Online Access Agreement

Security & Safeguards · Context

Definition of Access Device for Electronic Fund Transfers

Defines an Access Device as any card, code, or other means of access to a consumer account (or combination thereof) utilized by the consumer to initiate electronic fund transfers.

Supporting quotations

Means a card, code, or other means of access to a consumer's account, or any combination thereof (including username and password), that may be used by the consumer to initiate electronic fund transfers.

Qualifications & exceptions

• Limited to cards, codes, or means of access used to initiate electronic fund transfers

Security & Safeguards · Context

Definition of Qualifying Mobile Device

Defines a Mobile Device as any cell phone, smartphone, tablet, handheld, or wearable communication device that satisfies specified Wells Fargo hardware and software requirements.

Supporting quotations

A cell phone, smartphone, tablet, or any other handheld or wearable communication device satisfying the hardware and software requirements we specify.

Qualifications & exceptions

• Device must satisfy Wells Fargo specified hardware and software requirements

Security & Safeguards · Context

Definition and Elements of Online Access Process

Defines the Online Access Process to encompass access terms, access and security procedures via the Website, and Wells Fargo's reservation of right to modify, suspend, or terminate the Service, Agreement, or access.

Supporting quotations

The term Online Access Process includes:

The terms under which you're allowed to access and use the Service via the Website.

The process used to access the Service (including required security procedures) via the Website.

Our right to change, suspend or terminate all or part of the Service, this Agreement, or your access to the Service.

Qualifications & exceptions

• Encompasses security procedures and Wells Fargo authority to modify or terminate access

Security & Safeguards · Procedure

Individual Service Enrollment and Unique Login Credentials Required

Every account owner, Authorized Representative, and Delegate must individually enroll in the Service and maintain their own unique username and password.

Supporting quotations

Each owner of an Eligible Account, Authorized Representative, and Delegate, will need to individually enroll in the Service to access it, and will each need a unique password and username.

Qualifications & exceptions

• Applies individually to each owner, representative, and delegate accessing the service

Security & Safeguards · Company practice

Discretionary Termination of Delegate Access for Security or Violations

Wells Fargo reserves sole discretion to terminate or discontinue a Delegate's access to the Service, accounts, or financial services without prior notice in cases of conflicting instructions, perceived security risk, or Agreement violations.

Supporting quotations

If we get conflicting instructions, if we believe that an Eligible Account's security or our security may be at risk as a result of a Delegate, or if the Delegate violates any part of this Agreement, we may at our sole discretion end the Delegate's access to:

The Service.

An Eligible Account.

An Online Financial Service.

We may also prevent the individual from being a Delegate, or discontinue the individual's Delegate authority, without prior notice to you or any Eligible Account owner.

Qualifications & exceptions

• Discontinuation or termination may occur without prior notice

Security & Safeguards · Procedure

Technical Equipment Requirements and Operational Email Address Mandate

Access requires user-provided hardware, software, username and password, email address validation, and continuous maintenance of an operational email address to receive communications, alongside compliance with established security procedures.

Supporting quotations

To access your Eligible Accounts and Online Financial Services through the Website, you need a username, a password, and required hardware and software (see Online Banking Help for details). To complete your enrollment in the Service, you will be required to validate your email address. Additionally, you are required to maintain an email address that is continuously operational to receive email communications from us in order to continue to access your Eligible Accounts and Online Financial Services through the Website. You must provide all computer, telephone and other equipment, software (other than any software provided by us), and services you need to access the Service. You must also comply with any other security procedures we may establish.

Qualifications & exceptions

• Requires maintaining an email address that is continuously operational to receive communications

Not stated here

• The text of the linked Online Banking Help documentation is not supplied in this agreement

Security & Safeguards · Procedure

Reporting Errors and Compromised Credentials for Instant Payments

Users must immediately report suspected erroneous or unauthorized instant payments or compromised account credentials pursuant to Section 5 error reporting procedures.

Supporting quotations

If you believe that an erroneous or unauthorized payment has been made through the Bill Pay instant payments service using your account, or that your account credentials have been lost, stolen, or otherwise compromised, please contact us immediately in accordance with Section 5.

Qualifications & exceptions

• Reporting must be made immediately in accordance with Section 5

Security & Safeguards · Procedure

External Account Verification via Test Transfers and Proof of Ownership

Users authorize Wells Fargo to verify external accounts via low-value test credits and debits requiring reporting back transfer amounts or submitting documentary proof of ownership.

Supporting quotations

We may verify the non-Wells Fargo Accounts that you add to the Transfer & Payments Service. You authorize us to validate the non-Wells Fargo Accounts in a manner selected by us, including through the use of a test transfer, in which one or more low value payments is credited to and debited from your non-Wells Fargo Account. Once the test transfer is complete, we may ask you to access this non-Wells Fargo Account to tell us the amount of the test credit or debit or any additional information reported by your financial institution with this test transfer. We may also verify non-Wells Fargo Accounts by requiring you to submit proof of ownership of such Account(s).

Qualifications & exceptions

• Wells Fargo may require proof of ownership of external accounts

Security & Safeguards · Permission or license

Interbank Security Procedures and Security Procedure Deviation Authorization

External institutions maintaining user accounts may verify transfer instructions with Wells Fargo, constituting valid security procedures. Users permit Wells Fargo to authorize external institutions to accept transfer instructions under agreed procedures without standard verification, and debit accounts based solely on communications.

Supporting quotations

The financial institution at which your Account is maintained may contact us to verify the content and authority of fund transfer instructions and any changes to those instructions.

In connection with the Transfer & Payments Service, we may provide to that financial institution such information as may be required to verify the instructions and the verification may constitute a valid security procedure under the rules governing that Account.

You permit us to authorize your non-Wells Fargo financial institution to accept funds and transfer instructions in accordance with any authorization procedures you and such financial institution have agreed upon, or that we, on your behalf, and such financial institution have agreed upon, without verifying the instructions under the established security procedures (including Section 16(c) below, if applicable), regardless of whether you agreed to the security procedures or we agreed on your behalf.

In addition, we may authorize such financial institutions to charge and debit your Accounts based solely on these communications.

Qualifications & exceptions

• Permits authorization of external institutions without standard security verification

Security & Safeguards · Procedure

Wire Transfer Security Procedures and Commercial Reasonableness

Wire transfer Orders initiated on the Website are authenticated using username, password, security questions, random number generators, or one-time passcodes under Section 16 standards. Under UCC Article 4A-202(b), the procedure verifies authenticity (not error detection), and the user agrees it is commercially reasonable.

Supporting quotations

The Security Procedure consists of verifying your username and a password, and/or such other additional security and authentication methods as we may require from time to time.

We may also require you to answer security questions, use random number generators, or one-time passcodes to further verify an Order initiated on the Website from your Wires Funding Eligible Account.

Pursuant to Uniform Commercial Code Article 4A-202(b), the purpose of the Security Procedure is to verify the authenticity of an Order delivered to us in your name and not to detect errors in the transmission or content of an Order.

You agree the Security Procedure is commercially reasonable and is a satisfactory method of verifying the authenticity of Orders initiated on the Website from your Wires Funding Eligible Account.

Qualifications & exceptions

• Security procedure verifies authenticity but does not detect transmission or content errors

Security & Safeguards · Company practice

Discretionary Error Detection Actions and Order Delay Rights

Any action Wells Fargo takes to detect erroneous or unauthorized Orders is in its sole discretion and does not establish a standard procedure or liability for failure to perform. Wells Fargo may delay an Order if it detects it as erroneous or unauthorized.

Supporting quotations

Any action Wells Fargo takes to detect an erroneous Order or to attempt to detect an unauthorized Order, will be taken at Wells Fargo's sole discretion.

No matter how many times Wells Fargo takes this action, it will not become part of Wells Fargo's standard procedures for attempting to detect such erroneous or unauthorized Orders, and Wells Fargo will not in any situation be liable for failing to take or to correctly perform the action.

You agree that Wells Fargo may delay your Order if Wells Fargo detects it as erroneous or unauthorized.

Qualifications & exceptions

• Actions do not become standard procedures or create liability for failure to act

Security & Safeguards · Restriction or exception

Alert Security Unencrypted Transmission, Content Restrictions, and Carrier Limitations

Alerts may be transmitted unencrypted containing user names and account details. Users are prohibited from modifying or altering alert message content. Alert availability depends on carrier coverage, and standard carrier message/data rates apply.

Supporting quotations

You further agree that:

Alerts may be sent unencrypted, and may include your name and information pertaining to your account(s).

You may not modify, change, or alter the content of any alert message that we send to you.

Availability may be affected by your mobile carrier's coverage area and your mobile carrier's message and data rates may apply.

Qualifications & exceptions

• Alerts may be sent unencrypted and contain account information; content alteration prohibited

Security & Safeguards · Restriction or exception

FMS Security Risk Transfer Upon Download, Wireless Risks, and Device Damage

Downloading account data transfers security and confidentiality responsibility to the user and software provider. Users assume all risk of unauthorized access to stored software data, wireless download interception, letting others access software, and any resulting hardware damage to their computer.

Supporting quotations

You assume all risk that unauthorized third parties may access any Eligible Account information you download and store in your Financial Management Software.

If you send information in an unsecure manner or take the Eligible Account information out of our secure systems by downloading it, we're no longer responsible for the security and confidentiality of that information, and the responsibility is now yours (or may be shared with others, such as your Financial Management Software provider).

We aren't responsible for the security and confidentiality of the Eligible Account information if you:

Use wireless connections to download your account information, in which case you acknowledge other persons may be able to access the information being downloaded; or

Let others access or use your Financial Management Software.

Downloads of Eligible Account information are at your own risk. You are solely responsible for any resulting damage to the computer (or other electronic device) to which you download any information.

Qualifications & exceptions

• Security responsibility transfers to user upon download; bank not responsible for wireless downloads or hardware damage

Security & Safeguards · Restriction or exception

Third-Party Software Download Risks, Transmission Confidentiality, and Equipment Costs

Users assume all risk of unauthorized access to installed third-party software and entered data. Users and software providers are responsible for data confidentiality during transmission. Users bear download risks, data corruption, hardware damage, and equipment/telecommunications costs.

Supporting quotations

You assume all risk that unauthorized third parties may access any Third-Party Software you download and install, or any information you enter into the Third-Party Software.

If you use the Third-Party Software to transmit information, you and the Third-Party Software provider are responsible for the security and confidentiality of that information.

Any Third-Party Software downloads are your own risk and you alone are responsible for any resulting damage to the computer or other electronic device, as well as for any loss or corruption of data that might occur as a result.

You are solely responsible for acquiring and maintaining a computer or other electronic device that can handle and access the Third-Party Software, including any necessary equipment such as a modem, and that you're responsible for all costs associated with accessing the Third-Party Software.

Qualifications & exceptions

• User assumes risk of unauthorized access, data loss, device damage, and equipment costs

Security & Safeguards · Procedure

Username, Password Standards, and Authentication Controls

Access to Eligible Accounts requires a username, password, or approved authentication controls. Wells Fargo sets credential standards and recommends regular password updates and unique credential combinations.

Supporting quotations

You need a username and password, or other Wells Fargo approved security and authentication controls, to access your Eligible Accounts and Online Financial Services through the Service. We may set standards for your username and password, and other security and authentication controls. We recommend that you change your password regularly, and select a unique username and password combination for use only with the Service.

Qualifications & exceptions

• Access requires credentials meeting bank standards; unique credentials recommended

Security & Safeguards · Company practice

Transaction Security Procedures, Specialized Hardware/Software, and Browser Features

Wells Fargo may require additional mandatory or optional security procedures for certain transactions, which may involve special hardware, software, third-party services, security questions, random number generators, or one-time codes. Use of the Service may require specific browsers, OS features, plug-ins, JavaScript, and cookies.

Supporting quotations

We may also require additional security procedures for certain transactions. These additional security procedures may require special hardware, software, or third-party services. To enhance the security of your Eligible Accounts and Online Financial Services, we may also offer you additional, optional security procedures. These could include personal reference questions and answers, random number generators, or one-time access codes.

We may also require the use or activation of specific applications, internet browser software or mobile operating system features, plug-ins, and add-ons to use the Service. These could include JavaScript support and "cookies."

Qualifications & exceptions

• Transactions may require additional security controls, hardware, software, or browser features

Security & Safeguards · Procedure

Username and Password Standards, Confidentiality, and Update Channels

Usernames and passwords must meet established standards, and Wells Fargo may require changes at any time. Users are responsible for keeping passwords confidential, unique, and memorized. Credentials can be changed within the Service or by phone.

Supporting quotations

Usernames and passwords must meet the standards we establish. These standards will be available for your reference whenever you create or change a username and/or password.

We may require you to change or update your username and/or password at any time, including to meet any new standards we may establish. You are responsible for keeping your password confidential.

You can change your username and/or password within the Service or by calling 1-800-956-4442 (1-877-879-2495 for Wells Fargo Advisors accounts, or 1-866-552-3312 (WFCS Custodied brokerage accounts)).

Qualifications & exceptions

• Bank may require credential updates at any time; user responsible for confidentiality

Security & Safeguards · Procedure

UCC Article 4A Transfer Security Procedures and Commercial Reasonableness

For UCC Article 4A transfers (including business transactions and ExpressSend), security procedures verify credentials, security questions, random code generators, or one-time passcodes, and may require a non-burner mobile phone. The procedure verifies authenticity rather than error detection, and the user agrees it is commercially reasonable.

Supporting quotations

The provisions in this Section 16(c) only apply to transactions which may be subject to Article 4A of the Uniform Commercial Code ("UCC 4A"), including online transactions from business accounts, and ExpressSend (or any successor product(s) we may offer from time to time) transfers. This Section 16(c) does not apply to Wire Transfers – please see Section 8(b) above for the security procedure for Wire Transfers.

The security procedure consists of verifying your username and a password, and/or such other additional security and authentication methods as we may require from time to time.

We may require that you provide to us a permanent, text message-enabled U.S. mobile phone number that you intend to use for an extended period of time (i.e., no "burner" numbers), before you use any Service subject to this Section 16(c).

The purpose of the security procedure is to verify the authenticity of a transfer request delivered to us in your name and not to detect errors in the transfer. You agree the security procedure required by us in this Agreement is commercially reasonable, and meets your needs with regard to the size, type, and frequency of your transfers governed by UCC 4A.

Qualifications & exceptions

• Applies to UCC 4A transfers; requires non-burner mobile number; procedure verifies authenticity, not errors

Security & Safeguards · Procedure

Security Incident Immediate Notification Channels and Unauthorized Use Liability

Users must immediately notify Wells Fargo of suspected fraud, lost/stolen passwords, lost/compromised mobile devices, or unauthorized viewing/deletion of records by calling 1-800-956-4442 (24/7) or writing to Customer Correspondence. Users may be liable for losses resulting from unauthorized credential use to the extent permitted by law.

Supporting quotations

Even though information exchanged through the Service is protected by advanced encryption techniques while being transmitted, you still need to protect your username and password for the Service.

You must notify us immediately if you suspect fraudulent activity on your Eligible Account or if you believe that:

Your password may have been lost or stolen.

A Mobile Device you use to access the Service has been lost, stolen, or compromised.

Someone viewed, downloaded, or deleted electronic records from your Eligible Account or Online Financial Service without your permission.

To notify us:

Call 1-800-956-4442 anytime, 24 hours a day, seven days a week; or

Write to Wells Fargo Customer Correspondence, PO Box 6995, Portland, OR, 97228-6995.

In the event of unauthorized use of your username and password, or any other security or authentication technique we use, you may be liable for resulting losses, to the extent permitted by law or regulation.

Qualifications & exceptions

• User must notify bank immediately; may be liable for losses from unauthorized credential use as permitted by law

Security & Safeguards · Procedure

Duty to Report Unauthorized Credential Use by Phone Immediately

Users must immediately contact Wells Fargo by calling 1-800-956-4442 or the phone number on their account statement to report actual or suspected unauthorized use of their username or password.

Supporting quotations

You will immediately notify us at 1-800-956-4442 or the phone number located on your statement to report any actual or suspected unauthorized use of your username or password.

Qualifications & exceptions

• Immediate reporting required via 1-800-956-4442 or statement phone number

Security & Safeguards · Restriction or exception

Prohibitions on Scraping, Jailbreaking, Safety Circumvention, and Fraudulent Content

Users may not use the Service for unlawful purposes, engage in bot scraping, technical attacks, excess usage, prompt manipulation, or jailbreaking, circumvent abuse protections or safety filters, or create or share fraudulent, deceptive, or disinformation content.

Supporting quotations

You will not use the Service for unlawful purposes, or purposes that are not permitted expressly or implicitly, by this Agreement or by any applicable law or regulation. You will not engage in activity that is harmful to the Service, including bot scraping behaviors, technical attacks, excess usage, prompt-based manipulation, or "jailbreaking," and will not attempt to circumvent any aspect of the Service, including any abuse protections or safety filters. You will not manipulate the Service to contravene this Agreement.

You will not encourage, or attempt to harm or cause harm to others, or violate the rights of others.

You will not engage in activity that is fraudulent, invasive, infringing, false, deceptive, misleading, or promotes or encourages illegal activity. You will not attempt to create or share content that could mislead or deceive others, including for example creation of disinformation, content enabling fraud, or deceptive impersonation.

Qualifications & exceptions

• Applies to all Service interactions including AI prompts, scraping, and content creation

Security & Safeguards · Restriction or exception

Network Compliance, Disruption Prevention, Malware Distribution, and Anti-Spam Rules

Users must comply with network policies and are strictly prohibited from disrupting or impairing the Service, distributing viruses, malware, or destructive items, sending unsolicited spam, or engaging in phishing.

Supporting quotations

You will comply with all rules, policies, and procedures of networks through which you access and use the Service.

You will not use the Service in a way that disrupts, damages, disables, overburdens, interferes, or impairs the Service, the networks through which you access or use the Service, or with any other party's use of the Service. You will not distribute viruses, worms, Trojan horses, corrupted files, malware, hoaxes, or other items of a destructive or deceptive nature through the Service.

You will not generate, distribute, publish or facilitate unsolicited mass email, promotions, advertisements, or other solicitations (“spam”), or engage in any phishing activities.

Security & Safeguards · Restriction or exception

Unauthorized Account Access, Data Duplication, and Reverse Engineering Ban

Users are forbidden from accessing unauthorized accounts, copying, modifying, or distributing files from unauthorized accounts, extracting components, or reverse engineering any part of the Service or its interfaces.

Supporting quotations

You will not access or attempt to access any Service account for which you have no access authorization, or duplicate, modify, distribute, or display any of the data or files from any such account.

You will not obtain or attempt to obtain any materials or information through any means not intentionally made available or provided for through the Service. You will not attempt to reverse engineer, extract components of, gain unauthorized access to, or use the Service (or any interfaces provided with the Service) in a manner that is not expressly permitted under the Agreement.

Security & Safeguards · Restriction or exception

U.S. Sanctions, OFAC/BIS Denied Party Restrictions, and Anti-Bribery Compliance

Users warrant that they and their business are not located in embargoed territories (Cuba, Iran, North Korea, Crimea/Donetsk/Luhansk), are not Russian/Belarusian military end users, are not on OFAC SDN or BIS Entity lists, will not export the Service, and comply with the FCPA.

Supporting quotations

You acknowledge that your download, access, and use of this Service are subject to U.S. export control and sanctions laws (including those administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control) that prohibit the export, re-export, or transfer (in-country) of certain products, software, and technology (“Controlled Items”), which may include the Service, to certain territories or persons. You agree not to violate and not to cause Wells Fargo to violate U.S. export control and sanctions laws. By using the Service, you represent that:

You and/or your business are not physically located in an embargoed region (Cuba, Iran, North Korea, and Crimea region of Ukraine, Donetsk People’s Republic, and Luhansk People’s Republic Regions of Ukraine) and are not Russian or Belarusian military end users;

You and/or your business are not included on the Specially Designated Nationals List of the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”), the Entity List of the Department of Commerce’s Bureau of Industry and Security (“BIS”), or any other similar list (collectively, “Denied Party List”) which would require Wells Fargo to obtain a license from the relevant U.S. governmental agency for exporting any Controlled Items; your business is not a target of sanctions due its ownership or control by any sanctioned target; and you and/or your business are not otherwise a target of sanctions or export controls;

You and/or your business will not export, re-export, or transfer the Service to any embargoed region, use the Service on behalf of or make the Service available to another person on a Denied Party List, or attempt to derive, gain access to, acquire, reverse engineer, or decode any source code or technology related to the Service for these and other prohibited purposes.

You and/or your business will not use the Service in violation of applicable anti-bribery and corruption laws, including but not limited to, the U.S. Foreign Corrupt Practices Act.

Qualifications & exceptions

• Subject to U.S. export controls and OFAC/BIS sanctions lists

Security & Safeguards · Company practice

Bank Right to Block Transactions and Revoke Service for Sanctions Violations

Wells Fargo reserves the right to immediately block or reject transactions and suspend, terminate, or revoke access to the Service if the user or their business appears on a Denied Party List or is suspected of violating export control or sanctions laws.

Supporting quotations

Wells Fargo reserves the right to immediately block or reject transactions, and suspend, terminate, or revoke your access to the Service if you and/or your business become listed on a Denied Party List or otherwise prohibited by sanctions or if Wells Fargo has reasons to believe that you may have violated U.S. export control or sanctions laws or the representations above.

Qualifications & exceptions

• Immediate blocking or revocation upon sanctions listing or suspected violation