Step Mobile, Inc. Virtual Visa® Debit Card Agreement

Issued by Evolve Bank & Trust, Member FDIC

IMPORTANT—ARBITRATION AND CLASS ACTION WAIVER. THIS AGREEMENT CONTAINS A MANDATORY ARBITRATION PROVISION AND A CLASS ACTION WAIVER. SEE SECTION XIX.

I. Parties; Scope; Related Terms

This Debit Cardholder Agreement (“Agreement”) governs your use of the Step Mobile, Inc. Virtual Visa Debit Card (the “Card”) issued by Evolve Bank & Trust (the “Bank,” “we,” “us,” or “our”). The Bank has retained Step Mobile, Inc. (“Step” or the “Program Manager”) and its service providers to perform certain services for the Card on the Bank’s behalf. Step also provides a mobile application, rewards, credit-building, and other membership services (the “Step Platform”), which are governed by separate terms available at https://step.com/ and https://step.com/policies(collectively, the “Step Terms”). These Step services are not provided or controlled by the Bank and are not part of this Agreement. By accepting, adding, or using the Card, you agree to this Agreement. “You” and “Your” mean the natural person who receives the Card and any authorized user allowed under this Agreement.

II. Definitions

Defined terms used in this Agreement include: “Account” means the deposit or transaction account at the Bank that funds Card transactions. “Authorized Transaction” means a transaction you or anyone you permit to use the Card authorizes. “Transaction” means any debit, purchase, refund, hold, authorization, or other charge posted to the Card Account. “Program Manager” means Step Mobile, Inc., responsible for customer service, transaction processing workflows, and certain product functions on the Bank’s behalf. “Service Providers” means vendors engaged by the Bank or Step to perform network, processing, tokenization, fraud, identity verification, KYC, AML, or other services.

III. Virtual-Only Card; No Cash Access

The Card consists of virtual credentials (card number, expiration date, CVV). No physical card will be provided unless the Bank elects to issue one. You may use the virtual Card credentials where Visa debit is accepted, subject to merchant acceptance, network rules, and applicable limits in Exhibit 2. Virtual Card credentials may be provisioned into mobile wallets and token services. Any physical card remains the property of the Bank and must be surrendered on demand. The Card is nontransferable. The Card may be canceled, repossessed, or revoked at any time as permitted by law.

IV. Eligibility; Permitted Use; Prohibited Use

You must meet identity verification requirements and be at least 18 years old (or as required by local law). The Card is for personal, family, and household use only. Prohibited uses include illegal activity, business use (unless expressly permitted), purchase of certain restricted goods and services as determined by the Bank or Visa, and transactions intended to produce cash access (e.g., quasi-cash merchants) unless expressly enabled.

V. Program Manager; Roles; Liability

Step, as Program Manager, will manage customer support, onboarding, provision of credentials to wallets, transaction monitoring, and certain customer communications. The Bank remains the issuer and owner of the Account and is responsible for funds, FDIC insurance, and regulatory compliance. Step performs services on behalf of the Bank under a written agreement. Neither Step nor the Bank guarantees third-party provider performance. The Bank and Step each retain the rights and defenses available under applicable law. To the extent permitted by law, the Program Manager’s obligations and the Bank’s obligations are separate; you may have direct contractual rights against the Bank and certain service providers as required by law.

VI. Funding, Authorization, Settlement, and Holds

a. Funding flow. Transactions are authorized against available funds in the Account or a linked permitted funding source designated by you. A transaction will only finally settle when the merchant presents it for settlement to the Bank via the card network. b. Authorization holds. Merchants may request preauthorization. We may place a hold that reduces available balance. Holds may be released when the merchant settles or after a period consistent with merchant type and Visa rules. Holds for fuel, restaurants, hotels, and similar merchants may exceed the final transaction amount. Typical hold durations vary; some may remain for multiple days. c. Settlement differences. Final settlement may differ from the authorized amount (e.g., tips). You are responsible for settled amounts. d. Reserve and setoff. The Bank may place a reserve, setoff, or lien against funds in any account you hold with the Bank to secure obligations, overdrafts, negative balances, or chargebacks as permitted by law.

VII. Tokenization; Digital Wallets; Credential Rotation

We may tokenize the Card for use in digital wallets and mobile devices. Token provisioning, token replacement, push provisioning, and device authentication are subject to wallet providers’ terms and Visa tokenization rules. We may replace tokens or reissue credentials for security or operational reasons without prior notice. Adding the Card to a wallet may change how returns, disputes, and authorization flows operate.

VIII. Transaction Limits; Spending Controls

See Exhibit 2 for per-transaction, daily, and monthly limits. We may impose lower limits for new accounts or higher fraud risk. You may have access to in-app controls to freeze, restrict, or close the Card. Limits and controls may be changed by us for risk, compliance, or operational reasons.

IX. Fees; Fee Schedule

Fees appear in Exhibit 1. We may add, remove, or change Fees with notice as required by law. Fees may be debited from the Account even if this produces or increases a negative balance, subject to law.

X. Statements; Notices; E-communications

We provide electronic statements and notices via the Step App or email. You consent to electronic delivery where permitted. Paper statements are available on request and may incur a fee if permitted by law. Notice to us is effective when received at the contact information in this Agreement. Notice to you is effective when sent to your email or in-app inbox as provided in our records.  Please refer to the Step Electronic Communication Agreement available at: https://step.com/policies/eca.

XI. Privacy; Data Sharing; Marketing

We and Step collect, use, and share personal data under the Bank and Step privacy notices. We may share transaction and identity information with service providers, merchants, card networks, fraud and AML providers, and regulators in accordance with our Privacy Policy Notice available at https://www.getevolved.com/privacy-policy/. By using the Card you consent to necessary data sharing to operate the Card. Marketing or promotional contacts are subject to separate consent controls in the Step Terms.

XII. Monitoring; Fraud Detection; AML/KYC

We, Step, and third-party vendors monitor transactions for fraud, suspicious activity, AML, and compliance. We may suspend activity, place holds, require verification, or close accounts if suspicious activity is detected. We may share information with law enforcement and regulators as required.

XIII. Lost, Stolen, or Compromised Credentials; Security

You must keep credentials secure and not share PINs, CVVs, or one-time codes. If credentials are lost, stolen, or compromised, contact Step immediately at  1-800-847-2911 (in the US) or +1-303-967-1096 (collect call, outside the US) or hello@step.com. See Sections XVI–XVII for liability and error resolution procedures.

XIV. Unauthorized Transactions; Liability; Provisional Credit

If you notify us promptly of unauthorized transactions we will investigate. To the extent applicable, federal law (EFTA/Regulation E) and Visa rules may limit your liability. We will provisionally credit your Account in accordance with Regulation E timelines while we investigate, subject to required documentation and cooperation.

XV. Disputes, Chargebacks, and Merchant Claims

a. Chargebacks. For eligible transactions you may request assistance with merchant disputes and chargebacks. Eligibility and timelines follow Visa rules and the Bank’s chargeback procedures. Chargebacks are not guaranteed. b. Documentation. You must provide transaction details, receipts, and correspondence. c. Merchant refunds. Refunds depend on merchant action and may take several business days to post.

XVI. Error Resolution; Electronic Funds Transfer Rights

Follow the error resolution process in Section XVII (Your Right to Dispute Errors). We will investigate and respond per applicable law. Where Regulation E applies the timelines and provisional credit rules in Section XVII apply.

XVII. Your Right to Dispute Errors (Regulation E)

Contact us no later than 60 days after the first statement on which an error appears. To make an error claim provide: name, account number, dollar amount, date, and explanation. We will acknowledge receipt within 10 business days and resolve within 10 business days or up to 45 days as allowed by law. See contact details below.

XVIII. Recurring Payments; Stop Payment

You remain responsible for recurring charges you authorize. To stop future recurring charges notify the merchant and contact us at least 3 business days before next scheduled payment. If you notify us we will attempt to stop payment and follow applicable law. We may require written confirmation within 14 days.

XIX. Arbitration; Class Waiver; Opt-Out

Any Claim between you and the Bank or Step arising from or relating to the Card or this Agreement will be resolved by binding arbitration administered by the AAA, JAMS, or other mutually agreeable administrator under its rules. Arbitration shall be final and binding. You waive the right to jury trial and to participate in class or collective proceedings. You may opt out of the arbitration clause by sending written notice to hello@step.com within 30 days of account opening with your name, account number, and a statement that you decline arbitration. If you opt out, arbitration will not apply to you. Except as stated, arbitration will be conducted in Memphis, Tennessee, and governed by the Federal Arbitration Act. This section survives termination.

XX. Suspension, Cancellation, and Setoff

We may limit, suspend, or cancel the Card or Account for fraud, suspected illegal activity, nonpayment, KYC/AML failures, network rules, or other legitimate reasons. We may offset negative balances against funds in other accounts you hold with the Bank. We will provide notice where required by law.

XXI. Governing Law; Venue; Changes to Terms

Unless preempted by federal law, Tennessee law governs this Agreement. We may amend this Agreement. Material changes will be communicated in-app, by email, or as required by law. Minor administrative or security changes may occur without prior notice.

XXII. Intellectual Property; Trademarks

Step and the Bank own or license the marks and content used in the Step Platform and communications. You may not use our trademarks without written permission.

XXIII. Sanctions, Compliance, and Export Controls

You may not use the Card in violation of U.S. economic sanctions, export controls, or applicable law. We may block transactions that violate sanctions or law.

XXIV. Limitation of Liability; Indemnity

To the fullest extent permitted by law, our liability is limited to direct damages caused by our willful misconduct or gross negligence. We are not liable for indirect, incidental, or consequential damages. You agree to indemnify us for claims arising from your breach or misuse of the Card.

XXV. Severability; Survival; Waiver

If any provision is invalid, remaining provisions remain in force. Failure to enforce a right is not a waiver. Provisions that by their nature survive termination will survive.

XXVI. Miscellaneous

You may not assign your rights. We may assign or transfer our rights and obligations. This Agreement, exhibits, the Step Terms, and privacy notices form the full agreement between you and the Bank/Step regarding the Card.

Contact Information

Customer Support (Step): Phone Call 1-800-847-2911 (in the US) or +1-303-967-1096 (collect call, outside the US); Email: hello@step.com; Mailing: 380 Portage Avenue, Palo Alto, CA  94306 Issuer: Evolve Bank & Trust, Attn: Card Operations, [Evolve mailing address]; Customer Service: [Evolve contact info] Regulatory Complaints: [Evolve regulatory contact or FDIC info as appropriate]

Signature; Effective Date

This Agreement is effective when you accept, add, activate, or use the Card.