Att 2 - Voya 2025 Administrative Services Agreement — San Mateo City Council, November 17, 2025

OMNI TEM Custom RPSA (5-2017)
CITY OF SAN MATEO §457 DEFERRED COMPENSATION PLAN
CITY OF SAN MATEO OBRA 3121 SOCIAL SECURITY

REPLACEMENT PLAN
CITY OF SAN MATEO 401(a) GOVERNMENTAL PLAN

FOR SAFETY MANAGEMENT, SWORN POLICE PERSONNEL &
FIREFIGHTERS UNION LOCAL 2400

RETIREMENT PLAN SERVICES AGREEMENT
PLAN NUMBERS 664001, 664002 and 664336
P a g e | 1

RETIREMENT PLAN SERVICES AGREEMENT
This Agreement is made and entered into this 17th day of November, 2025 (“Effective Date”), by and among the City of San Mateo, California, (the “Plan Sponsor”) and Voya Retirement Insurance and Annuity Company (“VRIAC”), a corporation organized and existing under the laws of the State of Connecticut and Voya Financial Partners, LLC a limited liability company organized and existing under the laws of the State of Delaware and registered as a broker-dealer under the federal securities laws (the “Broker-Dealer”). VRIAC and the Broker-Dealer are hereinafter collectively called the “Contractor”. This Agreement governs the services the Contractor will provide to City Of San Mateo §457 Deferred Compensation Plan (the “457(b) Plan”) and the City of San Mateo OBRA 3121 Social Security Replacement Plan (the “OBRA 3121 Plan”) City of San Mateo 401(a) Governmental Plan for Safety Management, Sworn Police Personnel & Firefighters Union Local 2400 (the “401(a) Plan”) and, unless specified otherwise, will collectively be referred to herein as the “Plan”. This Agreement is separate and apart from any other contract issued to the Plan or Plan Sponsor by VRIAC, including any group annuity contract, funding agreement, or custodial / trust agreement.

RECITALS
WHEREAS, the Plan will be construed, administered and enforced according to the Internal Revenue Code (the “Code”) and the laws of the jurisdiction of issue identified in section 5.06; and WHEREAS, the Plan Sponsor has selected certain investment products offered or otherwise made available by or through VRIAC or the Broker-Dealer, respectively, for the investment of the Plan’s assets (the “Program”); and
WHEREAS, the Plan Sponsor further wishes to engage the Contractor as an administrative service provider to facilitate the administration of the Plan by providing services that shall include without limitation, accounting for deferrals or contributions, disbursement of funds, withholding of taxes, investment education, retirement counseling, investment of assets in the appropriate Plan investment options and proper recordkeeping of participant accounts; and WHEREAS, the Contractor wishes to provide such administrative services to the Plan.

NOW, THEREFORE, in consideration of the mutual promises contained herein, the parties do hereby agree as follows:

Section 1. Services

1.01 Good Order: The Contractor and the Plan Sponsor acknowledge that for purposes of this Agreement “Good Order” is defined as the receipt at the Contractor’s designated location of a transaction request, instructions or data that is complete, accurate and in an acceptable format, and which do not require the Contractor to apply any research or discretionary judgment. To qualify as current business day instructions, a transaction request, instructions or data sent electronically, by telephone, facsimile or mail must be received by the Contractor no later than the close of the New York Stock Exchange (“NYSE”) (typically 4:00 p.m. ET). If the Contractor receives a transaction request, instructions or data in Good Order after the close of the NYSE, the Contractor will process the data or request on the next business day that the NYSE is open. The parties understand and acknowledge that a transaction request, instructions or data deemed by the Contractor as being received not in Good Order may be returned for correction and processed upon resubmission in Good Order.

P a g e | 2

1.02 Allocation of Contractor Responsibilities: The Broker-Dealer or other broker-dealers with which Voya Financial Partners, LLC has a selling agreement shall service or perform all marketing communications, enrollment and securities transactions settlement and processing functions assigned to the Contractor. VRIAC shall perform all other responsibilities assigned to the Contractor, including Plan and participant recordkeeping. For plans that have multiple providers of investment products and administrative services, VRIAC will provide recordkeeping services solely for that portion of the Plan utilizing assets record kept by the Contractor.

1.03 Plan Specifications: The relevant characteristics of the Plan that will govern the administration of the Plan are documented within the Plan Specifications section of this Agreement.

1.04 Scope of Services: The Contractor agrees to provide the Plan with the services listed on Schedule A for the term of this Agreement. Services offered pursuant to the 401(a) Plan’s loan program will be subject to the terms specified in Schedule B.

1.05 Administrative Requirements: The Contractor agrees to comply with the requirements set forth on Schedule C in the performance of this Agreement.

1.06 Performance Standards: The Contractor agrees to comply with the standards set forth on Schedule D in the performance of this Agreement. At the Plan Sponsor’s request, the Contractor shall report to the Plan Sponsor how it measures compared to these performance standards. Any non-performance fee payable pursuant to the terms of this Agreement shall be in addition to any damages or other remedies available to the Plan, participants or the Plan Sponsor hereunder. The Contractor and the Plan Sponsor will review these performance standards at the Plan Sponsor’s request and make adjustments as necessary and mutually agreed.

1.07 Selection of Investment Options: The Plan Sponsor acknowledges that it is responsible for choosing the investment options to be made available to participants under the Plan. The Contractor agrees to provide Plan participants with a selection of investment options as specified in Schedule E.

1.08 Investment Provider Minimum Standards: Subject to the minimum standards set forth in Schedule F, the Contractor will provide its administrative services in connection with the Plan Sponsor’s selection of investment products to fund the Plan.

1.09 Modification to Investment Options: In order to confirm the fund selected by the Plan Sponsor can be recordkept by the Contractor, the addition or removal of any investment option to the Plan must be mutually agreed to by the Contractor and the Plan Sponsor and will be made in accordance with a mutually agreed upon schedule for implementing the change. (1) Subject to mutual agreement between the parties to add an investment option; (i) The Plan Sponsor may direct the Contractor to add or remove an investment option from the range of investment products the Contractor currently offers, and that are currently available in the Program, upon forty-five (45) days written notice of the proposed change.
(ii) The Plan Sponsor may direct the Contractor to add an investment option that the Contractor does not currently offer or an investment option that the Contractor currently offers but is not currently available in the Program, upon at least ninety (90) days written notice of the proposed change. Any investment option additions made pursuant to this Subsection 1.09(1)(ii) will be made in accordance with the Contractor’s scheduled quarterly fund updates.

P a g e | 3
(2) The Contractor reserves the right to reject any new investment option that imposes short-term trading (redemption) fees on participant accounts. (3) To the extent an existing investment option imposes short-term trading (redemption) fees on participant accounts, the investment option may be discontinued or short-term trading (redemption) fees may be deducted from participant accounts.

1.10 Limits Imposed by Underlying Funds: The Plan Sponsor understands and acknowledges that orders for the purchase of fund shares may be subject to acceptance by the fund. The Contractor reserves the right to reject, without prior notice, any allocation of payments to the variable investment option (which, depending on the Contractor’s product offering, may be a fund offered directly to the Plan, or a subaccount of a separate account which in turn invests in an underlying fund), if the Contractor’s purchase order for the corresponding fund is not accepted by the fund for any reason.

1.11 Limits Imposed by Contractor on Frequent Transfers: The Plan Sponsor understands and acknowledges that the investment products offered or otherwise made available by or through the Contractor are not designed to serve as vehicles for frequent trading in response to short- term fluctuations in the market. Such frequent trading can disrupt management of a fund and raise its expenses. This in turn can have an adverse effect on fund performance.

Accordingly, the Plan Sponsor agrees to adhere to the Contractor’s current Excessive Trading Policy, as set forth in Schedule G (the “Excessive Trading Policy”). The Contractor reserves the right to modify the Excessive Trading Policy in whole or in part at any time and without prior notice, depending on the needs of the underlying fund(s), the best interest of contract owners and fund investors, and/or state or federal regulatory requirements.

1.12 Access to Investment Advice: The Contractor agrees to make investment advisory services available to Plan participants, in a manner specified and set forth in separately signed agreements.

1.13 Access to Self Directed Brokerage Account: The Contractor agrees to make available to 457(b) and 401(a) Plan participants, a self directed brokerage account option (“SDBO”), as specified in a separately signed agreement.

Section 2. Participant Information

2.01 Provision of Certain Participant Information: The Plan Sponsor or its authorized representative shall facilitate the transmission to the Contractor of all current Plan participant level records including, but not limited to: name; address; social security number; active or terminated employment status; loan information; and deferral amount information. The Contractor shall be able to rely on the information provided by the Plan Sponsor. We are not responsible for any errors, omissions or other inaccuracies in the data you or an unaffiliated third party, including without limitation, prior service providers furnish us. Over the term of this Agreement, the Contractor and the Plan Sponsor will develop procedures for the Plan Sponsor to notify the Contractor of changes in employment status and, to the extent the Plan Sponsor has knowledge of the death of any participant, the Plan Sponsor will notify the Contractor of such death. The Plan Sponsor shall provide such information on a timely basis and use its best efforts to assure the accuracy and completeness of all information provided to the Contractor.

2.02 Changes in Deferral or Contribution Information; New Participant Deferral or Contribution Information: The Contractor and the Plan Sponsor will develop procedures to coordinate the processing of (i) changes in deferral or contribution amount information and (ii) initial deferral or contribution information pertaining to participants joining the Plan on or after the date the Contractor commences the provision of services under this Agreement.

P a g e | 4

2.03 Participants’ Ability to Direct Investments: Participants shall have the ability to choose their investment allocations and to make participant-directed transfers between investment options, subject to any limitations of the Plan and of the Contractor’s investment product. If the Plan is or becomes subject to ERISA, or is otherwise employer-controlled, the Plan Sponsor hereby provides written direction to the Contractor allowing participants to make such investment choices, subject to the Plan Sponsor’s right to revoke this authorization if allowed by the Plan.

2.04 Restricting Participant Accounts (Administrative Holds): The Plan Sponsor directs the Contractor to place an administrative hold on a participant’s account upon receipt of a signed or draft domestic relations order (DROs) or joinder, federal tax levy, or upon the receipt of other types of court orders that assert a claim to plan benefits. Placing an administrative hold on the participant’s account(s) will prevent the participant from taking distributions, including loans. The participant will continue to have the ability to make allocation changes and fund transfers to his/her account. With the exception of DROs, the restriction will remain on the account until such time that the Contractor is advised to remove the administrative hold either by the Plan Sponsor or upon receipt of a court order indicating that the matter has been resolved and the hold is no longer needed.

Administrative holds placed on a participant’s account due to DROs shall remain on the account for a period up to 18 months, or if earlier, until the date the Contractor is advised to remove the administrative hold either by the Plan Sponsor or a court order indicating that the matter has been resolved and the hold is no longer needed. If a subsequent order is received a new 18-month period will be activated.

Notwithstanding the foregoing, with respect to joinders issued pursuant to California Family Code 9 (if applicable), Section 2060, the restriction will not be removed until the Contractor receives either: (1) a QDRO; (2) a court order vacating/dismissing the joinder; or (3) or a final judgment that awards the participant all of the plan benefits.

2.05 Power of Attorney, Guardianship or Conservatorships: The Contractor will determine the validity of the documentation received relative to a power of attorney, guardianship or conservatorship. Once the documentation is determined to be in Good Order, the Contractor will set up or modify the existing account as directed in the documentation received.

Section 3. Compensation

3.01 Contractor’s Compensation: The Contractor’s services under the Agreement are rendered in connection with the Plan Sponsor’s selection of certain investment products offered by or through the Contractor, including the Voya Fixed Plus Ill - 457/401. The mutual fund revenue sharing paid to the Contractor from such investment products, if any, shall not be a source of compensation for the services rendered under this Agreement, but will instead be returned to plan participants as outlined in Appendix I to Schedule H and herein referred to as the “fee levelization service.”
The Contractor will assess an Annual Asset-Based Service Fee of 0.085% and will retain

0.04% for its annual compensation. The additional 0.045% will cover the administrative expense reimbursement described in Appendix I to Schedule H.

Fee will be calculated monthly based on the average daily fund balances including the stability of principal option, and will be deducted monthly across all funds, on a pro rata basis excluding the Self Directed Brokerage Account, and/or any outstanding loan balances, if available. The fee will be deducted from the participant’s money sources in the sequence elected by the Plan Sponsor for participant-initiated withdrawals in the Plan Specifications section of this Agreement. The Contractor reserves the right to revise the Annual Asset- Based Service Fee if plan characteristics change from what was originally assumed, or if the Plan Sponsor terminates the fee levelization service.

P a g e | 5
Additional transactional fees and charges may apply for optional services such as loans, investment advisory services and Self Directed Brokerage Account. Refer to Schedule H (“Additional Plan Services and Fees”) for additional fees and charges.

3.02 Assumptions Regarding Pricing: Any fees, reimbursements, products and services rendered in connection with this Agreement are contingent on the Contractor being the exclusive provider of investment products and administrative services to the Plan during the Term of this Agreement and any subsequent renewal periods (as described in Section 4.01). The addition of any other provider or providers to the Plan during the Term of this Agreement and any subsequent renewal periods or changes in the Plan document may impact any fees, reimbursements, products and services under this Agreement. The Plan Sponsor will notify the Contractor of any such changes in a timely manner.

This Agreement and fees are contingent on the Plan provisions in effect on the date of this Agreement. Any amendment to the Plan may impact this Agreement and fees.

The Plan Sponsor understands and acknowledges that the compensation to the Contractor is subject to the certain general provisions, as set forth in Schedule I (the “General Compensation Provisions”). The Contractor reserves the right to modify the General Compensation Provisions in whole or in part at any time and without prior notice, depending on the needs of the underlying fund(s), the best interest of contract owners and fund investors, and/or state or federal regulatory requirements.

3.03 Reimbursement of Plan Expenses: The Contractor shall reimburse the Plan for reasonable administrative expenses as set forth in Schedule J as directed by the Plan Sponsor.

3.04 Compensation Paid to Sales Professionals: The Contractor shall pay sales professionals a salary. The compensation paid to sales professionals will be derived exclusively from the Contractor’s compensation, defined in Schedule N. Sales professionals may also be eligible for additional expense reimbursement. Compensation may also be paid at the time of participant election of an annuitization distribution option and will be disclosed to the participant at the time the distribution option is elected.

3.05 Float: VRIAC and its affiliated companies (collectively referred to as “Voya ®” for purposes of this Section 3.05) earn income in the form of bank service credits on contributions awaiting investment and on payments awaiting distribution from the bank accounts that Voya maintains (or “float”). The bank service credits are applied against the bank service fees that apply to the bank accounts that Voya maintains and may not be redeemed for cash. Specifically, the bank accounts have been established to receive and hold for a reasonable time:
• contributions or other amounts to be invested in Your Plan, or • amounts redeemed to pay a distribution or disbursement from Your Plan.

Voya will receive income in the form of bank service credits (as described below) and offset such credits against bank service fees that are charged to Voya for the use of such bank accounts and for services provided by the banks for processing receipts or disbursements.

Float Generated by Contributions. Voya uses a bank account to receive and hold contributions or other Plan deposit amounts to be invested. Contributions or other deposit amounts are held until instructions from a Plan representative who has been authorized to provide direction to Voya (“Authorized Instructions”) are received in Good Order. Income in the form of bank service credits are earned on the bank account balance during any waiting period for Authorized Instructions. For Authorized Instructions received in Good Order by the close of the New York Stock Exchange (normally 4:00 p.m. Eastern Time), contributions or other deposit amounts will be invested on that Business Day. For Authorized Instructions received in Good Order after the close of the New York Stock Exchange, contributions or other deposit amounts will be processed on the next Business Day.

P a g e | 6
Additionally, from time to time, a corporate affiliate of Voya may receive money market like rates of return on other deposit or short-term investment products in which contributions awaiting investment may be held until such time as the Authorized Instructions are provided.

Float Generated by Distributions. Voya and/or one or more of its corporate affiliates receives income in the form of bank service credits in connection with distributions or disbursements that Voya pays on the Plan’s behalf. The service credits accrue during the period beginning when an amount is redeemed from the Plan’s investment to fund a distribution or disbursement check and ending when the check is presented for payment.

Additionally, from time to time, a corporate affiliate of Voya may receive money market like rates of return on other deposit or short-term investment products in which distributions may be held until such time as the check is presented for payment.

3.06 Transaction Processing: VRIAC seeks to avoid transaction processing errors to the greatest extent possible, but inadvertent errors do occur from time to time. When a transaction processing error for which VRIAC is directly responsible occurs, VRIAC will attempt to correct the error as soon as reasonably practicable after identification of the error. Once all necessary information has been gathered, VRIAC will promptly take corrective action to put the Plan and its participants in a position financially equivalent to the position they would have been in if the VRIAC processing error had not occurred.

VRIAC processes your Plan’s investment instructions on an “omnibus” or aggregated basis. If VRIAC’s correction of a VRIAC processing error results in a loss to your Plan or its participants, VRIAC will absorb the loss. If any gain results in connection with the correction of an VRIAC processing error, VRIAC will net any such gain against other losses absorbed by VRIAC and retain any resulting net gain as a component of its compensation for transaction processing services, including its agreement to make Plan and participant accounts whole for losses resulting from VRIAC processing errors. For more information on our error correction policy, please refer to Voya Retirement Insurance and Annuity Company’s Policy for Correction of Processing Errors (“VRIAC Policy”), which is included in Schedule K. The VRIAC Policy and any updates to the VRIAC Policy are posted in the Sponsor Disclosure section of Sponsor Web.

3.07 Fund Management Fees: Fund management fees and other fund operating expenses will also apply to the variable investment options under the Plan. Fees depend on the investment options chosen.

Section 4. Term, Termination, and Amendment

4.01 Term: This Agreement shall commence on the Effective Date and, unless sooner terminated as set forth in this Section 4, shall continue for an initial term of five (5) years (“Initial Term”).

Thereafter, this Agreement shall automatically renew for up to three (3) subsequent annual renewal terms unless either the Plan Sponsor or the Contractor provides written notice to the other party of its intent not to renew this Agreement at least ninety (90) calendar days before the end of the then current term. This Agreement may be amended in writing if agreed to by both parties.

4.02 Termination Without Cause: At any time following the Initial Term, either the Plan Sponsor or Contractor may terminate this Agreement upon at least ninety (90) calendar days’ advance written notice to the other party. The Plan Sponsor and Contractor may also mutually agree in writing to terminate this Agreement at any time.

4.03 Termination For Cause: Notwithstanding Section 4.01, either party may terminate this Agreement immediately at any time upon written notice “for cause.” For purposes of this Agreement, “for cause” shall mean: (1) failure of the other party to comply substantially with this Agreement and the attached schedules hereto which, when called to the attention of the P a g e | 7
other party in writing has not been corrected within thirty (30) calendar days of such notice; (2) the fraud or embezzlement on the part of the other party or provider of investment advice; (3) if the other party ceases to conduct business in the normal course, becomes insolvent, makes a general assignment for the benefit of creditors, suffers or permits the appointment of a receiver for its business or assets, or avails itself of, or becomes subject to any proceeding under the Federal Bankruptcy Act or any other statute of any state relating to insolvency or the protection of the rights of creditors; (4) failure of the other party to pay any fees under this Agreement; or (5) if pursuant to Section 1.09 the Plan Sponsor requests the addition or removal of an investment option under the Plans, that is reasonably anticipated by the Contractor to result in a reduction in revenues under the Plans and no mutual agreement is reached between the parties on the recoupment of such lost revenues, the Contractor shall have the right to terminate this Agreement.

4.04 Transfer of Records: In the event of the termination of this Agreement, the Contractor shall provide all electronic data records to the Plan’s designated representative or to a new contractor in an agreed upon format at no cost and within 180 days of written notice of intent to terminate this Agreement.

Section 5. General

5.01 Circumstances Excusing Performance: Neither the Plan Sponsor nor the Contractor shall be liable to the other for any delays or damages or any failure to act due, occasioned, or caused by reason of restrictions imposed by any government or government agency, acts of God, strikes, labor disputes, action of the elements, or causes beyond the control of the parties affected thereby.

5.02 Ownership and Use of the Content Copyright: Each party owns all right, title and interest in its pre-existing intellectual property. You acknowledge and agree that, except for your pre- existing intellectual property, all information and content distributed through or displayed on a Contractor Web site, printed or electronic literature, including but not limited to all text, graphics, images, software applications and code, video, audio, and user interface design ("Content") is the property of the Contractor and its affiliates or its third party licensors. You have a limited, non-exclusive license to use the Content during the term of this Agreement.

Original Content developed by the Contractor for the benefit of the Plan Sponsor is the property of the Contractor and its affiliates unless both parties agree to transfer ownership to the Plan Sponsor in writing.

If you or any appointee thereof, provides the Contractor with Content for distribution or display on a Contractor Web site, or in printed or electronic literature, you are responsible for obtaining permission from the owner or licensor for use of the Content.

5.03 Parties Bound: This Agreement and the provisions thereof shall be binding upon the respective parties and shall inure to the benefit of the same.

5.04 Applicable Law: This Agreement shall be construed in accordance with the laws of the State of California, referred to as the jurisdiction of issue. The Contractor and the Plan Sponsor shall comply with all state and federal laws and regulations applicable to the services to be performed.

5.05 Severability: If any provision of this Agreement shall be found to be illegal or invalid for any reason, the illegality or invalidity shall not affect the remaining parts of this Agreement and the remainder of this Agreement shall be construed and enforced as if said illegal or invalid provision had never been inserted herein. Neither party shall be required to perform any services under this Agreement which would violate any law, regulation or ruling.

P a g e | 8

5.06 Acknowledgment: The Plan Sponsor acknowledges the following. (a) The Contractor is performing non-discretionary, ministerial administrative services at the direction of the Plan and its authorized representatives. (b) Neither the Contractor nor its affiliates is the Plan administrator or a fiduciary under state law, the Investment Advisors Act of 1940 or, as applicable ERISA, and the Contractor is not responsible for the selection or supervision of fiduciaries to the Plan or of service providers not associated with the Contractor.
(c) The Plan Sponsor is solely responsible for maintaining the qualified status of the Plan, if applicable.
(d) The Plan Sponsor has consulted with a tax or legal advisor regarding the tax consequences of the Plan.
(e) The Plan Sponsor is responsible for the process of calculating and verifying student loan match contributions if applicable and identifying the specific match amounts contributed.
(f) The Plan Sponsor is responsible for selecting the Plan design and investment options that best meet its objectives. The Plan Sponsor understands that it has selected a program that may include a stability of principal option and/or variable annuities funded through a group annuity contract and/or mutual funds offered through a custodial or trust agreement to fund a tax-qualified arrangement; that the tax laws provide for deferral of taxation on earnings on participant account balances (excluding Roth or after-tax contribution sources); and that, although the annuity provides features and benefits that may be of value to participants, it does not provide additional deferral of taxation beyond that provided by the tax qualified arrangement itself. To the extent mutual funds are available as investment options under the Plan, there may be one or more classes of shares with respect to each mutual fund and each class of shares may have different rules, requirements and expense ratios and Plan Sponsor has made the determination that the class of shares chosen for the Plan is the appropriate class and is suitable for the Plan. All discretion and control with respect to the terms, administration of assets of the Plan shall remain with the Plan Sponsor or with the named fiduciaries under the Plan.
(g) The Plan Sponsor and its authorized representatives have sole responsibility for the overall administration of the Plan, including periodically providing participants with any notices required under the Code and related Regulations to which the Plan is subject and for making all benefit determinations. The Contractor and its affiliates shall not have any discretion with respect to the management or administration of the Plan or with respect to determining or changing the rules or policies pertaining to eligibility or entitlement of any participant in the Plan to benefits under the Plan. The Contractor and its affiliates shall not have any control or authority with respect to any assets of the Plan, including the investment or disposition thereof. (h) Plan Sponsor confirms that Contractor’s practices are consistent with the terms and administrative practices of the Plan, where applicable. The Plan Sponsor may delegate the day-to-day administration of certain Plan Sponsor responsibilities to the Contractor as indicated in Schedule A.
(i) The Plan Sponsor and its authorized representative have the sole authority for the review and final disposition of a Plan participant’s appeal of any benefit determination made by the Contractor under the Plan.
(j) The Contractor does not directly provide any investment advice to the Plan Sponsor with respect to the Plan’s assets.

P a g e | 9
(k) In performing services under this Agreement, the Contractor is entitled to rely on any information the Plan Sponsor, or its authorized representatives identified in Schedule L, or the Plan participants provide. The Contractor has a reasonable duty to inquire as to the authenticity or the accuracy of such information or the actual authority of such person to provide it.
(l) The Plan Sponsor will provide the Contractor with an up-to-date copy of the Plan document(s) and complete information governing the terms and operation of the Plan (including a written explanation of any practices and procedures not reflected in the Plan document). The Plan Sponsor will promptly provide to the Contractor any proposed amendments to the Plan for review and comment by the Contractor at least 90 days prior to the proposed amendment effective date. (m) Generally, only fees relating to the ongoing administration of the Plan may be passed through to participants. You will direct us to deduct from participant accounts those fees outlined in Schedule H. The Plan Sponsor is responsible for determining if an expense is deductible from Plan assets.
(n)VRIAC Error. VRIAC’s responsibility with respect to providing the services is limited to correcting errors, within a reasonable time, which result from its computer system malfunctions, its staff errors or are otherwise caused by VRIAC’s negligent acts.

VRIAC shall make a good faith effort to correct any such error as soon as reasonably practicable after identification of the error when such correction is reasonably necessary and practical under the circumstances. For more information on our error correction policy, please refer to Voya Retirement Insurance and Annuity Company’s policy for Correction of Processing Errors (“VRIAC Policy”), which is included in Schedule K. The VRIAC Policy and any updates to the VRIAC Policy are also posted in the Sponsor Disclosure section of Sponsor Web.
(o)Plan Sponsor Error. VRIAC will attempt to correct, at Plan Sponsor’s expense, processing errors resulting from Plan Sponsor, or Plan Sponsor’s representative, or otherwise caused by the negligent acts of Plan Sponsor; provided that Plan Sponsor promptly notifies VRIAC of such error and furnishes all data to VRIAC reasonably necessary to make such corrections. Plan Sponsor shall pay VRIAC its reasonable expenses incurred in making such corrections.

5.08 Notices: Each party will promptly provide the other with notice and copy of any attempts to levy or attach amounts held under the Plan and/or any litigation affecting the Plan of which it becomes aware and/or any notices or demands to be given under this Agreement. All such notices, demands or other communications hereunder shall be in writing and duly provided if sent certified mail, return receipt requested, addressed to the party to be notified or upon whom a demand is being made, at the addresses set forth in this Agreement or such other place as either party shall from time to time designate in writing. The date of service of a notice or demand shall be the receipt date on any certified mail receipt.

Notices to the Contractor shall be sent to:

Voya Retirement Insurance and Annuity Company
Attn: Deputy General Counsel
Legal Department, C2N
One Orange Way
Windsor, CT 06095
Notices to the Plan Sponsor shall be sent to:

City of San Mateo Human Resources Department
Attn: Human Resources Director
City of San Mateo §457 Deferred Compensation, OBRA 3121 & 401(a) Plans 330 West 20th Ave
San Mateo, CA 94403
P a g e | 10

5.09 Copies of Agreement: This Agreement may be executed in any number of counterpart copies, each of which when fully executed shall be considered as an original.

5.10 Headings: Headings are for convenience of reference only. Headings do not limit or expand the scope of the text and are not intended to emphasize any portion thereof.

5.11 Independent Contractor: The Contractor is associated with the Plan Sponsor only for the purposes and to the extent specified in this Agreement. With respect to the performance of the contracted services pursuant to this Agreement, the Contractor shall have the sole right to supervise, manage, operate, control and direct performance of the details incident to its duties under this Agreement.

5.12 Contractor Primary Contact: The Contractor designates certain individual(s) to serve as the primary point of contact for the Agreement. These individuals are identified in Schedule M.

5.13 Licensed Representative: The Contractor agrees to provide licensed representatives to perform enrollment and education services, and to assist participants with account balance inquiries, investment selection changes, interfund transfers or exchanges, and transaction initiation. These individuals are identified in Schedule N.

5.14 Subcontracting: The Contractor may enter into subcontracting agreements for work contemplated under the Agreement. Any subcontractor shall be subject to the same terms and conditions as the Contractor. The Contractor shall be fully responsible for the performance of any subcontractor.

5.15 Contract Assignability: Without the prior written consent of the Plan Sponsor, the Agreement is not assignable by the Contractor.

5.16 Licenses and Permits: The Contractor shall ensure that it has all necessary licenses and permits required by federal, state, and municipal laws, ordinances, rules and regulations. The Contractor shall maintain these licenses and permits in effect for the duration of this Agreement. The Contractor will notify the Plan Sponsor immediately of loss or suspension of any such licenses and permits. Failure to maintain a required license or permit may result in immediate termination of this Agreement.

5.17 Conflict of Interest: The Contractor shall make all reasonable efforts to ensure that no conflict of interest exists between its officers, employees, agents or subcontractors and the Plan Sponsor. The Contractor shall make a reasonable effort to prevent employees, consultants, or members of governing bodies from using their positions for purposes that are, or give the appearance of being, motivated by a desire for private gain for themselves or others such as those with whom they have family, business, or other ties.

5.18 Improper Consideration: The Contractor shall not offer or be forced to provide (either directly or through an intermediary) any improper consideration such as, but not limited to, cash, discounts, services, the provision of travel or entertainment, or any items of value to any officer, employee, group of employees, or agent of the Plan Sponsor in an attempt to secure favorable treatment or consideration.

5.19 Indemnification: The Contractor agrees to indemnify and hold the Plan Sponsor, its officers, employees and agents harmless from any loss, liability, claim, suit, fees (including reasonable attorneys’ fees) or judgment resulting from work or acts done or omitted by the Contractor’s officers, employees or agents in carrying out the Contractor’s responsibilities as set forth in this Agreement to the proportionate extent that it results from the negligence or wrongdoing of the Contractor or any of its officers, employees or agents. The Contractor agreements to indemnify shall not extend to any injury or damage which results from the Contractor’s reliance on information transmitted by the Plan Sponsor.

P a g e | 11
The Plan Sponsor agrees to indemnify and hold the Contractor, its officers, employees and agents harmless from any loss, liability, claim, suit, fees (including reasonable attorneys’ fees) or judgment resulting from work or acts done or omitted by the Plan Sponsor’s officers, employees or agents in carrying out the Plan Sponsor’s responsibilities as set forth in this Agreement to the proportionate extent that it results from the negligence or wrongdoing of the Plan Sponsor or any of its officers, employees or agents.

5.20 Insurance: During the term of this Agreement, the Contractor’s coverage shall be at least as broad as:
a) Commercial General Liability (CGL): Insurance Services Office (ISO) Form CG 00 01 12 07 covering CGL on an “occurrence” basis, including products- completed operations, personal & advertising injury, with limits no less than $2,000,000 per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this project/location or the general aggregate limit shall be twice the required occurrence limit. b) Automobile Liability: ISO Form Number CA 00 01 covering any auto (Code 1), or if Contractor has no owned autos, hired, (Code 8) and non-owned autos (Code 9), with limit no less than $1,000,000 per accident for bodily injury and property damage.
c) Workers’ Compensation: as required by the State of California, with Statutory Limits, and Employer’s Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease.

If the Contractor maintains higher limits than the minimums shown above, the Sponsor requires and shall be entitled to coverage for the higher limits maintained by the contractor.

Other Insurance Provisions
The insurance policies are to contain, or be endorsed to contain, the following provisions:

Additional Insured Status
The Sponsor, its elected and appointed officials, employees, and agents are to be covered as insureds on the auto policy for liability arising out of automobiles owned, leased, hired or borrowed by or on behalf of the Contractor; and on the CGL policy with respect to liability arising out of work or operations performed by or on behalf of the Contractor including materials, parts or equipment furnished in connection with such work or operations. General liability coverage can be provided in the form of an endorsement to the Contractor’s insurance (at least as broad as ISO Form CG 20 10, 11 85 or both CG 20 10 and CG 20 37 forms if later revisions used).

Primary Coverage
For any claims related to this contract, the Contractor’s insurance coverage shall be primary insurance as respects the Sponsor, its elected and appointed officials, employees, and agents. Any insurance or self-insurance maintained by the Sponsor, its elected and appointed officials, employees, or agents shall be excess of the Contractor’s insurance and shall not contribute with it.

Notice of Cancellation
Each insurance policy required above shall provide that coverage shall not be canceled, except after thirty (30) days’ prior written notice (10 days for non-payment) has been given to the Sponsor.

Waiver of Subrogation
P a g e | 12
Contractor hereby grants to Sponsor a waiver of any right to subrogation which any insurer of said Contractor may acquire against the Sponsor by virtue of the payment of any loss under such insurance. Contractor agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not the Sponsor has received a waiver of subrogation endorsement from the insurer.

Acceptability of Insurers
Insurance is to be placed with insurers with a current A.M. Best’s rating of no less than A:VII, unless otherwise acceptable to the Sponsor.

Verification of Coverage
Contractor shall furnish the Sponsor with original certificates and amendatory endorsements effecting coverage required by this clause. All certificates and endorsements are to be received and approved by the Sponsor before work commences. However, failure to obtain the required documents prior to the work beginning shall not waive the Contractor’s obligation to provide them. The Sponsor reserves the right to review endorsements required by these specifications, at any time.

5.21 Right to Monitor: The Plan Sponsor or any appointee thereof, shall have the right to review and audit all records, books, documents, and other pertinent items as requested, and shall have the right to monitor the performance of the Contractor in the delivery of services provided under this Agreement. Full cooperation shall be given by the Contractor in the implementation, and in any auditing or monitoring conducted.

5.22 Use and Disclosure of Confidential Information. Either party may disclose (“Disclosing Party”) confidential information to the other party ("Non-Disclosing Party") as described in this Section. The Non-Disclosing Party agrees that it will (i) disclose the Disclosing Party’s confidential information only to its employees, agents, advisors, third party service providers, consultants and contractors who have a need to know and are bound by confidentiality terms no less restrictive than those contained in this Agreement, and (ii) use the Disclosing Party’s confidential information only for the purposes of performing its obligations under this Agreement. The Non-Disclosing Party will use all reasonable care in handling and securing the Disclosing Party’s confidential information and will employ all security measures used for its own proprietary information of similar nature. These confidentiality obligations will not restrict any disclosure of confidential information by order of a court or any governmental agency, provided that the Non-Disclosing Party shall cooperate in all reasonable respects with the Disclosing Party in seeking to prevent or limit disclosure and shall limit any such disclosure to the information actually required to be disclosed.

5.23 Voya Data Security Standards and Addendum: The Contractor acknowledges that it has a Data Security Addendum in place as attached hereto in Schedule O. The Contractor reserves the right to terminate or modify the Data Security Addendum in whole or in part at any time and without prior notice to the Plan Sponsor. The Contractor shall provide an updated Data Security Addendum to the Plan Sponsor upon request. For purposes of the Data Security Addendum, the “Client” is the Plan Sponsor.

P a g e | 13
IN WITNESS WHEREOF, the parties hereto have caused this Agreement (including all referenced and attached Schedules and Appendices) to be executed by their respective officers thereunto duly authorized as of the Effective Date of this agreement.

CITY OF SAN MATEO SAN MATEO CONSOLIDATED FIRE

DEPARTMENT
By: By:

Printed
Name: Alex Khojikian
Printed
Name Matthew Turturici
Title: City Manager Title: Fire Chief

APPROVED AS TO FORM
By:

Printed
Name:

Title: City Attorney

VOYA FINANCIAL PARTNERS, LLC
By:

Printed
Name: Laurie A. Lombardo
Title: Vice President

VOYA RETIREMENT INSURANCE

AND ANNUITY COMPANY
By:

Printed
Name: Melissa M. McAuliffe
Title: Vice President
P a g e | 13
P a g e | 14
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Plan Specifications
The following reflects the relevant provisions of the Plan document that will govern the administration of the Plan. The Plan Sponsor acknowledges it has reviewed and confirmed that these accurately reflect the provisions of the Plan as of the effective date of this Agreement.

ERISA Status: The Governmental 457(b), OBRA 3121 Social Security Replacement and 401(a) Plans are not subject to Title I of the Employee Retirement Income Security Act of 1974 (“ERISA”).

Contribution Sources.

The sources of contribution permitted under the Governmental 457(b) Plan are:

Employee Pre-tax
457(b) Rollover
Non-457(b) Rollover
Designated Roth Contributions
Roth 457(b) Rollover
Roth Non-457(b) Rollover
In Plan Roth Rollover 457(b)
Rollover of In Plan Roth Rollover Non-457(b)
Employer Contribution: (specify contribution name) ________________________________ The sources of contribution permitted under the OBRA 3121 Plan are:

Employee Pre-tax
Rollover
Other (specify by name): (specify contribution name)
________________________________
The sources of contribution permitted under the 401(a) Plan are:

Employee Pre-tax
Employee Mandatory Contribution (including 414(h) pick-up) Rollover
After-tax Contribution (not designated Roth)
Employer Contribution: (specify contribution name) ________________________________ Other (specify by name): (specify contribution name)
________________________________
Vesting Schedule. The Employer source(s) of contributions under the 401(a) Plan are subject to the following vesting schedule. The Contractor will maintain participant vesting information, if applicable, according to the Plan. The Contractor will allocate forfeitures (if applicable) according to the provisions of the Plan.
100% Immediate or no vesting schedule applicable
5 year graded (20% per year after one year of service)
6 year graded (20% per year after two years of service) 3 year cliff
Other (specify) ________________________________
Permissible In-Service Withdrawal Options
The following participant-initiated withdrawals and/or transfers from a participant account are permitted under the 457(b)Plan (check all that apply):

Unforeseeable Emergency Withdrawal
P a g e | 15
In-Service Distribution of Rollover Account(s)
In-Service Withdrawal for Governmental 457(b) Plans (aka deminimus withdrawal) Purchase of Governmental Defined Benefit Plan Service Credit Tax-Free Distribution for Health and Long Term Care Insurance (for retired public safety officers)
Age Based Withdrawal – identify the age level to allow withdrawal 70 1/2 Qualified Birth and Adoption (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
Qualified Disaster Distributions (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
Domestic Abuse Withdrawals (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
In-Plan Emergency Withdrawals (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
The following participant-initiated withdrawals and/or transfers from a participant account are permitted under the OBRA 3121 Plan (check all that apply):

Unforeseeable Emergency Withdrawal
In-Service Withdrawal for Governmental 457(b) Plans (aka deminimus withdrawal) Age Based Withdrawal – identify the age level to allow withdrawal 70 1/2 The following participant-initiated withdrawals and/or transfers from a participant account are permitted under the 401(a) Plan (check all that apply):

Hardship Withdrawal
Age 59 ½ (available to 401(a)/(k) and 403(b) plans only) In-Service Distribution of Rollover Account(s)
Purchase of Governmental Defined Benefit Plan Service Credit Tax-Free Distribution for Health and Long Term Care Insurance (for retired public safety officers)
Normal Retirement Age – identify the age level to allow withdrawal 50 Age Based Withdrawal – identify the age level to allow withdrawal Qualified Birth and Adoption (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
Qualified Disaster Distributions (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
Domestic Abuse Withdrawals (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
In-Plan Emergency Withdrawals (will follow same sources/criteria as hardship withdrawals/unforeseeable withdrawal)
Permitted Frequency – Default is no restrictions on how often a participant may request an In- Plan Roth Transfer of Non-Distributable amounts. If Plan provides for a restriction describe here. Leave blank if no restriction.
_______(specify a number) In-Plan Roth Transfer every
calendar quarter semi-annual calendar year
Final Distribution Payment Options
The following payment options are available under the Governmental 457(b) Plan to a participant upon separation from service (check all that applies).

In cash (check applicable option):
full lump sum only partial or full lump sum
In installment payments over a period not to exceed the life expectancy of the participant or the joint and last survivor life expectancy of the participant and his or her designated primary Beneficiary. This includes the Systematic Withdrawal Option (SWO) and Estate Conservation Option (ECO) as described in the product information booklet.

Applied to the purchase of an annuity contract (must be checked if J&S annuity is the normal form of benefit under the Plan)
Rollover to another eligible retirement plan or IRA
P a g e | 16
Plan to plan transfer (after severance from employment) Combination of all permitted payment options
The following payment options are available under the OBRA 3121 Plan to a participant upon separation from service (check all that applies).

Applied to the purchase of an annuity contract (must be checked if J&S annuity is the normal form of benefit under the Plan)
Plan to plan transfer (after severance from employment) Combination of all permitted payment options
The following payment options are available under the 401(a) Plan to a participant upon separation from service (check all that apply).

Applied to the purchase of an annuity contract (must be checked if J&S annuity is the normal form of benefit under the Plan)
Rollover to another eligible retirement plan or IRA
Plan to plan transfer (after severance from employment) Combination of all permitted payment options

1.Money Source Withdrawal Sequence
The withdrawal or liquidation sequence for money sources available to fund a withdrawal from the Governmental 457(b) Plan is identified below. Money will be withdrawn from participant investment options on a pro-rata basis. Fixed Account restrictions may apply; refer to Schedule E.

Employee Elective Deferrals
Rollovers from another 457(b) Plan
Rollovers from a 401(a)/(k) or 403(b) Plan or IRA
Designated Roth
Roth Rollovers from another 457(b) Plan
Roth Rollovers from a 401(k) or 403(b) Plan
In Plan Roth Rollover
Rollover of In Plan Roth Rollover from a 401(k) or 403(b) Plan The withdrawal or liquidation sequence for money sources available to fund a withdrawal from the OBRA 3121 Plan is identified below. Money will be withdrawn from participant investment options on a pro-rata basis. Fixed Account restrictions may apply; refer to Schedule E.

Employee Elective Deferrals
Rollovers from another 457(b) Plan
Rollovers from a 401(a)/(k) or 403(b) Plan or IRA
Other
The withdrawal or liquidation sequence for money sources available to fund a withdrawal from the 401(a) Plan is identified below. Money will be withdrawn from participant investment options on a pro-rata basis. Fixed Account restrictions may apply; refer to Schedule E.

P a g e | 17
Employee Mandatory Contribution (including 414(h) pick-up) Other (Please specify)

2.Mandatory Distributions
Mandatory distributions for terminated participants apply under:
the 457(b) plan the OBRA 3121 plan the 401(a) plan
N/A - no mandatory distributions permitted.

If applicable, for purposes of mandatory distributions, rollover contribution balances will be:
included in determining participant account balance
excluded in determining participant account balance.

If applicable, select one of the following options regarding the automatic rollover of mandatory distributions pursuant to Code section 401(a)(31). All mandatory distributions / rollovers must be initiated by the Plan Sponsor.

Plan Sponsor has elected to reduce mandatory distribution limit from $7,000 to $1,000 for the 457(b) and OBRA 3121 Plans
Plan Sponsor has elected to require mandatory distribution of participant accounts up to $7,000 for the 401(a) Plan. Participant account’s with a balance of less than or equal to $1,000.00 will be paid to the participant in a single lump sum cash distribution. Participant accounts with a balance between $1,000.01 and $7,000.00 will be rolled over into an IRA at:

Voya Rollover IRA – If this option is elected, the Plan Sponsor must complete the “Voya Automatic Rollover/Mandatory Distribution Agreement.” Non-Voya Rollover IRA – provide the following information:

Name of IRA Provider:

Contact Name:

Street Address:

City/State/ZIP:

P a g e | 17
P a g e | 18
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule A: Scope of Contractor Services
The Contractor agrees to provide the Plan with the services listed within this Schedule for the term of this Agreement. For purposes of this Schedule, all references to “participant” are intended to apply equally to all account holders under the Plan. This includes participants, beneficiaries and alternate payees.

1. The one-time preparation and implementation of a Plan-specific product and service conversion or transition schedule which shall include notice to all Plan participants.

2. The initial installation of overall Plan records and individual Plan participant records.

3. To assist the Plan Sponsor and its legal counsel, the Contractor will, to the extent it has one available, provide a specimen plan document upon your request. As a specimen plan, you and your legal counsel may modify the document(s) to reflect your Plan design needs.

4. The development of Plan enrollment materials, including basic investment education material.

The distribution of such materials shall be as mutually agreed upon by the parties.

5. Conducting introductory on-site education and enrollment meetings for employees. Ongoing provision of employee enrollment and education services, including the provision of enrollment materials which include the necessary information for employees to enroll and make investment choices. Enrollment materials will be made available via the Contractor’s enrollment website.

6. Ongoing allocation of Plan contributions received in Good Order to individual participant accounts, and reconciliation of Plan and participant activity on a daily basis. For purposes of this provision, Plan contributions are deemed to include loan repayments (if applicable) and non- routine contributions, such as rollovers or plan to plan transfers, if permitted under the Plan.

7. Contractor will perform one test per month beginning in October through December on each participant account per Plan covered by this Agreement for the limit on elective deferrals pursuant to Code section 402(g) and/or 457(e)(15) and on the annual additions limit in accordance with Code section 415(c), if applicable. If the Plan Sponsor sponsors more than one plan, the Contractor will not aggregate the plans for testing purposes, unless specifically agreed to within this Agreement.

8. Ongoing maintenance of participant beneficiary designations under the Plan based upon mutually agreed upon procedures which shall be reflected in the Plan document. Participants may designate a beneficiary via the Contractor’s participant internet site or by speaking with a customer service representative via a toll free telephone line.

Community Property Edit
This optional feature of the online beneficiary maintenance service will take into account community property laws applicable in the participant’s resident state at the time that he or she is making a beneficiary designation. When this service has been elected, the Contractor’s online beneficiary maintenance service will require any participant who has identified themselves as being married or in a registered domestic partnership or a civil union and who does not designate a person identified as his or her spouse or domestic partner as a primary beneficiary for at least the percentage prescribed under the community property laws to complete and submit a paper beneficiary designation form.

P a g e | 19
The Plan Sponsor elects to utilize the Contractor’s Community Property Edit feature as described above.

9. Ongoing maintenance, recordkeeping of individual participant account records and processing in a timely manner of all transactions permitted under the Plan as authorized or approved by the Plan Sponsor. Any delegation of the Plan Sponsor’s role of authorizing or approving transactions under the Plan to the Contractor will be as directed later within this Schedule or other written instrument between the parties. Such direction shall not be construed as delegating Contractor discretion with respect to such decision.

10. Ongoing generation of periodic Plan activity reports for Plan Sponsor use, as mutually agreed upon, to be made available through a secure website.

Plan level confirmations including transactional activity and Sponsor Activity Report will be made available to You via paper as well as the Plan Sponsor Website.

11. Fee Disclosure
Sponsor Fee Disclosure
Post monthly plan-level fee and expense disclosure reports (as outlined in DOL regulation §2550.408b-2) to Sponsor Web (and Third Party Administrator Website, if applicable) if elected below.

Yes
No

Participant Fee Disclosure for Non-ERISA* plans only
Post monthly Participant Fee Disclosure report (in accordance with DOL (in accordance with DOL §2550.404a-5) to Sponsor Web, Participant Web and Third Party Administrator Website, if applicable) if elected below.

Yes
No

12. Ongoing processing of participant-initiated benefit payment requests received in Good Order, calculation and withholding of federal and state taxes, and the provision of necessary tax forms on a timely basis to participants who received taxable distributions during the previous year.

13. Establish and maintain an electronic interface with the Plan Sponsor for participant enrollment information (including automatic enrollments) and changes to the participant’s contribution amount or rate, as provided in Appendix I, II and III to Schedule A.

The Contractor will also make available to the 457(b) Plan a simplified paper enrollment process (“EZ Enroll”) for employees who choose not to select their own investment options. This EZ Enroll process will include a shorter enrollment form and will utilize the following default investment options based upon the date of birth of the employee. The EZ Enroll form will be available to newly hired eligible employees through an enrollment kit supplied by the Contractor to the Plan Sponsor. The Contractor will not meet individually to assist employees with completing the EZ Enroll form.

The Plan Sponsor accepts fiduciary responsibility to choose the appropriate “default” investment option and understands it may choose from any of the investment options available under the Plan. The Plan Sponsor has chosen the Vanguard Target Retirement Funds as the “default” investment option, and understands that contributions into these investments pursuant to the EZ Enroll procedure will be based on the employee’s date of birth, not the anticipated retirement age as the investments are designed. Employees electing to utilize the EZ Enroll procedure will have contributions allocated to the Vanguard Target Retirement Funds assuming the standard retirement age of 65. The Plan Sponsor reserves the right to change the “default” investment option at any time in the future with 30 days prior written notice to Contractor.

P a g e | 20
The Contractor will supply the enrollment kits containing the EZ Enrollment form in a group enrollment meeting setting. Outside of group enrollment meetings, the Contractor or County may provide the enrollment kit to an eligible employee.

14. Access to customer service representatives via a toll free telephone line to respond to Plan participant inquiries, provide information about participants’ accounts and investment options, help facilitate the enrollment of an employee into the Plan and to distribute administrative forms.

15. Access to an automated voice response system via toll free telephone lines, through which participants may obtain updated account and investment information and initiate transactions permitted under the Plan.

Access to an internet site and mobile app, through which participants may obtain updated account and investment information, and initiate transactions permitted under the Plan and request forms for initiating certain transactions as permitted under the Plan.

The Contractor provides a customer identifier or Personal Identification Number (PIN) for phone services and first time online account registration. Participants may be sent a PIN electronically or via U.S. Mail. Temporary PINs can be delivered to employees at your organization’s e-mail address when an e-mail domain associated with your organization is provided.

The Plan Sponsor authorizes the Contractor to provide temporary PINs by request of Participants to designated Employer email addresses. The following domains are registered to the Employer and provided for this purpose: @cityofsanmateo.org

16. The Contractor has an ongoing commitment to advancing the retirement readiness of your participants which includes our continued addition of self-service planning tools to the participant internet site and mobile app along with the availability of phone and local Voya Financial Advisors representatives to assist individuals with their broader financial needs. These services are offered outside of the recordkeeping services described in this. If individuals elect fee-based services, fees are charged directly to the employee and will not be withheld from any plan participant account. In order to facilitate the delivery of the services, the Contractor may use participant data to the extent and for purposes authorized by the participant whose data is being used. Securities and investment advisory services offered through Voya Financial Advisors, Inc., member SIPC.

17. Access to a Sponsor Web site, through which a Sponsor may obtain reports.The Sponsor must select a primary contact by completing an administrative form to be provided by the Contractor.

18. Incoming Rollovers / Transfers Authorization
Ongoing review and processing of participant-initiated incoming rollover or transfer requests, on behalf of the Plan Sponsor, shall be based on mutually acceptable procedures for the review, and processing of these types of requests. Incoming rollover and transfer requests determined to be in Good Order will be processed on the same business day as the assets are received by the Contractor.

At the Plan Sponsor’s direction, participants who have had a request denied shall be given the opportunity to appeal to the Plan Sponsor for review and final disposition of the determination.

19. Unforeseeable Emergency Related provisions:

Indicate who will be responsible for authorizing unforeseeable emergency withdrawals from the 457(b) Plan. Select one of the following options:
the Contractor*
Authorized Plan Sponsor representative
Other (firm or individual/s
name)______________________________________________________________ P a g e | 21
The Plan allows Self-Certification for Unforeseeable Emergency withdrawals (Safe Harbor definition of Hardship only) If elected You may rely on an employee’s written certification that a unforeseeable emergency withdrawal is based upon an immediate and heavy financial need and that the amount requested is no more than is necessary to satisfy the financial need. Your Plan document must support this election.

Self-Certificaton allowed:

Yes No
The Unforeseeable Emergency Withdrawal must be a type of emergency described in IRS Treas. Reg. Section 1.457-6(c)(2)(i): Reason are listed as follows:

Funeral Expenses
Illness or Accident
Impact of Casualty or Disaster
Prevent Eviction/Foreclosure
Repair Principal Residence
Unreimbursed Medical Expenses
*The Contractor will provide ongoing review and processing of participant unforeseeable emergency withdrawal requests on behalf of the Plan Sponsor, based on the standard for the review, qualification and processing of these withdrawals as provided in Appendix IV to Schedule A.

Paperless benefit payment processing – Unforeseeable Emergency withdrawals. (not available for paperless processing unless self-certification is elected above). This service allows participants to initiate benefit payment transactions (excluding annuity payments and death benefits) online through a secure website or through a toll-free customer service line and receive payment directly from the Contractor without completing benefit request paperwork. Paperless benefit payment service is not available if the plan requires spousal consent for In-service withdrawal transactions.

Plan Sponsor elects to utilize the Contractor’s paperless benefit payment processing service.

The Contractor will make a determination (approval and/or denial) within 5 business days of receipt of the request, and supporting documentation, in Good Order. If the request is approved, the request will be processed as of the date of favorable determination; with payment being mailed or made available electronically through ACH.

Permitted Frequency – Default is no restrictions on how often a participant may request an unforeseeable emergency or hardship withdrawal. If Plan provides for a restriction on frequency, it is to be noted below. Leave blank if no restriction.

One withdrawal request every ______ months.

20. Permissible In-Service Withdrawal Related Provisions Indicate who will be responsible for authorizing in-service withdrawals permitted under the Plan.

Select one of the following options:
the Contractor *
Authorized Plan Sponsor representative
Other (firm or individual’s name) ____________________________________________ *The Contractor’s ongoing review and processing of participant-initiated withdrawal or transfer requests, on behalf of the Plan Sponsor, shall be based on mutually acceptable procedures for the review and processing of these types of requests. Withdrawals or transfer requests are P a g e | 22
processed as of the date received in Good Order, with payment being mailed or made available electronically through ACH.

Paperless benefit payment processing – This service allows participants to initiate benefit payment transactions (excluding annuity payments and death benefits) online through a secure website or through a toll-free customer service line and receive payment directly from the Contractor without completing benefit request paperwork.

Plan Sponsor elects to utilize the Contractor’s paperless benefit payment processing service.

At the Plan Sponsor’s direction, participants who have had a request denied shall be given the opportunity to appeal to the Plan Sponsor for a review and final disposition of the determination.

Permitted Frequency – Default is no restrictions on how often a participant may request an in- service withdrawal. If Plan provides for a restriction on frequency, it is to be noted below.

Leave blank if no restriction.

One withdrawal request every ______ months.

21. Domestic Relations Order Administration
Indicate who will be responsible for reviewing and qualifying Domestic Relations Orders (DRO) under the Plan. Select one of the following options:
the Contractor *
Authorized Plan Sponsor representative
Other (firm or individual
name)___________________________________________________ *Ongoing review and processing of DROs on behalf of the Plan Sponsor, based on the standard for the review, qualification and processing of DROs as provided in Appendix V to Schedule A.

The Contractor will make a determination within 5 business days of receipt of a DRO in Good Order. If the request is approved, the request will be processed as of the date of favorable determination; with confirmation being provided.

If a DRO is not received in good order, the Contractor will work with the respective parties until the order is presented in Good Order.

NOTE: If a DRO received from a state agency is related to child support payments, the Contractor will 1) set up the alternate payee account AND 2) obtain sponsor authorization if required to process the check made payment to the alternate payee or if minor, to the custodial parent for the benefit of the minor child and mail directly to the state agency per instructions in the DRO. Additional distribution paperwork and/or action from the alternate payee are not required.

22. Benefit Payment Related Provisions
Indicate who will be responsible for authorizing participant-initiated benefit payment requests (including annuity payments, if permitted, and death benefits) under the Plan. Select one of the following options:
the Contractor*
Authorized Plan Sponsor representative
Other (firm or individual
name)______________________________________________________________ *The Contractor will provide ongoing review and processing of participant-initiated benefit payment requests (including annuity payments, if permitted, and death benefits) due to P a g e | 23
participant’s separation from service or death, on behalf of the Plan Sponsor, based on mutually acceptable procedures for the review, qualification and processing of these requests. The Plan Sponsor is responsible for providing the Contractor with any and all participant termination data in the mutually agreed upon electronic format, within a reasonable time period following the participant’s separation from service or death. In those individual circumstances where the Contractor does not have a beneficiary designation on file for the participant and where the Plan does not provide direction to make payment to the estate of the account holder, the Contractor will seek written direction from the Plan Sponsor as to who to make payment to pursuant to the Plan. The Contractor may not make the applicable benefit payment request transaction and/or paperwork available to the participant until the termination data is received from the Plan Sponsor in Good Order.

Plan Sponsor elects to utilize the Contractor’s paperless benefit payment processing service.

Benefit payment requests are processed as of the date received in Good Order; with payment being mailed or made available electronically through ACH. Accounts with administrative holds due to federal tax levies will not be distributed to the participant until such time that the federal tax levy is satisfied or as otherwise resolved. Once the participant has a triggering event, or requests a distribution, if evidence of payment of federal tax levy is not received, the Contractor will first make payment to satisfy the federal tax levy and then pay any remaining distribution amount to the participant.

At the Plan Sponsor’s direction, participants who have had a request denied shall be given the opportunity to appeal to the Plan Sponsor for a review and final disposition of the determination.

23. Access to counseling by licensed agents or representatives for Plan participants, who are retiring or otherwise requesting a benefit payment from the Plan, based on mutually acceptable standards.

24. Ongoing processing of Required Minimum Distributions (“RMD”) in accordance with Code Section 401(a)(9) for eligible Plan participants and their beneficiaries as described in this Section 24; provided, however, that such processing must comply with Code Section 401(a)(9) and the Treasury Regulations promulgated thereunder and, to the extent a conflict exists between the applicable law and regulations and this Section, the applicable law and regulations shall govern:
a. Based on the indicative age and employment status data in its files, with respect to each Plan, the Contractor shall timely notify participants who have attained their required beginning date or who are first eligible to receive RMDs (based on age and/or employment status) that an RMD is due and that an RMD calculation is available upon request. Subject to subsection (e) below, in the absence of an affirmative election or instructions received in Good Order from the participant on an annual basis for receiving the RMD, the Contractor is directed by the Plan Sponsor with respect to a 401(a) and/or 457(b) Plan to calculate and distribute the applicable RMD. With respect to a 403(b) Plan, the Contractor is directed by the Plan Sponsor to calculate the RMD amount but not distribute the RMD amount unless the participant requests such payment and the Contractor receives the distribution form in Good Order.
b. All distributions to Participants and beneficiaries shall be made in accordance with the requirements of Code Section 401(a)(9) and applicable regulations thereunder including the minimum distribution incidental benefit requirement. Under any P a g e | 24
method of payment selected by the Participant, distribution must be made over a period not extending beyond the life (or life expectancy) of the Participant. If a participant has reached RMD age and has separated from service with the Plan Sponsor, any distribution requested will first be reduced by the applicable RMD for the distribution calendar year. c. In the absence of an affirmative election or instructions received in Good Order from a Participant’s beneficiary or beneficiaries, as applicable, the Plan Sponsor directs the Contractor to calculate the RMD amount in accordance with Code Section 401(a)(9), for each of the 401(a), 403(b) and 457(b) plans (as applicable), provided the Contractor has received in Good Order proper notification of the participant’s death and complete beneficiary(ies) information (including, without limitation the complete name, and address and all required tax and other information of the beneficiary(ies)).
d. If a Participant dies on or after December 31, 2019 (or on or after December 31, 2021 for governmental plans and collectively-bargained plans), where the life expectancy rules are not available for the calculation of the RMD either because the Contractor has not received the requisite information by the date for issuing RMD payments or the beneficiary is not an “Eligible Designated Beneficiary” entitled to receive RMDs under the life expectancy rules under Code Section 401(a)(9), the Plan Sponsor directs the Contractor to apply the ten-year payout rule for each of the 401(a), 403(b) and 457(b) plans (as applicable) and force out a lump sum by December 31st of the tenth year following the year of the participant’s death to the individual beneficiary. If the Participant’s designated beneficiary is not an individual (i.e., an estate or in some cases, a trust) then the Plan Sponsor directs the Contractor to substitute the five-year payout rule for the ten-year payout rule.
e. The Plan Sponsor acknowledges that the Contractor shall not be responsible for any tax penalties or excise taxes the Plan Sponsor, Plan participants, or beneficiaries may incur as a result of the Contractor’s failure to calculate and distribute the RMD amount where the failure is due to the Plan Sponsor’s, the Plan participant’s or the beneficiaries’ failure to provide the required information to the Contractor in a timely manner.

25. Ongoing facilitation of communications between the Contractor, the Plan Sponsor and the Plan participants based on mutually acceptable guidelines.

26. Uncashed Distribution Checks
For non-ERISA plans, Voya makes an attempt to locate the payee of an uncashed check by sending several letters to the address of record. Payee’s who have checks outstanding for more than 180 days (i.e. uncashed), will receive a letter. The letter is sent to the same address as the check, and it is intended to remind the payee that they have a check outstanding. An additional letter is sent to the payee if the check remains uncashed past 365 days.

If a check remains outstanding for more than 365 days, the assets are identified as unclaimed property and Voya begins monitoring a dormancy period, as required by a state’s unclaimed property division. In addition to the 180 and 365 day letters, the Unclaimed Property team follows the state due diligence guidelines and performs required due diligence mailings (using the address the check was issued to) to attempt to resolve the uncashed check. The letters are typically sent 4 to 6 months prior to the escheatment of the property to a state’s unclaimed property division. If a check remains outstanding and reaches the dormancy period (as defined by a state), Voya escheats the assets to the state’s unclaimed property division, which is determined by the payee’s last known address.

P a g e | 24
P a g e | 25
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Appendix I to Schedule A:

Default Enrollment Services
This service allows the Plan Sponsor to adopt a default enrollment feature and to establish an electronic interface with the Contractor for acceptance of enrollment and contributions in the absence of a participant-initiated enrollment into the Plan.

Plan Sponsor acknowledges its responsibility for ensuring that a default enrollment complies with their state laws in regards to wage withholding. The payroll withholding laws of the Plan Sponsor’s state should be reviewed prior to election of this service to determine if deductions without an employee’s written consent is permitted.

The Plan Sponsor elects the Contractor’s Default Enrollment Service:
457(b) Plan
OBRA 3121 Plan
401(a) Plan
Plan Sponsor Responsibilities
The Plan Sponsor will be responsible for providing the Contractor with timely and accurate census information at least 2 business days prior to the submission of each payroll contribution to the Contractor. The Plan Sponsor will provide the Contractor with the following census information for any participant not previously enrolled in the Plan:
Social Security Number
Name
Address
Date of Birth
Date of Hire
This information will be provided to the Contractor in a mutually agreeable electronic format.

Default Investment Arrangement
The Plan Sponsor understands that it has the fiduciary responsibility to choose the appropriate “default” investment option, and therefore, may choose from any of the investment options available under the Plan.

OBRA 3121 Plan:

The Plan Sponsor has selected the Voya Fixed Plus Ill - 457/401 (Voya Fund No. 4300) as the “default” investment option.
401(a) Plan:

The Plan Sponsor has selected the Vanguard® Target Retirement Funds in Schedule E as the “default” investment option and understands that all contributions into these funds will be based on a Participant’s date of birth, not their anticipated retirement age as the investment is designed.

Plan participants will be allocated to the target date funds assuming the standard retirement age of

65. Plan Sponsor understands that all contributions will be invested in this investment option until such time that a participant makes allocation changes and/or fund transfers.

Enrollment Material Requirements
P a g e | 26
The Plan Sponsor understands and acknowledges that the Plan Sponsor is responsible for the distribution of enrollment materials to the employees identified as default enrolled into the Plan.

The Plan Sponsor will request enrollment materials from the Licensed Representative identified in Schedule N.

P a g e | 26
P a g e | 27
City Of San Mateo §457 Deferred Compensation Plan
Appendix II to Schedule A:

Contribution Rate Services
Contribution Rate Change Service:

This service allows participants to make contribution rate changes via the Contractor’s participant internet site or by speaking with a customer service representative of the Contractor. Please note it is your responsibility to notify the Contractor of terminated employees. Contribution rate changes in fractional percentages are supported after enrollment. This service supports the older worker catch-up contribution elections (if available under the Plan). No other types of catch-up or make- up contribution options available under the Plan are supported by the service.

Plan Sponsor acknowledges that it is responsible for ensuring that the Contribution Rate Change Service complies with their state laws in regards to wage withholding. The payroll withholding laws of the Plan Sponsor’s state should be reviewed prior to implementation of this program to determine if deductions, and/or contribution rate changes, without an employee’s written consent are permitted. The service includes increases, decreases, stops and restarts, either based on participant direction, or as directed by the Plan as a result of loans.

The Plan Sponsor elects to utilize the Contactor’s Contribution Rate Change service and participant Directed Contribution Rate Escalator service (described below) in accordance with the following criteria

Minimum and Maximum Deferral Contribution Method:

Pursuant to the Plan document, indicate the minimum and maximum contribution amount or rate a participant can elect. If you elect Dollar Amount or Both option, Your plan must allow for deferrals up to the maximum IRS limits.

NOTE: Dollar amount option not available independently if Plan has elected automatic enrollment or automatic rate escalator service.

Percentage-based
Employee elective deferral contributions Minimum 0% Maximum IRS Limit % Designated Roth contributions Minimum 0% Maximum IRS Limit % Other (describe) ___________________ Minimum ______% Maximum_________ % Dollar-based
Employee elective deferral contributions Minimum $0 Maximum $ IRS Limit Designated Roth contributions Minimum $0 Maximum $ IRS Limit Other (describe) ___________________ Minimum $______ Maximum $_________ Catch-up Contribution Method
Percentage-based Dollar-based Both N/A
Participant Directed Contribution Rate Escalator Service This service allows participants to elect automatic increases in deferral rates via the Contractor’s participant internet site or by speaking with a customer service representative of the Contractor.

Participant will indicate the frequency and amount of the contribution rate increase. The Contractor will send a reminder to the participant 30 days prior to the automatic increase.

Restrictions and Limitations:
This service is only available if the Plan Sponsor elects to utilize the Contractor’s Contribution Rate Change Service.
This service does not apply to catch-up contribution elections.

P a g e | 28
If there is a conflict between a participant’s Contribution Rate Escalator service and the contribution limits applicable to the Plan, the participant’s contribution rate escalator election will be cancelled.
The participant’s contribution rate escalator election will be cancelled if participant submits a contribution rate change election pursuant to the Contribution Rate Change Service above.

Important Note: Voya will not implement personal rate escalation schedules that existed with other vendors. If the plan intends to have a personal rate escalator, it must be affirmatively selected as an option in this Agreement.

P a g e | 28
P a g e | 29
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Appendix III to Schedule A:

Payroll Feedback File
Payroll Feedback File
If the Plan Sponsor has elected the Eligibility Tracking service, Automatic Enrollment service, the Contribution Rate Change service or offers loans, the Contractor will provide a periodic payroll feedback file through an automated process. It is the responsibility of the Plan Sponsor to update its payroll system based upon the data contained in the payroll feedback file in accordance with applicable Code requirements and regulations governing the effective date of deferral elections to the Plan.

The payroll feedback file is a .csv format file which can be uploaded to most payroll systems. As an alternative, a payroll feedback report in a .pdf format can be printed and used for manual entry into a payroll system.

Electronic File Delivery:

Please select one of the following delivery types (required):

Email: Contractor will send files in an encrypted format (access information will be provided).

Please provide one or more email addresses:

FTP (File Transfer Protocol): Contractor will send files via FTP. Please provide the FTP delivery address, ID and password:

FTP Delivery Address: ftp://
FTP ID:

FTP Password:

Sponsor Web/Archive: Plan Sponsor will obtain reporting data through the Contractor’s plan sponsor internet site.

The Contractor will send the periodic electronic payroll feedback file based on the information selected above until a change is provided, in writing, by the Plan Sponsor.

Reporting Frequency:

The Contractor will provide the automated contribution rate reporting data on the frequency that best meets the needs of the Plan Sponsor.

Notification of Report Availability:

The Plan Sponsor must identify an individual to receive notification of when the payroll feedback file is available. It is understood and acknowledged by the Plan Sponsor and Contractor that the individual designated below is responsible for accessing the file when notified of its availability.

Name: Erin Offield, Payroll Supervisor
Telephone: 650-522-7114
E-mail: [email protected]
Name: Eva Cheng, Payroll Technician
Telephone: 650-522-7109
E-mail: [email protected]
In the event that any identified individual is removed or replaced, the Plan Sponsor is responsible for notifying the Contractor immediately in writing.

P a g e | 30
P a g e | 30
P a g e | 31
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Appendix IV to Schedule A
Unforeseeable Emergency
Review and Approval Requirements
The Contractor is responsible for the ongoing review and processing of participant unforeseeable emergency withdrawal requests on behalf of the Plan Sponsor. The Contractor’s process is based on the following procedures for the review, qualification and processing of these withdrawals under the Plan. The Contractor will review the request to determine whether it satisfies the IRS and Plan requirements for an unforeseeable emergency.

To request an unforeseeable emergency, a participant must complete the relevant paperwork and provide the appropriate documentation to support the request.

Unforeseeable Emergency Approval Requirements
Specifically, an unforeseeable emergency means extraordinary and unforeseeable circumstances arising as a result of events beyond the control of the participant including:
severe financial hardship of the participant resulting from an illness or accident of a participant, the participant’s spouse or of a participant's dependent (as defined in Code Section 152(a))*; loss of the participant’s property due to casualty (including the need to rebuild a home following damage to a home not otherwise covered by homeowner’s insurance); or other similar extraordinary and unforeseeable circumstances arising as a result of events beyond the control of the participant.
*Effective in 2007, the Pension Protection Act of 2006 expanded this definition to include the participant’s designated primary beneficiary.

In its evaluation, The Contractor will limit the withdrawal to the amount reasonably necessary to satisfy the financial need, which may include any amounts necessary to pay Federal, state, or local income taxes or penalties reasonably anticipated to result from the distribution. In addition, a withdrawal shall be allowed only to the extent that such emergency is or may not be relieved through: 1) reimbursement or compensation from insurance or otherwise; 2) liquidation of the participant’s assets, to the extent the liquidation of such assets would not itself cause severe financial hardship; or 3) cessation of the participant’s deferrals under the Plan.

The determination of whether a request qualifies as an unforeseeable emergency will be based on all the facts and circumstances of the participant’s specific situation. While it is a subjective decision, the Contractor’s process incorporates three underlying principles: consistent application of the IRS rules to similar situations; decisions must be reasonable and not arbitrary; and when there is a close call, we err on the conservative side.

The Contractor takes this review process very seriously and understands the importance of consistently administering the IRS and Plan requirements. The Contractor recognizes that failure to do so, and thus treating the Plan like a savings account, can result in adverse tax consequences to the participant and to the Plan.

Withdrawal requests will be reviewed in a timely manner. For requests which are approved, the Contractor will process the withdrawal as of the date of the approval. A participant, who has had a withdrawal request denied because of insufficient documentation, can resubmit his or her request to the Contractor for re-review with all applicable documentation.

P a g e | 32
A participant whose request has been denied after submission of all relevant documentation has the opportunity to appeal the decision to the Plan Sponsor.

Appeals of Denied Requests
The Plan Sponsor is the final authority for review of any withdrawal requests which have been denied by the Contractor.

1. A participant desiring to appeal the Contractor’s decision must submit the appeal to the Plan Sponsor or its designee within 30 days of receipt of the denied request. The participant must document in a letter the reason he or she feels the request should be reevaluated and why the circumstances qualify as an unforeseeable emergency.

2. Appeals must include all documentation submitted with the original request to the Contractor; the Contractor’s determination letter and any additional supporting documentation not previously submitted.

3. The Plan Sponsor will review a participant’s request within 30 business days of the date of receipt of an appeal request.

4. In reviewing the original decision, the Plan Sponsor will review the specific facts and circumstances of the participant’s situation, the Contractor’s analysis and the applicable IRS and Plan requirements. The Plan Sponsor’s focus is on ensuring that the Contractor’s decision was made in accordance with all of the IRS and Plan guidelines, as summarized above. In its appeal review, the intent of the Plan Sponsor is not to be more lenient than the law requires as this would jeopardize the favorable tax treatment for the participant and the Plan.

5. The Plan Sponsor or its designee shall provide written notification to the participant, with a copy to the Contractor, as to whether its decision is to affirm the Contractor’s original decision to deny the request, or reverse that decision and approve the participant’s request.

6. The Plan Sponsor’s decision shall be binding on the participant, and he or she shall have no further ability to have the Plan Sponsor’s decision overturned.

P a g e | 32
P a g e | 33
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Appendix V to Schedule A
Domestic Relation Order
Review and Approval Requirements
The Contractor is responsible for the ongoing review and processing of Domestic Relations Orders (DRO) on behalf of the Plan Sponsor. The Contractor’s process is based on the following procedures for the review, qualification and processing of DROs which has been reviewed and approved by the Plan Sponsor. The Plan Sponsor acknowledges that the Contractor will perform this service in a ministerial capacity only and will not exercise any discretion in performing this service. The Contractor’s process if followed as specified below shall constitute a valid Plan Sponsor direction to process the DRO.

Definition of a Domestic Relations Order
A Domestic Relations Order ("DRO" or “Order”) is a court order, judgment, or decree issued under a state's domestic relations law that recognizes the right of a spouse, former spouse, child, or other dependent of a participant in an employee benefit plan to receive all or part of the participant's benefit in the plan.

A Qualified Domestic Relations Order ("QDRO") is a DRO that has met the specific requirements mandated by federal law and the provisions of the Plan as determined by the Plan Administrator or its designee. A QDRO requires a qualified plan to pay all or any part of a participant’s benefits to an alternate payee. An alternate payee is a spouse, former spouse, or dependent of the participant who is entitled to a portion of the participant’s benefits.

Requirements for QDRO
In order for a participant’s benefit to be assigned to an alternate payee (i.e., the spouse, former spouse, child or other dependent of the participant), a DRO that constitutes a QDRO within the meaning of the internal Revenue Code Section 414(p) must contain the required elements as outlined below as well as the Contractor’s Good Order requirements. In addition, certain state rules may be imposed on domestic relations orders by statute.

1. The Order must be an original or a court-certified copy of the original, signed by the judge or clerk of the court. A fax or a photocopy cannot be accepted as they are not in compliance with the Contractor’s Good Order standards.

2. The Order must create or recognize the existence of an alternate payee’s right to, or assigns to an alternate payee the right to, receive all or a portion of the benefits payable under the plan with respect to a participant.

3. The Order must constitute a judgment, decree or order (including approval of a property settlement agreement) that relates to provisions of child support, alimony payments or property rights to a spouse, former spouse, child or other dependent of a participant, made pursuant to a state domestic relations law (including a community property law).

4. The Order must clearly and unambiguously name each Plan to which the order applies.

The Order must reflect the full Plan name as stated within the Plan document.

5. The Order must provide the following participant information:
 Name (full legal name)
P a g e | 34
 Social Security Number 1
 Last known mailing address
 Date of Birth
1If state or local law prevents the inclusion of such information in the Order; this data must be provided to the Contractor in a letter and/or addendum, signed by the attorney that drafts the Order.

6. The Order must provide the following alternate payee1 information:
Name (full legal name)
Social Security Number 2
Last known mailing address
 Date of Birth
1If the alternate payee is a minor child, the name of the custodial parent is needed in the Order.
2If state or local law prevents the inclusion of such information in the Order; this data must be provided to the Contractor in a letter and/or addendum, signed by the attorney that drafts the Order.

7. The Order must include the exact dollar amount or percentage of the participant’s benefits to be paid by the Plan to each alternate.

8. If the participant has an outstanding and/or defaulted loan, the Order must indicate if the outstanding and/or loan balance should be used in determining the amount due.

9. The Order must specify the exact date or the payment period to which the Order applies (i.e., the determination or valuation date). Participant accounts are valued each business day the New York Stock Exchange is open.

10. The Order must clearly indicate if the dollar amount or percentage should be adjusted for any earnings (gains/losses) from the determination/valuation date to the date the assets are segregated, and if these should be segregated on behalf of the alternate payee.

11. The Order should clearly specify whether the participant’s vested or total account balance is to be used in determining the alternate payee’s portion he or she is entitled to.

Generally, the vested account balance is used for calculation purposes. Account values fluctuate with market conditions. The Contractor will verify whether there are sufficient funds available for segregation from the participant’s account in the amount of the court ordered award to the alternate payee(s). The Contractor will not be liable for any damage (actual or alleged) resulting from such actions. If the dollar amount specified is above the current balance, the Order may be rejected. Only vested benefits may be paid. If the participant is partially vested, and the award is for more than the presently vested amount, payment of the non-vested portion may not be made to the alternate payee until the participant has become vested in that amount.

12. If the Plan has non-core investment options (e.g., life insurance, self-directed brokerage account, certificate of deposit, etc.) the Order must not require that amounts be redeemed from non-core investment options. To the extent that amounts invested in the core investment options are not sufficient to satisfy the Order, the Contractor will not approve the Order until the participant has transferred from the non-core investment option into the core investment options the amount necessary to satisfy the Order.

13. The Order must provide that the calculation of the amount of the participant’s benefit to which the alternate payee is entitled to be readily calculable and according to records currently available to the Contractor. Pursuant to this requirement, the Contractor will not P a g e | 35
accept any Order that requires calculations prior to the time the Contractor began providing services to the Plan.

14. A plan may specify a date as of which QDROs are allowed under the Plan (such as Orders dated after a specified date, e.g., January 1, 2002). Court orders which pre-date the allowance of QDROs under the Plan may not be accepted. If no date is specified, the presumption is the Plan has always allowed QDROs.

15. The Order must not require the Plan to provide any type or form of benefit or any option, not otherwise provided under the Plan. Also, the Order cannot require payment to an alternate payee in the form of a qualified joint and survivor annuity in favor of the alternate payee and his or her spouse.

16. The Order must not require the Plan to provide increased benefits (determined on the basis of actuarial value).

17. The Order must not require any payment of benefits to an alternate payee that are required to be paid to another alternate payee under a previously issued QDRO.

18. The Order must not provide for tax treatment of the account other than as required under federal law and regulations. If the Order is for a minor, taxes will be withheld from the amount that is ultimately paid from the minor’s account unless the Order specifies otherwise.

19. The Order may state the segregated amount shall be distributed to the alternate payee, or the custodial parent for the benefit of a minor, if applicable, as soon as administratively feasible after the Contractor’s acceptance of the Order as a QDRO. The custodial parent for the minor will need to contact the Contractor at (800) 584-6001 to obtain a distribution form. The distribution can only be made payable to the custodial parent for the benefit of the minor. Taxes of 10% will be withheld from the minor’s distribution and the Form 1099- R will be reported to the participant.

NOTE: If this pertains to a Qualified Domestic Relations Order received from a state agency related to child support payments, the Contractor will 1) set up the alternate payee account AND 2) obtain sponsor authorization if required to process the check made payment to the alternate payee or if minor, to the custodial parent for the benefit of the minor child and mail directly to the state agency per instructions in the Order. Additional distribution paperwork and/or action from the alternate payee is not required.

If the Order meets all of the approval requirements listed above, it will be given effect and the Contractor will send notification of approval to the involved parties and their counsel.

If the order fails to meet one or more of the approval requirements listed above, it will be rejected.

A letter notifying the involved parties of the rejection will be mailed, together with an explanation.

Payments to the Alternate Payee
The alternate payee may receive an immediate or deferred payment in accordance with the distribution options provided under the Plan.

The alternate payee must complete and submit applicable disbursement paperwork for such distributions. Such paperwork is available by contacting a customer service associate.

P a g e | 35
P a g e | 36
City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule B: Loan Program
Terms of Contractor’s Loan Program (“Loan Program”):
Types of Loans Permitted – select all that apply.

General Purpose
Residential
Check here if participant loan payments will be allowed to defer for 12 months as a result of a Qualified Disaster (Participant can defer less than 12 months by calling Voya Contact Center). Note: Applicable to outstanding and new loans. Maximum number of loans that may be outstanding at any time. 1 General Purpose
1 Residential
1 Total (regardless of type of loan and assuming participant has no prior loan that has been deemed distributed, i.e. in default)
Permitted Frequency – Default is no restrictions on how often a participant may request a loan as long as the maximum number of loans is not exceeded. If Plan provides for a restriction on frequency, it is to be noted below. Leave blank if no restriction.

One General Purpose loan every ______ months.

One Residential loan every ______ months.
Minimum Loan Amount - Indicate the minimum loan amount pursuant to this Loan Program $1,000.
Maximum Loan Amount - the maximum amount of a loan made pursuant to this Loan Program shall be an amount which, when added to the outstanding balance of any other loans to the participant from the Plan and any other qualified plan of the Employer, does not exceed the lesser of:
(i) $50,000 reduced by the excess (if any) of
a) the highest outstanding balance of loans from the Plan to the participant during the one year period ending on the day before the date on which such loan is made, less
b) the outstanding balance of loans from the Plan to the participant on the date on which such loan was made, or
(ii) one-half (1/2) of the present value of the non-forfeitable accrued benefit of the participant under the Plan.
For purposes of this limit, all plans of the Employer shall be considered one plan, to the extent required by Section 72 of the Internal Revenue Code, and the balance of all loans under any plan of the Employer under which the individual participates must be aggregated in determining the maximum loan available from the Plan. The Employer will be responsible for confirming the accuracy of the loan amount available for participant and has an outstanding loan balance with an Employer sponsored plan that is not administered by the Contractor.
All assets under the participant’s Account with the Contractor will be considered in determining the maximum loan amount available.
Loan Initiation Fee shall be deducted from the participant’s total account balance before determining the maximum loan amount available.

P a g e | 37
Loan Interest Rate – the interest rate used for loans from your Plan must be commensurate with interest rates currently charged by persons in the business of lending money for loans which would be made under similar circumstances.

The Contractor will set the loan interest rate on the first business day of each calendar month following the month in which a change in the loan interest rate index occurs. Changes to the loan rate will be applicable to loans issued on or after the first business day of the month following the month in which the rate is changed. The index for establishing the loan interest rate for the Plan is as follows. Select one of the following options:

The Prime Interest Rate published in the Wall Street Journal on the last business day of each month.

Moody's Corporate Bond Yield Average – Monthly Average Corporates, as published by Moody's Investors Service, Inc. on the last business day of each month.

The following adjustment factor is to be added to the indexed interest rate for loans issued under the Plan. Select one of the following options.

No adjustment

0.5% (one-half percent)

1.0% (one percent)

1.5% (one and one-half percent)
2% (two percent)

2.5% (two and one-half percent)
Other (specify)* ______________________________________________ * Subject to the Contractor’s underwriting review and approval. Loan Repayment Frequency – A biweekly loan repayment frequency will be used to amortize the loan and calculate loan repayments. .
Loan Repayment Method – Select one of the following options.

Payroll deduction, subject to the Loan Repayment Following Separation from Service option shown below.

ACH debit to the participant’s bank account
Loan Repayment Following Separation from Service – Are participants that have separated from service permitted to continue loan repayments?
Yes – Plan Sponsor understands and agrees to the conditions noted below.

No
Conditions:

1. Must be permitted under the Plan document.

2. Plan Sponsor is responsible for providing the Contractor with any and all participant termination data in a mutually agreed upon electronic format.

3. Loan repayments for participants that have separated from service will be made via ACH Debit to the participant’s bank account.

4. Should the participant take a full distribution of his or her account balance, the outstanding loan will be automatically defaulted.
Prepayment - Prepayment of the full loan amount will be allowed at any time, without penalty.

Partial loan prepayments are not permitted.
Loan payoffs received by ACH or check, if applicable, are subject to a seven business day hold which may impact loan availability
Maximum loan repayment period – Internal Revenue Code section 72(p) requires a plan loan be repaid in full no later than 5 years from the date of the loan (except for a loan used to acquire a principal residence of the plan participant). Accordingly, it may be necessary to provide for a loan repayment term that is less than 60 months in order to meet the Code section 72(p) requirement (e.g., 57 or 58 months, etc.).

General Purpose 57 months (maximum of 57 months.)
Residential 360 months (maximum of 360 months.)
P a g e | 38
Investment of Loan Repayments - Loan repayments will be allocated in accordance with the participant’s current contribution investment allocation instructions on the date a loan repayment is received in good order.
Loan Default Restrictions - If the participant defaults on any loan under the Plan, the participant shall not be allowed to initiate another loan of that type under the Plan until the defaulted amount is repaid.
Loan Initiation Fee - The Contractor shall charge a one-time fee to the participant at the time of loan for services rendered under this Loan Program, in the amount of $100 per loan. Money Source Withdrawal Sequence
The withdrawal or liquidation sequence for money sources available to fund a loan from the 401(a) Plan is identified below. Note: Loan lien calculation based on all sources in Plan even if sources used for loan are limited.

Employee Mandatory Contribution
Fund Withdrawal Sequence – Money will be withdrawn from participant investment options on a pro-rata basis.
Spousal Consent – indicate if spousal consent is required for loans from the Plan Yes
No
Loan Authorization – indicate who will be responsible for authorizing loan disbursements.

Select one of the following options:
the Contractor, based on the loan provisions of the Internal Revenue Code Section 72(p), corresponding regulations and terms of the Loan Program as identified in this Schedule.

Authorized Plan Sponsor representative
Other firm or individual’s name)
______________________________________________________________ Paperless Loan Processing – This service allows Plan participants to initiate general purpose loans online through a secure website or through a toll-free customer service line and receive a check directly from the Contractor without completing loan request paperwork. The loan provisions (Promissory Note and Truth and Lending Disclosure) are included on the check remittance. By endorsing the check, the participant accepts the terms of the loan.

Paperless loan processing service is not available if the Plan requires additional qualifying criteria for loans (e.g., hardships or unforeseeable emergency) or if the Plan requires spousal consent for loan requests. This service is not available for residential loan requests.

Plan Sponsor elects to utilize the Contractor’s paperless loan processing service. Loan Default Monitoring – Where the Contractor is recordkeeping loans under the Plan, the Contractor will perform loan default monitoring as described herein. The loan default process will occur on the next to last business day of each month. This schedule allows us to effectively monitor and take action on loans that risk default. The Plan Sponsor agrees that the Plan document shall identify the Grace Period as the last business day of the calendar quarter following the calendar quarter in which the loan repayment was due. You also agree to have the Contractor actively monitor and alert participants of potential loan defaults and defaulted loans.
Loans extended under this Loan Program will be facilitated through a custodial agreement or trust agreement, as applicable, with Voya Institutional Trust Company.

Plan Sponsor Responsibilities:
Ensure the Plan document and any applicable state/local law allows for loans to be administered in accordance with the terms of this Loan Program.

P a g e | 39
The Plan Sponsor will inform the Contractor of the any change to the provisions of the Loan Program (and thus the criteria for approving loans under the Plan) as identified in this Schedule.
Establish payroll deduction of loan repayment amount for each participant with an approved loan.
Remit loan repayment amounts via the payroll submission tool being utilized by the Plan Sponsor on behalf of each active participant with an approved loan. The data provided is to include the loan identifier and repayment amount.
Notify the Contractor of any participant with an outstanding loan who begins a leave of absence, either bona fide (for a period of not more than one year) or due to uniformed service (military duty) and for whom suspension of loan repayments will apply. The data provided is to include the type of leave, the start date and the end date.

Contractor Responsibilities:
Process loans from a participant’s account in accordance with the terms of the Loan Program and the loan request package. The Contractor will rely on information provided by the Plan Sponsor or its designee to monitor regulatory limitations when issuing loans. The Contractor will not be responsible for any errors resulting from the failure of the Plan Sponsor or its designee to provide complete and accurate information.
Deduct the loan amount from the participant’s account based on the Money Source Withdrawal Sequence selected above, on a pro-rata basis across all current investment options within the participants account or such other method as agreed upon between Contractor and the participant.
Generate reports, including a Loan Amortization Report, to be made available to the Plan Sponsor through a secure website.
Furnish participants with quarterly account statements, reflecting loan activity since the prior statement date.
Provide the Plan Sponsor with the loan repayment amount for each participant loan as determined by the level amortization calculation applicable to the amount of the loan, the repayment frequency, and selected repayment period. Loan repayment amounts will be provided through an automated periodic payroll feedback file as described in Appendix III to Schedule A.

Loans can be re-amortized only upon written direction from the Plan Sponsor and only if there has been a change in the borrower’s payroll frequency or status. Outstanding loans cannot be refinanced.
Upon notice from Plan Sponsor that a participant with an outstanding loan is on a qualifying leave of absence, loan repayments may be suspended for the maximum period permitted under IRS rules. Currently, IRS rules permit loan repayments to be suspended in the following circumstances:
A participant on a bona fide leave may suspend payments for up to one year if the pay received by the participant during this period is less than the amount of the installment payments required under the terms of the loan. However, the loan must still be repaid by the end of the loan term (i.e., the period of suspension will be less than one year if the loan was within one year of the final payment due date when the leave began). A participant on a leave of absence due to performance of the uniformed services (as described under Internal Revenue Code Section 414(u)), may elect to suspend loan repayments for the period of uniformed service. In this situation, upon the participant’s return from uniformed service, the loan repayment period will be extended by a period equal to the length of the uniformed service.

P a g e | 40
On the last business day of the calendar quarter Contractor will default any loan in which the grace period expires that day. A confirmation statement will be sent to participants for whom a loan default is processed.
Compute and withhold federal and state income taxes, as required by law, for loan defaults or withdrawals from the Plan in order to repay outstanding loan amounts in full, in accordance with the Internal Revenue Code and applicable guidance. The Contractor will forward, within the applicable time limit, the appropriate information return reflecting the amount of the defaulted loan disbursement and taxes withheld to the appropriate taxing authority and to the participant.

P a g e | 40
P a g e | 41
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule C: Administrative Requirements
For purposes of this Schedule, all references to “participant” are intended to apply equally to all account holders under the Plan. This includes participants, beneficiaries and alternate payees.

1. Participant account statements and Plan Sponsor reports shall reflect accurate information with regard to contributions, allocations, earnings and withdrawals. Plan Sponsor agrees to review statements, IRS filings and other report or documents produced by the Contractor and to promptly identify in writing any errors or discrepancies. The Contractor agrees to correct any errors it is promptly notified of without charge. The Contractor will not have any additional liability for errors, unless due solely to its gross negligence.

2. Participant account statements include detail regarding all transactions since the prior statement date.

3. Under normal circumstances and unless otherwise authorized by the Plan Sponsor; participant statements shall be provided within 10 days of the end of a statement period. Where a participant has more than one Plan account subject to this Agreement, the account statement will reflect all Plan account balances, unless you direct the Contractor otherwise.

4. The Participant Quarterly Statements will be provided in English unless You select Spanish Quarterly Statements below.

Plan Sponsor/Trustee elects all Participant Quarterly Statements to be in Spanish.

Participants may elect to have their statements available in either Spanish or English by contacting Voya’s Customer Service Center.
5 Voya shall furnish eligible plan communications to participants in accordance with the requirements contained in the Department of Labor (DOL) Default Electronic Disclosure Final Rule. Those communications that cannot be provided electronically will be delivered in paper format via U.S. Postal Service. Except as otherwise provided by this Agreement, Voya will use its records to generate the following reports:
• Participant statements will be generated and posted online quarterly, accessible via the Participant Website.
• Participant activity confirmations for recurring and non-recurring transactions will be posted to the Participant Website.
• Participants with an email address on file will be mailed an Initial Paper Notice identifying the email address to be used for electronic delivery notification.

Participants can change their email address or opt out of electronic delivery by updating their preferences on the Participant Website or speaking with a customer service representative.
• Subsequently, these Participants will receive an electronic Notice of Internet Availability, indicating a plan communication is ready for viewing on Participant Website.
• If a Participant does not have an email address on file, or opts out of receiving communications electronically, then communications will be mailed to the participant’s address of record using the U.S. Postal Service.

6. Information on payout options, including a notice which satisfies the requirements of Internal Revenue Code Section 402(f), will be made available to participants through the internet or a P a g e | 42
toll free telephone number. Additionally, upon a terminated participant’s request, a licensed representative will provide to the participant education and assistance on the available payout options.

7. Contributions including loan repayments (if applicable) determined to be in Good Order on any day that the New York Stock Exchange is open (a "Business Day"), and prior to the close of the exchange, shall be applied to the appropriate account on that day's close of business of the New York Stock Exchange. Contributions received at any other time will be applied to the appropriate account on the next succeeding Business Day. Written confirmation of receipt and deposit will be provided to the Plan Sponsor or its designee by mail. The Contractor shall notify the Plan Sponsor or its designee by telephone within two business days of discovery of transactions received not in Good Order. If after 5 business days, transactions remain not in Good Order, the Contractor will require the Plan Sponsor to provide written consent for the Contractor to continue holding the amount of the contributions related to the not in Good Order transactions in a non-interest bearing suspense account. If after 14 business days, the transactions remain not in Good Order, the amount of the contributions received not in Good Order will be refunded to the Plan Sponsor.

8. A calendar year-end report shall be delivered to the Plan Sponsor, by March 31 st of the following year. The custom Plan Review book includes Plan-specific data on plan assets, participant counts and average balances, contribution and distribution activities, service utilization along with fund performance and Scorecard information. Industry benchmarking is available to help you compare your Plan to other comparable plans in the industry.

9. The Contractor will maintain appropriate records and documents for not less than six years from document creation. Upon reasonable prior notice, each party will make available to the other such records and documents relating to this Agreement as may be required for a Plan audit.

P a g e | 42
P a g e | 43

City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule D: Performance Standards*
Service Service Standard Measurement
Online Loans and
Distributions 99% same day
Received in good order prior to close of
NYSE must be processed same day
received.

Loans and
Distributions
(Forms in good
order)
99% two business
days
Received in good order prior to close of
NYSE must be processed within two
business days of received in good order
date.

QDRO Splits
99% of QDRO
transfers requests
received by the NYSE
close processed
within five business
days of receiving all
required supporting
documentation in
good order for a
qualified order. If the
account contains the
SDBA, the standard is
within seven business
days.

Voya will process 99% of QDRO transfers
requests received by the NYSE close
processed within five business days of
receiving all required supporting
documentation in good order. If the account
contains the SDBA, the standard is within
seven business days.

Release of
Participant Checks
/ ACH
98%
Five business days
from good order date
98% mailed within 5 business days from
good order date.

Online Fund
Transfers
99% processed same
day
Received in good order prior to close of
NYSE must be processed same day
received.

Online Enrollment
and Deferral
Changes
99% processed same
day
Received in good order prior to close of
NYSE must be processed same day
received.

Enrollment (Forms
in good order)
99% processed within
three business days
Received in good order prior to close of
NYSE must be processed with 3 business
days of received in good order date.

P a g e | 44
Service Service Standard Measurement
Electronic payroll
files (contributions
and loan
repayments in
good order with
funding)
99% processed within
two business days
Received in good order prior to close of
NYSE must be processed within two
business days of received in good order
date.

Rollover
Contributions
(Forms in good
order with funding)
99% processed within
two business days
Received in good order prior to close of
NYSE must be processed within two
business days of received in good order
date.

Participant
Statements (Mailed
/ Posted to Web)
99% 15 business
days
99% mailed / posted to the web within 15
business days following quarter end after
receiving all required supporting
requirements (if applicable) in good order.
1099-R 99% mailed by 01/31 99% mailed by January 31st each year.

Beneficiary
Designations
99% beneficiary
transfer transactions
within five business
days of receiving all
required supporting
documentation in
good order.

If the SDBA, the
standard is within
seven business days.

Voya will process 99% of beneficiary transfer
transactions received by the NYSE close
within five business days of receiving all
required supporting documentation in good
order. If the account contains the SDBA, the
standard is within seven business days.

Confirmations
98% mailed within
five business days
after processing.
98% mailed within five business days after
processing.

Valuation
Summary
100% by the 15th of
the month following
the close of the
quarter.

Ad Hoc Reports
100% within five
business days, most
within one day.
100% within five business days, most within
one day. For complex reporting requests, the
time frame will be mutually agreed upon
between the client and Voya.

Systems Availability
Voice Response
System (24/7)
99%
Participant and
Plan Sponsor
Website (24 hours
a day, 7 days a
week)
99%
Data Transmission 99%
Availability is calculated as a percentage of
time per quarter core inquiry and
transactional functions are available
excluding reserved maintenance windows
and scheduled applications update activities.

P a g e | 45
Accuracy
*Contractor measures performance against standards for all its defined contribution plan sponsors.

Contractor will furnish Plan Sponsor its results quarterly within 20 days after measuring performance but no later than the end of the month following each quarter-end (i.e., April 30, July 31, October 31, and January 30).
.

P a g e | 45
P a g e | 46
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule E: Plan Investment Options
The Contractor agrees to provide Plan participants with a selection of investment options as shown below. The Plan Sponsor acknowledges that it has chosen these investment options to be made available to participants under the Plan. The Plan Sponsor acknowledges receipt and has reviewed the prospectuses for each identified investment option.

Fund Number Fund Name Fund Legal
Structure
4300 Voya Fixed Plus Ill - 457/401* Annuity
898 Vanguard® Total Bond Market Index Fund -Admiral™ Shares Mutual Fund 3058 TCW MetWest Total Return Bond Fund - Plan Class Shares Mutual Fund 1296 Vanguard® Target Retirement 2020 Fund Mutual Fund
926 Vanguard® Target Retirement 2025 Fund Mutual Fund
1297 Vanguard® Target Retirement 2030 Fund Mutual Fund
793 Vanguard® Target Retirement 2035 Fund Mutual Fund
1298 Vanguard® Target Retirement 2040 Fund Mutual Fund
794 Vanguard® Target Retirement 2045 Fund Mutual Fund
1299 Vanguard® Target Retirement 2050 Fund Mutual Fund
2473 Vanguard® Target Retirement 2055 Fund Mutual Fund
3447 Vanguard® Target Retirement 2060 Fund Mutual Fund
8995 Vanguard® Target Retirement 2065 Fund Mutual Fund
F690 Vanguard® Target Retirement 2070 Fund Mutual Fund
795 Vanguard® Target Retirement Income Fund Mutual Fund 7027 American Funds American Balanced Fund® - Class R-6 Mutual Fund 2453 Parnassus Core Equity FundSM Inst Shares Mutual Fund 899 Vanguard® 500 Index Fund Admiral SharesTM Mutual Fund 7926 Vanguard® Equity Income Fund Admiral SharesTM Mutual Fund F837 Large Cap Growth Fund IV - Fee Class R1 CIT Mutual Fund 2469 T. Rowe Price All-Cap Opportunities Fund Mutual Fund 756 Vanguard® Mid-Cap Index Fund - Admiral™ Shares Mutual Fund 3593 Principal MidCap Fund - Institutional Class Mutual Fund 6912 MFS® Mid Cap Value Fund - Class R6 Mutual Fund
757 Vanguard® Small-Cap Index Fund - Admiral™ Shares Mutual Fund 6776 Franklin Small Cap Growth Fund - Class R6 Mutual Fund EO27 Small Cap Value Fund - Fee Class 11 CIT Mutual Fund 802 Vanguard® Real Estate Index Fund - Admiral™ Shares Mutual Fund 3669 MFS® International Intrinsic Value Fund - Class R6 Mutual Fund 9889 Vanguard® Total International Stock Index Fund Adm ™ Shares
Mutual Fund
2751 DFA International Small Company Portfolio - Inst Class Mutual Fund 1899 American Funds New Perspective Fund® - Class R-6 Mutual Fund *Only investment option available to City of San Mateo OBRA 3121 Social Security Replacement Plan.

Stability of Principal Disclosure
The Stability of Principal option, the Voya Fixed Plus Account III, is not a mutual fund or variable investment option, but is a fixed interest option offered through a group annuity contract issued by VRIAC. Guarantees are based on the claims paying ability of VRIAC.

P a g e | 47

The Voya Fixed Plus Account – III consists of a Guaranteed Minimum Interest Rate (“GMIR”) that is set for the life of the contract. The GMIR is stated in the Voya Fixed Plus Account – III contract.

Each calendar year (1/1 to 12/31), Voya will also set a one-year minimum guaranteed floor rate which will apply to all amounts held in the Voya Fixed Plus Account – III during that calendar year.

This one-year minimum guaranteed floor rate is guaranteed to never be less than the GMIR for the life of the contract.

During the year, Voya will credit interest to the Voya Fixed Plus Account – III at a “current credited interest rate”. The current credited interest rate may change but is guaranteed not to be below either the minimum guaranteed floor rate or the GMIR. Voya will not apply a decrease to the current rate following a rate change initiated solely by us prior to the last day of the three-month period measured from the first day of the month in which such change was effective. The current rate for a plan’s initial investment in the Voya Fixed Plus Account – III may be in effect for less than a full three-month period.

Voya will notify the Plan Sponsor of the calendar year minimum floor rate(s) through the December 31st Fund Performance report (the rates will be shown in the Additional Notes section following the performance tables). This report will be available in the first few days of January through the Sponsor Website in the Investment Information section. The Plan Sponsor may also obtain the rate(s) by contacting the Contractor’s Primary Contact identified in Schedule M in the latter part of December. The actual credited interest rate will be the greater of the declared interest rate, the calendar year minimum floor rate in effect and the GMIR. set forth in the group annuity contract.

Stability of Principal Restrictions
Participant Withdrawals
The Plan Sponsor is to choose from one of the following options relating to restrictions imposed when a participant requests a withdrawal from the Voya Fixed Plus Account III investment option.

Transfer and Withdrawal Limit
Equity Wash
Termination of Agreement
Upon your election to terminate this Agreement, the Plan assets invested in the Voya Fixed Plus Account III investment option on the effective date of the termination will be subject to “extended payout provision” rule as described in the group annuity contract.

Additional Information
For additional information on the Stability of Principal investment option available to the Plan, including all withdrawal rules and restrictions, please refer to the product disclosure booklet provided by VRIAC, or to the group annuity contract.

Plan Sponsor should consider the investment objectives, risks, and charges and expenses of the investment options carefully before choosing to make these options available to participants under the Plan. Fund prospectuses containing this and other information can be obtained by contacting your local representative. Please read the information carefully before signing this Agreement. You may also visit our website at www.voyaretirementplans.com/sponsor to view your Plan information on-line.

P a g e | 47
P a g e | 48
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule F: Investment Provider Minimum Standards Disclosure Statement The following items summarize the minimum administrative requirements required in order for the Contractor to transact with an investment provider on the Plan’s behalf:

1. Pricing Deadlines: The investment provider must furnish the Contractor with confirmed net asset value information as of the close of trading (generally 4:00 p.m., Eastern Time) on the New York Stock Exchange (“Close of Trading”) on each business day that the New York Stock Exchange is open for business (“Business Day”) or at such other time as the net asset value of the fund is calculated as disclosed in the relevant then current prospectus(es) in a format that includes (i) the fund’s name and the change from the last calculated net asset value, (ii) dividend and capital gains information as it arises, and (iii) in the case of a fixed income fund, the daily accrual or the distribution rate factor. Such information shall be provided to the Contractor by 6:30 p.m. Eastern Time. “Net” means after all management, service and administrative expenses are deducted.

2. Pricing Error Reimbursements: The investment provider shall agree to hold the Plan harmless for any amounts erroneously credited to participant accounts due to (i) an incorrect calculation of the fund’s daily net asset value (“NAV”), dividend rate, or capital gains distribution rate or (ii) incorrect or late reporting of the daily net asset value, dividend rate, or capital gains distribution rate of a fund, by reimbursing the Contractor, on the Plan’s behalf. In addition, the fund shall be liable to the Contractor for systems and out of pocket costs incurred by the Contractor in making the Plan’s or the participant’s account whole, if such costs or expenses are a result of the fund’s failure to provide timely or correct net asset values, dividend and capital gains or financial information and if such information is not corrected by 4:00 p.m.

Eastern Time of the next Business Day after releasing such incorrect information provided the incorrect NAV as well as the correct NAV for each day that the error occurred is provided. If a mistake is caused in supplying such information, which results in a reconciliation with incorrect information, the amount required to make a Plan’s or a participant’s account whole shall be borne by the investment provider providing the incorrect information, regardless of when the error is corrected.

3. Sales Literature: The investment provider will provide to the Contractor at least one complete copy of all prospectuses, statements of additional information, annual and semiannual reports and proxy statements, other related documents, and all amendments or supplements to any of the above documents that relate to the fund promptly after the filing of such document with the SEC or other regulatory authorities. The investment provider agrees to provide to the Contractor, in electronic format, performance updates and portfolio updates for the fund within 10 business days after the end of each calendar quarter.

4. Advertising: Advertising and literature with respect to the fund prepared by the Contractor for use in marketing shares of the fund to the Plan shall be submitted to the investment provider for review and approval before such material is used with the Plan. The investment provider shall advise the Contractor in writing within three (3) Business Days of receipt of such materials of its approval or disapproval of such materials.

5. Expense Reimbursement: The investment provider shall make available for reimbursement certain out-of-pocket expenses the Contractor incurs in connection with providing shareholder services to the Plan. These expenses include actual postage paid by the Contractor in connection with mailing updated prospectuses, supplements and financial reports to participants, and all costs incurred by the Contractor associated with proxies for the fund, P a g e | 49
including proxy preparation, group authorization letters, programming for tabulation and necessary materials (including postage).

6. Excessive Trading: The investment provider shall use its best efforts and shall reasonably cooperate with the Contractor to generally prevent any market timing and frequent trading activity under the Plan. See the Contractor’s “Excessive Trading” Policy, Schedule G.

P a g e | 49
P a g e | 50
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule G: Voya Financial® “Excessive Trading” Policy The Voya Financial® family of insurance companies (“Voya®”), as providers of multi-fund variable insurance and retirement products, has adopted this Excessive Trading Policy to respond to the demands of the various fund families which make their funds available through our variable insurance and retirement products to restrict excessive fund trading activity and to ensure compliance with Section 22c-2 of the Investment Company Act of 1940, as amended. Voya’s current definition of Excessive Trading and our policy with respect to such trading activity is as follows.

1.Voya actively monitors fund transfer and reallocation activity within its variable insurance and retirement products to identify Excessive Trading.

Voya currently defines Excessive Trading as:
a. More than one purchase and sale of the same fund (including money market funds) within a 60 calendar day period (hereinafter, a purchase and sale of the same fund is referred to as a “round-trip”). This means two or more round-trips involving the same fund within a 60 calendar day period would meet Voya’s definition of Excessive Trading; or
b. Six round-trips within a 12 month period.

The following transactions are excluded when determining whether trading activity is excessive:
a. Purchases or sales of shares related to non-fund transfers (for example, new purchase payments, withdrawals and loans);
b. Transfers associated with scheduled dollar cost averaging, scheduled rebalancing or scheduled asset allocation programs;
c. Purchases and sales of fund shares in the amount of $5,000 or less; d. Purchases and sales of funds that affirmatively permit short-term trading in their fund shares, and movement between such funds and a money market fund; and e. Transactions initiated by a member of the Voya family of insurance companies.

2.If Voya determines that an individual has made a purchase of a fund within 60 days of a prior round-trip involving the same fund, Voya will send them a letter warning that another sale of that same fund within 60 days of the beginning of the prior round-trip will be deemed to be Excessive Trading and result in a six month suspension of their ability to initiate fund transfers or reallocations through the Internet, facsimile, Voice Response Unit (VRU), telephone calls to Customer Service, or other electronic trading medium that Voya may make available from time to time (“Electronic Trading Privileges”). Likewise, if Voya determines that an individual has made five round-trips within a 12 month period, Voya will send them a letter warning that another purchase and sale of that same fund within 12 months of the initial purchase in the first round-trip in the prior twelve month period will be deemed to be Excessive Trading and result in a six month suspension of their Electronic Trading Privileges. According to the needs of the various business units, a copy of the warning letters may also be sent, as applicable, to the person(s) or entity authorized to initiate fund transfers or reallocations, the agent/registered representative or investment adviser for that individual. A copy of the warning letters and details of the individual’s trading activity may also be sent to the fund whose shares were involved in the trading activity.

3.If Voya determines that an individual has used one or more of its products to engage in Excessive Trading, Voya will send a second letter to the individual. This letter will state that the individual’s Electronic Trading Privileges have been suspended for a period of six months.

P a g e | 51
Consequently, all fund transfers or reallocations, not just those which involve the fund whose shares were involved in the Excessive Trading activity, will then have to be initiated by providing written instructions to Voya via regular U.S. mail. During the six month suspension period, electronic “inquiry only” privileges will be permitted where and when possible. A copy of the letter restricting future transfer and reallocation activity to regular U.S. mail and details of the individual’s trading activity may also be sent to the fund whose shares were involved in the Excessive Trading activity.

4.Following the six month suspension period during which no additional Excessive Trading is identified, Electronic Trading Privileges may again be restored. Voya will continue to monitor the fund transfer and reallocation activity, and any future Excessive Trading will result in an indefinite suspension of the Electronic Trading Privileges. Excessive Trading activity during the six month suspension period will also result in an indefinite suspension of the Electronic Trading Privileges.

5.Voya reserves the right to limit fund trading or reallocation privileges with respect to any individual, with or without prior notice, if Voya determines that the individual’s trading activity is disruptive, regardless of whether the individual’s trading activity falls within the definition of Excessive Trading set forth above. Also, Voya’s failure to send or an individual’s failure to receive any warning letter or other notice contemplated under this Policy will not prevent Voya from suspending that individual’s Electronic Trading Privileges or taking any other action provided for in this Policy.

6.Each fund available through Voya’s variable insurance and retirement products, either by prospectus or stated policy, has adopted or may adopt its own excessive/frequent trading policy. Voya reserves the right, without prior notice, to implement restrictions and/or block future purchases of a fund by an individual who the fund has identified as violating its excessive/frequent trading policy. All such restrictions and/or blocking of future fund purchases will be done in accordance with the directions Voya receives from the fund.

P a g e | 51
P a g e | 52
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule H: Additional Plan Services & Fees
Miscellaneous Plan Service Charges

1. Express mailing of termination, withdrawal and loan checks & related paperwork to participant (on exception basis only).
$50.00 per occurrence, to be assessed against the participant’s account.

EFT and ACH Credit are free of charge.

2. Stop payment.
$50.00 per occurrence, to be assessed against the participant’s account.

3. A loan initiation fee will apply to each Plan subject to this Agreement that permits loans.

The Contractor shall charge a one-time fee to the participant at the time of loan for services rendered.
$100 per loan, to be assessed against the participant’s account.

4. A self-directed brokerage account fee applicable to each Plan subject to this Agreement that has elected to use this optional service.
$50.00 annual fee per participant, to be assessed against the participant’s account.

5. Plan Document Amendments
If Plan Document Services are used, non-regulatory (or discretionary) amendments are available upon request for an additional fee of $200 per hour

6. Other Charges. (i) In addition to any other charges described herein, an additional charge will be incurred if we agree to provide other special services at your request. The charge will be based on our standard charge for such service or will be based on a formula for time spent to provide the service. You will be notified at the time of your request if an additional charge is applicable. (ii) If participant investment advisory services are selected, such services and associated fees will be set forth in separate agreements.

P a g e | 52
P a g e | 53

7. City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Appendix I to Schedule H
Fee Levelization Service
This optional service allows the Contractor to apply any revenue sharing generated by the plan’s mutual fund investment options to the individual participant’s whose account balances generated the revenue as a revenue credit. This credit may fully or partially offset the Plan’s recordkeeping fees. Contractor will receive its required revenue as described in Section 3.01 of this Agreement.

The Plan Sponsor elects to utilize the Contractor’s Fee Levelization Service (the “Service”) as described herein.

The revenue credit will be calculated monthly, on the 20th of the month (or the next business day if the 20th falls on a day the New York Stock Exchange is closed). It will be based on the average daily fund balance of the prior month, excluding the self-directed brokerage account funds, outstanding loan balances and the Voya Fixed Plus Ill - 457/401. Revenue basis points for all funds active on the first day of the month for which the revenue credit is being calculated will be used. Any revenue credit due to a participant will be allocated to their account on the same day as the revenue credit is calculated and invested prorata in accordance with their then current fund allocation instructions. Revenue credits will not be allocated to any self-directed brokerage account (SDBA) and or any outstanding loan balances, if available to the Plan.

A separate calculation will be performed for terminated participants who have a zero balance as of the end of the prior month as a result of a full withdrawal during the month. The credit will be calculated as described below. The monthly asset-based service fee will be calculated, and if the revenue credit is less than the asset- based service fee owed, no revenue credit or fee will be credited or debited from the account. If the revenue credit is greater than the monthly asset based fee, the net amount will be allocated to the participant’s accountFollowing the posting of the revenue credit to the participants account with a zero balance, a distribution will be processed on behalf of the participant, following the same distribution method as the original termination transaction. No additional processing fee, if applicable, will be charged to the participant account for the subsequent distribution processing of the revenue credit.

The Plan Sponsor agrees that:
The offering of this Service assumes that the plan’s investment menu does not contain any investment options which prohibit this type of arrangement. Contractor reserves the right to discontinue this Service should it be called into question, subject to scrutiny, or be deemed to be in violation of applicable law or regulation. Neither VRIAC or the Broker-Dealer, nor any of their affiliates, is acting as a fiduciary in connection with the Service.

P a g e | 53
P a g e | 54
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule I: General Compensation Provisions

1. Direct and Indirect Compensation:

This Schedule describes compensation received by the Contractor for services rendered to the Plan and Plan participants, including fees and revenue derived from both direct and indirect sources.

Direct Compensation includes compensation paid directly by Plan Sponsor or the Plan to the Contractor for plan recordkeeping and administrative services including certain transaction fees that are charged directly to participant accounts.

Indirect Compensation includes compensation from sources other than direct fees that the Contractor may collect from third parties, including revenue derived from service arrangements with mutual funds, revenue sharing and other indirect compensation that may be generated in servicing the Plan.

2. Assumptions:

As provided in Section 1 of the Agreement, the Contractor has agreed to perform certain services.

Based on the assumptions outlined in the Agreement, the Contractor agrees to supply the Services for the compensation specified in Section 3.01 of the Agreement, as supplemented by any additional compensation or transaction fees as specified within Schedule H. With respect to investment advisory services and/or Self Directed Brokerage Account, such fees shall be specified in a separately executed agreement(s).

3. Fund Specific Revenue:

Indirect compensation received by the Contractor represents revenue from investment companies based on the investment of assets held in the Plan pursuant to agreements between the applicable investment companies and the Contractor. They represent fees payable from such investment companies for shareholder services, sub-transfer agency services, or pursuant to a 12b-1 plan adopted by such investment companies.

In the case of investment options of VRIAC affiliates or former affiliates, Contractor compensation represents revenue assumptions made by the Contractor’s defined contribution business for purposes of product pricing. Gross revenues from such investment options generally include payments for investment management and for certain administrative services. Pricing assumptions are derived from gross fund revenues, less the internally transferred costs of fund management and administration. The pricing assumptions for certain investment options of VRIAC affiliates or former affiliates reflect the approximate weighted average of the net fund revenues of each portfolio within a given VRIAC fund complex.

In the case of the fixed income fund, the Contractor does not derive revenue at a fixed rate. As is the case with similar insurance company general account investment options, over the long-term we expect to earn a spread between the investment return on the underlying general account assets and amounts credited to contracts that utilize the Fixed Account. This spread is intended to cover our investment related expenses, a portion of product administration expenses that would otherwise be covered by explicit charges, and the risks associated with the minimum monthly, annual (if applicable), and lifetime interest rate guarantees, including those associated with asset defaults, as well as to provide a profit margin for the Contractor.

4. Changes in Investment Options:

To the extent the Contractor’s compensation is derived in whole or in part from revenue from the Plan Sponsor’s selection of certain investment products offered by or through the Contractor, the Contractor P a g e | 55
reserves the right to amend the Agreement, including this Schedule, in the event such revenue is reduced by a change in the investment products or options available under the Plan.

P a g e | 55
P a g e | 56
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule J: Reimbursement of Plan Expenses
Expense Account for Service Expenditures (“EASE Account”) The EASE Account is a funding source that can be directed towards the payment of allowable plan administrative expenses or allocated to participant accounts. The amount allocated to the EASE Account is directly attributable to excess fund revenue sharing amounts and administrative service fees in the amount of 0.045% of the assets of the Plan, but excluding any outstanding loan balances and assets in the Self Directed Brokerage Account. Please refer to your Expense Account for Service Expenditures Agreement for complete details regarding the administration of this optional account.

Changes to the amount allocated to the EASE Account may be made by (i) the Plan Sponsor by submission of such change to the Contractor on such form as Contractor may prescribe from time to time, or (ii) the Contractor by written notice to the Plan Sponsor.

P a g e | 56
P a g e | 57
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule K: VRIAC’s Policy for Correction of Inadvertent Processing Errors As your Plan’s administrative service provider, Voya Retirement Insurance and Annuity Company (“VRIAC”) has agreed to process transaction orders received in good order prior to market close from the plan and plan participants accurately and on a timely basis. We seek to avoid transaction processing errors to the greatest extent possible, but inadvertent errors do occur from time to time. Inadvertent processing errors are exclusively defined as incorrect or untimely processing by VRIAC employees of transactions that are received in good order. Inadvertent processing errors do not include errors made by plan sponsors or third parties.

VRIAC will correct any identified inadvertent processing error caused by VRIAC (a “VRIAC inadvertent processing error”) as soon as practicable, typically no later than five (5) business days after VRIAC has identified sufficient information to correct the error. VRIAC represents that in no event will VRIAC exercise discretionary authority or control over the correction of inadvertent processing errors in order to maximize gain or correct such error for VRIAC’s own benefit or interest.

Once a VRIAC inadvertent processing error has been identified, we promptly take corrective action to put the plan and its participants in a position financially equivalent to the position they would have been in if the processing error had not occurred. This means that VRIAC will make the plan whole for any loss to a plan resulting from correcting a VRIAC processing error. If any gain to a plan results in connection with a corrected transaction, VRIAC will keep that gain. The following examples illustrate the effect of the policy:
• When a plan participant directs that a certain dollar amount be contributed to his or her plan account, VRIAC credits the number of investment units that dollar amount will purchase to the participant’s account on Day 1, the day the contribution is processed.

The number of units is based on the unit’s dollar value on Day 1, as set by the investment fund and communicated to VRIAC after market close. If an inadvertent error occurs, and VRIAC does not process the contribution until Day 2, VRIAC will determine the number of units that should have been credited on Day 1, using Day 1’s unit price. If, on Day 2, the unit price has gone up, the dollar amount of the contribution will not be enough to cover the number of units the participant should have received. VRIAC will make up the difference such that the participant receives the number of units he or she would have received on Day 1 and VRIAC will absorb the loss. The participant is not charged for any additional cost.

However, if, on Day 2, the unit price has gone down, the amount of the contribution would purchase more units on Day 2 than it would have purchased on Day 1. In that circumstance, the participant will receive the number of units he or she would have received on Day 1 had the transaction been processed and VRIAC will keep the excess as part of its overall fee for services under the contract.

Regardless of whether there is a gain or a loss, the participant receives the benefit of what he or she requested.
• When a plan participant makes a withdrawal request of a certain dollar amount from his or her account, VRIAC liquidates or sells the number of investment units needed in order to make the distribution. Thus, on Day 1, VRIAC typically would sell or liquidate investment units in the participant’s investment fund at Day 1’s price to make the distribution. If, due to a VRIAC P a g e | 58
inadvertent processing Error, VRIAC processes the instructions a day late, VRIAC will make sure that the participant receives the dollar amount he/she requested. VRIAC will sell or liquidate the same number of units that would have been sold on Day 1 had the transaction been accomplished on Day 1. If the unit price has declined, liquidated units will have a lower value on Day 2 than they had on Day 1, which means that VRIAC must make up the difference so that the participant receives the requested amount in full. In doing so, VRIAC will incur a loss, which it absorbs. On the other hand, if the market has gone up and the units have increased in value, VRIAC will sell the same number of units as it would have sold on Day 1, but the sales amount will be higher than the requested withdrawal. VRIAC will keep the excess as part of its overall fee. In either circumstance, the participant receives the benefit of what he or she requested and bears no additional cost.

VRIAC tracks the net financial experience of VRIAC’s Correction Account and the effect of the corrections for each affected plan on an annual basis and will make that information available in accordance with ERISA Section 408(b)(2). Any gains kept by VRIAC constitutes additional compensation for the services provided by VRIAC under its contract and VRIAC will report it in accordance with ERISA Section 408(b)(2).

By executing an administrative services agreement with VRIAC, you are authorizing VRIAC’s application of the error correction policy as described above to your Plan in connection with the plan administrative services that VRIAC will provide. You have the right to terminate VRIAC’s services in accordance with the terms of the administrative services agreement.

P a g e | 58
P a g e | 59
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule L: Authorized Plan Sponsor Representative
The Contractor is hereby authorized to act upon the directions, instructions, and any information provided by any of the Authorized Plan Sponsor Representative(s) listed below. The following Authorized Plan Sponsor Representative(s) will be authorized to act on behalf of the Plan unless the Contractor is notified of a change in writing. The Contractor shall have no duty to inquire into the actual authority of such individuals listed below and Employer shall be responsible for communicating any changes to the Authorized Plan Sponsor Representative(s). In the event that an Authorized Plan Sponsor Representative(s) is removed or replaced, the Contractor must be notified immediately in writing. Please contact the Contractor's designated Plan Manager to request the applicable administrative form to complete.

1. Name (please type or print)
Jennifer Damian
Title
Sr. Human
Resources Analyst
Agency, Division or Location Name and Code (if applicable) Email: [email protected] Phone: 650-522-7268 `

2. Name (please type or print) Title
Agency, Division or Location Name and Code (if applicable) Email : Phone: Fax:

3. Name (please type or print) Title
Agency, Division or Location Name and Code (if applicable) Email: _______________ Phone: _______________________ Fax:

4. Name (please type or print) Title
Agency, Division or Location Name and Code (if applicable) Email: ______________________ Phone: __________________________ Fax:

P a g e | 59
P a g e | 60
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule M: Contractor’s Primary Contact
The Contractor designates the following individual(s) to serve as its primary point of contact to the Plan Sponsor with respect to this Agreement.

Bishop Bastien
Vice President – Strategic Relationship Management
Voya Retirement Insurance and Annuity Company
3017 Douglas Blvd, Suite 300
Roseville, CA 95661
Jon Zujko
Plan Manager
Voya Retirement Insurance and Annuity Company
One Orange Way
Windsor, CT 06095
P a g e | 60
P a g e | 61
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule N: Servicing Representatives
The Contractor and/or the Plan Sponsor designate the following individual(s) to serve as its representatives with respect to this Agreement. Representatives are designated as one of the following:

Agent, including Career Agent – Insurance licensed and Company appointed with Voya Retirement Insurance and Annuity Company, registered representative of Voya Financial Advisors, Inc. and receives commission based compensation.

Broker – (Non Voya FA Only) – Insurance licensed and Company appointed with Voya Retirement Insurance and Annuity Company, but affiliated with a broker-dealer other than Voya Financial Advisors, Inc. and receives commission based compensation.

Salaried Enroller – Voya Retirement Insurance and Annuity Company employees who will not receive commission based salary and are registered representatives of Voya Financial Advisors, Inc.

Agent Broker Salaried Enroller
Representative Name Peter Ng Last 4 Digits SSN 7482
Broker Dealer Affiliation Voya Financial Advisors, Inc
Office Code 147 Rep # 012 % Participation 100%
Agent Broker Salaried Enroller
Representative Name Last 4 Digits SSN
Broker Dealer Affiliation
Office Code Rep # % Participation (Loc. Code ___) Agent Broker Salaried Enroller
Representative Name Last 4 Digits SSN
Broker Dealer Affiliation
Office Code Rep # % Participation (Loc. Code ___) P a g e | 62
City Of San Mateo §457 Deferred Compensation Plan
City Of San Mateo OBRA 3121 Social Security Replacement Plan City Of San Mateo 401(a) Governmental Plan For Safety Management, Sworn Police Personnel & Firefighters Union Local 2400
Schedule O: Security Standards & VOYA Data Security Addendum This document contains the minimum information security standards relevant to the recordkeeping and related administrative services provided by Voya Institutional Plan Services, LLC and Voya Retirement Insurance and Annuity Company, (collectively, “Voya”) pursuant to its Administrative Services Agreement or Plan Services Agreement with you (“Agreement”). The standards may be revised from time to time and will become applicable as provided under the terms of your Agreement.

Minimum Information Security Standards
External SSO Access Standard –
Plan sponsors that have external benefit sites for their plan participants and currently have (or plan to implement) single sign-on (SSO) access to their Voya accounts must meet certain minimum security standards. These measures are required to safeguard the participant's account from potentially fraudulent activity.

The minimum security standard is the use of a secure username and password in combination with approved multi-factor authentication (MFA) methods for individuals accessing the Voya portal from an external network.

Such approved MFA methods must include the usage of one of the following:
(1) A one-time password (OTP) time-based security code delivered via SMS to a mobile device; (2) A software-based token using time-based one-time password algorithm (TOTP) or HMAC-based one-time password algorithm (HOTP) (e.g. Google Authenticator); (3) A hardware-based token implemented using the HMAC-based one-time password algorithm (HOTP) (e.g. Yubikey);
(4) Push authentication mechanisms (MSFT Authenticator or DUO); (5) Other more secure authentications that emerge over time (e.g. biometric authentication).

In addition to these minimum authentication standards for SSO access to their Voya accounts, Voya reserves the right to implement functionality requiring the plan participant who uses SSO access to register for Voya’s participant website, if they haven’t done so previously.

P a g e | 62
P a g e | 63
VOYA Data Security Addendum

1. Definitions.
“Affected Persons” means Client’s and its Affiliate’s former and current employees whose Personal Information (“PI”) may have been disclosed or compromised as a result of an Information Security Incident.
“Affiliates” means any entities that, now or in the future, control, are controlled by, or are under common control with Client. An entity will be deemed to control another entity if it has the power to direct or cause the direction of the management or policies of such entity, whether through ownership, voting securities, contract, or otherwise.
“Confidential Information” means (a) non-public information concerning the Disclosing Party, its affiliates, and their respective businesses, products, processes, and services, including technical, marketing, agent, customer, financial, personnel, and planning information; (b) PI; (c) trade secrets; and (d) any other information that is marked confidential or which, under the circumstances surrounding disclosure, the Non-Disclosing Party should know is treated as confidential by the Disclosing Party. Except with respect to PI, which will be treated as Confidential Information under all circumstances, Confidential Information will not include (A) information lawfully obtained or developed by the Non- Disclosing Party independently of the Disclosing Party’s Confidential Information and without breach of any obligation of confidentiality; or (B) information that enters the public domain without breach of any obligation of confidentiality.

All Confidential Information will remain the property of the Disclosing Party. “Information Security Incident” means any breach of security or cyber security incident impacting Voya that has a reasonable likelihood of (a) resulting in the loss or unauthorized access, use or disclosure of Client PI; (b) materially affecting the normal operation of Voya; or (c) preventing Voya from complying with all of the privacy and security requirements set forth in this Agreement.
“Law” means all U.S. and non-U.S. laws, ordinances, rules, regulations, declarations, decrees, directives, legislative enactments and governmental authority orders and subpoenas. “Personal Information (PI)” means any information or data that (a) identifies an individual, including by name, signature, address, telephone number or other unique identifier; (b) can be used to identify or authenticate an individual, including passwords, PINs, biometric data, unique identification numbers (e.g., Social Security numbers), answers to security questions or other personal identifiers; (c) is “non-public personal information” as defined in the Gramm-Leach-Bliley Act 15 U.S.C. § 6809(4) or “protected health information” as defined in 45 C.F.R. § 160.103; (d) is an account number or credit card number or debit card number, in combination with any required security code, access code, or password, that would permit access to an individual’s financial account; or (e) is “Personal Information” as defined in The California Consumer Privacy Act of 2018 (Cal. Civ. Code Division 3, Part 4, Title 1.81.5). “Services” means the services that Voya provides to Client pursuant to this Agreement. “Voya Personnel” means Voya’s employees and subcontractors engaged in the performance of Services.

2. Data Security.

2.1. Security Standards and Controls.

P a g e | 64
(a) Voya will establish and maintain:
(i) administrative, technical, and physical safeguards against the destruction, loss, or alteration of confidential Information; and
(ii) Appropriate security measures to protect Confidential Information, which measures meet or exceed the requirements of all applicable Laws relating to personal information security.
(b) In addition, Voya will implement and maintain the following information security controls:
(i) Privileged access rights will be restricted and controlled; (ii) An inventory of assets relevant to the lifecycle of information will be maintained;
(iii) Network security controls will include, at a minimum, firewall and intrusion prevention services;
(iv) Detection, prevention and recovery controls to protect against malware will be implemented;
(v) Information about technical vulnerabilities of Voya’s information systems will be obtained and evaluated in a timely fashion and appropriate measures taken to address the risk;
(vi) Detailed event logs recording user activities, exceptions, faults, access attempts, operating system logs, and information security events will be produced, retained and regularly reviewed as needed; and (vii) Development, testing and operational environments will be separated to reduce the risks of unauthorized access or changes to the operational environment.

2.2. Information Security Policies. Voya will implement and maintain written policies, standards or procedures that address the following areas:
(a) Information security;
(b) Data governance and classification;
(c) Access controls and identity management;
(d) Asset management;
(e) Business continuity and disaster recovery planning and resources; (f) Capacity and performance planning;
(g) Systems operations and availability concerns;
(h) Systems and network security;
(i) Systems and application development, quality assurance and change management; (j) Physical security and environmental controls;
(k) Customer data privacy;
(l) Patch management;
(m) Maintenance, monitoring and analysis of security audit logs; (n) Vendor and third party service provider management; and (o) Incident response, including clearly defined roles and decision making authority and a logging and monitoring framework to allow the isolation of an incident.

2.3. Subcontractors. Voya will implement and maintain policies and procedures to ensure the security of Confidential Information and related systems that are accessible to, or held by, third party service providers. Voya will not allow any third parties to access Voya’s systems or store or process sensitive data, unless such third parties have entered into written contracts with Voya that require, at a minimum, the following:
(a) The use of encryption to protect sensitive PI in transit, and the use of encryption or other mitigating controls to protect sensitive PI at rest; (b) Prompt notice to be provided in the event of a cyber security incident; (c) The ability of Voya or its agents to perform information security assessments; and (d) Representations and warranties concerning adequate information security.

P a g e | 65

2.4. Encryption Standards, Multifactor Authentication and Protection of Confidential Information. (a) Voya will implement and maintain cryptographic controls for the protection of Confidential Information, including the following:
(i) Use of an encryption standard equal to or better than the industry standards included in applicable National Institute for Standards and Technology Special Publications (or such higher encryption standard required by applicable Law) to protect Confidential Information at rest and in transit over un-trusted networks;
(ii) Use of cryptographic techniques to provide evidence of the occurrence or nonoccurrence of an event or action;
(iii) Use of cryptographic techniques to authenticate users and other system entities requesting access to or transacting with system users, entities and resources; and
(iv) Development and implementation of policies on the use, protection and lifetime of cryptographic keys through their entire lifecycle. (b) In addition to the controls described in clause (a) above, Voya will:
(i) Implement multi-factor authentication for all remote access to Voya’s networks; (ii) Ensure that no Client PI is (A) placed on unencrypted removable media, mobile devices, computing equipment or laptops or (B) stored outside the United States; and
(iii) Ensure that media containing Confidential Information is protected against unauthorized access, misuse or corruption during transport.

2.5. Information Security Roles and Responsibilities. Voya will employ personnel adequate to manage Voya’s information security risks and perform the core cyber security functions of identify, protect, detect, respond and recover. Voya will designate a qualified employee to serve as its Chief Information Security Officer (“CISO”) responsible for overseeing and implementing its information security program and enforcing its information security policies. Voya will define roles and responsibilities with respect to information security, including by identifying responsibilities for the protection of individual assets, for carrying out specific information security processes, and for information security risk management activities, including acceptance of residual risks. These responsibilities should be supplemented, where appropriate, with more detailed guidance for specific sites and information processing facilities.

2.6. Segregation of Duties. Voya must segregate duties and areas of responsibility in order to reduce opportunities for unauthorized modification or misuse of Voya’s assets and ensure that no single person can access, modify or use assets without authorization or detection. Controls should be designed to separate the initiation of an event from its authorization. If segregation is not reasonably possible, other controls such as monitoring of activities, audit trails and management supervision should be utilized. Development, testing, and operational environments should be separated to reduce the risks of unauthorized access or changes to the operational environment.

2.7. Information Security Awareness, Education and Training. Voya will provide regular information security education and training to all Voya Personnel, as relevant for their job function. In addition, Voya will provide mandatory training to information security personnel and require key information security personnel to stay abreast of changing cyber security threats and countermeasures.

2.8. Vulnerability Assessments. Voya will conduct monthly vulnerability assessments that meet the following criteria:
(a) All production servers and network devices must be scanned at least monthly; (b) All vulnerabilities must be rated;
(c) All vulnerability remediation must be prioritized based on risk; P a g e | 66
(d) All tools used for scanning must have signatures updated at least monthly with the latest vulnerability data; and,
(e) Voya will implement and maintain a formal process for tracking and resolving issues in a timely fashion.

2.9 Penetration Testing. If any Services to be provided by Voya include the hosting or support of one or more externally facing applications that can be used to access systems that store or process Client data, the terms of this Section will apply. (a) At least once every 12 months during the Term and prior to any major changes being moved into production, Voya will conduct a Valid Penetration Test (as defined below) on each internet facing application described above.

As used herein, a “Valid Penetration Test” means a series of tests performed by a team of certified professionals, which tests mimic real-world attack scenarios on the information system under test and include, without limitation, the following:
(i) Information-gathering steps and scanning for vulnerabilities; (ii) Manual testing of the system for logical flaws, configuration flaws, or programming flaws that impact the system’s ability to ensure the confidentiality, integrity, or availability of Client’s information assets; (iii) System-compromise steps;
(iv) Escalation-of-privilege steps; and
(v) Assignment of a rating for each issue based on the level of potential risk exposure to Client’s brand or information assets.
(b) Upon Client’s request, Voya will provide to Client an executive summary of any material issues or vulnerabilities identified by the most recent Valid Penetration Test along with the scope of systems tested. The report may be redacted to ensure confidentiality.

2.10 Physical and Environmental Security. Voya will ensure that all sites are physically secure, including the following:
(a) Sound perimeters with no gaps where a break-in could easily occur; (b) Exterior roof, walls and flooring of solid construction and all external doors suitable protected against unauthorized access with control mechanisms such as locks, bars, alarms, etc.;
(c) All doors and windows to operational areas locked when unattended; (d) Equipment protected from power failures and other disruptions caused by failures in supporting utilities;
(e) Closed-circuit television cameras at site entry/ exit points; badge readings at all site entry points, or other means to prevent unauthorized access; and (f) Visitor sign-in/ mandatory escort at site; and
(g) With respect to remote work environments, if the foregoing controls are not present, then Voya will use commercially reasonable efforts to mitigate any increased risk associated with such remote work environments, by, for example, limiting the types of access and functional roles eligible for a remote work environment, restricting access to a virtual private network (vpn) or virtual desktop infrastructure (vdi), providing formal guidance and standards for workspace security, and enhancing data protection controls such as data masking, logging and monitoring.

2.11 Information Security Incident Notification.
(a) In the event of any Information Security Incident, Voya will, at its sole expense promptly (and in any event within 72 hours after Voya confirms an Information Security Incident) report such Information Security Incident to Client by sending an email to Client Contact Information, summarizing in reasonable detail the effect on Client, if known, and designating a single point of contact at Voya who will be:
(i) Available to Client for information and assistance related to the Information Security P a g e | 67
Incident; investigate such Information Security Incident, perform a root cause analysis, develop a corrective action plan and take all necessary corrective actions; (ii) Mitigate, as expeditiously as possible, any harmful effect of such Information Security Incident and cooperate with Client in any reasonable and lawful efforts to prevent, mitigate, rectify and remediate the effects of the Information Security Incident;
(iii) Provide a written report to Client containing all information necessary for Client to determine compliance with all applicable laws, including the extent to which notification to affected persons or to government or regulatory authorities is required; and
(iv) Cooperate with Client in providing any filings, communications, notices, press releases or reports related to such Information Security Incident. (b) In addition to the other indemnification obligations of Voya set forth in this Agreement, Voya will indemnify, defend and hold harmless Client from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorneys’ fees, arising out of or relating to any Information Security Incident, which may include, without limitation:
(i) Expenses incurred to provide notice to Affected Persons and to law-enforcement agencies, regulatory bodies or other third parties as required to comply with law; (ii) Expenses related to any reasonably anticipated and commercially recognized consumer data breach mitigation efforts, including, but not limited to, costs associated with the offering of credit monitoring or a similar identify theft protection or mitigation product for a period of at least twelve (12) months or such longer time as is required by applicable laws or any other similar protective measures designed to mitigate any damages to the Affected Persons; and
(iv) Fines or penalties that Client pays to any governmental or regulatory authority under legal or regulatory order as a result of the Information Security Incident.

2.12. Risk Assessments. Upon Client’s request no more than once per year, Voya will complete an industry standard information security questionnaire and provide relevant Service Organization Control (“SOC”) audit reports, when available. Voya’s standard security requirements are set forth in Exhibit A. Voya represents and warrants that, as of the Effective Date, the statements in Exhibit A are true and correct in all material respects.

3. Privacy and PII

3.1. With respect to any PI, Voya will:
(a) Comply with the Voya Privacy Notice at www.voya.com/privacy-notice; (b) Retain, use, process and disclose all PI accessed, obtained or produced by Voya only to perform its obligations under this Agreement and as specifically permitted by this Agreement, or as otherwise instructed by Client, and not for any other purpose; (c) Refrain from selling such PI or using such PI for any other purpose, including for its own commercial benefit;
(d) Treat all PI as Confidential Information;
(e) Comply with the provisions of this Agreement to return, store or destroy the PI; and (f) Comply with all applicable Laws with respect to processing of PI.

Voya hereby certifies to Client that it understands the restrictions and obligations set forth above and will ensure that Voya and all Voya Personnel comply with the same.

3.2 As needed to comply with applicable Laws concerning the processing of PI or personal information security, or to the extent required by any changes in such Laws or the enactment of new Laws, the Parties agree to work cooperatively and in good faith to amend this Agreement in a mutually agreeable and timely manner, or to enter into further mutually agreeable agreements in an effort to comply with any such Laws applicable to the Parties. If the Parties cannot so agree, or if Voya cannot comply with the new or additional requirements, Client may terminate this Agreement upon written notice to Voya.

P a g e | 68

4. Confidential Information.

4.1. Confidential Information. Either Party (“Disclosing Party”) may disclose Confidential Information to the other Party (“Non-Disclosing Party”) in connection with this Agreement.

4.2. Use and Disclosure of Confidential Information. The Non-Disclosing Party agrees that it will disclose the Disclosing Party’s Confidential Information only to its employees, agents, consultants, and contractors who have a need to know and are bound by obligations of confidentiality no less restrictive than those contained in this Agreement. In addition, Voya agrees that it will use the Disclosing Party’s Confidential Information only for the purposes of performing its obligations under this Agreement. The Non-Disclosing Party will use all reasonable care in handling and securing the Disclosing Party’s Confidential Information and will employ all security measures used for its own proprietary information of similar nature. These confidentiality obligations will not restrict any disclosure of Confidential Information required by Law or by order of a court, regulatory authority or governmental agency; provided, that the Non-Disclosing Party will limit any such disclosure to the information actually required to be disclosed. Notwithstanding anything to the contrary, Client may fully comply with requests for information from regulators of Client and the Client Affiliates.

4.3. Treatment of Confidential Information Following Termination. Promptly following the termination or expiration of this Agreement, or earlier if requested by the Disclosing Party, the Non-Disclosing Party will return to the Disclosing Party any and all physical and electronic materials in the Non-Disclosing Party’s possession or control containing the Disclosing Party’s Confidential Information. The materials must be delivered via a secure method and upon such media as may be reasonably required by the Disclosing Party.

Alternatively, with the Disclosing Party’s prior written consent, the Non-Disclosing Party may permanently destroy or delete the Disclosing Party’s Confidential Information and, if requested, will promptly certify the destruction or deletion in writing to the Disclosing Party. Notwithstanding the foregoing, if the Non-Disclosing Party, due to requirements of applicable Law, must retain any of the Disclosing Party’s Confidential Information, or is unable to permanently destroy or delete the Disclosing Party’s Confidential Information as permitted above within 60 days after termination of this Agreement, the Non- Disclosing Party will so notify the Disclosing Party in writing, and the Parties will confirm any extended period needed for permanent destruction or deletion of the Disclosing Party’s Confidential Information. All Confidential Information in the Non-Disclosing Party’s possession or control will continue to be subject to the confidentiality provisions of this Agreement. The methods used to destroy and delete the Confidential Information must ensure that no Confidential Information remains readable and cannot be reconstructed so to be readable. Destruction and deletion must also comply with the following specific requirements:

MEDIUM DESTRUCTION METHOD
Hard copy Shredding, pulverizing, burning, or other
permanent destruction method
Electronic tangible media, such as
disks and tapes
Destruction or erasure of the media
Hard drive or similar storage device Storage frame metadata removal to hide the organizational structure that combines
disks into usable volumes and physical
destruction of the media with a Certificate
of Destruction (COD)
P a g e | 69

4.4 Period of Confidentiality. The restrictions on use, disclosure, and reproduction of Confidential Information set forth in this Section will, with respect to PI and Confidential Information that constitutes a “trade secret” (as that term is defined under applicable Law), be perpetual, and will, with respect to other Confidential Information, remain in full force and effect during the term of this Agreement and for three years following the termination or expiration of this Agreement.

4.5. Injunctive Relief. The Parties agree that the breach, or threatened breach, of any of the confidentiality provisions of this Agreement may cause irreparable harm without adequate remedy at law. Upon any such breach or threatened breach, the Disclosing Party will be entitled to injunctive relief to prevent the Non-Disclosing Party from commencing or continuing any action constituting such breach, without having to post a bond or other security and without having to prove the inadequacy of other available remedies. Nothing in this Section will limit any other remedy available to either Party.

5.Cyber Liability Insurance. During the Term, Voya will, at its own cost and expense, obtain and maintain in full force and effect, with financially sound and reputable insurers, cyber liability insurance to cover Voya’s obligations under this Addendum. Upon execution of the Agreement, Voya will provide Client with a certificate of insurance evidencing the following coverage and amount with such insurer:

Risk Covered: Network Security (a.k.a.

Cyber/IT) Limits: $50,000,000

6.Disaster Recovery and Business Continuity Plan. Voya maintains, and will continue to maintain throughout the Term, (a) a written disaster recovery plan (“Disaster Recovery Plan”), which Disaster Recovery Plan is designed to maintain Client’s access to services and prevent the unintended loss or destruction of Client data; and (b) a written business continuity plan (“BCP”) that permits Voya to recover from a disaster and continue providing services to customers, including Client, within the recovery time objectives set forth in the BCP. Upon Client’s reasonable request, Voya will provide Client with evidence of disaster recovery test date and result outcome.

Exhibit A
Security Requirements
FC: Foundation Controls
FC-1: Information Asset Management
FC-1.1 Voya implements and maintains an inventory list and assigns ownership for all computing assets including, but not limited to, hardware and software used in the accessing, storage, processing, or transmission of Client PI.

FC-1.2 Voya reviews and updates the inventory list of assets for correctness and completeness at least once every 12 months and updates the inventory list as changes are made to the computing assets.

FC-2: Data Privacy and Confidentiality
P a g e | 70
FC-2.1 Voya will maintain an Information and Risk Management policy that is reviewed and approved by management at least annually.

FC-2.2 Voya protects the privacy and confidentiality of all Client PI received, disclosed, created, or otherwise in Voya’s possession by complying with the following requirements:

FC-2.2A Such information is encrypted at rest on mobile devices (including mobile storage devices), portable computers, and in transit over un-trusted networks with an encryption standard equal to or better than Advanced Encryption Standard (AES) 256 bit encryption or such higher encryption standard required by applicable law.

FC-2.2B All hardcopy documents and removable media are physically protected from unauthorized disclosure by locking them in a lockable cabinet or safe when not in use and ensuring that appropriate shipping methods (tamper-proof packaging sent by special courier with signatures) are employed whenever the need to physically transport such documents and removable media arises.

FC-2.2C All media is labeled and securely stored in accordance with Voya policies.

FC-2.2D All electronic media is securely sanitized or destroyed when no longer required in accordance with industry standards.

FC-3: Configuration Management
FC-3.1 Voya implements and maintains accurate and complete configuration details (e.g., Infrastructure Build Standards) for all computing assets used in accessing, storing, processing, or transmitting Client PI.

FC-3.2 Voya reviews configuration details of the computing assets at least once every 12 months to validate that no unauthorized changes have been made to the assets.

FC-3.3 Voya updates the configuration details of all computing assets used to access, process, store, or transmit Client PI as configuration changes take place.

FC-4: Operating Procedures and Responsibilities
FC-4.1 Voya implements and maintains operational procedures for information processing facilities and designates specific roles or personnel responsible for managing and maintaining the quality and security of such facilities, including, but not limited to, formal handover of activity, status updates, operational problems, escalation procedures and reports on current responsibilities.

Voya IT policies and standards document the policies and procedures for job scheduling processes and tools.

FC-4.2 Voya updates the operational procedures as changes take place and performs a comprehensive review and update of the procedures at least once every 2 years.

FC-5: Security Awareness and Training
P a g e | 70
P a g e | 71
FC-5.1 Voya performs pre-employment background checks, including criminal history for 7 years, credit score and history (if applicable), credentials verification (if applicable), and educational background.

FC-5.2 Voya implements and maintains a documented security awareness program for all Voya Personnel which covers access to Client PI.

FC-5.3 Voya’s security awareness program includes security requirements, acceptable use of computing assets, legal responsibilities, and business controls, as well as training in the correct use of information processing facilities and physical security controls.

FC-5.4 Voya ensures that all Voya Personnel complete security awareness training prior to being provided access to Client PI and at least annually thereafter. Voya provides mandatory annual training programs that include security awareness training to all Personnel.

UA: User Access Controls
UA-1: User Access Controls
UA-1.1 Voya implements and maintains identity management system(s) and authentication process(es) for all systems that access, process, store, or transmit Client PI.

UA-1.2 Voya ensures that the following user access controls are in place:

UA-1.2A The “Least Privilege” concept is implemented ensuring no user has more privileges than they require in performing their assigned duties.

UA-1.2B Users requiring elevated privileges as a normal part of their job responsibilities have a regular, non-privileged account to perform regular business functions.

UA-1.2C All users have an individual account which cannot be shared UA-1.2D Account Names/IDs are constructed not to reveal the privilege level of the account or position of the account holder.

UA-1.2E System- or application-level service accounts are owned by a member of management or an IT system administration delegate and only have the privileges necessary to function as required by the application, system, or database for which the account has been created.

UA-1.2F Automated processes disable access upon 24 hours of termination and initiate manager review on employee position changes, in accordance with Voya policies.

UA-2: Access Control Management
UA-2.1 Voya maintains a comprehensive physical security program. Access to Voya facilities is restricted and logs are maintained for all access. Physical security and environmental controls are present in Voya buildings.

UA-2.2 Voya ensures that access to systems that access, process, store, or transmit Client PI is limited to only those personnel who have been specifically authorized to have access in accordance with the users’ assigned job responsibilities.

UA-2.3 Voya ensures that accounts for systems that access, process, store, or transmit Client PI are controlled in the following manner:

UA-2.3A Users must provide a unique ID and Password for access to systems. Access to applications/systems is limited to a need-to-know basis, and is enforced through role based access controls.

UA-2.3B Accounts are protected on computing assets by screen-savers that are configured with an inactivity time-out of not more than 15 minutes.

UA-2.3C Accounts are locked after no more than 5 consecutive failed logon attempts, depending upon the system and platform.

UA-2.3D Accounts remain locked until unlocked by an Administrator or through an approved and secure end-user self-service process.

P a g e | 71
P a g e | 72
UA-2.3E Accounts are reviewed on a periodic and regular basis to ensure that the account is still required, access is appropriate, and the account is assigned to the appropriate user.

UA2.4 Voya ensures that wireless mobile devices are secured against threats coming from these wireless networks and wireless connections are required to be encrypted.

UA-3: User Access Management
UA-3.1 Voya ensures that passwords for all accounts on systems that access, process, store, or transmit Client PI are configured and managed in accordance with industry standards:

UA-4: Information Access Restriction
UA-4.1 Voya implements information access restrictions on all systems used to access, process, store, or transmit Client Information.

UA-4.2 Voya ensures the following Information Access Restrictions are in place:

UA-4.2A Access to underlying operating systems and application features that the user does not require access to in the performance of their assigned responsibilities are strictly controlled.

UA-4.2B Access to source code and libraries are restricted to only those individuals who have been specifically approved to have access. A person who develops code changes cannot be the same person who migrates the code change into production.

UA-4.2C Access between Development, Test, and Production environments are strictly controlled.

The version management system provides segregation of code, data and environments.

UA-4.2D Temporary privileged access to production data is granted to authorized personnel based on job function for emergency support and only via access control and logging security tools.

PS: Platform Security Controls
PS-1: Computer System Security (Servers and Multi-user System sonly) PS-1.1 Voya implements and manages a formal process for ensuring that all computer systems that access, process, store, or transmit Client PI are protected and configured as follows prior to and while remaining in a production status:

PS-1.1A Systems are assigned to an asset owner within Voya's organization.

PS-1.1B Systems are located in a data center or similarly controlled environment with appropriate physical security mechanisms and environmental controls to ensure systems are protected from theft, vandalism, unplanned outages, or other intentional or unintentional hazards.

PS-1.1C All systems are configured to meet Voya standards, monitored to ensure a compliant state, and patched as required to maintain a high degree of security.

Issues found to be out of compliance are required to be tracked to closure.

PS-1.1D Systems are configured with commercially available and licensed anti-virus software which is set to perform active scans, perform scans of uploaded or downloaded data/files/web content, and is updated on at least on a daily basis.

PS-1.1E System clocks are configured to synchronize with a reputable time source (e.g., NTP).

PS-1.1F Systems display a warning banner to all individuals during the logon process that indicates only authorized users may access the system.

PS-1.1G Systems that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

P a g e | 72
P a g e | 73
PS-1.1H All high and medium vulnerability and risk issues identified are remediated utilizing a risk based approach and in alignment with application team code release schedules.

PS-1.1I Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor systems.

PS-2: Network Security
PS-2.1 To ensure systems accessing, processing, storing, or transmitting Client PI are protected from network related threats, Voya implements the following network security controls prior to connecting any network component to a production network and for the duration that the component remains in a production status.

PS-2.1A Networks are constructed using a defense-in-depth architecture, are terminated at a firewall where there are connections to external networks, and are routinely scanned for unapproved nodes and networks.

PS-2.1B Business-to-Business (B2B) and Third Party network connections (Trusted) to systems accessing, processing, storing, or transmitting Client PI are permitted only after a rigorous risk assessment and formal approval by Voya management.

Network connections from un- trusted sources to internal resources are not permitted at any time.

PS-2.1C Network components (switches, routers, load balancers, etc.) are located in a data center or a secure area or facility.

PS-2.1D Voya systems are configured to provide only essential capabilities and restrict the use of any unneeded functions, ports, protocols and services.

PS-2.1E Intrusion detection/prevention technologies, firewalls, and proxy technologies are implemented, monitored and managed to ensure only authorized and approved traffic is allowed within and between segments of the network.

PS-2.1F Internal Voya wireless networks are configured with the most robust security standards available, including but not limited to, 802.11i/n, strong authentication, IP/MAC address filtering, firewall protection, and intrusion detection/prevention.

PS-2.1G Wireless networks are not used to access Client Information unless the information is encrypted at either the file or transport level.

PS-2.1H Network components that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

PS-2.1I Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor network components.

PS-3: Generic Application and Database Security
PS-3.1 Voya implements and maintains an application security certification and assurance process that ensures that all applications that access, process, store, or transmit Client PI provide the following:

PS-3.1A Application and database design ensures security, accuracy, completeness, timeliness, and authentication/authorization of inputs, processing, and outputs.

PS-3.1B All data inputs are validated for invalid characters, out of range values, invalid command sequences, exceeding data limits, etc. prior to being accepted for production. Voya implements static source code analysis tools to validate data inputs.

PS-3.1C Application source code developed in house by Voya is protected through the use of a source code repository that ensures version and access control. The version management system provides segregation of code, data and environments.

P a g e | 73
P a g e | 74
PS-3.1D Applications and databases are tested for security robustness and corrective measures are applied prior to the application being placed into a production environment. All systems are configured to meet Voya standards, monitored to ensure compliance state, and patched as required to maintain a high degree of security.

PS-3.1E Applications and databases are implemented into a production environment with minimal privileges and critical configuration files and storage subsystems are protected from unauthorized access.

PS-3.1F Applications and databases that have been implemented into a production environment are routinely tested for vulnerabilities and risks using industry best practice tools and methods.

PS-3.1G Voya ensures that Consumer/Internet facing applications have been designed and implemented using multi-factor authentication architecture. Web sessions require the use of an HTTPS (encrypted) connection, as well as authorization to approved data and services.

PS-3.1H Voya ensures that only authorized and trained personnel have access to configure, manage, or monitor applications and databases.

PS-4: Workstation and Mobile Devices Security (End User Devices) PS-4.1 Voya ensures that the following security controls have been implemented and are maintained to protect Client PI accessed, processed, stored, or transmitted on workstations and mobile devices.

PS-4.1A Workstations are located in a physically secure environment with mechanisms in place to prevent unauthorized personnel from accessing data stored on the device, reconfiguring the BIOS or system components, or from booting the device from unauthorized media. Portable devices are configured for boot-up encryption.

PS-4.1B Laptops/portable computers and other mobile devices are assigned to an owner who is responsible for physically securing the device at all times, and the owner of the device must receive adequate awareness training on mobile device physical security.

PS-4.1C Portable devices are configured for boot-up encryption. All laptop hard drives are encrypted using AES 256. Any device deemed "remote" requires hard drive encryption.

PS-4.1D All workstations, laptops/portable computers and other mobile devices (where applicable) are configured with commercially available and licensed anti-virus software which is set to perform active scans, to perform scans of uploaded or downloaded data/files/web content, and is updated on at least a daily basis.

PS-4.1E All workstations, laptops/portable computers and other mobile devices (where applicable) are configured with a commercially available and licensed operating system, patched according to manufacturer’s recommendations, hardened according to best industry practices and standards and configured so that regular users do not have administrative privileges.

PS-4.1F Laptops/portable computers and other mobile devices (where applicable) are configured with personal firewall technology.

PS-4.1G Workstations, laptops/portable computers and other mobile devices (where applicable) display a warning banner to all individuals during the logon process that indicates that only authorized users may access the system or device.

PS-4.1H Voya implements and maintains processes for recovering laptops/portable computers and mobile devices from terminated Voya Personnel.

PS-5: Backup and Restore
PS-5.1 Voya implements and maintains backup and restore procedures to ensure that all Client PI received, disclosed, created, or otherwise in the possession of Voya is appropriately protected against loss.

P a g e | 74
P a g e | 75
PS-5.2 Voya ensures that backups are securely stored and storage systems are physically and logically protected.

PS-5.3 Voya implements a backup and availability schedule to meet business and regulatory requirements.

PS-6: Remote Network Access Controls
PS-6.1 Voya implements and maintains a remote network access control strategy or process.

PS-6.2 Voya ensures the following remote network access controls are in place:

PS-6.2A Users requiring remote access are appropriately authorized by Voya management.

PS-6.2B Remote access connections are established through the use of Virtual Private Networking (VPN) or secure VDI mechanisms that provide transmission security, encryption and connection timeout (e.g. split-tunneling disabled.) PS-6.2C Only Voya approved and controlled (managed) computing devices are used when remotely accessing (where applicable) Voya’s computing environments where Client PI is held. Any device deemed "remote" requires data encryption.

Encrypted communications are required for all remote connections.

PS-6.2D Users are thoroughly authenticated using multi-factor authentication prior to being provided remote access.

ITR: IT Resilience Controls
ITR-1: Architecture
ITR-1.1 Voya ensures that the architecture of computing environments where Client PI is accessed, processed, stored, or transmitted incorporates reasonable industry best practices for authentication/authorization, monitoring/management, network design, connectivity design, firewall and intrusion prevention technologies and storage and backup capabilities.

ITR-2: Hardware and Software Infrastructure Resilience
ITR-2.1 Voya ensures all hardware and software components classified with an availability rating of “critical” used in the accessing, processing, storage, or transmission of Client PI is:
Identified and cataloged
Supported by the manufacturer of the component (or if developed in- house, follows Voya’s SDLC Policy which includes quality/security) Applications and systems classified as A4 may be designed with high availability features and have no single point of failure Reviewed on a regular basis for capacity implications (at minimum once every 12 months)
ITR-2.2 Voya maintains Business Continuity Plans to address business unit and departmental actions to be undertaken before, during and after an incident or disaster. Voya’s Disaster Recovery Plan addresses the recovery and availability of systems and data.

ITR-3: Capacity Assurance
ITR-3.1 Voya ensures that computing environments used to access, process, store, or transmit Client PI are assessed for capacity and performance on a periodic basis (at minimum once every 12 months) and appropriate corrective actions are taken to make the environment sufficiently robust enough to perform its stated mission.

CM: Change Management Controls
CM-1: Change Management Process
CM-1.1 Voya implements and maintains a change control process to ensure that all changes to the environment where Client PI is accessed, processed, stored, or transmitted is strictly documented, assessed for impact, and approved by personnel authorized by Voya to provide approval for such changes, thoroughly tested, accepted by management, and tracked.

P a g e | 75
P a g e | 76
CM-1.2 Voya implements an emergency change control process to manage changes required in an emergency situation where a computing system is down or there are imminent threats/risks to critical systems involving Client PI.

CM-2: Separation of Environments
CM-2.1 Voya maintains physically and/or logically separate development, test, and production computing environments. Development, testing, and acceptance environments are separate from the production environment.

CM-2.2 Voya ensures that Client data used for development or testing purposes is completely depersonalized/desensitized of confidential values prior to entering a development or test environment. Data is depersonalized in non-production controlled environments for testing purposes with required approvals. PI elements are required to be depersonalized in non- production environments.

SM: Security Monitoring Controls
SM-1: Security Event Monitoring and Incident Management SM-1.1 Voya implements and maintains a security event monitoring process and associated mechanisms to ensure events on computing systems, networks, and applications that can impact the security level of that asset or the data residing therein are detected in as close to real-time as possible for those assets used to access, process, store, or transmit Client PI.

SM-1.2 Voya implements and maintains an incident management process to ensure that all events with a potential security impact are identified, investigated, contained, remediated, and reported to Client effectively and in a timely manner.

SM-1.3 Voya has implemented monitoring controls that provide real-time notifications of events related to loss of confidentiality, the integrity, or the availability of systems.

SM-1.4 Event logs (audit trails) are stored for analysis purposes for a minimum period of 3 years.

SM-2: Technical State Compliance
SM-2.1 Voya ensures computing environments that access, process, store, or transmit Client PII are continually in compliance with quality and security requirements including, but not limited to, authentication/authorization, monitoring/management, network design, connectivity design, firewall and intrusion prevention technologies, and storage and backup capabilities.

SM-2.2 Voya ensures IT Risk Management facilitates risk assessments of information technology processes and procedures in accordance with the annual IT Risk Assessment Plan approved by the IT/Privacy Risk Committee. Risk Assessment results are communicated to management for awareness and resolution or risk acceptance of findings based on management’s risk appetite.

SM-3: Security and Penetration Testing
SM-3.1 Voya implements and maintains vulnerability and penetration testing (Ethical Hacking) processes to ensure the computing environment where Client PII is accessed, processed, stored, or transmitted is continually protected from internal and external security threats.

SM-3.2 Voya implements and maintains a process for vulnerability scanning on at least a monthly basis and ensures issues are remediated, utilizing a risk based approach within a reasonable timeframe.

SM-3.3 Penetration testing (Ethical Hacking) of Internet facing systems or systems exposed to un- trusted networks is conducted prior to the system being deployed into a production status, after any significant changes, and then at least once every 12 months thereafter.

San Mateo City CouncilNovember 17, 2025

San Mateo City Council
November 17, 2025