MasterCard International Franchise Management 2000 Purchase Street Purchase, NY November 2, 1999 CONFIDENTIAL Mr. William Appleton Assistant Vice President, Cards First American National Bank 550 Metroplex Drive Nashville, TN 37211 Re: Pinnacle Business Management, Inc. Maestro/Cirrus Affinity/Co-Branded Marketing Program Dear Mr. Appleton: Thank you for submitting First American National Bank's application for a Maestro/Cirrus Affinity/Co-Branded (A/CB) marketing program with Pinnacle Business Management, Inc. We are pleased to inform you that First American National Bank may proceed with the A/CB marketing program's development and launch, although final approval is contingent upon the receipt of all required documentation. Based on the information in your application, MasterCard understand the ECash Maestro/Cirrus Card program will operate as described below. Given this understanding, we determine the ECash Maestro/Cirrus Card program to be in compliance with applicable Affinity/Co-Branded Rules as specified in Maestro International Operating Rules and Cirrus System Rules. I. Program Design A. The First American National Bank Pinnacle Business Management, Inc. program will exclusively offer a Maestro/Cirrus Card product. B. ECash Maestro/Cirrus cards may be used at any MasterCard Network displaying the MasterCard, Maestro, and Cirrus brands. C. Ecash Card MasterCard cardholders will not be offered any specific affinity/co-branded benefits at this time. D. First American National Bank is required to provide a card design to MasterCard International to complete the file for this A/CB marketing program. Please forward this document at your earliest convenience. II. Security Requirements MasterCard International's Security & Risk Management group has reviewed the Pinnacle Maestro/Cirrus card marketing program. In addition to the security measures outlined in Pinnacle's October 25, 1999 letter, the following security procedures for card handling and distribution, and completed cardholder application handling, should be implemented at all locations involved with the Pinnacle Program. A. AUDIT CONTROL LOG The Audit Control Log provides the ability to account for the number and location of Pinnacle Ecash Maestro/Cirrus Cards at any point during storage or distribution. At a minimum, the Audit Control Log should contain the following information. - description of cards stored and released (i.e., account numbers) - date and time of each card release - signature of individual(s) releasing the card Access to the card stock should be under dual control. Ideally, there should be one employee who has one access level (i.e. key entry) and second employee who retains a combination for a secondary lock. Both employees' names should be indicated on the Audit Control Log. The Audit Control Log's ability to track the cards also will assist exception monitoring personnel in identifying potential loss situations. B. CARD THEFT First American National Bank should be notified in the event of a confirmed or suspected theft of Pinnacle Ecash Maestro/Cirrus Cards. The information can be used to revise exception monitoring for tracking and identifying the location of the potential loss. C. CARD STORAGE Although the Pinnacle Ecash Maestro/Cirrus Cards are not "live" until activated by the cardholder, the card storage area must be protected at all times by using recognized security control devices, limiting and controlling access and applying acceptable audit control procedures. These cards should be stored in a safe with dual control access (dual keys or key & combination). The storage facility area should be used only for these cards and for no other supplies. This storage area is considered a high priority security area. D. COMPLETED CARDHOLDER APPLICATION HANDLING Completed cardholder applications should be handled in a secure manner. At the end of each day, all original copies either should be removed from all locations involved in the Pinnacle Business Management, Inc. marketing program or should be destroyed with a shredder. III. NOMENCLATURE & MARKETING A. According the Maestro/Cirrus communications standards, all A/CB Program communications must prominently refer to the Maestro/Cirrus debit functionality. Pleas submit all marketing materials for this Maestro/Cirrus A/CB marketing program for review prior to use. IV. CARD DESIGN A. Cad design was not submitted with the A/CB application. Final card design approval is contingent on receipt of a proof submitted by your card manufacturer to Ms. Kisha Thorne, Specialist, Card Design Services who can be reached at telephone 914-249-5713 or fax 914-249-4355. Please notify MasterCard if First American National Bank adds or modifies any element of this A/CB marketing program. If you have any questions regarding the A/CB marketing program, please call Michelle Mitchell, Program Manager, Affinity/Co-Branded Approval Process at 914-249-5005 or fax at 914-249-4351 or your regional MasterCard Office. We are delighted that you have selected Maestro International and Cirrus System, Incorporated for the First American National Bank Pinnacle Business Management, Inc. Card program. MasterCard International is ready to make every effort possible to meet your schedules for launch and to make this exciting new program a success. Sincerely, MasterCard International /s/ Shari Krikorian Director Brand Standards cc. J. Laubert MasterCard International