Contract analysis

I. Executive Summary This memorandum sets forth a Transfer Impact Assessment ("TIA") evaluating the legal framework governing transfers of personal data from the European Union — specifically, from the Netherlands — to the United States in the context of Skybridge Fintech Ltd.'s ("Skybridge" or "SBF") customer-facing Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCC") package currently under ne

II. Scope of the Assessment A. Client and Transaction Background Skybridge Fintech Ltd. ("Skybridge" or "SBF") is a Delaware C-corporation headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810. Founded in 2019, Skybridge provides software-as-a-service ("SaaS") payment processing, fraud detection, and regulatory-reporting software, marketed under the trade name "SBF Core," to FDIC-insured banks,

1. Payment processing: Facilitating the execution, clearing, and settlement of consumer and commercial payment transactions initiated by or on behalf of Meridian accountholders, including ACH transfers, wire transfers, debit card transactions, and real-time payment network transactions.

2. Anti-fraud analytics: Deploying real-time and near-real-time machine learning models and rule-based systems to detect, flag, and prevent fraudulent transactions and unauthorized account access. This includes the analysis of behavioral biometric data (keystroke dynamics and mouse movement patterns) to identify anomalous user behavior.

3. Regulatory reporting: Generating the reports and data exports required by federal and state banking regulators, including Suspicious Activity Reports ("SARs"), Currency Transaction Reports ("CTRs"), and call reports, as well as internal compliance reporting for Meridian's compliance function. No processing is undertaken for purposes beyond those specified above. The DPA expressly prohibits Skybridge from processin

III. Legal Framework for International Data Transfers under GDPR A. Chapter V of the GDPR — General Principles The GDPR establishes a comprehensive regime governing the transfer of personal data to countries outside the European Economic Area in Articles 44 through 49, collectively comprising Chapter V of the Regulation. The overarching principle, set forth in Article 44, is that any transfer of personal data to a th

1. Know your transfers: Map and document all transfers of personal data to third countries, including the identification of the personal data transferred, the transfer tool relied upon, and the entities involved.

2. Identify the transfer tool: Determine which Article 46 transfer tool (or other lawful basis under Chapter V) is being relied upon for each transfer.

3. Assess the law and practices of the third country: Evaluate whether anything in the law or practice of the third country impinges on the effectiveness of the appropriate safeguards of the transfer tool being relied upon, in the context of the specific transfer.

4. Identify and adopt supplementary measures: Where the assessment in Step 3 reveals that the third country's law or practices impinge on the effectiveness of the transfer tool, identify and adopt supplementary measures that, when combined with the transfer tool, ensure that transferred data is afforded an essentially equivalent level of protection.

5. Take procedural steps: Implement any formal procedural steps required by the specific transfer tool or supplementary measures adopted — for example, including supplementary measures as additional contractual provisions or implementing specific technical configurations.

6. Re-evaluate at appropriate intervals: Continuously monitor developments in the third country that may affect the initial assessment, and re-evaluate the transfer at appropriate intervals. This memorandum follows the EDPB's six-step methodology in its analysis and recommendations. Steps 1 and 2 are addressed in Section II (Scope of the Assessment) and Section VI (Transfer Mapping); Step 3 is addressed in Section IV

IV. Assessment of US Law and Practices (Step 3 of EDPB Methodology) A. US Government Surveillance Framework Consistent with the EDPB's six-step methodology and the Schrems II requirements, this section assesses the laws and practices of the United States that could potentially impinge on the effectiveness of the SCCs as the chosen transfer tool. The analysis focuses on the four principal legal authorities that govern

1. FISA Section 702. Section 702 of the Foreign intelligence Surveillance Act, codified at 50 U.S.C. § 1881a, authorizes the US government — specifically, the National Security Agency ("NSA"), with oversight from the Foreign intelligence Surveillance Court ("FISC") — to target non-US persons reasonably believed to be located outside the United States for the purpose of acquiring foreign intelligence information. Unde

2. Executive Order 12333. Executive Order 12333, originally issued in 1981 and subsequently amended, governs intelligence activities conducted by the US intelligence community outside of the FISA statutory framework. Unlike FISA 702, EO 12333 does not authorize the government to compel private companies to provide access to data or to assist in surveillance activities. Instead, EO 12333 collection typically involves

3. CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018). The Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"), enacted on March 23, 2018, as part of the Consolidated Appropriations Act of 2018, amended the Stored Communications Act (18 U.S.C. § 2713) to clarify that a provider of electronic communication services or remote computing services that is subject to US jurisdiction shall comply with obligat

4. National Security Letters (NSLs). National Security Letters are administrative subpoenas issued by the Federal Bureau of Investigation ("FBI") under several statutory authorities (principally 18 U.S.C. § 2709 and 12 U.S.C. § 3414) to obtain certain categories of records in connection with national security investigations. NSLs are limited in scope to subscriber information and transactional records — they do not a

V. Supplementary Measures (Step 4 of EDPB Methodology) In accordance with Step 4 of the EDPB's six-step methodology, this section identifies and describes the supplementary technical, organizational, and contractual measures that Skybridge has implemented or will implement to ensure that the personal data transferred from the EU to the US receives an essentially equivalent level of protection, notwithstanding the US

1. Encryption at rest (AES-256). All personal data stored by Skybridge and Osprey Cloud is encrypted at rest using the Advanced Encryption Standard with 256-bit keys ("AES-256"), which is recognized by the National Institute of Standards and Technology ("NIST") as providing a high level of cryptographic security and is widely considered to be computationally infeasible to break with current technology. This encryptio

2. Encryption in transit (TLS 1.2+). All personal data transmitted between SBF Europe (Amsterdam), Skybridge (Wilmington), and Osprey Cloud infrastructure (Ashburn and Frankfurt) is encrypted in transit using Transport Layer Security ("TLS") protocol version 1.2 or higher. TLS encryption protects data against interception during transmission across public and private networks, directly mitigating the risk of data cap

3. Multi-factor authentication (MFA). Multi-factor authentication is required for all administrative access to SBF Core and to the underlying Osprey Cloud infrastructure that hosts SBF Core. MFA requires users to present at least two independent authentication factors — typically a password (something the user knows) and a time-based one-time password generated by a hardware token or authenticator application (someth

4. Pseudonymization and access controls. Skybridge has implemented role-based access controls ("RBAC") across SBF Core that limit personnel access to personal data on a strict need-to-know basis. Access permissions are configured at a granular level, such that individual employees are granted access only to the specific categories of personal data and processing functions required for their designated roles. All acce

5. Annual penetration testing. Skybridge engages Ironvault Security Group LLC, an independent third-party information security firm located at 11710 Plaza America Drive, Suite 400, Reston, Virginia 20190, to conduct annual penetration testing of SBF Core and associated infrastructure. Penetration testing is designed to identify vulnerabilities in the application, network, and infrastructure layers that could be explo

1. SOC 2 Type II certification. Skybridge has obtained a Service Organization Control 2 Type II ("SOC 2 Type II") report, issued by the independent accounting and audit firm Graystone & Ketchum LLP, located at 300 Delaware Avenue, Suite 700, Wilmington, Delaware 19801 (Lead Audit Partner: Sandra Clearfield). The current SOC 2 Type II report covers the audit period from October 1, 2024 through September 15, 2025, and

2. Cyber-liability insurance. Skybridge maintains a cyber-liability insurance policy issued by Bastion Mutual Insurance Company, Policy No. CYB-2025-04821, providing coverage of $10 million per occurrence and $20 million in aggregate. The policy period runs from January 1, 2025 through December 31, 2025, and renewal for the 2026 policy year is currently in progress. The policy is brokered by Kestrel Risk Advisors LLC

3. CISO oversight. Rebecca Muñoz serves as Chief Information Security Officer ("CISO") of Skybridge Fintech Ltd. and is responsible for maintaining Skybridge's overall information security posture, including incident response procedures, vulnerability management, security architecture review, and compliance with applicable security standards and regulatory requirements. Ms. Muñoz reports directly to Skybridge's Chief

4. Employee training and confidentiality obligations. All Skybridge personnel — currently 187 employees — and all SBF Europe personnel — currently 14 employees — are subject to binding confidentiality agreements that prohibit the unauthorized disclosure of personal data and other confidential information. All personnel are required to complete annual data protection training covering the GDPR, the CCPA/CPRA, applicab

5. Sub-processor management. Skybridge operates a general written authorization model for the engagement of sub-processors, consistent with Article 28(2) of the GDPR and Clause 9 of the SCCs. Under this model, the Controller (Meridian) provides general written authorization for Skybridge to engage sub-processors, subject to the following conditions: Skybridge must provide the Controller with at least 30 days' prior w

1. Standard Contractual Clauses (Implementing Decision 2021/914). As described throughout this memorandum, the SCCs serve as the primary contractual mechanism for the EU–US data transfers. Module 2 (Controller-to-Processor) governs the Meridian → Skybridge transfer, and Module 3 (Processor-to-Sub-processor) governs the Skybridge → Osprey Cloud and Skybridge → SBF Europe transfers. The SCCs are governed by the law of

2. Transparency commitments. The SCCs include robust transparency commitments on the part of Skybridge as the data importer. Specifically, pursuant to Clause 15 of the SCCs, Skybridge commits to: (a) promptly notify the data exporter (to the extent legally permitted under applicable law, including any applicable non-disclosure obligations) of any legally binding request by a public authority or law enforcement agency

3. Data minimization. The DPA includes express data minimization provisions requiring that the processing of personal data be limited to what is strictly necessary for the specified purposes of payment processing, fraud detection, and regulatory reporting. Skybridge is contractually prohibited from processing personal data for any purpose beyond those documented in th