AMENDMENT Number 2 TO

Exhibit 10.40

AMENDMENT

Number 2

TO

THE MASTER AGREEMENT

BETWEEN

CITIBANK, N.A.

AND

TRX DATA SERVICES INC.

The Master Services Agreement (the “Agreement”), effective as of February 1, 2002, by and between Citibank, N.A. (“Citi”) and TRX Data Services, Inc. (“Provider”), in consideration of the mutual promises of the parties is hereby amended as follows:

1. The following shall be added as a new Subsections G and H to Section 11 “Compliance with Citi Policies and Procedures”:

G. Diversity Initiative. Provider acknowledges that Citi has implemented a Supplier Diversity Program which, among other initiatives, encourages the use of minority and women-owned businesses (“Diverse Suppliers”) as suppliers and subcontractors to the fullest possible extent consistent with the efficient performance of its business strategies. To assist Citi in complying with these goals, Provider will (at no additional cost to Citi) report to Citi within fifteen (15) days of the last day of each calendar quarter, the dollar amount spent by Provider in connection with this Agreement with any Diverse Suppliers which are involved in the provision of the goods and services under this Agreement. These reports shall be forwarded to the attention of the Citigroup Supplier Diversity Program, 333 West 34th Street, New York, NY 10001, attention Director Supplier Diversity Program. All such reports shall be kept and treated by Citi in accordance with Citi’s confidentiality obligations herein. Provider further acknowledges that Citi prefers, when contracting with suppliers that are not directly Diverse Suppliers, to contract with suppliers who can substantiate that a minimum of ten percent (10%) of the subcontractors or suppliers that they utilize in providing their products or services to Citi are Diverse Suppliers.

H. Equipment and Network Security. If access to Citi’s or an Affiliate’s computer systems, other equipment or personal property (“Citi’s Systems”) is required in order for Provider to fulfill its obligations to Citi, then Citi shall determine the nature and extent of such access. If Citi or an Affiliate provides Provider with remote access to Citi’s Systems, then any and all information relating to such remote access shall be considered Citi’s Confidential Information and shall be subject to the obligations of confidentiality set forth in Section 8 of the Agreement. In addition, any and all access to Citi’s Systems shall be subject to the following.

2. The following shall be added at the end of Section 20 “Audit”:

Licensor shall be required to perform a SAS 70 Audit and provide the results to Citi consistent with the terms of this Section 20. All expenses related to such audit shall be paid by Citi. Provider agrees that the results of such audit shall not be shared with any of Provider’s customers. Upon Citi’s request, Provider will provide a completed audited statement of the financial condition of Provider’s organization, including (i) audited year-end results for the three (3) previous years, including revenues, expenses, net income, total assets, liabilities and footnotes; and (ii) the most recent financial interim statement.

3. Section 13 B “Export” shall be deleted in its entirety and replaced with the following:

B. Export Controls. Without limiting the generality of Section 20.1, Provider specifically agrees to comply, and will cause its Personnel to comply, with the requirements of all applicable export laws and regulations, including but not limited to the U.S. Export Administration Regulations. Unless authorized by U.S. regulation or Export License, Provider will not export or reexport, directly or indirectly, any software or technology received from Citi, or allow the direct product thereof to be exported or reexported, directly or indirectly, to (a) any country in Country Group E:2 of the Export Administration Regulations of the Department of Commerce (see http://www.bxa.doc.gov) or any other country subject to sanctions administered by the Office of Foreign Assets Control (see http://www.treas.gov/ofac/); or (b) any non-civil (i.e. military) end-users or for any non-civil end-uses in any country in Country Group D:1 of the Export Administration Regulations, as revised from time to time. Provider understands that countries other than the U.S. may restrict the import or use of strong encryption products and may restrict exports, and Provider agrees that it shall be solely responsible for compliance with any such import or use restriction. If requested by Citi, Provider shall cause its Personnel to execute and return to Citi the appropriate form of Assurance of Compliance set forth as Appendix A, either A-1 or A-2. (Attached)

4. The following shall be added as a new Subsection C to Section 13 “Compliance with Laws”.

C. Insider Trading and Tipping Notice. The Provider acknowledges that the federal securities laws, other applicable local laws, and the Citi’s policies and procedures prohibit any person or entity that has received from the Citi material, nonpublic information about a company, from purchasing or selling securities of that company or from communicating such information to any other person or entity that may sell or purchase such securities

2

5. Section 10 “Insurance” shall be deleted in its entirety and replaced with the following:

INSURANCE REQUIREMENTS

A. Required Coverage. During the term of this Agreement and for so long as any Work Order has not yet been completed or terminated, Provider will maintain, at its own expense, insurance coverage with limits of no less than those set forth below, and with insurers with a minimum A.M. Best Financial Strength rating of “A- (Excellent)” and Financial Size rating of “X”, or equivalent ratings from other valid rating agencies and under forms of policies satisfactory to Citi.

B. Certificates of Insurance. Provider will deliver Certificates of Insurance to Citi prior to the execution of the Master Agreement. Said certificate shall indicate that policies providing coverage and limits of insurance are in full force and effect. Each Certificate shall provide that no less than thirty (30) days notice will be given in writing to Citi prior to cancellation, termination, or material alteration of any one of the policies. At least ten (10) days before the expiration of an insurance policy required hereunder, Provider will deliver to Citi a certificate of insurance attesting to the renewal of such insurance. In addition, each policy required pursuant to Subsections A(3), A(4), A(5) (Employers Liability only) and A(6) shall name Citi, Affiliates and assignees (suggest other parties if necessary) as additional insureds. Each policy required pursuant to Subsection A(2) shall name Citi, Affiliates and assignees as loss

[*] - Confidental Treatment Requested

3

payees. Citi’s acceptance of delivery of a Certificate of Insurance that does not conform to the requirements of this Section shall not relieve Provider of its obligation to provide insurance conforming to the requirements hereof.

C. No Limitation. The requirements set forth above as to types, limits and approval of insurance coverage to be maintained by Provider will not in any manner limit the liabilities and obligations assumed by Provider under this Agreement.

6. The parties agree that upon execution of this Amendment #2, they will take steps to consolidate all existing Amendments and Exhibits to the Master Agreement into one Amended and Restated Master Agreement, which accurately reflects the terms and conditions of such Amendments and Exhibits.

All other provisions of the Agreement remain unchanged and in full effect.

UNDERSTOOD AND AGREED:

4

APPENDIX A-1

ASSURANCE OF COMPLIANCE

WITH EXPORT LAW AND REGULATIONS

(PROVIDER’S PERSONNEL, US RESIDENT)

I hereby certify that, unless the permission of the U.S. Departments of Commerce, Treasury, or State, as applicable, is obtained, either in writing or in accordance with applicable regulations; I will not export, reexport or otherwise disclose, directly or indirectly, any proprietary software or technical data received from Citi, Citigroup or any of its direct or indirect subsidiaries or affiliates (collectively, “Citigroup”), or the direct product of any such software or technical data, to any of the following nations or nationals thereof:

I agree to be bound by any future modifications of the foregoing list of restricted destinations by amendments to the U.S. Export Administration Regulations or other U.S. Government agencies.

I understand that prior approval of the U.S. Department of Commerce or other appropriate agencies can be provided by regulations authorizing certain exports or by licenses or other authorizations obtained after prior application to the agency.

Additionally, I understand that countries other than the U.S. may restrict exports and may also restrict the import or use of strong encryption products and agree that we shall be solely responsible for compliance with any such export, import or use restrictions.

Further, I understand that failure to comply with the U.S. export regulations exposes Citigroup (and individuals providing services to Citigroup) to severe criminal and administrative penalties and sanctions, as well as adverse publicity, and that violation of this Assurance can result in the termination of my service assignment.

5

APPENDIX A-2

ASSURANCE OF COMPLIANCE

WITH EXPORT LAW AND REGULATIONS

(PROVIDER’S PERSONNEL, FOREIGN NATIONAL)

[DATE]

[Business]

[Street Address]

[City, State, Zip]

[Attn: Export Licensing Coordinator]

Re: No Reexport of Controlled Technical Data or Software

To whom it may concern:

During my engagement with any direct or indirect subsidiary or affiliate of Citigroup (collectively “Citigroup”), I may have access to proprietary technical data and computer software. As a foreign national (non-U.S. citizen without U.S. permanent residency status), I understand that this access constitutes an export of technical data/software from the United States and is therefore governed by the provisions of the U.S. Export Administration Regulations (“EAR”).

Consequently, I agree to comply with U.S. Export Administration Regulations as they pertain to any technical data or computer software to which I have access. I hereby certify that, unless prior written authorization is received from the U.S. Department of Commerce or other appropriate agencies, I shall not knowingly reexport, directly or indirectly, this technical data/computer software without full compliance with U.S. export control laws, and in particular I will not export it to any of the following nations or nationals thereof:

I agree to be bound by any future modifications of the foregoing list of restricted destinations by amendments to the U.S. Export Administration Regulations or other U.S. Government agencies.

I also agree that, without the prior approval of the U.S. Department of Commerce or other appropriate agencies, I shall not knowingly export to any of the above nations, directly or indirectly, any product (or any part thereof), process or service which is the direct product of this technical data/computer software.

I understand that prior approval of the U.S. Department of Commerce or other appropriate agencies can be provided by regulations authorizing certain exports or by licenses or other authorizations obtained after prior application to the agency, and that prior regulatory approvals are more likely to be available for exports to the second group of countries.

6

Additionally, I understand that countries other than the U.S. may restrict the import or use of strong encryption products and export of any products, and I agree that I will accept responsibility for compliance with any such restrictions.

I certify that I understand that this assurance I am providing is a condition to my having access to such data or software and applies in addition to any commercial nondisclosure agreements to which I am now or may be a party. Failure to comply exposes Citigroup (and individuals providing services to Citigroup) to severe criminal and administrative penalties and sanctions, as well as adverse publicity. Additional personal liability can result, including disciplinary action up to and including termination and/or problems under U.S. immigration laws.

7