Limitation of Liability and One-Year Claims Period

What it is

The agreement caps each party's total liability to the other at the net revenue Marqeta earned under the agreement in the 12 months preceding the triggering event, with enumerated exceptions including indemnification obligations, confidentiality breaches, and Customer misuse of PII or KYC data. All breach claims must be brought within one year of discovery of the breach.

Why it matters (compliance & governance perspective)

This provision establishes a contractual liability ceiling tied to Marqeta's revenue rather than Customer's potential losses, and imposes a one-year contractual limitations period on all breach claims regardless of form. For customers operating large-scale card programs, the net revenue cap may be substantially lower than the financial exposure created by a service failure or data breach.

Consumer impact (what this means for users)

Under this clause, Customer's maximum recoverable damages from Marqeta for any non-excluded claim are capped at Marqeta's net revenue from the prior 12 months, which may not reflect the scale of Customer's card program or losses. The agreement requires all breach claims to be initiated within one year of discovery, regardless of applicable statutory limitations periods.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: The contractual one-year limitations period may interact with state statutes that restrict or prohibit shortening of statutory limitations periods by contract. California courts have addressed contractual limitations clauses, and enforceability depends on whether the shortened period is reasonable and whether it applies to statutory claims. The FTC Act and CFPB-enforced consumer financial protection laws operate independently of contractual limitations periods for regulatory enforcement purposes. 2. GOVERNANCE EXPOSURE: High. The liability cap defined by reference to Marqeta's net revenue creates asymmetric exposure for large-volume customers whose financial losses from a service outage, data breach, or processing failure may significantly exceed 12 months of Marqeta's earned fees. The carve-out for payment and funding obligations ensures Marqeta's revenue collection rights are uncapped, while Customer's recovery rights are capped. 3. JURISDICTION FLAGS: California governs, but the enforceability of contractual limitations periods varies by claim type. Statutory claims under California consumer protection law or federal financial regulation may not be subject to contractual shortening. Legal teams in EU or UK jurisdictions should assess whether local law permits such caps for data breach or regulatory failure scenarios. 4. CONTRACT AND VENDOR IMPLICATIONS: The net revenue cap structure should be evaluated against Customer's risk exposure modeling for card program operations. If Customer's program processes high transaction volumes, a 12-month net revenue figure may represent a small fraction of Customer's potential downside. Cyber insurance and operational risk insurance should be reviewed to determine whether they provide coverage above the contractual recovery ceiling. 5. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the one-year discovery-based limitations period is enforceable under California law for all claim types asserted under this agreement, particularly for latent data security breaches where discovery may be delayed. Contract review should confirm whether the Excluded Claims carve-outs adequately protect Customer's highest-risk exposure scenarios, including unauthorized access to Cardholder Data and Transaction Data.

Applicable agencies

Provision details

Other risks in this policy

• Customer Bears All Card Loss Risk high
• Customer Indemnifies Marqeta and Issuer Broadly high
• Customer Pays All Fees Through Remainder of Term high
• Customer Prohibited from Exporting Services Without License high
• Disclaimer of Implied Warranties high
• Exclusion of Consequential and Punitive Damages high