Contract analysis

I. Executive Summary Calderwood & Harkness LLP has been engaged by Skybridge Fintech Ltd. (the "Company" or "Skybridge") to conduct a review of the Company's existing insurance program in connection with the proposed $60,000,000 convertible note bridge financing (the "Bridge Financing") led by Ridgeline Ventures Fund IV, L.P. ("Ridgeline"). This memorandum sets forth our findings and recommendations based on that rev

II. Scope of Review and Methodology A. Documents Reviewed In conducting this review, we examined the following documents and materials, which were provided to us by the Company (principally through Priya Ramanathan, General Counsel) in response to our due diligence requests:

1. All documents provided in response to Item 14 of the Due Diligence Request List (dated November 13, 2023) and Item 7 of the Supplemental Due Diligence Request List (dated December 6, 2023), which collectively requested copies of all material insurance policies, binders, certificates, and related correspondence.

2. Current policy declarations pages for each of the Company's material insurance policies, including all endorsements, riders, and amendments thereto.

3. Binders of insurance for each policy currently in effect.

4. A summary of the Company's claims history for the past three policy years (policy years 2021–2022, 2022–2023, and the current 2023–2024 policy year through the date of the summary), as prepared by the Company's insurance broker.

5. Selected correspondence between the Company and its insurance broker, Halcyon Benefit Group ("Cascade Risk Advisors"), relating to policy placement, renewal terms, and claims submissions during the review period.

6. The Loan and Security Agreement dated August 15, 2022 (the "Kelvantis LSA"), by and between Kelvantis Lending Corp. ("Kelvantis") and Skybridge Fintech Ltd., establishing the Company's $15,000,000 venture debt facility (maturing August 15, 2025), including the insurance covenants set forth therein (specifically, the provisions requiring the Company to maintain minimum insurance coverage of specified types and amou

7. The Company's organizational chart and current headcount data, as relevant to the assessment of EPLI and Workers' Compensation coverage adequacy. We note that the Company represented to us that the foregoing documents constitute the complete set of material insurance policies and related documents currently in effect. We have relied on that representation in preparing this memorandum. B. Methodology. Our review wa

1. Policy Terms Review. We reviewed the terms, conditions, limits of liability, retentions and deductibles, exclusions, and key endorsements of each material insurance policy to identify the scope of coverage afforded to the Company, its directors and officers, and other insureds.

2. Industry Benchmarking. We assessed the adequacy of the Company's insurance program against industry benchmarks for fintech and SaaS companies at a comparable stage of development and revenue level. In conducting this assessment, we drew upon publicly available market data, third-party insurance benchmarking reports (including the Glenrock Management Consulting 2023 Tech & Life Sciences Looking Ahead Guide and the

3. Contractual Compliance. We assessed compliance with the insurance covenants contained in the Kelvantis LSA, including minimum coverage types and amounts, lender's loss payee endorsements, and additional insured requirements.

4. Investor Expectations. We evaluated the Company's insurance program against anticipated investor expectations in the context of the Bridge Financing and the planned Series D. Institutional investors at the growth stage, including the members of the Investor syndicate, typically expect portfolio companies to maintain robust D&O, cyber, and E&O coverage consistent with the company's risk profile and valuation.

5. Regulatory Considerations. We considered insurance-related implications of the Company's regulatory posture, including its payments orchestration and embedded lending operations, state money transmission licensing obligations, and PCI-DSS compliance requirements. This analysis was conducted in coordination with the Regulatory & Compliance Diligence Memorandum dated December 22, 2023. Important Caveat. We note that

III. Directors & Officers (D&O) Liability Insurance A. Current Policy Summary The Company currently maintains a Directors & Officers Liability Insurance policy issued by Meridian National Indemnity Company ("Meridian"), a surplus lines insurer rated A (Excellent) by AM Best. The key terms of the current policy are summarized below: Named Insureds. The policy covers Skybridge Fintech Ltd. as the named entity, and all

1. Fraud/Dishonesty Exclusion. The policy excludes claims arising from or attributable to any fraudulent, dishonest, or criminal act by an insured person, provided that this exclusion applies only after a final adjudication in the underlying proceeding (the "final adjudication carve-out"). This carve-out is important because it preserves defense coverage pending the resolution of fraud allegations and prevents the ca

2. Prior/Pending Litigation Exclusion. The policy excludes claims arising from, based upon, or attributable to any litigation or proceeding that was pending on or before the inception date of the policy, or arising from the same or substantially similar facts as any such prior proceeding. The Company has represented that there is no prior or pending litigation that would trigger this exclusion with respect to the cur

3. Insured-vs.-Insured Exclusion. The policy excludes claims brought by one insured against another insured. This exclusion is a standard feature of D&O policies and is designed to prevent collusive claims. However, this exclusion raises a potential issue in the Company's context, given the multi-investor cap table and the presence of investor-designated directors on the Company's board. We discuss this issue further

4. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or property damage are excluded from D&O coverage, as such risks are addressed under the Company's CGL and other liability policies.

5. Professional Services Exclusion. Claims arising from the rendering or failure to render professional services are excluded from D&O coverage, as such risks are addressed under the Company's E&O/Technology Professional Liability policy. This exclusion helps avoid overlapping coverage and potential disputes between the D&O and E&O carriers. Defense Costs. Under the current policy, defense costs are included within t

1. Increase Aggregate Limits. We recommend increasing the aggregate D&O limit from $10,000,000 to at least $15,000,000, and preferably $20,000,000, prior to or concurrent with the planned Series D. Given the anticipated Series D valuation and the Company's growth trajectory, a $20,000,000 aggregate limit would be more consistent with industry norms and would provide a more adequate cushion against the risk of defense

2. Excess Side A / DIC Layer. We recommend that the Company consider adding an excess Side A / Difference in Conditions ("DIC") layer to provide dedicated protection for independent directors. A Side A DIC policy would provide coverage that "drops down" in the event that the primary D&O policy fails to respond — for example, due to an insured-vs.-insured exclusion, a bankruptcy-related limitation, or a dispute with t

3. Insured-vs.-Insured Exclusion Carve-Back. We recommend that the Company confirm with Meridian and Cascade Risk Advisors that the insured-vs.-insured exclusion contains an explicit carve-back for derivative suits brought on behalf of the Company. This carve-back is important because derivative claims are, by their nature, brought by one insured (a shareholder, who may also be a director) against other insureds (dir

4. Securities Claim Definition. We recommend that the Company confirm with Meridian and Cascade Risk Advisors that the policy's definition of "Securities Claim" is broad enough to encompass claims arising from the issuance of convertible notes in the Bridge Financing, including claims alleging misrepresentation or omission of material information in connection with the offering, as well as claims arising from the fut

IV. Errors & Omissions (E&O) / Technology Professional Liability Insurance A. Current Policy Summary The Company maintains an Errors & Omissions / Technology Professional Liability Insurance policy issued by Cascadia Specialty Insurance Group ("Cascadia"), rated A+ (Superior) by AM Best. The key terms of the current policy are summarized below: Scope of Coverage. The Cascadia policy provides coverage for claims arisi

1. Professional Negligence. Coverage for claims alleging negligent acts, errors, or omissions in the performance of Technology Professional Services, including claims arising from defects in the Skybridge Platform, incorrect processing of payment transactions, and failures in the embedded lending functionality.

2. Failure to Perform / Service Outages. Coverage for claims alleging failure to perform contracted services, including claims arising from platform downtime, service outages, and interruptions in payment processing functionality. This coverage is particularly relevant given that Skybridge's customers rely on the platform for real-time payment processing and any significant outage could result in claims from affected

4. Media Liability. The policy includes a media liability insuring agreement providing coverage for claims alleging defamation, invasion of privacy, or infringement of copyright in connection with the Company's content and marketing activities. Key Exclusions. The Cascadia policy contains the following material exclusions:

1. Intentional/Criminal Acts Exclusion. Claims arising from intentional, dishonest, fraudulent, malicious, or criminal acts by an insured.

2. Prior Known Claims Exclusion. Claims based upon, arising from, or attributable to any fact, circumstance, act, error, or omission of which any insured had knowledge prior to the inception of the policy and which a reasonable person would have expected to give rise to a claim.

3. Contractual Liability Exclusion. Claims arising from liability assumed under any contract or agreement, provided that this exclusion contains a carve-back for liability that the Company would have in the absence of such contract or agreement ("Technology Services Carve-Back"). This carve-back is important because it preserves coverage for claims arising from the Company's performance of technology services, even w

4. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or property damage.

5. Employer's Liability Exclusion. Claims brought by or on behalf of any employee of the Company. Retroactive Date. The policy's retroactive date is March 12, 2017, which is the date of the Company's incorporation in the State of Delaware. This means that the policy covers claims arising from wrongful acts that occurred on or after that date, provided that such claims are first made during the current policy period.

1. Increase Per-Claim Limit. We recommend that the Company consider increasing the per-claim limit from $5,000,000 to $10,000,000 in connection with the next policy renewal (July 1, 2024) or the Series D, whichever occurs first. A $10,000,000 per-claim limit would be more consistent with the Company's growing GPV and customer base, and would provide more adequate protection against large-scale platform errors or outa

2. Confirm Embedded Lending Coverage. We recommend that the Company confirm with Cascadia and Cascade Risk Advisors that the definition of "Professional Services" or "Technology Services" specifically encompasses the Company's embedded lending platform operations, including credit underwriting technology, loan origination, and loan servicing functionality — not solely payment processing services.

3. Verify Third-Party API Coverage. We recommend that the Company verify that the policy does not contain subcontractor or vendor carve-outs that would create coverage gaps where third-party API integrations are involved in the delivery of the Skybridge Platform's services. If such exclusions exist, the Company should negotiate appropriate carve-backs or endorsements.

V. Cyber Liability / Privacy & Network Security Insurance A. Current Policy Summary The Company maintains a Cyber Liability / Privacy & Network Security Insurance policy issued by Trident Cyber Insurance Co. ("Trident"), rated A (Excellent) by AM Best and a recognized specialist in technology and financial services cyber risk. The key terms of the current policy are summarized below: First-Party Coverages. The Triden

1. War/Terrorism Exclusion. The policy excludes losses arising from war, invasion, acts of foreign enemies, hostilities, civil war, rebellion, revolution, insurrection, military or usurped power, or terrorism. Notably, the policy includes a cyber-war carve-out that excludes losses attributable to a cyber operation conducted by or on behalf of a nation-state as part of a military or intelligence operation, even if suc

2. Infrastructure Failure Exclusion. The policy excludes losses arising from the failure of public utilities, telecommunications infrastructure, or internet backbone providers that is unrelated to a security event affecting the Company's own systems. This exclusion is standard but could be relevant in the event of a widespread internet outage affecting the Company's cloud infrastructure.

3. Prior Known Incidents Exclusion. The policy excludes claims or losses arising from incidents that were known to the Company prior to the inception of the policy.

4. Contractual Penalties Beyond Insurable Fines. The policy excludes contractual penalties or liquidated damages imposed under commercial contracts, to the extent such penalties exceed the scope of insurable fines and penalties under applicable law.

5. Trade Secret Misappropriation by Insureds. The policy excludes claims arising from the misappropriation of trade secrets by the Company or its employees.

6. Bodily Injury/Property Damage Exclusion. Claims for bodily injury or tangible property damage are excluded. Territorial Scope. The Trident policy provides worldwide coverage, which is appropriate given that the Company's platform processes transactions involving international e-commerce customers and merchants. However, we note that certain jurisdictions (particularly within the European Union and the European Eco

1. Increase Aggregate Limits. We recommend increasing the aggregate cyber limit from $10,000,000 to at least $15,000,000, and preferably $20,000,000, consistent with the Company's growth trajectory, transaction volumes, and the expected increase in scrutiny from the Series D investor base. This increase should be pursued at the next policy renewal (July 1, 2024) or earlier if market conditions are favorable.

2. Cloud Infrastructure Coverage. We recommend confirming that the policy's definition of "Computer System" (or equivalent defined term) includes cloud infrastructure and third-party hosted environments, including the Company's Ridgeway Industries ("Meridian Technologies") production environment and any other cloud service provider environments used by the Company. Many cyber policies contain limitations or exclusion

3. Regulatory Proceedings Coverage. We recommend evaluating whether the policy provides adequate coverage for regulatory proceedings related to state money transmission licensing and compliance, which is an area of heightened regulatory focus for fintech companies operating in the payments space. This consideration should be coordinated with the analysis set forth in the Regulatory & Compliance Diligence Memorandum d

4. Social Engineering Fraud Sublimit. If the Trident policy currently includes a social engineering fraud coverage sublimit, we recommend evaluating whether that sublimit is adequate given the Company's exposure profile. If the policy does not currently include social engineering fraud coverage, we recommend adding this coverage at the next renewal or via a mid-term endorsement, if available.

VI. General Commercial Liability (CGL) Insurance A. Current Policy Summary The Company maintains a General Commercial Liability Insurance policy issued by Keystone General Insurance Company ("Keystone"), rated A (Excellent) by AM Best. The key terms of the current policy are summarized below: Scope of Coverage. The Keystone policy is written on a standard ISO Commercial General Liability form (CG 00 01) or equivalent

1. Professional Liability Exclusion. Claims arising from the rendering or failure to render professional services are excluded, as such risks are covered under the Company's E&O / Technology Professional Liability policy.

2. Employment Practices Exclusion. Claims arising from employment-related practices (including discrimination, harassment, wrongful termination, and retaliation) are excluded, as such risks are covered under the Company's EPLI policy.

3. Pollution Exclusion. Standard total pollution exclusion.

4. Cyber/Data Breach Exclusion. Claims arising from data breaches, cyber events, or privacy violations are excluded, as such risks are covered under the Company's Cyber Liability / Privacy & Network Security policy.

5. Auto Liability Exclusion. Claims arising from the ownership, maintenance, or use of automobiles are excluded. The Company has represented that it does not own or lease any vehicles. Workers' Compensation / Employers' Liability. Workers' compensation and employers' liability coverage is maintained separately from the CGL policy and is discussed in Section VII.B below. C. Adequacy Assessment The CGL limits of $2,000

VII. Other Insurance Coverages A. Employment Practices Liability Insurance (EPLI) The Company maintains an EPLI policy issued by Cascadia Specialty Insurance Group (the same carrier that underwrites the Company's E&O policy), providing coverage for claims arising from wrongful employment practices, including discrimination, harassment, wrongful termination, retaliation, failure to promote, and wage and hour disputes.

VIII. Compliance with Kelvantis Loan and Security Agreement As noted above, the Company is party to the Loan and Security Agreement dated August 15, 2022, by and between Kelvantis Lending Corp. and Skybridge Fintech Ltd. (the "Kelvantis LSA"), which established a $15,000,000 venture debt facility maturing on August 15, 2025. The Kelvantis LSA contains affirmative covenants requiring the Company to maintain insurance

IX. Note Purchase Agreement Insurance Representations The NPA being prepared for the Bridge Financing will contain representations and warranties by the Company regarding the adequacy and status of its insurance program. Based on our review of the most recent draft of the NPA (draft dated December 19, 2023, circulated by investor counsel Whitfield, Pratt & Soo LLP), the anticipated insurance-related representations i

1. A complete list of all material insurance policies maintained by the Company, with the information described in clause (iv) above.

2. Disclosure of any pending claims, reported incidents, or circumstances known to the Company that could reasonably be expected to give rise to a claim under any insurance policy.

3. To the extent the Company determines it is appropriate, a brief description of the coverage enhancement recommendations set forth in this memorandum, to the extent such recommendations relate to areas where the Company's curren