Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze market-standard indemnification and liability cap structures in data processing agreements ("DPAs") between financial technology ("fintech") software-as-a-service ("SaaS") vendors and FDIC-insured banking institutions, and to recommend a framework for Skybridge Fintech Ltd. ("Skybridge" or "SBF") to adopt in its customer-facing DPA template. The analys

II. Background and Engagement Context A. The Parties An understanding of the parties to this transaction and their respective roles is necessary to contextualize the liability and indemnification analysis that follows. Skybridge Fintech Ltd. Skybridge is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Founded in 2019 by Nadia Karimova (Chief Executive Officer), S

III. Market Survey — Indemnification and Liability Cap Structures in Bank-Vendor DPAs A. Methodology. To develop a market-informed recommendation for the Skybridge template DPA, our team conducted a review of indemnification and liability cap structures in data processing agreements between fintech SaaS vendors and FDIC-insured banking institutions. Our review encompassed the following sources and frameworks:

1. Precedent Transaction Review. We reviewed DPA terms from approximately thirty precedent transactions in the financial services sector involving fintech SaaS vendors and FDIC-insured institutions, including agreements from our firm's prior representations as well as publicly available terms where applicable. The sample included vendors with ARR ranging from $15 million to $250 million and bank clients with total as

2. Regulatory Frameworks. We considered the following regulatory frameworks and guidance documents that inform liability allocation expectations in bank-vendor agreements: • OCC Bulletin 2023-17 ("Third-Party Relationships: Risk Management Guidance"), which sets forth the OCC's expectations for banks' management of third-party relationships, including specific guidance on contractual provisions relating to indemnific

3. Industry Guidance. We also considered guidance from the International Association of Privacy Professionals ("IAPP"), industry model DPA templates published by trade associations, and secondary literature addressing liability allocation best practices in technology services agreements. B. Typical Liability Cap Structures Based on our market survey, we identified four principal approaches to structuring liability ca

IV. Recommended Liability Cap Structure for Skybridge Template DPA A. Proposed Formula Based on the market survey and the considerations discussed above, we recommend the following liability cap formula for the Skybridge template DPA: Liability Cap. The aggregate liability of Processor to Controller under or in connection with this Data Processing Agreement, whether arising in contract, tort (including negligence), s

V. Indemnification Provisions — Recommended Structure A. Scope of Indemnification We recommend that the Skybridge template DPA include an indemnification provision under which Skybridge, as Processor, agrees to indemnify, defend, and hold harmless the Controller and its officers, directors, employees, agents, and affiliates from and against any and all losses, damages, costs, liabilities, and expenses (including reas

VI. Carve-Outs and Super-Cap Items A. Items Typically Carved Out from the Liability Cap In bank-vendor DPAs, certain categories of claims are frequently "carved out" from the general liability cap—meaning that the cap does not apply and liability for such claims is either uncapped or subject to a separate, higher "super-cap." The following carve-out categories are most commonly encountered: Willful Misconduct or Gros

VII. Insurance Coverage — Interaction with Liability Cap and Indemnification A. Skybridge's Existing Cyber-Liability Insurance Skybridge maintains a Technology Errors & Omissions and Cyber Liability insurance policy with the following key terms: The policy provides coverage for, among other things: (i) third-party claims arising from technology errors and omissions in the delivery of Skybridge's SaaS platform; (ii) t

VIII. Regulatory Framework Considerations Affecting Indemnification and Liability A. OCC Bulletin 2023-17 (Third-Party Risk Management) OCC Bulletin 2023-17, issued on June 6, 2023, provides comprehensive guidance on the risk management practices that the OCC expects banks to apply to their third-party relationships. The Bulletin applies to all bank-third-party relationships, with a particular emphasis on relationshi