Contract analysis

I. Introduction and Purpose This Supplemental Due Diligence Request List (this "Supplemental Request List") is delivered by Calderwood & Harkness LLP ("Calderwood & Harkness") to Skybridge Fintech Ltd. (the "Company" or "Skybridge") as a supplement to the initial Due Diligence Request List dated November 13, 2023 (the "Initial Request List"), which was previously delivered to the Company in connection with the propos

II. General Instructions The following general instructions apply to all requests set forth in this Supplemental Request List and should be read in conjunction with the general instructions contained in the Initial Request List:

1. Organization. All responsive materials should be organized by numbered request category, corresponding to the section and subsection numbers used in this Supplemental Request List (e.g., materials responsive to Request III.A should be uploaded to a VDR folder labeled "III.A — Money Transmission Licenses and Permits"). Where a single document is responsive to multiple requests, the document should be uploaded once

2. Non-Existence or Inapplicability. If any requested item does not exist or is not applicable to the Company, the Company is requested to provide written confirmation to that effect, specifically identifying the request number and providing a brief explanation. A blanket statement of inapplicability will not be sufficient; each such determination should be made on a request-by-request basis.

3. Amendments and Restatements. Where any requested document has been amended, supplemented, restated, or otherwise modified since its original execution, the Company should provide all versions of such document, including the current effective version and all prior amendments, supplements, restatements, or modifications, in chronological order.

4. Status Updates. For any ongoing or pending matters (including, without limitation, pending regulatory applications, ongoing litigation, pending negotiations, and unresolved disputes), the Company should provide status updates reflecting the most current information available as of the most recent practicable date prior to production.

5. Cross-References to Initial Request List. Where a request in this Supplemental Request List supplements, updates, or expands upon a request contained in the Initial Request List, a cross-reference to the corresponding Initial Request List item number has been provided where practicable. In instances where additional materials are being requested to supplement a prior production, the Company should identify the new

6. Privilege Log. To the extent the Company withholds any responsive document or portion of a document on the basis of attorney-client privilege, work product protection, or any other applicable privilege, the Company should maintain a privilege log identifying each such document by date, author, recipient(s), subject matter, and the basis for the privilege assertion.

III. Regulatory and Licensing — Money Transmission A. Money Transmission Licenses and Permits

1. A complete list of all states and jurisdictions (including the District of Columbia, U.S. territories, and any non-U.S. jurisdictions) in which Skybridge Fintech Ltd. currently holds a money transmitter license, money services business registration, or any equivalent permit, authorization, or approval. For each such license, registration, or permit, the list should include: (a) the name of the issuing regulatory a

2. Copies of all currently effective money transmitter licenses, money services business registrations, or equivalent permits held by the Company in any jurisdiction, including any licenses that are conditional, provisional, or subject to special terms, conditions, or restrictions imposed by the issuing regulatory authority.

3. Copies of all license applications currently pending in any state or jurisdiction where the Company has applied for but not yet received a money transmitter license, money services business registration, or equivalent permit. For each pending application, the Company should provide: (a) a description of the current status of the application; (b) copies of all correspondence between the Company and the relevant sta

4. A copy of the Company's current Financial Crimes Enforcement Network ("FinCEN") Money Services Business ("MSB") registration confirmation, together with copies of any amendments, updates, or renewals filed since the initial registration.

5. To the extent not subject to applicable legal privilege or regulatory confidentiality restrictions, copies of any Suspicious Activity Reports ("SARs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. In the event the Company determines that production of individual SARs is prohibited or inadvisable under applicable law or regulation, the Company sh

6. Copies of any Currency Transaction Reports ("CTRs") filed by the Company with FinCEN during the three-year period preceding the date of this Supplemental Request List. If production of individual CTRs is impracticable due to volume, the Company should provide an aggregate summary indicating the total number of CTRs filed during each calendar year. C. Regulatory Examinations and Inquiries

7. Copies of any examination reports, supervisory letters, deficiency notices, findings letters, matters requiring attention ("MRAs"), cease-and-desist orders, consent orders, civil money penalty assessments, or other regulatory correspondence, orders, or actions received from any state or federal financial regulator (including, without limitation, state banking departments, state departments of financial institution

8. A summary description of any pending or threatened regulatory inquiries, investigations, or enforcement actions relating to the Company's money transmission, payments processing, or money services business activities. For each such matter, the summary should include: (a) the identity of the regulatory authority; (b) the nature and subject matter of the inquiry, investigation, or enforcement action; (c) the current

9. Copies of any remediation plans, corrective action plans, or compliance improvement programs developed, submitted, or undertaken by the Company in response to any regulatory examination findings, supervisory letters, deficiency notices, or other regulatory directives during the three-year period preceding the date of this Supplemental Request List, together with documentation reflecting the Company's completion or

10. A summary description of the Company's anti-money laundering ("AML") and Bank Secrecy Act ("BSA") compliance program, including a description of the program's key components (e.g., written policies and procedures, internal controls, customer identification and due diligence procedures, transaction monitoring, suspicious activity reporting, employee training, and independent testing). To the extent available, the

11. Identification of the Company's designated BSA/AML compliance officer, including the individual's name, title, reporting structure, qualifications, and the date of appointment to the role.

12. A copy of the most recent independent AML/BSA audit or assessment report prepared by an external firm, including the date of the audit, the scope of the assessment, and the identity of the firm that conducted it. If any findings, recommendations, or deficiencies were identified in the report, the Company should also provide documentation reflecting the Company's response or remediation efforts. E. Surety Bonds an

13. Copies of all surety bonds, letters of credit, certificates of deposit, or other financial security instruments posted or maintained by the Company in connection with its money transmitter licenses or money services business registrations in any jurisdiction. For each such instrument, the Company should provide: (a) the name of the issuing surety company or financial institution; (b) the principal amount or face

IV. Intellectual Property — Open-Source Software A. Open-Source Software Inventory

14. A complete inventory or software bill of materials ("SBOM") listing all open-source software components that are incorporated into, linked with, bundled with, distributed with, or otherwise used in connection with the Company's payments orchestration platform and embedded lending platform (collectively, the "Company Products"). For each open-source component identified, the inventory should include the following

15. Identification of any open-source components included in the inventory described in Request 14 above that are subject to "copyleft" or reciprocal licensing obligations, including without limitation components licensed under GPL v2, GPL v3, AGPL v3, LGPL (any version), or MPL 2.0. For each such component, the Company should provide: (a) A description of how the copyleft-licensed component interacts with the Compan

16. Copies of any internal policies, procedures, guidelines, or governance frameworks adopted by the Company governing the selection, evaluation, approval, use, integration, and tracking of open-source software within the Company's products, services, and internal systems. This request includes any policies that establish approved or prohibited license categories, required review or approval workflows, or documentati

17. A description of any automated scanning tools, software composition analysis ("SCA") tools, or other technical systems used by the Company to detect, identify, catalog, and monitor open-source software usage across its codebase and deployed environments. For each such tool or system, the Company should provide: (a) the name of the tool or vendor (e.g., Larkspur Data Systems, Crestline Health IT, Glenrock Systems,

18. A description of any contributions of the Company's proprietary source code, documentation, or other materials to any open-source projects, communities, or foundations, whether initiated by the Company or by individual employees or contractors acting within the scope of their engagement. For each such contribution, the Company should identify: (a) the open-source project to which the contribution was made; (b) th

V. Data Privacy and Customer Contracts A. Customer Data Processing Agreements

19. Copies of the Company's current standard form data processing agreement ("DPA") or data processing addendum, including any standard attachments, exhibits, or schedules (e.g., descriptions of processing activities, technical and organizational security measures, subprocessor lists, and standard contractual clauses).

20. A list of all customers with which Skybridge has entered into non-standard, negotiated, or materially modified data processing agreements or data processing addenda that deviate from the Company's standard form. For each such customer, the Company should provide: (a) the identity of the customer; (b) a brief description of the material deviations from the standard form; and (c) a complete copy of the executed, no

21. Identification of any customers who have requested a data processing agreement or data processing addendum from the Company but have not yet received an executed agreement, or where DPA negotiations are currently pending. For each such customer, the Company should indicate the current status of negotiations and any anticipated timeline for execution. B. Privacy Policies and Notices

22. Copies of all current versions of the Company's customer-facing privacy policies and privacy notices, including any product-specific, service-specific, or jurisdiction-specific privacy notices (e.g., California Consumer Privacy Act notices, GDPR-specific notices, or notices applicable to particular Company Products).

23. A history of all material amendments, updates, or revisions to the Company's privacy policies during the two-year period preceding the date of this Supplemental Request List, together with copies of each prior version of the privacy policy in effect during that period. For each material amendment, the Company should provide a brief description of the nature of the change and the effective date. C. Data Protection

24. Copies of any data protection impact assessments ("DPIAs") or privacy impact assessments ("PIAs") conducted by or on behalf of the Company in connection with the payments orchestration platform or the embedded lending platform during the two-year period preceding the date of this Supplemental Request List. This request includes any DPIAs or PIAs conducted in connection with the introduction of new product feature

25. A description of any cross-border transfers of personal data conducted by or on behalf of the Company, including without limitation transfers of personal data to or from the European Union/European Economic Area ("EU/EEA"), the United Kingdom ("UK"), Canada, or any other jurisdiction that imposes data localization requirements or restrictions on the international transfer of personal data. For each category of cr

26. Copies of any Standard Contractual Clauses ("SCCs") adopted pursuant to Commission Implementing Decision (EU) 2021/914, Binding Corporate Rules ("BCRs"), transfer impact assessments, or other data transfer mechanisms executed, implemented, or relied upon by the Company in connection with cross-border transfers of personal data.

27. Identification of any data hosting, data processing, or data storage that occurs outside the United States, including: (a) the geographic location of each data center or server facility; (b) the identity of each hosting, infrastructure, or cloud services provider (e.g., Ridgeway Industries, Crestline Systems, Aldermere Technologies); (c) the categories of data hosted or processed at each location; and (d) any con

28. A summary of any data security incidents, unauthorized access events, data breaches, or other security events occurring during the three-year period preceding the date of this Supplemental Request List that involved or potentially involved the unauthorized access, acquisition, disclosure, or loss of personal data, customer data, or other confidential information. For each such incident, the summary should include

29. Copies of any breach notification letters, notices, or communications sent by the Company to affected individuals, state attorneys general, data protection authorities, or law enforcement agencies in connection with any data security incident occurring during the period described above. F. Data Security Standards and Certifications

30. A description of the Company's information security program, including an overview of the technical, administrative, and physical security controls implemented to protect personal data, customer data, and other sensitive information. The description should identify any applicable industry standards, certifications, or frameworks to which the Company adheres, including without limitation SOC 2 Type II, PCI-DSS (Pa

31. Copies of the most recent SOC 2 Type II report issued to the Company, including any management assertions, system descriptions, and complementary user entity controls. If the Company has obtained PCI-DSS certification, copies of the most recent Report on Compliance ("ROC") or Self-Assessment Questionnaire ("SAQ"), as applicable.

32. The date and scope of the most recent third-party penetration test or security audit conducted on the Company's systems, networks, and applications, together with the identity of the firm that conducted the assessment. To the extent not subject to applicable privilege, a summary of any critical or high-severity findings identified during the assessment and the Company's remediation status with respect to such fin

VI. Existing Indebtedness — Kelvantis Lending Corp. Venture Debt Facility A. Complete Loan Documentation

33. A complete copy of the Loan and Security Agreement, dated August 15, 2022, by and between Kelvantis Lending Corp. ("Kelvantis") and Skybridge Fintech Ltd. (the "Kelvantis LSA"), together with all exhibits, schedules, annexes, side letters, and attachments thereto.

34. Copies of all amendments, supplements, modifications, waivers, consents, forbearance agreements, or other written instruments that amend, supplement, modify, or otherwise relate to the Kelvantis LSA, executed or delivered at any time since August 15, 2022.

35. Copies of all promissory notes, warrants, warrant agreements, or other instruments or securities issued by the Company to Kelvantis or any of its affiliates in connection with the Kelvantis venture debt facility.

36. Copies of all UCC-1 financing statements, UCC-3 amendments, UCC-3 continuation statements, and any other lien filings made by or on behalf of Kelvantis Lending Corp. (or any agent, successor, or assignee thereof) in connection with the Kelvantis facility, in any jurisdiction. B. Current Outstanding Balance and Payment Status

37. A statement of the current outstanding principal balance, accrued and unpaid interest, and any other amounts outstanding under the Kelvantis facility as of the most recent practicable date. The original facility amount is understood to be $15,000,000, and the Company is requested to confirm or correct this understanding.

38. A schedule of all principal and interest payments made by the Company to Kelvantis under the facility from the date of origination through the most recent payment date, including the date of each payment, the amount of each payment, and the allocation between principal, interest, and fees.

39. Confirmation of the stated maturity date of the Kelvantis facility. Based on the Company's prior productions, the maturity date is understood to be August 15, 2025; the Company is requested to confirm or correct this understanding, and to identify any provisions that could accelerate the maturity date or otherwise modify the scheduled repayment terms.

40. Identification of any amounts held in restricted accounts, reserve accounts, escrow accounts, or other segregated accounts in connection with the Kelvantis facility, together with the current balance of each such account, the purpose of the restriction, and the conditions under which the restricted funds may be released. C. Covenant Compliance

41. A complete list of all financial covenants and material operating covenants contained in the Kelvantis LSA, including without limitation any minimum cash covenants, minimum revenue covenants, maximum leverage ratio covenants, minimum liquidity covenants, and any negative covenants restricting the Company's business activities or financial operations.

42. A copy of the most recent compliance certificate delivered by the Company to Kelvantis pursuant to the Kelvantis LSA, together with the supporting calculations and certifications demonstrating the Company's compliance with each financial covenant as of the applicable measurement date.

43. Identification of any covenant violations, defaults, events of default (whether payment defaults, financial covenant defaults, or other defaults), or potential defaults that have occurred at any time during the term of the Kelvantis facility, including any such defaults that were subsequently cured, waived, or subject to forbearance arrangements. For each such event, the Company should provide: (a) a description

44. Identification and copies of any provisions in the Kelvantis LSA (including any side letters, amendments, or other related agreements) that restrict, condition, or require the prior written consent of Kelvantis for any of the following actions by the Company: (i) the incurrence of additional indebtedness (including the issuance of convertible promissory notes); (ii) the issuance of convertible securities, options

45. Copies of any existing intercreditor agreements, subordination agreements, standstill agreements, or similar arrangements to which Kelvantis Lending Corp. is a party, including any agreements governing the relative priority of claims, payment waterfalls, or enforcement rights among multiple creditors of the Company.

46. Identification of the specific provisions of the Kelvantis LSA (including any definitions of "Permitted Indebtedness," "Subordinated Debt," or equivalent terms) that establish the terms and conditions upon which additional indebtedness may be incurred on a subordinated basis, and any limitations or requirements imposed on the form, terms, or conditions of any such subordinated indebtedness.

47. Copies of any correspondence, term sheets, draft agreements, or other communications between the Company (or its counsel) and Kelvantis Lending Corp. (or its counsel) regarding the proposed convertible note financing, the proposed terms of subordination, or any request for lender consent or waiver in connection with the Transaction. This request supplements materials already produced and specifically includes, bu

48. Copies of any warrants or warrant agreements issued to Kelvantis Lending Corp. or any of its affiliates in connection with the venture debt facility. For each such warrant, the Company should provide or confirm: (a) the exercise price per share; (b) the number of shares underlying the warrant; (c) the class and series of equity subject to the warrant; (d) the expiration date; (e) any anti-dilution, adjustment, or