diligently pursues such cure and such failure is cured within ninety (90) days following the receipt of such notice;

(ii) fails to pay any properly submitted invoice providing for material amounts in the aggregate that are undisputed for a period exceeding sixty (60) days following COMPANY and BPPR’s receipt of notice from EVERTEC of such non-payment; or

(iii) makes any assignment of this Master Agreement, except as expressly provided herein.

(b) For purposes of this Section 9.2 and notwithstanding anything in this Master Agreement to the contrary:

(i) “Material Breach” means a breach, or series of breaches, of a party’s duties or obligations (other than a failure to make a payment pursuant to this Master Agreement) that if left uncured for ninety (90) days following receipt of notice from COMPANY or BPPR detailing the relevant deficiency or failure, (A) would result in a Material Adverse Effect on such notifying party and its Subsidiaries (taken as a whole) or BPPR and its Subsidiaries (taken as a whole), as applicable, or (B) would reasonably be expected to have an adverse effect on the notifying party that is material, individually or in the aggregate, measured on a scale relative to the notifying party’s rights and privileges and reasonably expected benefits under this Master Agreement, provided that this clause (B) shall apply solely after September 30, 2025 and solely in the case of termination by COMPANY or BPPR.

-73-

(ii) “Material Adverse Effect” means, with respect to any Person, any fact, event, change, effect, development, condition or occurrence that has a materially adverse effect on or with respect to any business, assets, liabilities, financial condition, or results of operations of such Person.

(c) Notwithstanding anything in this Master Agreement to the contrary, any breach or default under a particular Service Addendum will give the non-breaching party or parties the right to terminate that particular Service Addendum, subject to the cure periods set forth under Section 9.2(a)(i), and will not automatically operate as a default under any other Service Addendum.

9.3 Termination without Cause.

(a) Except as provided in a Service Addendum or SOW signed after the Effective Date, the Popular Parties may terminate any of the Services, Service Addendums or SOW in whole or in part at any time at their sole discretion with one hundred eighty (180) days prior written notice.

(b) If COMPANY or BPPR terminate a component of the Services, and that component does not have a discrete service code, unit rate or other charging methodology applicable to it: (i) the parties will discuss in good faith whether a corresponding reduction to the charges is appropriate, but (ii) EVERTEC will not be required to reduce the charges as a result of such termination unless the parties agree to a reduction in writing. Notwithstanding the preceding sentence, the Parties shall negotiate in good faith to agree on discrete service codes for each component of the Services following the date hereof.

(c) EVERTEC may terminate any Services, Service Addendums or SOWs that have been unused or unconsumed by any Popular Party for longer than ninety (90) days by providing sixty (60) days prior written notice (an “EVERTEC Cancellation Notice”), provided such ninety (90) day period will not apply with respect to (i) Services that are used on a seasonal basis (e.g., annual processing functions) or (ii) Services that are scheduled for use on a later date following implementation or other circumstances. The termination will not be effective if the applicable Popular Party sends written notice to EVERTEC within thirty (30) days after receipt of an EVERTEC Cancellation Notice with reasons as to why the relevant Service, Service Addendum or SOW should not be terminated notwithstanding lack of usage or consumption.

(d) In connection with the Core API Layer SOW, subject to Section 3.10(c), the Popular Parties shall have the right to terminate this Master Agreement effective as of September 30, 2025, in whole or in part (including, for the avoidance of doubt, the Popular Parties’ obligations with respect to Section 2.2), in the event that:

(i) if the Core API Deadline is on or before June 30, 2023 (the “Base Date”), the Core API Completion does not occur within eighteen (18) months of the Core API Deadline (the “Core API Delay Window”);

-74-

(ii) if the Core API Deadline is after the Base Date, the Core API Completion does not occur within the Core API Delay Window less the number of months between the Base Date and the Core API Deadline; provided, that the Core API Delay Window shall in no event be reduced to less than twelve (12) months after the Core API Deadline; and

(iii) notwithstanding anything to the contrary in clause (i) and (ii) above, if the Core API Deadline is June 30, 2025 as a result of the failure of Virtusa Corporation to complete the Virtusa Work Order, as contemplated by Section 3.10(a), the Core API Completion does not occur within eighteen (18) months of the Core API Deadline.

(e) The termination of any or all Services, Service Addendums or SOWs under this Section 9.3 shall not result in the automatic termination of this Master Agreement or the Popular Parties’ obligations to pay Annual Minimums under Section 2.2 (except as provided otherwise in Section 2.2 or Section 9.3(d)).

9.4 Effect upon Termination.

(a) Unless indicated otherwise in the written termination notice, upon the termination of any Service, all remaining Services will continue in full force and effect; provided, however, that should this Master Agreement be terminated, all Services in effect as of the date of termination will also terminate.

(b) Except as otherwise provided in this Master Agreement, upon termination, all further obligations of the parties pursuant to this Master Agreement or the particular Service that was terminated, whichever the case may be, will terminate (except the obligation of COMPANY, BPPR, and their appropriate respective Subsidiaries to make a payment for any unpaid and properly invoiced amounts, in accordance with Section 3.2 and the obligation of EVERTEC to provide Transition Assistance) without further liability of any party to the others; provided, however, that termination will not release the party that terminates from any liability which at the time of termination had already accrued to the non-terminating party or parties, including EVERTEC’s obligation to continue to provide the Services during the Transition Period, if so requested by COMPANY or BPPR, and the parties’ obligations to comply with the provisions of this Master Agreement related to any Services being provided during the Transition Period.

(c) No party shall be liable to the others for damages of any kind solely as a result of terminating this Master Agreement in accordance with its provisions.

(d) Furthermore, any such termination will be without prejudice to any rights or remedies any party may have arising out of any breach of any material representation, warranty, covenant or condition by any other party hereto.

-75-

9.5 Transition Assistance.

(a) “Termination Notice Date” means, as applicable for each Affected Service, the earliest of (i) twelve (12) months prior to expiration of the Initial Term, (ii) the date of any termination of this Master Agreement and all Services hereunder pursuant to Section 9.2 hereof, (iii) the date of notice of termination or non-renewal of any individual Service or Services under this Master Agreement with or without the termination of this Master Agreement, including terminations under Section 9.3 and any reductions or removal of portions or volumes of Services, and (iv) the date of a Release Event pursuant to Section 3.1 of the Technology Agreement.

(b) “Affected Services” means any Services that are not renewed or that are terminated pursuant to a particular notice of non-renewal or termination, as applicable.

(c) For each Affected Service, a “Transition Period” commences on the applicable Termination Notice Date and continues until the earlier of (i) the 18-month anniversary of the effective date of termination or expiration of the Affected Services and (ii) the date on which all Affected Services have been completely transitioned to COMPANY, BPPR, or another third-party provider designated by COMPANY or BPPR (a “Successor Supplier”), subject to any extension of the Transition Period as described in Section 9.5(e).

(d) During each Transition Period, EVERTEC will (i) provide COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers transition support and assistance including providing COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers (x) information and cooperation necessary to effect the transition, with business continuity, of the applicable Affected Services and (y) the support and assistance described in Schedule 9.5 and (ii) continue to provide the applicable Affected Services to COMPANY or BPPR, their respective Subsidiaries, subject to the terms and conditions (including payment terms) that are in effect as of the applicable Termination Notice Date ((i) and (ii) collectively, “Transition Assistance”). During the Transition Period, COMPANY, BPPR, and their respective Subsidiaries and EVERTEC shall use their Best Efforts to completely transition each Affected Service requested by the COMPANY, BPPR, and their respective Subsidiaries to COMPANY, BPPR, and their respective Subsidiaries and Successor Suppliers prior to the end of the Transition Period.

(e) If COMPANY or BPPR, or their respective Subsidiaries or Successor Suppliers, as applicable, have used and continue to use Best Efforts to completely transition the applicable Affected Services and reasonably continue to need such Transition Assistance following the 18-month anniversary of the effective date of termination or expiration of the Affected Services, the Transition Period shall be extended until such Service or Services shall be completely transitioned to COMPANY or BPPR or their respective Subsidiaries or Successor Suppliers (the “Extended Transition Period”), subject to the parties’ agreement on an updated fee arrangement if the Extended Transition Period extends beyond March 31, 2030.

(f) On September 30, 2028, hourly rates for any programming/development necessary to provide the Transition Assistance described in Section 9.5(d)(i) requested by COMPANY or BPPR will be adjusted by the lesser of (i) the aggregate change in CPI for the period from September 30, 2022 through September 29, 2028 (not to exceed 25%); and (ii) the difference between the sum of the change in annual CPIs (not to exceed 5%) during each one-year period commencing on September 30, 2022 and ending on September 29, 2028 less the sum of CPI adjustment actually applied during those years pursuant to Section 3.1(b) herein; provided that the fee adjustment cannot be negative.

-76-

(g) In furtherance of and as a part of such Transition Assistance and as further described in Schedule 9.5, EVERTEC shall assist COMPANY, BPPR, and their respective Subsidiaries to develop a plan for the complete transition of all Services requested by the COMPANY, BPPR, or their respective Subsidiaries from EVERTEC to COMPANY, BPPR, and their respective Subsidiaries or a Successor Supplier, on a reasonable schedule, which shall give consideration to COMPANY, BPPR, and their respective Subsidiaries’ need for the orderly continuation of such Services.

(h) Prior to providing any Transition Assistance, EVERTEC shall deliver to COMPANY, BPPR, and their respective Subsidiaries a good faith estimate of all projected expenses and charges payable for the Transition Assistance; provided that:

(i) to the extent the Transition Assistance consists of Services that were provided pursuant to this Master Agreement, the expenses and charges for such Services shall be the price for such Services under this Master Agreement), which expenses and charges shall be paid by COMPANY, BPPR, or their appropriate respective Subsidiaries in accordance with the provisions of this Master Agreement; and

(ii) to the extent the Transition Assistance consists of additional programming, development or other assistance that is incremental to the Services that were provided pursuant to this Master Agreement, the expenses and charges for personnel resources will be determined using the programming/development time and materials rates then in effect under this Master Agreement; provided, if COMPANY or BPPR requests assistance that requires specialized skills that (A) EVERTEC does not make available to COMPANY or BPPR under this Master Agreement; (B) are only available from third parties at a higher cost than the costs EVERTEC incurs to engage third parties for other skills under this Master Agreement and (C) COMPANY or BPPR, as applicable, determines not to engage a third party or parties directly, EVERTEC may increase the time and materials rates to reflect the incremental costs EVERTEC must incur to procure the specialized skills requested by COMPANY or BPPR.

(i) The quality of the Services provided by EVERTEC, and EVERTEC’s performance of the Services, will not be materially degraded during the period EVERTEC is providing Transition Assistance. EVERTEC shall not make any changes to the EVERTEC Personnel that are critical to providing Services in accordance with this Master Agreement during the Transition Period or reassign any such critical EVERTEC Personnel away from performing Services under this Master Agreement during the Transition Period except as mutually agreed to by the parties in writing.

(j) EVERTEC will, to the extent requested by COMPANY, BPPR, or their respective Subsidiaries: (i) assign to COMPANY, BPPR, their respective Subsidiaries and/or the Successor Supplier leases for some or all of the EVERTEC leased equipment that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, including applicable maintenance agreements that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, and COMPANY, BPPR, their respective Subsidiaries and the Successor Supplier shall assume the obligations under such leases that relate to periods after such date (to the extent EVERTEC is able to obtain any required consents for such assignments); and (ii) sell to COMPANY, BPPR, their

-77-

respective Subsidiaries or the Successor Supplier, at EVERTEC’s then current book value, some or all of the equipment owned by EVERTEC or its Affiliates that is located at facilities of COMPANY, BPPR, or their respective Subsidiaries, including applicable maintenance agreements. EVERTEC will also provide all user and other documentation relevant to such Equipment in EVERTEC’s possession. COMPANY, BPPR, their respective Subsidiaries or the Successor Supplier (as applicable). EVERTEC will be operationally responsible for obtaining any consents from Third Parties necessary to obtain any licenses or transfer any Equipment to COMPANY, BPPR, their respective Subsidiaries or Successor Supplier; provided that COMPANY or BPPR, as applicable, shall be responsible for any out-of-pocket costs incurred by EVERTEC in connection therewith.

(k) The provisions of this Master Agreement shall apply with respect to all Services (including Transition Assistance) provided during the Transition Period. Nothing contained herein shall obligate COMPANY, BPPR, or their respective Subsidiaries to receive Transition Assistance from EVERTEC.

(l) Notwithstanding anything to the contrary in this Master Agreement, the provisions of this Section 9.5, including Schedule 9.5, shall survive the expiration or termination of this Master Agreement (or any portion thereof) for any reason.

(m) As and when reasonably requested by COMPANY, BPPR, and their respective Subsidiaries during the Term, EVERTEC will provide to COMPANY, BPPR, and their respective Subsidiaries such information and other cooperation regarding the performance of the Services and the manner in which the Services are integrated with COMPANY’s, BPPR’s and their Subsidiaries’ Systems and processes as would be reasonably necessary to enable COMPANY, BPPR, and their respective Subsidiaries or potential third-party providers to conduct due diligence and prepare an informed plan to obtain such services from a third party provider. The Popular Parties and their respective Subsidiaries may disclose such information and other information about the Services to such third parties, provided such third parties may use it solely for the purposes described in this Section 9.5(m) and will be subject to confidentiality obligations substantially similar to those in this Master Agreement. This Section 9.5(m) will not, however, require EVERTEC to provide Proprietary Application Information.

ARTICLE TEN– INSURANCE AND INDEMNIFICATION

10.1 Insurance.

(a) EVERTEC agrees to maintain adequate insurance coverage from reputable providers in amounts as set forth below. All such insurance policies will be carried at EVERTEC’s own expense. Except as EVERTEC, COMPANY and BPPR may otherwise agree, EVERTEC will maintain in full force and effect during the Term insurance as follows:

(1) Statutory Workers’ Compensation Insurance or a workers’ compensation and employers’ liability insurance, as applicable under the applicable state statutory law of the relevant jurisdiction, covering all its employees and including occupational disease coverage.

-78-

(2) Commercial General Liability Insurance covering against claims for bodily injury, death, property damage, personal injury, advertising injury and products/completed operations with limits in an amount of not less than one million dollars ($1,000,000) per occurrence. The annual aggregate limit shall not be less than two million dollars ($2,000,000). For this policy, the Insurance Services Office Inc. (“ISO”) Commercial General Liability occurrence coverage form CG 00 01 or its equivalent will be used.

(3) Automobile Liability Insurance with limits not less than 1 million dollars ($1,000,000) each occurrence combined single limit of liability. This insurance shall include Third Party bodily injury and property damage liability including owned and not owned and hired automobile coverage. For this policy, the ISO form number CA 00 or its equivalent will be used.

(4) Umbrella Insurance with limits not less than five million dollars ($5,000,000) covering excess of loss over primary liability insurance policies, including Comprehensive General Liability, Comprehensive Automobile Liability and Employers Liability insurance policies, where applicable under state Legal Requirements.

(5) Fidelity and Crime insurance with limits not less than fifteen million dollars ($15,000,000) each occurrence and annual aggregate including Electronic & Computer Crime, Unauthorized Computer Access coverage, and employee dishonesty coverage which shall be extended to loss of Third Parties.

(6) Technology professional liability and cyber insurance (Errors and Omissions) with limits not less than fifteen million dollars ($15,000,000) each occurrence and annual aggregate covering any damages caused by an error, omission or any negligent acts related to the services to be provided under this Master Agreement by EVERTEC and/or its Subcontractors, agents, officers or employees and including coverage for computer programming and electronic data processing services, network security liability, content injury, privacy injury, regulatory proceedings, dependent loss and Third Party custodian. This insurance shall include coverage for Third Party claims and for losses, unauthorized disclosures, access or use of BPPR Data in any format, including coverage for accidental loss, theft, unauthorized disclosure access or use of BPPR Data.

(7) Employment Practices Liability Insurance with limits not less than one million dollars ($1,000,000) per claim and in general aggregate providing protection against inappropriate workplace conduct, including: wrongful termination, discrimination, harassment, retaliation, defamation, invasion of privacy, failure to promote, deprivation of a career opportunity, and negligent evaluation.

-79-

(b) Certificates of Insurance. Certificates of insurance (“COI”) evidencing all coverage described in this Section 10.1(b) shall be furnished to COMPANY or BPPR (i) upon execution of this Master Agreement; (ii) annually, within forty-five (45) days following the insurance policy renewal; (iii) whenever the insurer or the insurance coverage changes; or (iv) upon COMPANY’s or BPPR’s request and will include the following:

(1) The COI will require thirty (30) days’ advance written notice to COMPANY and BPPR before cancellation of, material change to, potential exhaustion of aggregate limits of, or non-renewal of the required insurance coverage(s).

(2) The COI will state that the respective EVERTEC insurance will respond on a primary basis without contribution from any other insurance of COMPANY, BPPR, or their respective Subsidiaries.

(c) EVERTEC shall maintain the coverages required in this Section 10.1(c) from insurance carriers that have an AM Best rating of A- VII or better for risks insured in Puerto Rico and an AM Best rating of A VIII for risks insured outside Puerto Rico; provided that if an insurance carrier’s rating changes to a rating below A- VII or A VIII (as applicable), EVERTEC shall use Best Efforts to promptly replace such insurance carrier to one that has a AM Best rating of A- VII or A VIII (as applicable) and in all cases shall replace it prior to the next annual renewal of the applicable coverage.

(d) Insurance deductibles or retentions shall not exceed three million dollars ($3,000,000) per insurance policy unless approved in writing by COMPANY and BPPR.

(e) All liability insurance, except for Crime, Employment Practices Liability, Workers’ Compensation, Professional Liability and Cyber Liability required under this Master Agreement must include an additional insured endorsement, without containing any special limitations on the scope of the endorsement, specifying COMPANY and BPPR and their officers, employees and agents as additional insureds, including additional insured status with respect to liability arising out of ongoing operations and completed operations, but only with respect to EVERTEC’s activities to be performed under this Master Agreement.

(f) EVERTEC shall waive rights of subrogation which EVERTEC or any insurer of EVERTEC may acquire against COMPANY or BPPR by virtue of the payment of any Loss; and EVERTEC will obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not COMPANY or BPPR has received a waiver of subrogation endorsement from EVERTEC or EVERTEC’s insurer(s); provided, however, that (x) any such waivers shall not be extended to cover losses caused by acts of any COMPANY and BPPR or their affiliates, subsidiaries or parent companies and their agents or employees, which are not connected with the operations being conducted by EVERTEC or any third-party hired by EVERTEC and their principals so stipulated and then only, in so far as is necessary to meet the requirements of this Master Agreement; and (y) any such endorsements shall not extend, modify, increase limits of, or otherwise alter the coverage provided by any policy applicable within this Master Agreement.

-80-

(g) If any of the required insurance is on a claims made basis and does not include an extended reporting period of at least 36 months, EVERTEC shall maintain either tail coverage or continuous claims made liability coverage, for a minimum of 36 months following the termination of this Master Agreement.

(h) If EVERTEC outsources to any Third Party (including a Subcontractor) any part of the services it renders or the products it supplies to COMPANY or BPPR, then EVERTEC’s required insurance policies must be endorsed to provide coverage for liabilities that may arise through such Third Party or Subcontractor to the same extent as if the work were performed, or the goods provided, by EVERTEC. In the alternative, EVERTEC must submit to COMPANY and BPPR proof of the Third Party’s or Subcontractor’s insurance under the same coverage and limits as required from EVERTEC. Any claims arising from the work or product provided by the Third Party or Subcontractor will be paid first through EVERTEC’s insurance and, to the extent not covered, then by such Third Party’s or Subcontractor’s insurance.

(i) The insolvency, bankruptcy or failure of any insurance company providing coverage as required herein shall not relieve either party of its obligations to maintain adequate insurance as provided in this Section 10.1.

10.2 Indemnity. Each party (the “Indemnifying Party”) hereby agrees to indemnify, defend, protect and hold harmless the other parties, their Affiliates and their respective Representatives, suppliers, Third Party information providers, Subcontractors and permitted assigns and successors in interest (collectively, the “Indemnified Party”) from and against any Losses incurred or suffered by, or asserted against, such Indemnified Party directly or indirectly in relation to or arising from:

(a) subject to Section 2.3 of Exhibit C hereof with respect to any failure by EVERTEC to meet its Service Levels, any breach of this Master Agreement, including any breach of representation or warranty, by the Indemnifying Party;

(b) any claim brought by any Third Party against an Indemnified Party based on the Indemnifying Party’s use or provision of the Services;

(c) the Indemnified Party’s compliance with the Indemnifying Party’s Specifications or instructions;

(d) acts or omissions of the Indemnifying Party and its Representatives in connection with the installation, maintenance, presence, use or removal of equipment or software not provided by the Indemnified Party;

(e) with respect to the COMPANY or BPPR as the Indemnifying Party, claims by Third Parties that EVERTEC’s use of Intellectual Property provided by COMPANY or BPPR infringe the Third Party’s Intellectual Property rights, except to the extent the infringement claim is based on (i) use of the Intellectual Property for any purpose not permitted in this Master Agreement; or (ii) enhancements or other modifications made by EVERTEC to the Intellectual Property, other than at the specific written direction of COMPANY, BPPR or any of their respective Subsidiaries or Affiliates;

-81-

(g) with respect to the EVERTEC as the Indemnifying Party, a Data Breach occurring due to a breach of this Master Agreement, gross negligence, fraud or willful misconduct by EVERTEC or its Representatives; provided that EVERTEC’s indemnification obligation under this Section 10.2(g) with respect to Data Breaches shall be subject to the Data Cap;

(h) the Indemnified Party’s use or provision of the Services or data supplied by the Indemnifying Party; and

(i) claims against the Indemnified Party for damage to, or loss of use of property of Third Parties and/or injury or death of any person to the extent that such damage, injury or death is caused by the negligent act or omission of the Indemnifying Party.

Notwithstanding anything in this Section 10.2 to the contrary, (i) with respect to EVERTEC as the Indemnifying Party, this Article Ten shall not apply to claims relating to infringement of any Intellectual Property right of a Third Party, which claims shall be exclusively the subject of Section 7.4, (ii) with respect to COMPANY and BPPR as the Indemnifying Party, (A) any claims related to infringement of any Intellectual Property right of a Third Party shall be exclusively the subject of Section 10.2(e); and (B) BPPR’s indemnification obligation and liability with regard to infringement claims related to a BPPR Pass Through License shall be subject to and limited solely to the following: (x) if COMPANY or BPPR receives notice of an infringement claim against an EVERTEC Indemnified Party related to a BPPR Pass Through License, if requested by EVERTEC, COMPANY or BPPR shall use Best Efforts to pursue its rights, if any, for indemnification or other monetary remedies against the applicable Third Party licensor in accordance with the terms set forth in the BPPR Pass Through License; and (y) monetary awards actually received by COMPANY or BPPR, less the amount of all fees, claims, costs and expenses (including attorneys’ fees) incurred by COMPANY or BPPR in connection with pursuing such claim against a Third Party provider for infringement, shall be allocated between COMPANY and BPPR and its respective Affiliates, on the one hand, and EVERTEC, on the other, in proportion to the damages and costs sustained by such party due to the BPPR Pass Through License.

10.3 Indemnification Procedures. With respect to claims covered by Section 10.2 above, the following procedures will apply:

(a) Notice. Promptly after receipt by an Indemnified Party of notice of the commencement or threatened commencement of any civil, criminal, administrative or investigative action or proceeding involving a claim in respect of which the Indemnified Party will seek indemnification pursuant to this Article Ten, the Indemnified Party will notify the Indemnifying Party of such claim in writing. The failure of Indemnified Party to so notify an Indemnifying Party will relieve Indemnifying Party of its obligations under this Section 10.3 to the extent that Indemnifying Party can demonstrate damages attributable to such failure. Within fifteen (15) days following receipt of written notice from the Indemnified Party relating to any claim, but no later than fifteen (15) days before the date on which any response to a complaint or summons is due, the Indemnifying Party will notify the Indemnified Party in writing if the Indemnifying Party elects to assume control of the defense and settlement of that claim (a “Notice of Election”).

-82-

(b) Procedure Following Notice of Election. If the Indemnifying Party delivers a Notice of Election relating to any claim within the required notice period, the Indemnifying Party will be entitled to have sole control over the defense and settlement of such claim; provided that (i) the Indemnified Party will be entitled to participate in the defense of such claim and to employ counsel at its own expense to assist in the handling of such claim; and (ii) the Indemnifying Party will notify the Indemnified Party before ceasing to defend against such claim, and will not compromise or settle such claim without the Indemnified Party’s prior written consent if such compromise or settlement would impose a penalty or limitation upon the Indemnified Party, including, an injunction or other equitable relief, or such compromise or settlement does not include the release of the Indemnified Party from all liability arising from or relating to such claim. After the Indemnifying Party has delivered a Notice of Election relating to any claim, the Indemnifying Party will not be liable to the Indemnified Party for any legal expenses incurred by the Indemnified Party in connection with the defense of that claim. In addition, the Indemnifying Party will not be required to indemnify the Indemnified Party for any amount paid or payable by the Indemnified Party in the settlement of any claim for which the Indemnifying Party has delivered a timely Notice of Election if such amount was agreed to without the written consent of the Indemnifying Party.

(c) Procedure Where No Notice of Election Is Delivered. If the party which is the Indemnifying Party does not deliver a Notice of Election relating to any claim within the required notice period, the Indemnified Party will have the right to defend the claim in such manner as it may deem appropriate, and the failure of the Indemnifying Party to deliver such Notice of Election will not affect the indemnification obligations of such party under this Master Agreement.

(d) Cooperation. When seeking indemnification, the Indemnified Party will at all times reasonably cooperate with the Indemnifying Party in the defense or settlement of any claim which is subject to this Article Ten.

(e) Entitlement to Payment. In the event an Indemnifying Party elects not to assume control of the defense and settlement of that claim, the Indemnified Party will be entitled to payment by the Indemnifying Party upon the Indemnified Party’s settlement of the claim or the adjudication of liability, whichever first occurs.

ARTICLE ELEVEN– SERVICES FOR CLIENTS

11.1 Scope of Services. EVERTEC acknowledges that the Services are intended to enable COMPANY, BPPR, and their respective Subsidiaries to manage effectively certain of:

(a) COMPANY, BPPR, and their respective Subsidiaries’ internal operations, and

(b) COMPANY, BPPR, and their respective Subsidiaries’ performance and delivery of services and products for COMPANY, BPPR, and their respective Subsidiaries’ respective Clients (hereinafter collectively referred to as the “Popular Services and Products”).

-83-

Provided EVERTEC is given the opportunity to (i) coordinate with COMPANY and BPPR and approve the Specifications for the Services, COMPANY, BPPR, or one of their respective Subsidiaries proposes to offer under a written agreement between COMPANY, BPPR, or one of their respective Subsidiaries and a Client that includes the provision of such Services (“Client Agreements”); and (ii) review and accept changes to any applicable operating manuals of COMPANY, BPPR, or their respective Subsidiaries that impact EVERTEC with respect to its provision of the Services, EVERTEC shall use Best Efforts to ensure that the Services are provided in a manner that allows COMPANY, BPPR, and their respective Subsidiaries to act in accordance with the corresponding Client Agreements and operating manuals for each of the Popular Services and Products. In the event that COMPANY, BPPR, or their respective Subsidiaries make any change to any Popular Service and Product that requires a change or modification to the Services, such change shall be processed and implemented pursuant to this Master Agreement.

11.2 Special Representations Regarding EVERTEC’s Performance of Services under Service Agreements with Governmental Agencies. In connection with any Client Agreement wherein the Client is a Governmental Authority of the Commonwealth of Puerto Rico, EVERTEC shall comply with all applicable Legal Requirements relating to government procurement and contracting.

11.3 Client Agreements.

(a) EVERTEC will have no liability or obligation under any Client Agreement, whether through an outsourcing arrangement or through reselling of the Services; provided, however, that EVERTEC shall be responsible to COMPANY, BPPR, and their respective Subsidiaries for any Losses caused by a breach of any of its obligations under this Master Agreement. COMPANY, BPPR, and their respective Subsidiaries will have no authority to bind EVERTEC to any terms or conditions of the Service in connection with or as part of any Client Agreement, except as otherwise provided by the parties in writing.

(b) EVERTEC agrees to assist COMPANY, BPPR, and their respective Subsidiaries with the investigation of any claims arising under a Client Agreement. Furthermore, EVERTEC will refer to COMPANY, BPPR, and their respective Subsidiaries any complaint that is received by EVERTEC, in which case, EVERTEC will be notified of the results of any investigation performed by COMPANY, BPPR, or their respective Subsidiaries within five (5) days following the receipt of the referral for investigation.

(c) COMPANY, BPPR, and their respective Subsidiaries are responsible for any acts or omissions by Clients that, if performed by COMPANY, BPPR, or their respective Subsidiaries, would constitute a breach of this Master Agreement. COMPANY, BPPR, and their respective Subsidiaries are responsible for all fees and expenses that are payable to EVERTEC under this Master Agreement regardless of whether COMPANY, BPPR, and their respective Subsidiaries receive payment from the Client for the Services provided. Any charge-back or credit arrangements between COMPANY, BPPR, and their respective Subsidiaries and a Client are the responsibility of COMPANY, BPPR, and their respective Subsidiaries, and do not affect COMPANY, BPPR, and their respective Subsidiaries’ liability for the payment of such fees and expenses.

-84-

(d) Notwithstanding any limit of liability herein, COMPANY hereby agrees to indemnify, defend, protect and hold harmless EVERTEC, its Affiliates and their respective Representatives, suppliers, Third Party information providers, Subcontractors and permitted assigns and successors in interest (collectively, the “EVERTEC Indemnitee”) from and against any Losses incurred or suffered by, or asserted against, any EVERTEC Indemnitee directly or indirectly in relation to or arising from any claim brought by any Third Party against an EVERTEC Indemnitee based on (i) a Client’s use of the Services in a manner inconsistent with this Master Agreement and (ii) any breach of a Client Agreement by COMPANY, BPPR, or their respective Subsidiaries or a Client to the extent such breach is not attributable to a breach of this Master Agreement by EVERTEC.

[Signature page follows.]

-85-

IN WITNESS WHEREOF, the parties hereto have caused this Master Agreement to be executed by their duly authorized Representatives as of the date first written above.

[Signature Page to the Master Agreement]