# IRU Participation Agreement - Additional Sections

This document contains the additional sections that need to be added to the IRU Participation Agreement to address identified gaps.

## Location: Insert after PART XI: GENERAL PROVISIONS, before EXECUTION

---

## PART XII: SERVICE LEVEL AGREEMENTS

### 12.1 Service Availability

DBIS shall use commercially reasonable efforts to ensure that infrastructure and SaaS services are available and operational, subject to the following service level objectives:

(a) **Target Availability**: 99.9% monthly uptime for infrastructure services
(b) **Measurement Period**: Monthly calendar month
(c) **Exclusions**: Availability calculations exclude:
    - Scheduled maintenance windows (with advance notice)
    - Force majeure events
    - Participant-caused outages
    - Third-party service outages beyond DBIS control
    - Emergency maintenance required for security or stability

### 12.2 Performance Targets

DBIS shall maintain the following performance targets:

(a) **Settlement Latency**: < 100ms for M-RTGS settlement (95th percentile)
(b) **API Response Time**: < 200ms for API requests (95th percentile)
(c) **Transaction Throughput**: Support for capacity tier-appropriate transaction volumes
(d) **System Responsiveness**: < 500ms for portal operations (95th percentile)

### 12.3 Support Service Levels

DBIS shall provide support services with the following response times:

(a) **Critical Issues** (Service unavailable, security incidents):
    - Response time: 1 hour
    - Resolution target: 4 hours
    - 24/7 support availability

(b) **High Priority Issues** (Significant degradation, major functionality impaired):
    - Response time: 4 hours
    - Resolution target: 24 hours
    - Business hours support (extended hours for Tier 1-2)

(c) **Standard Issues** (Minor issues, general inquiries):
    - Response time: 1 business day
    - Resolution target: 5 business days
    - Business hours support

(d) **Low Priority Issues** (Documentation, feature requests):
    - Response time: 3 business days
    - Resolution target: As agreed
    - Business hours support

### 12.4 Maintenance Windows

DBIS may conduct scheduled maintenance during maintenance windows:

(a) **Standard Maintenance**: Monthly, 4-hour window, 30 days advance notice
(b) **Emergency Maintenance**: As required, with maximum advance notice practicable
(c) **Maintenance Communication**: Via Phoenix Portal, email notification
(d) **Maintenance Minimization**: DBIS shall minimize maintenance frequency and duration

### 12.5 Service Level Monitoring

DBIS shall:
(a) Monitor service levels continuously
(b) Provide service level reports via Phoenix Portal
(c) Notify Participants of service level breaches
(d) Implement corrective actions for service level issues

### 12.6 Service Level Remedies

In the event of service level breaches:
(a) DBIS shall investigate and report on root causes
(b) DBIS shall implement corrective actions
(c) Participants may be entitled to service credits or fee adjustments as specified in Exhibit B
(d) Repeated or material breaches may constitute grounds for termination by Participant

---

## PART XIII: BUSINESS CONTINUITY & DISASTER RECOVERY

### 13.1 Business Continuity Plan

DBIS maintains a comprehensive business continuity plan that includes:

(a) **Redundancy**: Multi-region, multi-host infrastructure deployment
(b) **Failover Capabilities**: Automatic and manual failover procedures
(c) **Data Backup**: Regular backups with point-in-time recovery
(d) **Recovery Time Objectives (RTO)**: < 1 hour for critical services
(e) **Recovery Point Objectives (RPO)**: < 15 minutes data loss maximum

### 13.2 Disaster Recovery

DBIS maintains disaster recovery capabilities:

(a) **Geographic Redundancy**: Infrastructure deployed across multiple geographic regions
(b) **Data Replication**: Real-time or near-real-time data replication
(c) **Backup Systems**: Secondary systems ready for activation
(d) **Testing**: Regular disaster recovery testing (at least quarterly)
(e) **Documentation**: Comprehensive disaster recovery procedures

### 13.3 High Availability Architecture

DBIS infrastructure is designed for high availability:

(a) **Multi-Sentry Pattern**: Multiple Besu Sentry nodes for redundancy
(b) **Active/Passive FireFly**: FireFly HA configuration
(c) **Database Replication**: Primary/replica database configuration
(d) **Load Balancing**: Traffic distribution across multiple nodes
(e) **Health Monitoring**: Continuous health checks and automatic failover

### 13.4 Incident Response

DBIS maintains incident response procedures:

(a) **Incident Classification**: Severity levels and response procedures
(b) **Communication**: Participant notification procedures
(c) **Escalation**: Escalation procedures for critical incidents
(d) **Post-Incident Review**: Root cause analysis and improvement plans

### 13.5 Participant Responsibilities

Participants are responsible for:
(a) Maintaining their own business continuity plans
(b) Testing integration with DBIS services
(c) Implementing appropriate redundancy in their systems
(d) Coordinating with DBIS on disaster recovery procedures

---

## PART XIV: SUPPORT & MAINTENANCE

### 14.1 Support Services

DBIS provides support services through:

(a) **Phoenix Portal**: Primary support channel with ticket system
(b) **Email Support**: Email support for standard inquiries
(c) **Phone Support**: Phone support for critical issues (Tier 1-2)
(d) **Documentation**: Comprehensive documentation and knowledge base
(e) **Training**: Training materials and sessions (as available)

### 14.2 Support Levels

Support is provided based on Capacity Tier:

(a) **Tier 1 (Central Banks)**: Premium support, 24/7 availability, dedicated support contact
(b) **Tier 2 (Settlement Banks)**: Enhanced support, extended hours, priority response
(c) **Tier 3 (Commercial Banks)**: Standard support, business hours, standard response
(d) **Tier 4 (DFIs)**: Standard to enhanced support based on usage profile
(e) **Tier 5 (Special Entities)**: Limited support, business hours, standard response

### 14.3 Maintenance Services

DBIS provides maintenance services including:

(a) **Regular Updates**: Security patches, bug fixes, feature updates
(b) **Performance Optimization**: System tuning and optimization
(c) **Capacity Management**: Capacity monitoring and adjustments
(d) **Security Hardening**: Ongoing security improvements
(e) **Documentation Updates**: Keeping documentation current

### 14.4 Change Management

DBIS follows change management procedures:

(a) **Change Notification**: Advance notice of material changes (at least 30 days)
(b) **Change Testing**: Testing of changes before deployment
(c) **Rollback Procedures**: Ability to rollback changes if issues arise
(d) **Change Communication**: Clear communication of changes and impacts
(e) **Participant Input**: Opportunities for participant input on material changes

### 14.5 Version Control

SaaS modules are subject to version control:

(a) **Version Pinning**: Version-pinned deployments for stability
(b) **Version Updates**: Regular updates with advance notice
(c) **Version Compatibility**: Backward compatibility where possible
(d) **Version Documentation**: Documentation of version changes
(e) **Version Support**: Support for multiple versions during transition periods

---

## PART XV: DATA RETENTION & PORTABILITY

### 15.1 Data Retention

DBIS retains Participant data in accordance with:

(a) **Operational Data**: Retained for the duration of the IRU Term plus 7 years
(b) **Transaction Data**: Retained for the duration of the IRU Term plus 10 years (or as required by law)
(c) **Audit Data**: Retained for the duration of the IRU Term plus 10 years
(d) **Compliance Data**: Retained as required by applicable law and regulations
(e) **Legal Requirements**: Retention periods may be extended to comply with legal requirements

### 15.2 Data Portability

Upon termination or request, DBIS shall provide data portability:

(a) **Data Export Formats**: Standard formats (JSON, CSV, XML, database dumps)
(b) **Data Export Scope**: All Participant data, transaction history, configuration data
(c) **Data Export Timeline**: Within 30 days of request (or as agreed)
(d) **Data Export Security**: Secure data transfer, encryption, verification
(e) **Data Export Assistance**: Technical support for data export and migration

### 15.3 Data Deletion

Upon termination and after data portability:

(a) **Data Deletion Timeline**: Within 90 days of termination (or as required by law)
(b) **Data Deletion Scope**: All Participant data except as required for:
    - Legal compliance
    - Audit requirements
    - Dispute resolution
    - Regulatory obligations
(c) **Data Deletion Confirmation**: Written confirmation of data deletion
(d) **Secure Deletion**: Secure deletion methods, data overwriting where applicable

### 15.4 Data Backup and Recovery

DBIS maintains data backup and recovery:

(a) **Backup Frequency**: Regular backups (daily, with incremental backups)
(b) **Backup Retention**: Backup retention per data retention policies
(c) **Backup Security**: Encrypted backups, secure storage, access controls
(d) **Recovery Capabilities**: Point-in-time recovery, data restoration procedures
(e) **Backup Testing**: Regular backup and recovery testing

---

## PART XVI: AUDIT RIGHTS & COMPLIANCE MONITORING

### 16.1 Participant Audit Rights

Participants have the right to:

(a) **Financial Audit**: Audit fee calculations and charges (with reasonable notice)
(b) **Compliance Audit**: Audit DBIS compliance with this Agreement (with reasonable notice)
(c) **Security Audit**: Security audits (subject to security protocols and DBIS approval)
(d) **Third-Party Audits**: Engage qualified third-party auditors (subject to confidentiality)
(e) **Audit Scope**: Reasonable scope, non-disruptive, subject to security and confidentiality

### 16.2 DBIS Audit Rights

DBIS has the right to:

(a) **Compliance Audit**: Audit Participant compliance with this Agreement
(b) **Security Audit**: Security audits of Participant systems (if applicable)
(c) **Regulatory Audit**: Audits required by regulatory authorities
(d) **Operational Audit**: Audits of Participant's use of DBIS services
(e) **Audit Cooperation**: Participant shall cooperate with DBIS audits

### 16.3 Compliance Monitoring

DBIS conducts ongoing compliance monitoring:

(a) **Regulatory Compliance**: Monitoring of regulatory compliance requirements
(b) **AML/KYC Compliance**: Ongoing AML/KYC compliance monitoring
(c) **Sanctions Screening**: Continuous sanctions list screening
(d) **Transaction Monitoring**: Transaction pattern monitoring and analysis
(e) **Risk Assessment**: Regular risk assessments and updates

### 16.4 Compliance Reporting

DBIS provides compliance reporting:

(a) **Regular Reports**: Quarterly compliance reports (via Phoenix Portal)
(b) **Incident Reports**: Compliance incident reports (as required)
(c) **Regulatory Reports**: Reports to regulatory authorities (as required)
(d) **Participant Reports**: Compliance status reports to Participants (as applicable)
(e) **Audit Reports**: Audit reports and findings (as applicable)

### 16.5 Regulatory Cooperation

Both parties shall cooperate with regulatory authorities:

(a) **Regulatory Requests**: Respond to regulatory requests and inquiries
(b) **Regulatory Examinations**: Facilitate regulatory examinations
(c) **Regulatory Reporting**: Provide required regulatory reports
(d) **Regulatory Compliance**: Maintain compliance with applicable regulations
(e) **Regulatory Notification**: Notify relevant parties of regulatory issues

---

## PART XVII: LIABILITY & INSURANCE

### 17.1 Limitation of Liability

Subject to applicable law:

(a) **Maximum Liability**: DBIS's total liability shall not exceed the total fees paid by Participant in the 12 months preceding the claim
(b) **Excluded Damages**: DBIS shall not be liable for indirect, consequential, special, or punitive damages
(c) **Direct Damages**: Liability limited to direct damages only
(d) **Force Majeure**: No liability for force majeure events
(e) **Participant Fault**: No liability for damages caused by Participant's breach or negligence

### 17.2 Exceptions to Limitation

The limitation of liability does not apply to:

(a) **Willful Misconduct**: Willful misconduct or fraud
(b) **Gross Negligence**: Gross negligence (to the extent permitted by law)
(c) **Intellectual Property**: Infringement of intellectual property rights
(d) **Confidentiality**: Breach of confidentiality obligations
(e) **Indemnification**: Indemnification obligations

### 17.3 Indemnification

Each party shall indemnify the other for:

(a) **Third-Party Claims**: Claims arising from the indemnifying party's breach of this Agreement
(b) **Intellectual Property**: Claims of intellectual property infringement by the indemnifying party
(c) **Regulatory Actions**: Regulatory actions arising from the indemnifying party's breach
(d) **Indemnification Procedures**: Notice, defense, settlement procedures
(e) **Limitations**: Subject to limitation of liability provisions

### 17.4 Insurance

DBIS maintains appropriate insurance:

(a) **Professional Liability**: Professional liability insurance
(b) **Cyber Liability**: Cyber liability and data breach insurance
(c) **General Liability**: General liability insurance
(d) **Insurance Coverage**: Coverage amounts appropriate for DBIS operations
(e) **Insurance Certificates**: Certificates available upon request (subject to confidentiality)

### 17.5 Participant Insurance

Participants are encouraged to maintain:

(a) **Professional Liability**: Professional liability insurance
(b) **Cyber Liability**: Cyber liability insurance
(c) **Errors & Omissions**: Errors and omissions insurance
(d) **Appropriate Coverage**: Coverage appropriate for Participant's operations
(e) **Insurance Notification**: Notification of material changes in insurance coverage

---

## PART XVIII: CHANGE MANAGEMENT & CAPACITY EXPANSION

### 18.1 Change Management Procedures

DBIS follows structured change management:

(a) **Change Classification**: Classification of changes (major, minor, emergency)
(b) **Change Approval**: Change approval processes and authorities
(c) **Change Testing**: Testing requirements before deployment
(d) **Change Communication**: Communication of changes to Participants
(e) **Change Rollback**: Rollback procedures for problematic changes

### 18.2 Material Changes

Material changes require:

(a) **Advance Notice**: At least 90 days advance notice (or as practicable for emergencies)
(b) **Change Documentation**: Documentation of changes and impacts
(c) **Participant Input**: Opportunities for participant input (for material changes)
(d) **Governance Review**: Governance review for material changes (as appropriate)
(e) **Regulatory Notification**: Regulatory notification (if required)

### 18.3 Capacity Expansion

Participants may request capacity expansion:

(a) **Expansion Request**: Written request via Phoenix Portal or formal request
(b) **Expansion Assessment**: DBIS assessment of expansion feasibility
(c) **Expansion Approval**: Approval process and timeline
(d) **Expansion Implementation**: Implementation timeline and procedures
(e) **Expansion Fees**: Fee adjustments for capacity expansion

### 18.4 Capacity Reduction

Participants may request capacity reduction:

(a) **Reduction Request**: Written request with advance notice (at least 90 days)
(b) **Reduction Assessment**: Assessment of reduction impacts
(c) **Reduction Approval**: Approval process
(d) **Reduction Implementation**: Implementation timeline
(e) **Fee Adjustments**: Fee adjustments for capacity reduction

### 18.5 Upgrade Procedures

SaaS module upgrades follow procedures:

(a) **Upgrade Notification**: Advance notice of upgrades (at least 30 days)
(b) **Upgrade Testing**: Testing before production deployment
(c) **Upgrade Deployment**: Staged deployment and rollback capability
(d) **Upgrade Documentation**: Documentation of upgrade changes
(e) **Upgrade Support**: Support during upgrade process

---

## PART XIX: TERMINATION FEES & COSTS

### 19.1 Termination Fees

Upon termination, the following fees may apply:

(a) **Early Termination Fee**: If Participant terminates before end of IRU Term (except for DBIS breach):
    - Calculated as percentage of remaining IRU Grant Fee (pro-rated)
    - Or as specified in Exhibit B
    - Subject to minimum and maximum amounts

(b) **Migration Fees**: Fees for extended migration support beyond standard transition period
(c) **Data Export Fees**: Fees for extensive data export beyond standard scope
(d) **Outstanding Fees**: All outstanding fees and obligations must be paid

### 19.2 Termination Costs

Participants are responsible for:

(a) **Outstanding Fees**: Payment of all outstanding fees
(b) **Migration Costs**: Costs of migration to alternative systems
(c) **Data Export Costs**: Costs of data export (if beyond standard scope)
(d) **Return Costs**: Costs of returning DBIS property or materials
(e) **Other Costs**: Other costs as specified in this Agreement

### 19.3 Fee Refunds

Fee refunds (if any):

(a) **IRU Grant Fee**: Generally non-refundable except as specified in this Agreement
(b) **Ongoing Fees**: Pro-rated refunds for prepaid fees (if termination is for DBIS breach)
(c) **Refund Process**: Refund process and timeline
(d) **Refund Conditions**: Conditions for refund eligibility

---

## PART XX: FORCE MAJEURE

### 20.1 Force Majeure Events

Force majeure events include but are not limited to:

(a) **Natural Disasters**: Acts of God, earthquakes, floods, fires, storms
(b) **War and Conflict**: War, terrorism, civil unrest, military actions
(c) **Government Actions**: Government actions, regulations, orders, embargoes
(d) **Cyberattacks**: Cyberattacks, security breaches, infrastructure attacks
(e) **Pandemics**: Pandemics, public health emergencies
(f) **Infrastructure Failures**: Major infrastructure failures beyond DBIS control
(g) **Third-Party Failures**: Failures of third-party services beyond DBIS control

### 20.2 Force Majeure Obligations

In the event of force majeure:

(a) **Notification**: Prompt notification to the other party
(b) **Mitigation**: Reasonable efforts to mitigate effects
(c) **Resumption**: Resumption of performance as soon as practicable
(d) **Documentation**: Documentation of force majeure event and impacts
(e) **Communication**: Regular communication on status and recovery

### 20.3 Force Majeure Duration

If force majeure continues for:

(a) **30 Days**: Parties shall discuss alternative arrangements
(b) **90 Days**: Either party may terminate this Agreement (with written notice)
(c) **Termination Rights**: Termination rights and procedures
(d) **Survival**: Survival of certain obligations after termination

### 20.4 Exclusions

Force majeure does not excuse:

(a) **Payment Obligations**: Payment of fees and charges
(b) **Confidentiality**: Confidentiality obligations
(c) **Intellectual Property**: Intellectual property obligations
(d) **Dispute Resolution**: Dispute resolution obligations

---

## EXHIBIT B: FEE SCHEDULE

### B.1 IRU Grant Fee

The IRU Grant Fee is a one-time fee payable upon IRU activation:

| Capacity Tier | IRU Grant Fee (USD) | Notes |
|--------------|---------------------|-------|
| Tier 1 (Central Banks) | $[Amount] | Negotiable based on jurisdiction |
| Tier 2 (Settlement Banks) | $[Amount] | Standard fee structure |
| Tier 3 (Commercial Banks) | $[Amount] | Based on usage profile |
| Tier 4 (DFIs) | $[Amount] | Based on institutional size |
| Tier 5 (Special Entities) | $[Amount] | Case-by-case basis |

**Payment Terms**: Due upon execution of this Agreement or as specified in writing.

### B.2 Ongoing Operational Costs

Ongoing operational costs are billed monthly or quarterly in advance:

#### B.2.1 Infrastructure Usage Fees

| Usage Metric | Tier 1 | Tier 2 | Tier 3 | Tier 4 | Tier 5 |
|--------------|--------|--------|--------|--------|--------|
| Transaction Volume (per 1M transactions) | $[Amount] | $[Amount] | $[Amount] | $[Amount] | $[Amount] |
| Message Volume (per 1M messages) | $[Amount] | $[Amount] | $[Amount] | $[Amount] | $[Amount] |
| API Calls (per 1M calls) | $[Amount] | $[Amount] | $[Amount] | $[Amount] | $[Amount] |

#### B.2.2 Capacity Fees

| Capacity Level | Monthly Fee (USD) |
|----------------|-------------------|
| Standard Capacity | $[Amount] |
| High Capacity | $[Amount] |
| Premium Capacity | $[Amount] |

#### B.2.3 Support Fees

| Support Level | Monthly Fee (USD) |
|---------------|-------------------|
| Standard Support | $[Amount] |
| Enhanced Support | $[Amount] |
| Premium Support | $[Amount] |

#### B.2.4 Compliance Fees

| Service | Monthly Fee (USD) |
|---------|-------------------|
| Compliance Monitoring | $[Amount] |
| Regulatory Reporting | $[Amount] |
| AML/KYC Services | $[Amount] |

### B.3 Service Level Credits

In the event of service level breaches, Participants may be entitled to service credits:

| Breach Level | Service Credit |
|--------------|----------------|
| Availability < 99.9% but ≥ 99.0% | 10% of monthly fees |
| Availability < 99.0% but ≥ 95.0% | 25% of monthly fees |
| Availability < 95.0% | 50% of monthly fees |

### B.4 Fee Adjustments

Fees may be adjusted:
- **Annual Adjustment**: Up to [X]% annually based on inflation/cost changes
- **Material Changes**: Require 90 days notice and governance review
- **Capacity Changes**: Pro-rated adjustments for capacity tier changes

### B.5 Payment Terms

- **Currency**: USD (or as agreed in writing)
- **Payment Method**: Wire transfer, ACH, or as agreed
- **Payment Terms**: 30 days from invoice date
- **Late Payment**: Interest at [X]% per month on overdue amounts

### B.6 Taxes

All fees are exclusive of taxes. Participant is responsible for:
- Value-added tax (VAT)
- Goods and services tax (GST)
- Other applicable taxes
- Tax withholding (if required)

---

**Note**: Specific fee amounts are to be determined based on:
- Capacity tier and usage profile
- Jurisdictional factors
- Market conditions
- Negotiated terms

Fee schedules are customized for each Participant and attached to the executed Agreement.
