Contract analysis

I. Purpose and Scope of Memorandum The purpose of this memorandum is to provide a comprehensive overview of the federal, state, and international privacy and data security regulatory frameworks applicable to Skybridge Fintech Ltd. ("Skybridge" or "SBF"), a Delaware-incorporated fintech software-as-a-service ("SaaS") company headquartered at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, in connection with the

II. Data Processing Overview — Factual Foundation Before turning to the regulatory analysis, it is necessary to establish the factual foundation regarding the nature, scope, and context of the personal data processing that will occur under the DPA. A clear understanding of the data processing activities is essential to determining the applicability and specific requirements of each regulatory framework. A. Party Role

1. Osprey Cloud Infrastructure, Inc., 2200 Campus Drive, San Jose, CA 95131. Osprey Cloud is Skybridge's primary IaaS/PaaS provider and hosts all SBF Core workloads across its US-East and EU data center regions. An existing Data Processing Agreement between Skybridge and Osprey Cloud, dated March 1, 2024, governs Osprey Cloud's processing of personal data on behalf of Skybridge's clients and includes Module 3 Standar

2. Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593). SBF Europe is a wholly owned subsidiary of Skybridge and serves as an EU-based sub-processor responsible for managing the processing of EU personal data for Skybridge's bank clients. SBF Europe employs 14 individuals — eight engineers, four customer support personnel, and two compliance professionals — and is manag

III. Federal Banking Privacy and Security Laws This section addresses the principal federal banking privacy and security laws and regulatory guidance applicable to the Skybridge–Meridian relationship, with a focus on the implications of each for the structure and provisions of the DPA. A. Gramm-Leach-Bliley Act (GLBA) / Regulation P (12 CFR Part 1016)

1. Overview. The Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, establishes the foundational federal framework for the privacy and security of consumer financial information. GLBA applies to "financial institutions" — defined broadly to include any institution the business of which is engaging in financial activities as described in Section 4(k) of the Bank Holding Company Act of 1956 — and imposes two prin

2. Applicability to Meridian and Skybridge Meridian, as an FDIC-insured federally chartered savings bank, is unambiguously a "financial institution" subject to GLBA. Meridian is subject to the privacy provisions of Regulation P and to the interagency guidelines on information security promulgated by the OCC and FDIC. Skybridge, in its capacity as a provider of SBF Core services to Meridian, qualifies as a "service pr

3. NPI Classification The categories of personal data processed through SBF Core, as described in Section II.C above, include numerous data elements that constitute NPI under GLBA. NPI is defined, in relevant part, as personally identifiable financial information provided by a consumer to a financial institution, resulting from a transaction with the consumer, or otherwise obtained by the financial institution. The f

4. DPA Implications The GLBA framework creates several specific requirements that must be addressed in the DPA: Safeguards Provisions. The DPA must expressly require Skybridge to implement and maintain administrative, technical, and physical safeguards that are appropriate to the size and complexity of Skybridge's operations, the nature and scope of the data processing activities, and the sensitivity of the NPI at is

1. Overview. OCC Bulletin 2023-17 (June 6, 2023), titled "Third-Party Relationships: Risk Management Guidance," supersedes the prior OCC Bulletin 2013-29 and provides comprehensive interagency guidance — jointly issued by the OCC, FDIC, and Federal Reserve — on the risk management practices that banking organizations should adopt with respect to their third-party relationships. The guidance articulates the expectatio

2. Application to the Skybridge–Meridian Relationship Meridian is supervised by the OCC as a federally chartered savings bank and by the FDIC as an insured depository institution. Meridian is also subject to CFPB oversight with respect to consumer financial protection matters. Accordingly, Meridian is required to maintain a TPRM program consistent with OCC Bulletin 2023-17 and related interagency guidance. Within the

3. Key Contractual Requirements OCC Bulletin 2023-17 identifies a number of specific contractual provisions that banking organizations should include in agreements with third-party service providers, particularly those providing critical activities. Each of these requirements must be addressed in the DPA: Audit Rights. The guidance emphasizes that banking organizations must retain the right to audit their third-party

4. DPA Implications Audit Rights Clause. The DPA should provide that the Controller (Meridian) or its duly authorized representatives may audit the Processor (Skybridge) upon thirty (30) days' advance written notice, no more than once per twelve-month period under ordinary circumstances, at the Controller's expense. However, this frequency limitation should not apply in the event of a confirmed personal data breach,

1. Overview. The Computer-Security Incident Notification Rule, codified at 12 CFR Part 53 (OCC) and parallel provisions at 12 CFR Part 304 (FDIC) and 12 CFR Part 225 (Federal Reserve), became effective on April 1, 2022. The rule establishes two related notification requirements: Bank-to-Regulator Notification. A banking organization must notify its primary federal regulator no later than thirty-six (36) hours after t

2. Interplay with DPA Breach Notification Timeline The interplay between the 12 CFR Part 53 notification requirements and the DPA breach notification provisions is critical and must be carefully structured to ensure that all parties can meet their respective notification obligations: The bank-to-regulator notification timeline under 12 CFR Part 53 is thirty-six (36) hours from the banking organization's determination

3. Recommendation. The DPA should specify that Skybridge must notify Meridian of a Personal Data Breach (as defined in the DPA) within forty-eight (48) hours of becoming aware of the breach. However, for incidents that are reasonably likely to constitute "notification incidents" under 12 CFR Part 53 — i.e., incidents that have materially disrupted or are reasonably likely to materially disrupt SBF Core services for f

IV. State Privacy Laws This section addresses the state-level comprehensive privacy laws and data breach notification statutes that are applicable to the Skybridge–Meridian relationship, with particular focus on the CCPA/CPRA and the New Jersey Data Privacy Act, and their implications for the DPA. A. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

1. Overview. The California Consumer Privacy Act ("CCPA"), as substantially amended by the California Privacy Rights Act ("CPRA"), establishes a comprehensive framework of consumer privacy rights for California residents. The CPRA amendments became effective on January 1, 2023, with enforcement commencing on July 1, 2023. The CCPA/CPRA is administered and enforced by the California Privacy Protection Agency ("CPPA")

2. Applicability to the Skybridge–Meridian Relationship Although Meridian does not operate retail branches in California — its physical footprint spans New Jersey, New York, Pennsylvania, and Connecticut — Meridian likely has accountholders who are California residents. This may include individuals who opened accounts at Meridian branches before relocating to California, individuals who maintain online-only banking r

3. Service Provider Obligations Under the CCPA/CPRA, a "service provider" is a person or entity that processes personal information on behalf of a business pursuant to a written contract that, among other things, prohibits the service provider from selling or sharing the personal information, retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the c

4. DPA Implications The DPA must include CCPA/CPRA-specific service provider provisions that address each of the requirements outlined above. These provisions may be incorporated as a standalone section or schedule within the DPA (anticipated as Schedule F — US State Privacy Law Supplement) or woven into the body of the DPA alongside analogous provisions addressing GDPR and other regulatory frameworks. Given the DPA'

1. Overview. The New Jersey Data Privacy Act, enacted as NJ S3377, establishes a comprehensive framework of consumer privacy rights for New Jersey residents. The law is expected to take effect on January 15, 2026 — just one month before the target signing date of February 15, 2026 for the Skybridge–Meridian DPA. The timing of the NJ S3377 effective date is directly relevant to this engagement, as Meridian is headquar

2. Key Provisions Controller-Processor Framework. NJ S3377 establishes distinct obligations for controllers (entities that determine the purposes and means of processing personal data) and processors (entities that process personal data on behalf of controllers). Meridian is the controller; Skybridge is the processor. Consumer Rights. The law grants New Jersey consumers the following rights: the right to access their

3. DPA Implications Given that NJ S3377 is expected to take effect on January 15, 2026, just one month before the DPA target signing date, the DPA must be drafted to comply with NJ S3377's processor requirements from the outset. Specific implications include: Processor Contract Requirements. The DPA must satisfy each of the contractual requirements specified in NJ S3377, as enumerated above. Fortunately, these requir

V. European Union General Data Protection Regulation (GDPR) A. Applicability The General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") applies to the processing of personal data of individuals who are in the European Union. The GDPR has extraterritorial reach and applies to the processing of personal data of EU residents by controllers or processors established in the EU, as well as to controllers or

Article 28 of the GDPR establishes mandatory requirements for the contractual relationship between a controller and a processor. The DPA between Meridian (as controller) and Skybridge (as processor) must satisfy all of the requirements set forth in Article 28(3), which provides that the processing by the processor shall be governed by a contract that sets out, at a minimum: (a) Processing on documented instructions.