Heartland Payment Systems (HPY)

20.8 Regulatory Compliance

(a) Prohibition Lists. Without limiting the generality of Section 20.7, Service Agent shall maintain, either directly or through third parties, a compliance program that includes comprehensive procedures designed to ensure Service Agent’s compliance with the rules and regulations promulgated by the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury. Service Agent’s procedures, which may be changed as Service Agent determines necessary to comply with Applicable Law, shall include regular screening against OFAC’s Specially Designated Nationals and Blocked Persons List and the U.S. Department of State’s Terrorist Exclusion List (TEL), and any similar lists promulgated by the U.S. Government (Prohibition Lists). Service Agent shall review potential matches identified by such screening, and if an actual match is confirmed, Service Agent shall (i) take any required actions to comply with Applicable Law (including, as needed, providing required notifications, blocking transactions or freezing funds) and (ii) alert American Express of any confirmed positive match of a Program Merchant to a Prohibition List.

(b) Screening. Service Agent will:

(i) include at least the following information in its screens of the Program Merchants against the Prohibition Lists: (A) legal name of the Program Merchant; (B) “Doing Business As”/ “Trade Name” name; and (C) Program Merchant Principal (including last name, first name, and, if obtained, middle name or initials on an account;

(ii) conduct screening against the entire Prohibition List for a particular Program Merchant when an account is opened for such Program Merchant, and for all Program Merchants on a periodic basis (generally quarterly). For clarification, Service Agent may change the frequency specified in this paragraph as it deems necessary in its sole discretion to comply with Applicable Law; and

(iii) promptly terminate the Card Acceptance Agreement of any Program Merchant listed on a Prohibition List and then notify American Express and the necessary Government Agency/regulator promptly after effecting such cancellation.

-18-

(c) Training. Service Agent will:

(i) ensure all personnel performing applicable compliance activities are adequately trained, and Service Agent must provide refresher training at least annually thereafter. The scope of each employee’s training will be tailored to his or her particular job function;

(ii) cause its management to participate in training programs and take action to ensure high employee attendance;

(iii) ensure identified staff attend appropriate training sessions and have the knowledge necessary to fulfill their respective compliance obligations; and

(iv) refresh training programs and materials so that they remain current and relevant to the then-current regulatory environment and business processes.

20.8 Regulatory Compliance