VirePay Terms of Service

1. Agreement and acceptance

These Terms of Service (the "Terms") govern access to and use of the VirePay platform, APIs, documentation and related technology (the "Service") by a business customer ("Customer", and where the Customer is a lender, "Lender").

The Service is offered to businesses only. It is not offered to consumers, and a borrower is not a party to these Terms by reason of a payment being processed through the Service.

By creating an account, accepting these Terms in the Service, or using the Service, the Customer agrees to these Terms. The individual accepting confirms that they are authorized to bind the Customer.

Acceptance is recorded server-side with the document version, the timestamp, the accepting user, the Customer's tenant, the locale displayed and the acceptance event. Acceptance is never pre-checked and is never inferred from continued use alone where renewed acceptance is required.

Outstanding review: LEGAL REVIEW REQUIRED

2. Definitions

• "Approved Payment Provider" means a third-party payment provider or financial institution engaged to execute payment transactions. No provider is selected or approved as at the effective date of this draft.
• "LMS" means a loan-management or origination platform used by the Customer, such as CreditBook SLOAN, that submits or receives instructions in respect of the Customer.
• "Instruction" means an authorized payment or servicing instruction submitted to the Service by the Customer or an approved system acting for the Customer.
• "PAD Authorization" means a pre-authorized debit authorization obtained by the Lender from a borrower.
• "Funding Wallet" means a lender-specific, provider-held or provider-reported funding account, wallet, subaccount, segregated balance or equivalent payment-provider structure used to support the Lender's money movement. The lender-facing product may call it a Funding Wallet; the underlying provider implementation may vary. It is never a "VirePay Wallet".
• "Collections" means the Service's repayment and collection workflows for authorized debits from borrowers. The Service uses the product term "Collections"; it does not operate a separate or contradictory concept of repayments.
• "Customer Data" means data submitted to the Service by or for the Customer, including borrower and loan records.
• "Platform Records" means VirePay-generated operational records, including payment attempts, statuses, ledger entries, servicing events, reconciliation results and audit history.

Outstanding review: PROVIDER CONFIRMATION REQUIRED

3. VirePay's role

VirePay is a payment-workflow and financial-technology orchestration platform. It connects the Lender and its LMS to an Approved Payment Provider: Lender / LMS → VirePay → Approved Payment Provider.

Subject to configuration and applicable approvals, VirePay may:

• receive authorized Instructions;
• validate technical, authentication and permission state;
• orchestrate authorized payment workflows, including loan funding, Collections and, where supported, transfers to the Lender's bank;
• record workflow and transaction state;
• receive and record provider results;
• reconcile records across the Customer's systems, VirePay and provider-reported outcomes;
• report confirmed outcomes to the Customer and its LMS;
• maintain audit and history records; and
• provide lender operational and accounting-support reporting.

VirePay does not: provide lending capital; make loans; approve borrowers; underwrite borrowers; determine loan terms; determine how much a borrower owes; independently determine payment schedules; own lender capital; take custody of lender or borrower money; act as the Lender's bank; guarantee repayment; or guarantee collection.

VirePay is not the Customer's lender, bank, financial institution, loan broker or underwriter, and does not act as the borrower's agent. VirePay does not guarantee the Customer's compliance with law and does not provide legal, tax or accounting advice.

4. Lender responsibility

The Lender is solely responsible for its lending business throughout Canada, in every province and territory in which it operates. The Lender and its LMS remain authoritative for the underlying lending relationship, including:

• providing lending capital;
• determining whether it may legally lend;
• lending licences, permits, registrations and provincial or territorial lending authority;
• underwriting, credit decisions, loan approvals and loan terms;
• loan size, loan amounts and any lending limits applicable to its business;
• the original principal, contractual balance, amount due, due dates and repayment schedule of each loan;
• interest and fees associated with the loan;
• delinquency and default treatment, and write-off decisions, policy and amounts;
• lending disclosures and borrower agreements;
• obtaining the PAD Authorization required for each collection;
• servicing requirements imposed on the Lender;
• the legality of its lending activities and of each loan submitted through the Service;
• compliance with all laws applicable to its lending business.

Outstanding review: LEGAL REVIEW REQUIRED

5. No licensing determination by VirePay

VirePay does not independently determine, confirm or certify that a Lender holds every licence, permit, registration or approval required to conduct its lending business in any jurisdiction in Canada.

No status, label, report or export produced by the Service means that VirePay has assessed a Lender's lending authority. Operational statuses such as "Account active", "Integration active" or "Processing enabled" describe the state of a technology configuration only. VirePay's technical processing never certifies a Customer's compliance.

6. External loan-management systems

Where the Customer uses CreditBook SLOAN or another loan-management or origination platform, that external system performs only the functions it has contractually agreed to perform with the Customer. VirePay is not a party to that arrangement unless separately agreed in writing.

The Lender and its LMS remain authoritative for the underlying lending relationship. VirePay may receive an authorized Instruction from an approved LMS. VirePay does not re-underwrite the borrower, independently or legally approve the loan, independently determine whether the Lender is licensed, independently determine whether the loan is legally valid, replace Customer compliance systems, or guarantee that information supplied by an LMS is legally sufficient.

VirePay may reasonably rely on authorized Instructions submitted through authenticated channels by the Customer or its approved systems, subject to VirePay's authentication, tenant isolation, permissions, amount and currency validation, idempotency, duplicate protection, state validation, provider availability, security controls, suspension rights and legal obligations.

7. Authorized instruction principle

When an authenticated Customer, or an approved system acting for the Customer, submits an Instruction, the Customer is responsible for the underlying authorization and legal basis for that Instruction.

VirePay remains responsible for VirePay-side technology and payment controls. VirePay may validate authentication; authorization; tenant identity; permissions; the lender-to-resource relationship; amount; currency; payment state; PAD workflow state; idempotency; duplicate protection; provider availability; security; and technical validity.

VirePay uses idempotency keys, duplicate detection, safe retry controls and transaction-state validation so that a duplicate LMS or API request does not result in duplicate payment activity where the Service can identify the original Instruction. These protections are preserved as a core responsibility of the Service and are not waived.

These controls are technical and contractual controls only. They are not, and must not be represented as, a determination by VirePay of the legality, enforceability or regulatory sufficiency of the underlying loan, disclosure or borrower relationship.

8. Funding Wallet

A Funding Wallet is a lender-specific funding account, wallet, subaccount, segregated balance or equivalent structure held with, or reported by, the Approved Payment Provider or financial institution serving the Lender. It is used to support the Lender's money movement. The lender-facing product may call it a Funding Wallet; the underlying provider implementation may vary.

The funds in a Funding Wallet remain the Lender's capital. VirePay does not own those funds, does not hold or take custody of them, and never pools them into a VirePay balance. The Approved Payment Provider or financial institution maintains the underlying financial infrastructure. A Funding Wallet is never a "VirePay Wallet".

Whether a provider supports Funding Wallets, partial withdrawals, collection-to-wallet settlement, transfers to bank or cancellation, and the applicable clearing timing, is subject to provider confirmation and is not settled as at the effective date of this draft.

Outstanding review: PROVIDER CONFIRMATION REQUIRED

9. Funds and payment flow

VirePay orchestrates and records authorized payment Instructions. VirePay does not take possession, custody or control of Customer or borrower funds at any point in the flows below, each of which is subject to provider confirmation, settlement and clearing rules, and return rules:

• Loan funding — instruction path: Lender / LMS → VirePay → Approved Payment Provider. Funds path: the Lender's provider-held Funding Wallet or account → the Approved Payment Provider → the borrower's bank account.
• Collections — instruction path: Lender / LMS → VirePay → Approved Payment Provider. Funds path: the borrower's bank account → the Approved Payment Provider → the Lender's provider-held Funding Wallet or account, subject to provider confirmation, settlement and clearing, and return rules.
• Transfer to bank — where supported and configured, instruction path: Lender → VirePay → Approved Payment Provider. Funds path: the Funding Wallet or account → the Approved Payment Provider → the Lender's verified external business bank account.

VirePay's operational ledger is a technology record used for reconciliation, workflow and audit. It is not a bank account, not a store of value, and not evidence of legal ownership, custody or settlement of funds.

The exact funds-flow, custody and settlement structure depends on the payment provider and banking arrangements ultimately approved, and is not settled as at the effective date of this draft. These Terms describe the intended structure conditionally and do not state any provider capability as final fact until confirmed.

Outstanding review: PROVIDER CONFIRMATION REQUIREDOutstanding review: LEGAL REVIEW REQUIRED

10. Transaction limits

The Service does not impose a universal platform-wide maximum loan size. Loan size, loan terms and lending limits remain the responsibility of the Lender, its LMS and applicable legal requirements.

Individual transactions may be subject to limits arising from the Approved Payment Provider, the Customer's own configuration, legal or regulatory requirements, risk and security controls, or contract. No dollar amount for any such limit is set by these Terms.

VirePay expects that the majority of initial lending activity on the Service will commonly fall in the approximate range of $250 to $1,500 CAD. This is a typical business expectation only — not a contractual or technical platform maximum — and larger loans may be processed subject to the Lender, its LMS, the Approved Payment Provider and applicable requirements.

11. Customer representations and warranties

The Customer represents and warrants, on each date it uses the Service, that:

• it is validly organized and in good standing where applicable;
• the person accepting these Terms has authority to bind it;
• information it supplies to VirePay is accurate and not misleading;
• it possesses all authority necessary to conduct its business;
• it is solely responsible for determining which lending licences, permits, registrations and approvals it requires;
• it maintains all lending authority required for its activities;
• each loan submitted through the Service has been properly authorized by the Customer;
• each Instruction submitted to the Service is authorized;
• it has obtained the borrower agreements and disclosures required by applicable law;
• it has obtained the required PAD Authorization before submitting an applicable collection Instruction;
• its use of the Service complies with applicable law;
• it will not use the Service for fraudulent, misleading, abusive or unauthorized activity; and
• it will promptly notify VirePay of circumstances that materially affect its authority to use the Service.

Outstanding review: LEGAL REVIEW REQUIRED

12. No independent verification

VirePay does not independently verify the representations in section 11. VirePay's acceptance of an account, an Instruction or a data record is not confirmation that a representation is true.

13. Payment providers and third-party infrastructure

Actual payment processing depends on independent third-party payment providers, financial institutions and payment networks. Approved Payment Providers and financial institutions are independent third parties; VirePay does not control them.

The Customer acknowledges that provider availability, provider outages, banking-network delays, returns, NSF, rejected transactions, reversals, settlement delays, provider risk controls, provider onboarding requirements, provider suspension and provider transaction limits may affect whether and when an Instruction is executed.

VirePay cannot guarantee provider uptime, banking-network uptime, transaction approval, settlement timing, return timing, successful collection or successful loan funding.

VirePay does not guarantee that any Instruction will succeed. VirePay may suspend, delay or reject an Instruction where required or reasonably necessary because of a payment provider, a financial institution, applicable law, a court order, a regulator, security concerns, fraud controls or system integrity requirements. Nothing in this section eliminates responsibilities VirePay legally retains for its own systems and controls.

Outstanding review: PROVIDER CONFIRMATION REQUIRED

14. Pre-authorized debit (PAD) workflows

Obtaining and maintaining the authority to debit a borrower's account is the Lender's responsibility, including the form, content, delivery, confirmation period, amendment and cancellation requirements applicable to that authorization.

VirePay provides technology used to manage PAD workflow state and to store evidence supplied by the Lender. The existence of a PAD record in the Service is not a determination by VirePay that the authorization is valid, sufficient or enforceable.

The debit itself is executed by the approved payment provider and banking infrastructure. VirePay does not have, and does not claim, standing authority to debit borrower accounts on its own behalf.

Outstanding review: LEGAL REVIEW REQUIRED

15. Collections outcomes and no guarantee

VirePay provides technology for submitting and managing authorized payment and Collections workflows. A collection may succeed, fail, be rejected, be returned, be reversed, be delayed, or remain unknown pending provider confirmation, and VirePay does not guarantee collection or settlement.

Settlement state is recorded only from trusted evidence. The absence of such evidence is recorded as an unsettled or unknown state and is never presented as success.

Where the final provider outcome of an Instruction cannot be determined, VirePay may maintain the Instruction in an unknown or investigation-required state rather than assuming success or failure, and may perform status lookup and reconciliation before any retry. The Service does not automatically resubmit an uncertain transaction.

A previously successful payment may later be returned, reversed, disputed or otherwise adjusted. VirePay preserves the original event and records subsequent events rather than rewriting history. The provider-confirmed status remains authoritative for the actual payment outcome.

16. Write-offs and post-write-off recoveries

VirePay does not independently decide that a borrower's loan should be written off. The Lender and its LMS remain responsible for delinquency decisions, default treatment, write-off policy, the write-off amount and the accounting and tax treatment of a write-off. VirePay may record and report a write-off status received through an authorized system.

VirePay may record a payment received after the Lender's LMS previously reported the loan as written off. Such a recovery is recorded as a later event attached to the original loan, without rewriting the earlier write-off history. VirePay does not independently determine its accounting or tax treatment.

17. Accounting-support reporting

VirePay does not provide legal, tax or accounting advice. VirePay may provide operational and accounting-support reports based on records received and processed by the Service. Those reports may contain:

• principal advanced;
• principal collected;
• LMS-reported interest;
• LMS-reported fees;
• returns;
• reversals;
• write-offs;
• recoveries; and
• outstanding values.

VirePay does not calculate the Customer's income tax payable, does not determine tax deductions, does not determine whether a write-off is legally or tax deductible, and does not automatically add GST/QST to loan principal. Accounting and tax decisions remain with the Customer and its advisers.

18. Account security

The Customer is responsible for the security of its accounts and integration credentials.

Access to the Service is by email address and password. VirePay does not use usernames, and an email address that cannot receive mail cannot be used to sign in. Signing in requires a second step: a numeric verification code sent by email to the address on the account and entered before the session is treated as verified. Verification codes expire and the number of entry attempts and resends is limited. A session that has not completed verification is refused for sensitive operations even where the password was correct.

Passwords must satisfy the complexity requirements enforced by the Service at the time the password is set. The Customer is responsible for the security of the email accounts, mailboxes and email infrastructure to which verification codes and password-reset messages are delivered, and acknowledges that a person who controls a user's mailbox may be able to obtain access to that user's account. Verification codes are personal to the user and are not requested by VirePay support.

• protect credentials and keep them confidential;
• complete email verification when prompted, and never disclose or forward a verification code to any person, including a person claiming to act for VirePay;
• maintain control of the email addresses associated with its users, and update or remove an address promptly when a user's mailbox changes or is decommissioned;
• maintain an accurate list of authorized users;
• promptly remove terminated personnel;
• not share accounts between individuals;
• report suspected compromise of an account, a password or a mailbox to VirePay without undue delay;
• secure API credentials and rotate them when required; and
• ensure integration credentials are used only by authorized systems.

Outstanding review: LEGAL REVIEW REQUIRED

19. Customer administrators

Customer administrators are responsible for managing their organization's authorized users, roles and permissions, subject to VirePay's security controls. Actions taken by an authenticated and verified user of the Customer are attributed to the Customer, except to the extent caused by VirePay's failure of its own controls.

20. Acceptable use

The Customer will not, and will not permit any person to:

• commit fraud or submit unauthorized payment activity;
• share credentials or verification codes, or circumvent security, sign-in verification or other authentication controls;
• scrape, crawl or extract data without authorization;
• reverse engineer the Service, except to the extent this restriction is unenforceable under applicable law;
• introduce malicious software;
• submit unlawful transactions;
• impersonate a person or organization;
• access accounts, tenants or data it is not authorized to access;
• attack, probe, overload or exploit the Service;
• abuse the APIs or attempt to defeat rate limits; or
• use the Service for activities prohibited by an approved payment provider.

21. Suspension and restriction

VirePay may suspend an account, disable an integration, pause payment Instructions, restrict API access or terminate access where reasonably necessary because of security risk, fraud, payment-provider direction, regulatory requirement, legal process, court order, material breach, non-payment of VirePay fees, threat to platform integrity, abuse or unauthorized activity.

Where practicable and lawful, VirePay will notify the Customer and limit the scope and duration of a suspension.

Exercising a suspension right does not mean that VirePay assumes responsibility for monitoring, policing or certifying any Customer's licensing status or lending compliance.

Outstanding review: LEGAL REVIEW REQUIRED

22. Fees and payment

• VirePay's commercial fees may include subscription fees, platform fees, transaction fees, and integration or implementation fees, as agreed in the applicable order form or fee schedule.
• Loan principal, Collections proceeds and Funding Wallet funds are the Lender's money, not VirePay revenue. VirePay's fees are charged and accounted for separately from lender money.
• Fees are exclusive of taxes. References to applicable taxes in this section concern taxes on fees charged by VirePay to the Customer — never borrower loan principal or lender capital — and taxes on VirePay's income remain VirePay's responsibility. Actual tax treatment remains subject to legal and accounting review.
• Invoices are payable on the terms stated in the applicable order form. Late amounts may bear interest and may result in suspension under section 21.
• Fee changes take effect on notice and, where a committed term applies, at renewal.
• Refunds apply only where expressly stated in an order form or required by law.
• VirePay does not deduct its fees from borrower collection proceeds by default. Any such commercial or provider structure would require provider support, contractual approval, legal review and explicit configuration.

Outstanding review: PROVIDER CONFIRMATION REQUIREDOutstanding review: LEGAL REVIEW REQUIRED

23. Intellectual property

VirePay and its licensors own the Service, including its software, APIs, interfaces, documentation, workflow architecture, trademarks and all related intellectual property. No rights are granted except the limited, non-exclusive, non-transferable right to use the Service during the term in accordance with these Terms.

The Customer retains all rights in Customer Data. VirePay does not claim ownership of the Customer's loan or borrower records because it processes them. VirePay may use Customer Data to operate, secure, support, reconcile, report on and maintain the Service, and as described in the Privacy Policy and any data processing agreement between the parties.

VirePay may create and use aggregated or de-identified information that does not identify the Customer, any borrower or any individual, provided it cannot reasonably be re-identified.

If the Customer provides feedback, VirePay may use it without restriction or obligation.

24. Confidentiality

Each party will protect the other's confidential information using at least reasonable care and will use it only to perform under these Terms.

Confidential information includes customer business information, borrower information, APIs and non-public technical information, credentials, pricing, security information and other non-public platform information.

Disclosure is permitted to personnel and service providers who need to know and are bound by confidentiality obligations, and where required by law or legal process, with notice where lawful.

Personal information is also governed by the Privacy Policy and by any data processing agreement the parties execute; where they conflict, the data processing agreement governs personal information.

Outstanding review: LEGAL REVIEW REQUIRED

25. Warranties and service availability

VirePay will provide the Service with reasonable skill and care. Except as expressly stated in these Terms or a written service level agreement, and subject to warranties that cannot be excluded under applicable law, the Service is provided "as is" and VirePay disclaims implied warranties including merchantability, fitness for a particular purpose and non-infringement.

VirePay does not guarantee uninterrupted availability, error-free operation, loan repayment, Customer compliance, borrower solvency, provider uptime, banking-network uptime, settlement timing, or regulatory acceptance of a Customer's activities.

Any availability commitment or support target applies only if set out in a separate written service level agreement. No such commitment forms part of these Terms by implication.

Outstanding review: LEGAL REVIEW REQUIRED

26. Indemnification

To the extent permitted by applicable law, the Customer will defend, indemnify and hold harmless VirePay and its personnel from third-party claims, proceedings, penalties, damages and reasonable costs arising from:

• the Customer's lending activity;
• the Customer's licences, registrations or the absence of them;
• the Customer's loan agreements, disclosures, underwriting and lending decisions;
• interest or fees alleged to be unlawful;
• borrower claims concerning the underlying loan or the lending relationship;
• unauthorized Instructions supplied by or for the Customer;
• the Customer's violation of law or misuse of the Service;
• Customer-provided data, including its accuracy and the authority to supply it;
• alleged infringement of third-party rights by Customer Data or Customer systems; and
• the Customer's fraud or wilful misconduct.

Outstanding review: LEGAL REVIEW REQUIRED

27. Limitation of liability

Subject to the carve-outs below and to any liability that cannot be limited under applicable law, neither party is liable for indirect, incidental, special, punitive or consequential damages, or for lost profits, lost revenue, loss of opportunity, loss of goodwill or loss of data, however caused.

VirePay is not liable for loss arising from third-party payment provider outages, banking or network failures, borrower NSF, returns or reversals, unauthorized activity by the Customer or its personnel, or events beyond VirePay's reasonable control.

Each party's aggregate liability is limited to a proportionate cap to be set by reference to fees paid in a defined preceding period. The amount and period are not settled in this draft.

The limitations do not apply where prohibited by applicable legislation, and do not exclude liability for fraud, wilful misconduct, death or personal injury caused by negligence, or a party's confidentiality or indemnity obligations to the extent legally required.

Outstanding review: LEGAL REVIEW REQUIRED

28. Force majeure

Neither party is liable for a delay or failure caused by an event beyond its reasonable control, including natural events, labour disruption, war, civil unrest, epidemic, government action, failure of telecommunications, payment networks, banking systems or third-party infrastructure. Payment obligations for amounts already due are not excused.

29. Third-party services

The Service integrates with independent third parties, which may include payment providers, financial institutions, LMS platforms, cloud infrastructure providers and communication providers. VirePay does not control those third parties and is not responsible for their acts, omissions, availability or terms.

This section does not disclaim responsibilities VirePay legally retains for its own selection, engagement and oversight of the service providers and subprocessors it uses to deliver the Service.

30. Term, termination and effect

• The Customer may terminate as set out in its order form, or on notice where no committed term applies.
• VirePay may terminate for material breach that is not cured within a reasonable notice period, or immediately on a ground listed in section 21 where suspension is insufficient.
• Termination does not waive fees accrued before the effective termination date.
• Provisions that by their nature should survive do survive, including confidentiality, intellectual property, indemnification, limitation of liability, fees owing and governing law.
• Where applicable, the Customer may export its data during a defined post-termination window, after which export access ends.
• Financial records, payment evidence, PAD evidence and audit history are retained for the periods required by law, by an approved payment provider or by VirePay's retention framework. They are not deleted merely because an account was terminated.
• Data no longer subject to a retention requirement is securely destroyed or irreversibly anonymized.
• Pending payment activity at termination is completed, cancelled or suspended as required by the approved payment provider and applicable law.

Outstanding review: LEGAL REVIEW REQUIREDOutstanding review: PROVIDER CONFIRMATION REQUIRED

31. Changes to these Terms

VirePay maintains a version, an effective date and an archived copy of each published version. Historical accepted versions are never rewritten or replaced.

Where a change is material and requires renewed acceptance, the updated Terms are displayed and affirmative acceptance is required before continued use of the affected functionality. Acceptance boxes are never pre-checked.

32. Governing law, disputes and notices

• Governing law: [PLACEHOLDER — province or territory not selected].
• Jurisdiction and venue: [PLACEHOLDER — courts not selected].
• Dispute resolution process: [PLACEHOLDER — escalation, mediation or arbitration not selected].
• Notices: [PLACEHOLDER — notice addresses and method not configured].
• No mandatory arbitration clause, class-action waiver, jury waiver or waiver of a right that cannot lawfully be waived is included in this draft. None may be added without legal review.

Outstanding review: LEGAL REVIEW REQUIREDOutstanding review: PRODUCTION CONFIGURATION REQUIRED

33. General

These Terms, together with any order form, data processing agreement and policies referenced in them, are the entire agreement for the Service. If a provision is unenforceable, the remainder continues in effect. Neither party may assign without consent, except to a successor of its business. No agency, partnership, joint venture or employment relationship is created. The English and French versions of these Terms are intended to be legally equivalent; which version governs a dispute is not settled in this draft.

Outstanding review: LEGAL REVIEW REQUIRED