Contract analysis

I. Executive Summary This memorandum analyzes the sub-processor risk allocation structure for Skybridge Fintech Ltd.'s customer-facing Data Processing Agreement ("DPA") with Meridian Federal Savings Bank ("Meridian" or "Controller") and recommends a comprehensive framework that can serve as Skybridge's bank-grade template for all future similarly situated bank clients. The analysis addresses the unique regulatory, co

II. Background A. The Parties and Transaction Context Skybridge Fintech Ltd. is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Skybridge operates the "SBF Core" platform, a Software-as-a-Service ("SaaS") solution that provides real-time payment processing, anti-fraud analytics, and regulatory reporting functionality to FDIC-insured depository institutions. SBF C

III. Regulatory and Legal Framework for Sub-Processor Oversight The sub-processor risk allocation framework must be structured to satisfy the requirements of multiple, overlapping regulatory regimes. This section surveys the applicable regulatory and legal requirements governing sub-processor oversight in the context of the Skybridge-Meridian relationship. A. OCC Bulletin 2023-17 (Third-Party Risk Management) OCC Bul

Article 28(2) provides that a processor shall not engage another processor (i.e., a sub-processor) without the prior specific or general written authorization of the controller. Where general written authorization has been given, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such c

Article 28(4) requires that where a sub-processor is engaged, the sub-processor must be bound by the same data protection obligations as those set out in the contract between the controller and the processor (i.e., the DPA). This "flow-down" requirement ensures that the chain of data protection obligations is maintained throughout the sub-processing relationship. Article 28(4) further provides that where the sub-proc

IV. Existing Sub-Processor Agreements A. Skybridge–Osprey Cloud DPA (March 1, 2024) Skybridge and Osprey Cloud are parties to a Data Processing Agreement executed on March 1, 2024 (the "Osprey DPA"). The Osprey DPA includes Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) to provide a lawful transfer mechanism for the transfer of EU personal data from Skybridge to Osprey Cloud's data center faciliti

V. Recommended Sub-Processor Authorization Model A. General Written Authorization vs. Specific Written Authorization GDPR Article 28(2) permits two models for controller authorization of sub-processors: (i) prior specific written authorization, under which the controller must individually authorize each sub-processor before the processor may engage that sub-processor, and (ii) prior general written authorization, und

VI. Flow-Down Obligations A. Contractual Requirements A foundational element of the sub-processor risk allocation framework is the requirement that Skybridge impose on each sub-processor, by way of a written contract, data protection obligations that are no less protective than those set forth in the DPA between Skybridge and Meridian. This "flow-down" requirement ensures that the chain of contractual data protection

VII. Liability and Risk Allocation for Sub-Processor Acts A. Skybridge's Liability to Controller Under the DPA, Skybridge will assume liability for the acts and omissions of its sub-processors as if they were Skybridge's own acts and omissions. This liability allocation is consistent with GDPR Article 28(4), which establishes the processor's full liability for sub-processor performance, and is a standard market expec

VIII. Audit Rights Over Sub-Processors A. Controller Audit Rights The DPA will grant the Controller (or its regulators, including the OCC, FDIC, and CFPB) the right to audit the Processor's data processing activities and security controls. Under the proposed audit framework, the following parameters will apply: (a) Frequency. The Controller may conduct audits no more than once per 12-month period, unless a more frequ

IX. Sub-Processor Data Breach Notification Chain A. Upstream Notification Timeline The sub-processor data breach notification chain must be structured to ensure that breach notifications flow upstream through the processing chain with sufficient speed to enable each party to meet its regulatory and contractual notification obligations. The recommended notification chain is as follows: Step 1: Sub-Processor → Skybridg

X. International Transfer Considerations (SCC Module 3) A. Transfers Requiring Module 3 SCCs The sub-processor risk allocation framework must address the international transfer of EU personal data within the sub-processing chain. The following transfers require Module 3 SCCs (Processor-to-Sub-processor): Transfer 1: Skybridge (US Processor) → Osprey Cloud (US Sub-processor). This transfer involves the transmission of