Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the key differences between Meridian Federal Savings Bank's ("Meridian" or "MFSB") form Data Processing Agreement (the "Meridian Form DPA"), received from Meridian's outside counsel, Blackwell, Raines & Stoddard LLP ("BRS"), on November 25, 2025, and Skybridge Fintech Ltd.'s ("Skybridge" or "SBF") existing customer-facing DPA template (the "Skybridge T

II. Background and Scope A. Parties and Roles For purposes of this memorandum and the data processing relationship at issue, the parties and their respective roles under applicable data protection law are as follows: Meridian Federal Savings Bank acts as the Data Controller. Meridian is the entity that determines the purposes and means of the processing of personal data in connection with the services to be provided

1. Meridian Form DPA, as received from Blackwell, Raines & Stoddard LLP on November 25, 2025 (52 pages, including schedules and exhibits).

2. Skybridge Fintech Ltd. existing customer-facing DPA template (current internal version, last revised August 2025, 28 pages).

3. Meridian Federal Savings Bank Third-Party Risk Management Due Diligence Questionnaire, received from BRS on November 25, 2025 (146 questions across 8 sections).

4. Existing Skybridge Fintech Ltd.–Osprey Cloud Infrastructure, Inc. Data Processing Agreement, dated March 1, 2024, including Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) (38 pages).

5. SOC 2 Type II Report for Skybridge Fintech Ltd. SBF Core Platform, issued by Graystone & Ketchum LLP, dated September 15, 2025 (audit period: October 1, 2024 – September 15, 2025) (Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality).

6. Bastion Mutual Insurance Company Cyber-Liability Insurance Policy, Policy No. CYB-2025-04821 ($10 million per occurrence / $20 million aggregate; policy period: January 1, 2025 – December 31, 2025), issued through Kestrel Risk Advisors LLC (broker).

III. Gap Analysis — Key Areas of Divergence This section sets forth our detailed analysis of the nine key areas of divergence between the Meridian Form DPA and the Skybridge Template. For each area, we describe the positions taken by each party's respective document, identify the prevailing market standard for bank-vendor data processing agreements of comparable scope and size, and provide our recommended position fo

1. Meridian Form DPA Position The Meridian Form DPA proposes an approach to liability that is notably aggressive from the Controller's perspective. Section 12.1 of the Meridian Form DPA provides that the Processor's liability for breaches of the DPA shall be uncapped — that is, the Processor would bear unlimited aggregate liability for any and all losses, damages, claims, and expenses arising from or related to any b

2. Skybridge Template Position The Skybridge Template takes a significantly more conservative approach to liability. Section 9.1 of the Skybridge Template provides that the Processor's aggregate liability under the DPA shall be capped at an amount equal to one times (1×) the fees paid by the Controller in the twelve-month period immediately preceding the event giving rise to the claim (i.e., the trailing-12-month fee

3. Market Standard Our review of precedent bank-vendor DPAs and our experience advising on comparable transactions indicate that the market standard for liability caps in mid-market bank-vendor data processing agreements typically employs a formula-based approach. The most common structure is to set the liability cap at the greater of: (a) a fixed-dollar floor (commonly ranging from $3 million to $10 million, dependi

4. Recommendation. We recommend that the Skybridge counter-proposal include a liability cap structured as follows: The Processor's aggregate liability under this Data Processing Agreement shall not exceed the greater of (a) Five Million United States Dollars ($5,000,000) or (b) two times (2×) the aggregate fees paid by the Controller to the Processor in the twelve (12) month period immediately preceding the event giv

Section 13 of the Meridian Form DPA imposes a broad, one-directional indemnification obligation on the Processor. Under the Meridian Form DPA, Skybridge would be required to indemnify, defend, and hold harmless Meridian and its officers, directors, employees, agents, and affiliates from and against all losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of investigation)

2. Skybridge Template Position The Skybridge Template does not include an indemnification provision in the DPA itself. The Skybridge Template relies instead on the limitation of liability clause contained within the DPA and defers indemnification matters to the underlying SaaS subscription agreement. Skybridge's standard SaaS subscription agreement includes mutual indemnification provisions covering intellectual prop

3. Market Standard The inclusion of an express indemnification provision in the DPA is increasingly common in bank-vendor data processing agreements, particularly in the wake of OCC Bulletin 2023-17, which emphasizes the importance of contractual provisions that allocate risk appropriately in third-party relationships involving critical activities. Bank examiners reviewing the TPRM file for a critical-activity vendor

4. Recommendation. We recommend that Skybridge accept the inclusion of an express indemnification provision in the DPA. This is necessary to satisfy Meridian's TPRM program requirements and will be expected by future bank clients for whom this DPA will serve as a template. The absence of an indemnification provision in Skybridge's current template is a notable gap that should be addressed in the counter-proposal. The

Section 7.1 of the Meridian Form DPA requires the Processor to notify the Controller of a Personal Data Breach within twenty-four (24) hours of the Processor becoming aware of such breach. The Meridian Form DPA defines "awareness" broadly, including constructive awareness (i.e., when the Processor should reasonably have become aware of the breach based on the exercise of reasonable diligence).

Section 7.2 of the Meridian Form DPA sets forth detailed initial notification content requirements. The Processor's notification to the Controller must include, at a minimum: (a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) the name a

2. Skybridge Template Position

Section 6.1 of the Skybridge Template provides for a seventy-two (72) hour notification timeline from the point at which the Processor becomes aware of a Personal Data Breach. The Skybridge Template defines awareness more narrowly than the Meridian Form DPA, referencing actual (rather than constructive) awareness by the Processor's designated incident response team. The notification content requirements in the Skybri

3. Market Standard The applicable regulatory framework provides important context for evaluating breach notification timelines in bank-vendor DPAs. The FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) requires banking organizations to notify their primary federal regulator no later than 36 hours after the banking organization determines that a "notification incident" has occurred. Separately, ba

4. Recommendation. We recommend that the Skybridge counter-proposal include a 48-hour notification timeline, revised from Skybridge's current 72-hour template standard. This adjustment brings Skybridge's position into alignment with Meridian's TPRM program requirements, prevailing market practice, and the regulatory expectations established by the FDIC/OCC Computer-Security Incident Notification Rule. We believe this

Section 5 of the Meridian Form DPA requires the Processor to obtain specific prior written authorization from the Controller before engaging any sub-processor to process personal data on behalf of the Controller. Each sub-processor must be individually identified and approved by the Controller in advance of the commencement of any processing activities. Under the Meridian Form DPA, the Controller has an absolute righ

Section 5.3 of the Meridian Form DPA requires the Processor to flow down all of the data protection obligations contained in the DPA to each sub-processor by way of a written agreement. The Meridian Form DPA does not specify a particular time frame within which the Controller must respond to a sub-processor approval request, creating potential operational uncertainty if the Controller delays its review.

2. Skybridge Template Position The Skybridge Template provides for a general written authorization model, under which the Controller provides blanket authorization for the Processor to engage sub-processors, without any requirement for prior notice to the Controller or any Controller objection right. Under the current Skybridge Template, Skybridge maintains an internal list of its sub-processors but does not share th

3. Market Standard The prevailing market approach to sub-processor approval in bank-vendor DPAs is a general written authorization with prior notice and objection right model. This approach is consistent with GDPR Article 28(2), which provides that where a processor engages another processor pursuant to a general written authorization, the processor must inform the controller of any intended changes concerning the ad

4. Recommendation. We recommend that the Skybridge counter-proposal include a general written authorization model with 30-day prior written notice to the Controller before engaging any new sub-processor or replacing any existing sub-processor. The specific elements of the recommended sub-processor approval provision are as follows: • General Authorization: The Controller provides general written authorization for the

Section 8 of the Meridian Form DPA grants the Controller (or its authorized third-party auditor) the right to conduct on-site audits and inspections of the Processor's facilities, systems, records, and data processing activities. The Meridian Form DPA requires only ten (10) business days' advance written notice for such audits. Notably, the Meridian Form DPA does not impose any frequency limitation on audit rights —

Section 8.2 of the Meridian Form DPA addresses regulator access. This provision requires the Processor to permit the OCC, FDIC, CFPB, and any other applicable federal or state regulatory authority to examine the Processor in the same manner and to the same extent as if the services were being performed by the Controller itself, consistent with the examination authority established by OCC Bulletin 2023-17 and applicab

Section 8.3 of the Meridian Form DPA provides that all audits shall be conducted at the Processor's expense, including the Processor's internal costs of facilitating and supporting the audit.

2. Skybridge Template Position The Skybridge Template takes a significantly more limited approach to audit rights. Under Section 7 of the Skybridge Template, the Controller may request copies of Skybridge's most recent SOC 2 Type II report and may submit written questionnaires regarding Skybridge's data protection practices and security controls. The Skybridge Template does not grant the Controller any on-site audit

3. Market Standard In market-standard bank-vendor DPAs, on-site audit rights are a standard feature, but processors typically negotiate reasonable limitations to prevent audits from becoming unduly burdensome or disruptive to their operations. The most common approach includes the following elements: • Frequency: Typically limited to once per twelve (12) month period, with exceptions for audits triggered by a persona

4. Recommendation. We recommend the following approach to audit rights in the Skybridge counter-proposal: • On-Site Audit Right: Skybridge should accept the Controller's right to conduct on-site audits, but the DPA should limit on-site audits to once per twelve (12) month period, unless an audit is triggered by: (a) a Personal Data Breach affecting the Controller's personal data; (b) a regulatory inquiry, investigati

Section 10.1 of the Meridian Form DPA requires the Processor, upon termination or expiration of the DPA, to return and/or delete all Controller personal data within thirty (30) days. The Controller may elect whether personal data is returned (i.e., exported to the Controller in a commonly used, machine-readable format) or deleted (i.e., permanently and irreversibly destroyed using industry-standard methods).

Section 10.2 of the Meridian Form DPA requires the Processor to provide a written certification of deletion to the Controller, signed by an authorized officer of the Processor, confirming that all personal data has been deleted and that no copies, backups, or residual data remain in the Processor's possession or in the possession of any sub-processor. The Meridian Form DPA does not include any exception for data reta

2. Skybridge Template Position

Section 8.1 of the Skybridge Template provides for a 180-day post-termination retention period during which the Processor will retain the Controller's personal data in its systems. During this period, the Controller may request the return of its data. At the expiration of the 180-day period, the Processor will delete the Controller's personal data from its systems in accordance with its standard data destruction proc

3. Market Standard Post-termination data retention periods of 60 to 90 days are standard in bank-vendor DPAs. This timeframe provides adequate time for the Controller to complete data migration (i.e., to export its data from the Processor's platform and import it into a successor system) and for the Processor to execute its data deletion procedures across all relevant systems, including backup and disaster recovery e

4. Recommendation. We recommend the following approach to data retention and return/deletion in the Skybridge counter-proposal: • Post-Termination Retention Period: Upon termination or expiration of the DPA, the Processor shall retain the Controller's personal data for a period of ninety (90) days to allow the Controller to complete data migration. During this period, the Processor shall make the Controller's persona

Section 14 of the Meridian Form DPA includes detailed insurance requirements applicable to the Processor. The Meridian Form DPA requires the Processor to maintain technology errors and omissions ("Tech E&O") and cyber-liability insurance throughout the term of the DPA with the following minimum coverage levels: (a) $15 million per occurrence; and (b) $30 million in the aggregate.

Section 14.2 of the Meridian Form DPA requires the Processor to name the Controller as an additional insured under the Processor's cyber-liability policy. Section 14.3 requires the Processor to provide the Controller with a certificate of insurance evidencing the required coverage on an annual basis. Section 14.4 requires the Processor to maintain the required insurance coverage for three (3) years following terminat

2. Skybridge Template Position The Skybridge Template does not include any insurance requirements. The DPA is silent on the Processor's obligation to maintain insurance coverage, the minimum coverage levels, and the Controller's right to request evidence of coverage. This omission is consistent with many SaaS provider DPA templates, which tend to address insurance in the underlying commercial agreement rather than in

3. Market Standard Cyber-liability insurance requirements are standard in bank-vendor DPAs, particularly for critical-activity vendor relationships. The OCC Bulletin 2023-17 does not mandate specific insurance levels, but it expects banks to assess the financial condition and insurance coverage of third-party vendors and to include appropriate contractual provisions addressing insurance. For deals of this ACV (approx