Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the export control and sanctions compliance obligations arising from the Channel Reseller Program Agreement (the "Agreement"), execution version dated March 22, 2024, between Lumos Analytics Inc. ("Lumos"), a Delaware C-Corporation headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, California 94304, and Meridian Data Solutions GmbH ("Meridian")

II. Scope of Engagement and Background A. Engagement Context Calderwood & Harkness LLP was engaged by Lumos Analytics Inc. on January 30, 2024, pursuant to an engagement letter signed on the same date, to negotiate and draft the Channel Reseller Program Agreement and all ancillary documents relating to Lumos's engagement of Meridian Data Solutions GmbH as a non-exclusive reseller of the Lumos Prism™ platform in the E

1. Meridian Data Solutions UK Ltd ("Meridian UK"), a company registered in England and Wales under Companies House number 12847391, with its registered office at 14 Fenchurch Place, London EC3M 5AJ. The sole director of Meridian UK is Katarina Voss. Meridian UK is authorized to resell within the United Kingdom and Ireland.

2. Meridian Data Solutions SARL ("Meridian France"), a French société à responsabilité limitée registered under SIREN number 912 483 057, with its registered office at 27 Rue de la Boétie, 75008 Paris, France. The Gérant (managing director) of Meridian France is Jean-Philippe Moreau. Meridian France is authorized to resell within France, Belgium, Luxembourg, and French-speaking Switzerland. Any additional sub-distrib

III. Applicable Regulatory Frameworks This section provides a detailed overview of the principal regulatory frameworks governing the export, reexport, and distribution of Lumos Prism™ through the Meridian channel reseller program. The analysis addresses each regime in turn, beginning with the U.S. Export Administration Regulations, proceeding to the EU Dual-Use Regulation, and then addressing U.S. OFAC sanctions and

1. Jurisdictional Reach The Export Administration Regulations, codified at 15 C.F.R. Parts 730 through 774, are administered by the Bureau of Industry and Security within the U.S. Department of Commerce. The EAR governs the export, reexport, and transfer (in-country) of all items that are "subject to the EAR," a term defined in 15 C.F.R. § 734.2. Items subject to the EAR include, broadly, all items of U.S. origin (i.

2. Classification of Lumos Prism™ A threshold question for any export control analysis is the proper classification of the item at issue under the Commerce Control List. The CCL, set forth in Supplement No. 1 to Part 774 of the EAR, organizes controlled items into ten categories (Categories 0 through 9), each of which is further divided into product groups (A through E) encompassing systems, equipment, and components

3. License Exception Considerations If Lumos Prism™ is classified as EAR99, no license is required for its export or reexport to any destination that is not subject to a comprehensive U.S. embargo or to restrictions imposed by the Entity List, Denied Persons List, or Unverified List. EAR99 items may generally be exported to most countries in the EMEA Territory without a BIS license, subject to the general prohibition

1. Scope and Application The EU Dual-Use Regulation, Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 (the "Recast Regulation"), entered into force on September 9, 2021, repealing and replacing the prior Regulation (EC) No 428/2009. The Recast Regulation establishes a Union regime for the control of exports, brokering, technical assistance, transit, and transfer of dual-use items

2. Classification Under EU Control Lists Annex I to the EU Dual-Use Regulation contains the EU Dual-Use Control List, which is aligned with the multilateral export control regimes, including the Wassenaar Arrangement, the Missile Technology Control Regime, the Nuclear Suppliers Group, and the Australia Group. The EU Control List is organized into ten categories mirroring the Wassenaar Arrangement categories. Lumos Pr

3. Obligations for Meridian as EU-Based Reseller As an EU-based entity engaged in the distribution of items that may be subject to the EU Dual-Use Regulation, Meridian bears independent compliance obligations under the Regulation and under applicable national export control laws. These obligations exist irrespective of the contractual provisions in the Agreement and apply by operation of law. Specifically, Meridian m

1. Overview of OFAC Programs The Office of Foreign Assets Control, a bureau within the U.S. Department of the Treasury, administers and enforces U.S. economic sanctions programs. OFAC's sanctions programs are among the most extensive in the world and carry significant penalties for violations, including civil penalties of up to approximately $330,000 per violation (or twice the value of the underlying transaction, wh

2. Applicability to Lumos and Meridian Lumos is unambiguously a "U.S. person" for purposes of all OFAC sanctions programs. As a Delaware C-Corporation headquartered in California, Lumos is subject to the full range of OFAC prohibitions, including the prohibition on exporting, reexporting, or otherwise providing U.S.-origin goods, technology, and services to comprehensively sanctioned jurisdictions and SDN-listed pers

1. U.S.-Origin Software: To the extent Meridian facilitates the distribution of Lumos Prism™ — a U.S.-origin software product — Meridian's activities are subject to the EAR, and any diversion of the software to a sanctioned end user or jurisdiction could result in OFAC enforcement action against Lumos and create secondary sanctions exposure for Meridian.

2. Secondary Sanctions Risk: Even absent a direct OFAC nexus, Meridian could face secondary sanctions if it engages in significant transactions involving sanctioned persons or jurisdictions in connection with its resale of the platform.

3. U.S. Dollar Payment Processing: The Agreement provides for payment of reseller commissions and platform fees in U.S. dollars, with payments processed through Pinnacle National Bank, N.A., located at 555 California Street, San Francisco, California 94104. All U.S. dollar transactions clear through the U.S. financial system and are subject to OFAC compliance screening by the correspondent banks involved in the trans

1. EU Restrictive Measures The European Union implements sanctions — referred to as "restrictive measures" — through Council Decisions adopted under the Common Foreign and Security Policy ("CFSP") and Council Regulations adopted under Article 215 of the Treaty on the Functioning of the European Union ("TFEU"). EU sanctions regulations are directly applicable in all EU Member States and are binding on all persons with

2. Overlap and Divergence with OFAC There is substantial overlap between OFAC sanctions and EU restrictive measures with respect to several jurisdictions and persons. Both regimes impose comprehensive or near-comprehensive restrictions on Iran, North Korea, and Syria, and both regimes restrict transactions involving the Crimea, Donetsk, and Luhansk regions of Ukraine. The convergence of these regimes simplifies compl

IV. Analysis of Reseller Agreement Compliance Provisions This section evaluates the export control and sanctions compliance provisions included in the execution version of the Channel Reseller Program Agreement dated March 22, 2024. The provisions discussed below were the subject of extensive negotiation between Calderwood & Harkness and Kessler Hartmann Rechtsanwälte PartG mbB and reflect a carefully balanced framew

V. Restricted Territories — Detailed Analysis This section provides a jurisdiction-by-jurisdiction analysis of the Restricted Territories identified in the Agreement, examining the applicable U.S. and EU sanctions regimes, areas of regulatory convergence and divergence, and specific compliance considerations for each territory. A. Cuba OFAC Regime: The Cuban Assets Control Regulations, 31 C.F.R. Part 515, administere