Contract analysis

I. EXECUTIVE SUMMARY This memorandum summarizes the regulatory and licensing posture of Skybridge Fintech Ltd. ("Skybridge" or the "Company"), a Delaware corporation headquartered at 1200 Market Street, Suite 1400, Wilmington, Delaware 19801, with an engineering office located at 450 Folsom Street, 7th Floor, San Francisco, California 94105, in connection with the proposed approximately $450,000,000 de-SPAC business

II. COMPANY OVERVIEW AND REGULATORY FRAMEWORK A. Business Model and Regulatory Characterization Skybridge operates a cloud-based payment orchestration platform that routes, processes, and reconciles payment transactions on behalf of its financial institution and neobank clients. The platform is designed to serve as a middle-layer infrastructure connecting Skybridge's clients to the payment rails — including card netw

III. STATE MONEY TRANSMITTER LICENSING ANALYSIS A. Overview of Money Transmission Regulation Nearly all U.S. states, as well as the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, have enacted money transmitter or money services business licensing statutes that regulate the business of money transmission within their borders. The definition of "money transmission" varies by state but generally include

1. Commence all change-of-control filings promptly, with a target filing date of no later than early June 2025 for all jurisdictions requiring prior approval.

2. Engage local regulatory counsel in New York, California, and Texas — the jurisdictions with the longest expected processing times and the most complex application requirements — to assist with the preparation and submission of change-of-control applications and to manage follow-up communications with the applicable regulators.

3. Calendar follow-up dates for each state's processing timeline relative to the projected closing date of July 21, 2025, and establish a weekly reporting cadence to monitor the status of all pending filings.

4. Prepare contingency plans for any jurisdiction where approval may not be received prior to closing, including drafts of requests for interim operating authority or temporary extensions.

IV. PAYMENT PROCESSOR AND PAYMENT FACILITATOR REGISTRATIONS A. Card Network Registration Skybridge is registered as a payment facilitator ("PayFac") with major card networks through its sponsoring acquiring bank relationships. Payment facilitator registration is required for entities that process card-based payment transactions on behalf of sub-merchants or clients, providing those clients with access to the card net

V. BANK SECRECY ACT / AML COMPLIANCE A. FinCEN Registration Skybridge is registered with the Financial Crimes Enforcement Network ("FinCEN") as a money services business — specifically as a money transmitter — pursuant to 31 C.F.R. § 1022.380. Federal law (31 U.S.C. § 5330) requires every money services business to register with FinCEN, and Skybridge maintains a current and effective FinCEN MSB registration. FinCEN M

VI. DATA PRIVACY AND CYBERSECURITY A. Federal Privacy Framework

1. Gramm-Leach-Bliley Act (GLBA). Skybridge qualifies as a "financial institution" under the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., by virtue of its payment-related activities. As a financial institution under the GLBA, Skybridge is subject to the Act's requirements for the protection of nonpublic personal information ("NPI") of consumers, including the obligation to provide initial and annual privacy noti

2. FTC Safeguards Rule Compliance. In accordance with the revised FTC Safeguards Rule, which became effective on June 9, 2023, Skybridge has implemented the following updated safeguards: • Designated Qualified Individual. The Company has designated Daniel Hsiao, Chief Technology Officer, as the qualified individual responsible for overseeing and implementing the Company's information security program. Mr. Hsiao has m

1. California (CCPA / CPRA). Skybridge processes personal information of California residents, both through its clients' end users whose transaction data flows through the platform and through its own employees, many of whom are based at the Company's San Francisco engineering office. The Company meets the applicability thresholds under the California Consumer Privacy Act, as amended by the California Privacy Rights

2. Other State Privacy Laws. In addition to the CCPA/CPRA, Skybridge is subject to the following state comprehensive privacy laws, each of which has been enacted and become effective: • Virginia Consumer Data Protection Act (VCDPA). Applicable to Skybridge based on the Company's processing of personal data of Virginia residents. The Company has implemented compliance procedures consistent with the VCDPA's requirement

VII. CONSUMER FINANCIAL PROTECTION A. CFPB Oversight The Consumer Financial Protection Bureau ("CFPB") has supervisory authority over "larger participants" in certain consumer financial product markets under the Dodd-Frank Wall Street Reform and Consumer Protection Act, 12 U.S.C. § 5514. The CFPB has promulgated rules defining "larger participant" thresholds for several consumer financial product markets, including i