FOURTH ADDENDUM TO SIXTH AMENDED AND RESTATED SERVICE AGREEMENT (Form 8-K)

FOURTH ADDENDUM TO

SIXTH AMENDED AND RESTATED SERVICE AGREEMENT

This Fourth Addendum to that certain Sixth Amended and Restated Service Agreement (the "Addendum") effective as of the 1st day of October, 2025 (the "Effective Date"), is entered into by and between Comenity Bank ("Bank"), a Delaware state bank, with its principal place of business at One Righter Parkway, Suite 100, Wilmington, Delaware 19803 and Comenity Servicing LLC ("Servicer"), a Texas limited liability company with its principal place of business at 3095 Loyalty Circle, Columbus, OH 43219.

RECITALS

WHEREAS, Bank and Servicer entered into that certain Sixth Amended and Restated Service Agreement as of January 1, 2025, (the "Agreement") to outsource certain services to Servicer; and

WHEREAS, Bank and Servicer desire to modify certain Services and Performance Standards set forth in Appendix A and Appendix B to the Agreement.

NOW, THEREFORE, in consideration of the mutual agreements hereinafter set forth, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, Bank and Servicer agree as follows:

1.Services. Bank and Servicer agree to amend the Services set forth in Appendix A to the Agreement, such that certain Services are hereby added or deleted as set forth in further detail in Exhibit A hereto.

2.Performance Standards. Bank and Servicer agree to amend the Performance Standards set forth in Appendix B to the Agreement, such that certain Performance Standards are hereby amended, added, or deleted as set forth in further detail in Exhibit B hereto.

3.Miscellaneous. Capitalized terms not otherwise defined in this Addendum shall have the meanings assigned to them in the Agreement. Other than as set forth above and in Exhibit A and Exhibit B hereto, the parties agree that the Agreement, as amended by this Addendum, shall continue in full force and effect. The parties may execute this Addendum in one or more counterparts, each of which shall be deemed an original, but all of which shall constitute but one and the same instrument.

IN WITNESS WHEREOF, the parties have caused this Addendum to be executed by their authorized officers effective as of the date first written above.

COMENITY BANK

By: /s/ Baron Schlachter

Name: Baron Schlachter

Title: President, Comenity Bank

COMENITY SERVICING LLC

By: /s/ Tammy McConnaughey

Name: Tammy McConnaughey

Title: President

EXHIBIT A

1.Additions. Set forth below are additional Services, all of which shall be incorporated into Appendix A to the Agreement.

SECTION I: SERVICES APPLICABLE TO ALL COMENITY BANK PRODUCTS

Service Category			Service Description			Amended/ Added
Analytic Data Platforms			•Oversee and manage the process of data flow for Enterprise Data Hub (EDH) and Enterprise Data Warehouse (EDW). •Ensure availability of the Enterprise Data Warehouse ("EDW") and Enterprise Data Hub ("EDH"). •Management of EDW and EDH asset/system/data access reviews and respective records retention. •Manage incoming data transmission to analytic data platform, online reports and files from specified contractual sources within the specified timeframes. •Review and Remediation of Partial or Duplicate Data in EDW Loads. •File Reconciliation and Failure Management for analytic data platforms sourced between Bread Financial and Brand Partners. •File Transmission and Tokenization for PCI Data Protection. •Tracking and Incident Management for Daily and Monthly File Deliveries into and out of the analytic data platform. •Monitoring and Incident Management for Failed CDC Jobs. •BID process: file/data creation for brand partners.			Added
Cybersecurity Operation Center			•Identify, prioritize, analyze and document cyber incidents. •Detect and determine impacts of anomalous activity. •Mitigation of impact of cyber incidents. •Coordinate with internal and external stakeholders regarding cyber incident response and restoration. •Monitor information systems and networks to ensure confidentiality, integrity, and availability of corporate information systems.			Added

Service Category			Service Description			Amended/ Added
Cybersecurity Technology & Controls			•Ensure appropriate protection of technology assets including security planning, intrusion detection and response, remote access, etc. •Vulnerability management to support scanning, discovery, and reporting of vulnerabilities to enable timely patching of findings by remediation teams. Application security code scanning and penetration testing to discover security weaknesses and to provide reporting to remediation teams for fix action thereby protecting technology assets. •Oversight of technology design to ensure appropriate security controls & platform integration to protect information and data integrity. •Infrastructure & Application security. •Product Security Management. •Cyber strategy & architecture.			Added
Digital Engineering			•Oversee & manage digital engineering for Omnichannel Platform and customer-facing digital assets, including the Mobile App and Account Center, Apply & Buy, Fraud, Credit Risk, Marketing, Capability Enablement, New Business and Brand Integration and Solutions value streams.			Added
Enterprise Architecture			•Provide strategic oversight of the planning, design, and acquisition of technology solutions to ensure alignment with business objectives, architectural standards, and regulatory requirements.			Added
Enterprise Reporting & Professional Services			•Self-Service Analytics (SSA) Platform. •Brand Interface Reporting. •Core Performance Metrics (CPM) Reporting. •Bounty Reporting. •Data Marts - Reporting/Semantic Data Layer.			Added
Identity & Access Management			•User & machine identity lifecycle management across associates, partners & customers. •Authentication & authorization enforcement. •Privileged access management. •Identity governance & role-based access controls. •Access reviews & audit support.			Added

Service Category			Service Description			Amended/ Added
Operations Engineering			•Provide Technology services, platform, network, including telecommunications through a secure environment, which can be outsourced to third and fourth parties, including but not limited to: •Asset & Configuration Management. •Change enablement. •Incident & Problem Management. •Network Infrastructure & Services Operations. •On Premise Infrastructure & Service Operations. •Management of end user technology. •Provide a 24 X 7 control center/help desk facility to monitor and manage data processing operations on behalf of Bank.			Added
Platform Engineering			•Provide Technology services, platform, network through a secure environment, which can be outsourced to third and fourth parties, including but not limited to: •Cloud migration and all cloud infrastructure management. •Software development lifecycle (SDLC) automation. •Development of testing frameworks and tools. •Enabling standards and best practices through a developer experience solution.			Added
Servicing and Core Processing Engineering			•Provide Technology services, platform, network, including telecommunications through a secure environment, which can be outsourced to third and fourth parties, including but not limited to: •Associate technologies in operations including but not limited to VCARS, IVR and Collections. •Core Processing Platform and Core Processing Engineering. •Financial Servicing Engineering including payments. •Servicing AI Assistant. •Telephone Infrastructure & Services Operations. •Loyalty and Rewards.			Added

Service Category			Service Description			Amended/ Added
Technology & Cyber Governance			•Technology Disaster Recovery. •Technology Issue Management. •Technology Compliance, Audit Readiness, Control & Regulatory Assessments & Control Automation. •Maintain technology policies and standards. •Technology Third Party Risk Management. •Technology Risk Reporting.			Added
Technology Innovation & Transformation			•Develop and maintain technology solutions through the following core processes: •Manage pipeline of key technology-based positions to support recruitment and staffing. •Ensure the capabilities of the current and future workforce meet strategic and technical requirements, ensure appropriate assignment of roles and responsibilities, maintain job descriptions, determine succession paths, oversee certifications requirements. •Manage and maintain technology functional organization chart.			Added

2.Deletions. Set forth below are Services which shall be deleted from Appendix A to the Agreement.

SECTION I: SERVICES APPLICABLE TO ALL COMENITY BANK PRODUCTS

Service Category			Service Description			Amended/ Added
Data Processing			•Manage all aspects of processing platform(s), including day to day operation, backups and maintenance, and disaster recovery. •Provide a 24 X 7 control center/help desk facility to monitor and manage data processing operations on behalf of Bank. •Ensure availability of the Enterprise Data Warehouse ("EDW") and Enterprise Data Hub ("EDH"). The EDW and EDH are used to compile and store all data generated as part of operations of the bank. •Manage incoming data transmission, online reports and files from specified contractual sources within the specified timeframes.			Deleted
End User Support			•Provision of hardware, software and support to ensure continuous functioning of end user computing needs.			Deleted
Information Security Support			•Provide technologies and manage network and application access to protect client/customer data while assuring privacy and regulatory compliance.			Deleted
Information Technology Services/Outsourcing			•Provide Information Technology services, platform, network, including telecommunications through a secure environment, which can be outsourced to third and fourth parties, including but not limited to: •Timely Incident Restoration. •Unix/Linux Server Availability. •Windows Server Availability. •Mainframe Availability. •Critical Application Availability. •Data/Voice Connectivity Availability. •Stability of Integration Hub API's Supporting Critical Applications. •Implementation of Critical Security Updates/Patches. •Completion of Critical Batches. •Authorizations. •Account maintenance through self-service or Care Center Associate. •Other IT services as needed. •Provide IT Quality services as listed below: •Provide management of production defects. •Maintain tracking of Critical and High defects. •Maintain listing of critical applications supporting the Bank. •Maintain oversight of critical application performance. •Provide monitoring of IT fixes implemented. •Other IT Quality Services, as requested.			Deleted

EXHIBIT B

1.Amendments and Additions. Set forth below are additional Performance Standards or revisions to existing Performance Standards, all of which shall be incorporated into Appendix B to the Agreement.

SECTION I: PERFORMANCE STANDARDS APPLICABLE TO ALL COMENITY BANK PRODUCTS

Service Category			Performance Standard			Measuring Period			Amended/ Added
Analytic Data Platforms			Deliver 99% of daily EDW data transmissions from the Mainframe to be available for consumption on the required contractual source file frequency within 48 hours, outside of planned maintenance activities.			Monthly			Amended
			Initiate transfer of 95% PLP Services Files by specified time.			Monthly			Amended
			100% of Online files updated by 4:00AM (CTZ).			Monthly			Amended
			95% of Online files updated by 2:00AM (CTZ).			Monthly			Amended
			Initiate transfer of 100% Monthly Outgoing transmissions by specified time.			Monthly			Amended
			Initiate transfer of 95% Daily Outgoing transmissions by specified time.			Monthly			Amended
			100% Month-End online reports generated by target time.			Monthly			Amended
			95% Daily online reports generated by target time.			Monthly			Amended
Digital Engineering			Maintain 99.95% Transaction Success of Digital Self Service API.			Monthly			Added
			Maintain 99.9% availability for New Account systems to process all applications (SNAP).			Monthly			Amended
			Maintain 99.9% availability of Account Center (Web).			Monthly			Amended
Financial Support			Change Management: 95% of Change Requests completed on-time.			Monthly			Amended
			Change Management: 88% of change records are successfully implemented into the production environment.			Monthly			Amended
			Service Request Management: 88% of Service Requests completed on-time.			Monthly			Amended
			Availability Management: Maintain 99.9% availability of Cloud Device dependent applications.			Monthly			Amended
			Application Availability: Maintain 99.95% availability of Critical HIGH applications.			Monthly			Amended
			Application Availability: Maintain 99.95% availability of Critical MEDIUM applications.			Monthly			Amended
			Application Availability: Maintain 99.85% availability of Critical Low Important applications.			Monthly			Amended
			97% of Severity 1 Root Cause Analyses completed on-time.			Monthly			Amended

Service Category			Performance Standard			Measuring Period			Amended/ Added
Operations Engineering			Work 95% of service requests within 15 business days.			Monthly			Amended
			Help desk support is available 24/7 where at least 90% of monthly inbound calls are answered within 20 seconds or less.			Monthly			Amended
			Maintain 99.55% data connectivity availability (measured as the availability of Lan, Wan, Internet and Client Connectivity).			Monthly			Amended
			Complete 99.5% of on-Premise Mainframe Batch Production Stream Completion jobs within 1 business day of required completion time.			Monthly			Amended
			Priority 1 Incidents Restored within Defined time.			Monthly			Amended
			97% of Priority 2 Incidents Restored within Defined time.			Monthly			Amended
			96% of Priority 3 Incidents Restored within Defined time.			Monthly			Amended
			No more than 1 Priority 1 incident in production for critical applications per release.			Monthly			Amended
			No more than 1 Priority 2 incident in production for critical applications per release.			Monthly			Amended
			Maintain 99.95% or greater Unix & Linux Server availability.			Monthly			Amended
			Maintain 99.95% or greater Windows Server availability.			Monthly			Amended
			Maintain 99.95% or greater Mainframe availability.			Monthly			Amended
			Maintain 99.5% availability of Storage System.			Monthly			Amended
			Maintain 99.9% availability of SQL.			Monthly			Amended
			95.5% Ticket Assignment Accuracy Rate.			Monthly			Amended
			98% Handle Time Less than Fifteen Minutes.			Monthly			Amended

Service Category			Performance Standard			Measuring Period			Amended/ Added
Platform Engineering			98% of Code Modules Released into Production without Defect.			Monthly			Amended
Servicing and Core Processing Engineering			Maintain 99% or greater of Critical Patches Applied Within 30 Days.			Monthly			Amended
			Maintain 99.55% voice connectivity availability (measured as the uptime of all voice connectivity components - SIP, PRI, POTs, e911).			Monthly			Amended
			Maintain 99.9% transaction success of IVR APIs.			Monthly			Amended
			Maintain 99.95% transaction success of Customer Care APIs.			Monthly			Amended
			Maintain 99.95% transaction success of Web Collections APIs.			Monthly			Amended
			Maintain 99.9% availability of Easy Pay.			Monthly			Amended
			Maintain 99.9% availability of Interactive Voice Response (IVR).			Monthly			Amended
			Maintain 99.95% availability of Alvaria.			Monthly			Amended
			Maintain 99.95% availability of VCARS.			Monthly			Amended
			Maintain 99.95% availability of Web Collections.			Monthly			Amended
			99.99% of Authorization System Availability.			Monthly			Amended
			99.9% of Authorization System Responsiveness for Co-Brand and uPLCC in 1 Second.			Monthly			Amended
			99.9% of Authorization System Responsiveness for PLCC in 0.5 Second.			Monthly			Amended
			Complete 100% same day Fiserv Monetary Postings received by the designated cut-off time.			Monthly			Amended

			Complete 100% same day Fiserv Non-Monetary Postings received by the designated cut-off time.			Monthly			Amended
			FCRM - OFAC Response: 99% of GO response within 750ms.			Monthly			Amended
			FCRM - SAR Reporting: 100% of reporting sent to FinCen within 1 day of receipt.			Monthly			Amended
			Maintain 98.5% availability of First Dispute.			Monthly			Amended
			Maintain 98.5% Availability of First Track.			Monthly			Amended
			Maintain 99% Solution Builder (eCustomer Service) availability.			Monthly			Amended
			Maintain 99.5% Fraud Detection Work Center availability.			Monthly			Amended
			Maintain 99.9% Availability of DDA.			Monthly			Amended
			Maintain 99.9% Defense Edge availability.			Monthly			Amended
			Maintain 99.95% Fiserv RESTful Web Services availability.			Monthly			Amended
			Maintain 99.95% Online System availability.			Monthly			Amended
			PLP Services - Maintain 99.9% Agent Portal availability.			Monthly			Amended
			PLP Services - Maintain 99.9% Partner API availability.			Monthly			Amended
			PLP Services - Maintain 99.9% Rewards Website Fulfillment availability.			Monthly			Amended
			Restful Web Services System Responsiveness: Tier 1 - 98% within 250ms.			Monthly			Amended
			Restful Web Services System Responsiveness: Tier 2 - 97% within 500ms.			Monthly			Amended
			Restful Web Services System Responsiveness: Tier 3 - 97% within 1000ms.			Monthly			Amended
			Maintain 99.5% Nautilus availability.			Monthly			Amended
			Maintain 99.9% availability of Financial Crime Risk Management (FCRM).			Monthly			Amended
			Maintain 99.9% availability of PLP (Rewards).			Monthly			Amended

SECTION II: PERFORMANCE STANDARDS APPLICABLE TO REVOLVING CREDIT CARDS

Service Category			Performance Standard			Measuring Period			Deleted
Card Embossing & Issuance			Maintain 99% cardholder personalization accuracy.			Monthly			Added
			Maintain 99% cardholder personalization timeliness of 2- day turnaround.			Monthly			Added
			Maintain 99.5% cardholder personalization timeliness of 3- day turnaround.			Monthly			Added
Lockbox Payment Processing			No greater than 5 Encoding Errors per 100,000 payments made by DELUXE for a dollar or greater in which the intended amount on the check was clear (i.e. payment deposited to the wrong customer account when clearly identified or able to determine within parameters provided, providing duplicate images to the Financial Institution, etc.).			Monthly			Amended

2.Deletions. Set forth below are Performance Standards which shall be deleted from Appendix B to the Agreement.

SECTION I: PERFORMANCE STANDARDS APPLICABLE TO ALL COMENITY BANK PRODUCTS

Service Category			Performance Standard			Measuring Period			Deleted
Information Technology Servicing/Outsourcing			Maintain 99.9% Transaction Success of Account Center APIs.			Monthly			Deleted
			Maintain 99.9% transaction success of Mobile App APIs.			Monthly			Deleted