Contract analysis

I. Purpose and Scope This memorandum identifies the ongoing compliance obligations and recurring deadlines arising from the Data Processing Agreement ("DPA") and Standard Contractual Clauses ("SCCs") package negotiated between Skybridge Fintech Ltd. ("Skybridge" or "Processor") and Meridian Federal Savings Bank ("Meridian" or "Controller"). The DPA/SCC package is targeted for execution on February 15, 2026, concurren

II. Summary of Key Compliance Dates and Deadlines The following table provides a consolidated calendar of all key compliance dates and recurring deadlines arising under the DPA/SCC package and related regulatory requirements. Each item is cross-referenced to the relevant section of this memorandum, the applicable contractual provision, and the responsible Skybridge personnel. This table is intended to serve as a quic

III. Cyber-Insurance Renewal — Bastion Mutual Insurance Company Contractual Obligation. Section 11.2 of the DPA requires Skybridge to obtain and maintain throughout the term of the agreement (and for a period of twenty-four months following termination) a technology errors and omissions and cyber-liability insurance policy with per-occurrence coverage of no less than ten million dollars ($10,000,000). The DPA further

1. Confirm Renewal Completion. Thomas Elridge should confirm with Kestrel Risk Advisors LLC that the renewal of Policy No. CYB-2025-04821 (or a successor policy number) has been completed and that the renewed policy is in full force and effect. Coverage limits must remain at or above $10,000,000 per occurrence and $20,000,000 in the aggregate, consistent with the DPA's requirements.

2. Obtain Updated Certificate of Insurance. Upon confirmation of renewal, Skybridge should promptly obtain an updated certificate of insurance naming Meridian Federal Savings Bank as an additional insured (or certificate holder, as applicable under the policy terms) and deliver the certificate to Meridian as a closing deliverable in connection with the DPA execution on February 15, 2026.

3. Ensure Continuous Coverage. Any gap in coverage between the expiration of the prior policy on December 31, 2025, and the effective date of the renewed policy would constitute a breach of Section 11.2 of the DPA. Thomas Elridge should confirm with Kestrel Risk Advisors that the renewal is backdated or otherwise structured to ensure continuous, uninterrupted coverage from January 1, 2026, forward.

4. Calendar Next Renewal. The next anticipated renewal date is December 31, 2026. This date should be calendared with at least ninety (90) days of advance lead time — i.e., no later than October 2, 2026 — to allow sufficient time for broker engagement, market review, and completion of the renewal process before the policy expiration date.

5. Material Changes. If the renewal results in any material changes to the policy — including a change in carrier, a reduction in coverage limits, the addition of exclusions relevant to the processing activities described in the DPA, or a change in deductible or self-insured retention — Thomas Elridge should assess whether notice to Meridian is required under the DPA and, if so, provide such notice promptly.

IV. SOC 2 Type II Audit Cycle — Graystone & Ketchum LLP Contractual Obligation. DPA Schedule B, Section 3.2, and the audit rights provisions set forth in DPA Section 8 require Skybridge to maintain a current SOC 2 Type II report issued by an independent, nationally recognized auditing firm. The DPA further provides that Skybridge may satisfy Controller audit requests under DPA Section 8.1 by providing its current SOC

1. Confirm Engagement. Rebecca Muñoz should confirm that Graystone & Ketchum LLP has been engaged for the new audit period and that the engagement letter reflects the appropriate scope — including, at a minimum, the Security, Availability, Confidentiality, and Processing Integrity criteria — and covers the SBF Core platform, all relevant integrations with Osprey Cloud Infrastructure, and the processing activities des

2. Remediation of Prior Findings. Rebecca Muñoz and Sanjay Dhillon should coordinate to ensure that any control deficiencies, exceptions, or remediation items identified in the September 15, 2025 report have been fully addressed before the commencement of the new audit period. Unresolved findings from the prior report that recur in the new report would significantly undermine the report's value as a substitute for on

3. Closing Deliverable. The current SOC 2 Type II report (dated September 15, 2025) should be provided to Meridian upon execution of the DPA on February 15, 2026, as part of the closing deliverables package. The report should be transmitted under a separate non-disclosure acknowledgment consistent with AICPA guidance on restricted-use reports.

4. Proactive Sharing Upon Issuance. Upon issuance of the new SOC 2 Type II report (anticipated September–October 2026), Skybridge should proactively share the report with Meridian and with all other bank clients using the standardized DPA template. Proactive sharing reduces the likelihood that Controllers will exercise their contractual right to conduct on-site audits, which are significantly more disruptive and cost

5. Staleness Risk. Skybridge should carefully track the timing of the audit cycle to ensure that the SOC 2 Type II report does not become stale. If, at any point, the report is more than twelve months old and a Controller requests an audit, Skybridge's ability to rely on the report in lieu of an on-site audit may be compromised. In such a scenario, the Controller would be entitled under DPA Section 8.1 to conduct an

V. EU-US Data Privacy Framework Re-Certification Contractual and Regulatory Context. Skybridge self-certified under the EU-US Data Privacy Framework ("DPF") as of July 1, 2025, and was assigned Certification ID DPF-2025-03912. While the Standard Contractual Clauses — specifically, Modules 2 (Controller-to-Processor) and 3 (Processor-to-Processor), governed by the law of the Netherlands per Clause 17 of the SCCs — ser

1. Calendar Re-Certification Deadline. The annual re-certification deadline — July 1, 2026, or the specific deadline established by the DPF program — should be calendared with at least sixty (60) days of advance lead time to allow sufficient preparation and review.

2. Joint Review by Elridge and Vogt. Thomas Elridge and Lena Vogt (Managing Director, Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands, KvK Registration No. 82104593) should jointly review Skybridge's DPF compliance ahead of the re-certification date. This review should encompass, at a minimum: (a) the adequacy and accuracy of Skybridge's publicly posted privacy policy as it pertains t

3. Monitor Legal Developments. Calderwood & Harkness LLP will continue to monitor developments regarding the legal validity of the EU-US Data Privacy Framework. As Thomas Elridge is aware, the DPF was adopted by the European Commission pursuant to Adequacy Decision C(2023) 4745 on July 10, 2023, and has been the subject of scrutiny by the European Parliament and civil society organizations. Any future legal challenge

4. Recordkeeping. Skybridge should maintain comprehensive records of its DPF compliance, including copies of the initial certification, all re-certifications, the publicly posted privacy policy, and documentation of the dispute resolution mechanism. These records should be readily available for presentation to Meridian or to regulatory authorities — including the Federal Trade Commission, which has enforcement author

VI. Sub-Processor List Update Obligations Contractual Obligation. Under DPA Schedule C, Section 2, and SCC Annex III, Skybridge operates under a general written authorization from Meridian for the engagement of sub-processors to assist in the processing of personal data. This general authorization is subject to a critical procedural requirement: Skybridge must provide Meridian with at least thirty (30) days' prior wr

1. Osprey Cloud Infrastructure, Inc. — Provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the SBF Core platform. Data center locations: US-East region (Ashburn, Virginia) and EU region (Frankfurt, Germany), with a disaster recovery secondary availability zone in US-East (Ashburn, Virginia). Headquarters: 2200 Campus Drive, San Jose, CA 95131. Chief Executive Officer: Martin Cho.

2. Skybridge Fintech Europe B.V. — Skybridge's wholly owned European subsidiary, responsible for EU personal data processing activities, including support, development, and compliance functions for EU-resident data subjects. Registered office: Keizersgracht 482, 1017 EG Amsterdam, Netherlands. KvK Registration No. 82104593. Managing Director: Lena Vogt. Current headcount: 14 employees (8 engineers, 4 customer support

1. Internal Process for Sub-Processor Changes. Thomas Elridge (or a designee within the legal team) should establish a formal internal process for tracking any planned changes to the sub-processor list. This process should require that any Skybridge business unit or engineering team proposing to engage a new vendor or service provider that will process personal data on behalf of a Controller must submit the proposal

2. Contractual Flow-Down. For any new sub-processor, Skybridge must ensure that the sub-processing agreement contains contractual provisions that are no less protective than those set forth in the DPA, including with respect to data protection obligations, security measures, audit rights, breach notification timelines, and data return/deletion requirements. In addition, consistent with OCC Bulletin 2023-17 (Third-Par

3. Objection Resolution. If Meridian objects to a proposed new or replacement sub-processor during the thirty-day notice period, Skybridge should promptly engage with Meridian to understand the basis for the objection and attempt to resolve the issue through the DPA's objection resolution mechanism (DPA Schedule C, Section 3). This may involve providing additional information about the sub-processor's data protection

4. Maintenance and Distribution. Skybridge should maintain an updated version of SCC Annex III and DPA Schedule C at all times and distribute the updated documents to all Controllers promptly upon any change to the sub-processor list. A master tracking spreadsheet of all Controller DPA versions and sub-processor notifications should be maintained by the legal team.

5. Osprey Cloud DPA Monitoring. The existing Skybridge–Osprey Cloud DPA, dated March 1, 2024, should be monitored for any upcoming renewal, amendment, or expiration. In addition, if Osprey Cloud makes any material changes to its data center locations, processing activities, or security posture, such changes may trigger the sub-processor update notice process and should be communicated to Meridian and all other Contro

VII. Data Breach Notification Readiness Contractual Obligation. DPA Schedule D, Section 1, requires Skybridge to notify Meridian within forty-eight (48) hours of becoming aware of a Personal Data Breach (as defined in the DPA, consistent with Article 4(12) of the GDPR and applicable U.S. state breach notification laws). The notification must include all information reasonably available to Skybridge at the time, inclu

1. Incident Response Plan. Skybridge should maintain and regularly update its written incident response plan, which should incorporate the DPA-specific notification procedures and escalation matrix. The plan should be tested at least annually through tabletop exercises and, ideally, through simulated breach scenarios.

2. Tabletop Exercises. Tabletop exercises should be conducted at least annually, with participation from Rebecca Muñoz, Thomas Elridge, and Sanjay Dhillon. These exercises should simulate realistic breach scenarios involving the SBF Core platform and should include practice runs of the notification procedures under DPA Schedule D, including preparation of the notification content and escalation to Meridian's Andrea S

3. Contact Information Maintenance. The escalation matrix contact information for Meridian personnel — specifically, Chief Compliance Officer Andrea Sokolov and VP Third-Party Risk Management Marcus Tibaldi — should be verified at least quarterly and updated immediately upon any change. Skybridge should request that Meridian provide prompt notice of any changes to these contacts.

4. Breach Notification Template. The breach notification template, which reflects the content requirements of DPA Schedule D, Section 1, should be readily accessible to the incident response team. The template should be stored in a location that will remain accessible even in the event of a system compromise — for example, in a secure offline repository or a separate cloud environment.

5. Insurance Coordination. In the event of a breach, Skybridge should promptly coordinate with Bastion Mutual Insurance Company to activate breach-response coverage under Policy No. CYB-2025-04821 (or its successor policy). The incident response plan should include the relevant Bastion Mutual claims contact information and the policy's notice-of-claim requirements.

6. GDPR Breach Notification. For breaches affecting the personal data of the approximately 3,200 EU-resident Meridian accountholders, Skybridge must ensure that parallel notification procedures are followed under GDPR Article 33 (notification to the supervisory authority) and, where applicable, Article 34 (notification to affected data subjects). The competent supervisory authority for Skybridge Fintech Europe B.V. i

VIII. New Jersey Data Privacy Act (S3377) Compliance Effective Date. The New Jersey Data Privacy Act, enacted as S3377, became effective on January 15, 2026. As of the date of this memorandum, the statute is in full force and effect, and compliance is required for all processing of the personal data of New Jersey residents. Relevance to the Skybridge/Meridian Relationship. Meridian Federal Savings Bank is headquarter

1. Confirm DPA Sufficiency. Thomas Elridge should confirm that the executed DPA's provisions — including those addressing data protection impact assessment cooperation (Section 6), consumer rights request assistance (Section 5), and security measures (Schedule B) — satisfy the processor requirements of S3377. Based on our review, the DPA provisions are substantially aligned with S3377's requirements, but a final conf

2. Monitor Implementing Regulations. S3377 authorizes the New Jersey Division of Consumer Affairs to issue implementing regulations and guidance. As of the date of this memorandum, no such regulations have been issued. Thomas Elridge should monitor for any rulemaking activity and assess the impact on Skybridge's obligations.

3. Internal Policy Updates. Skybridge's internal privacy policies and procedures should be reviewed and updated to reflect S3377 obligations, including the handling of consumer rights requests from New Jersey residents and the classification of behavioral biometric data as sensitive data.

4. Coordination with Meridian. Thomas Elridge should coordinate with Meridian on any data protection assessment requirements that may be triggered by the processing of New Jersey-resident data through the SBF Core platform, particularly in connection with processing activities involving sensitive data (such as behavioral biometric authentication data used in the anti-fraud analytics module).

IX. Annual Penetration Testing Contractual Obligation. DPA Schedule B, Section 3.4, requires Skybridge to conduct annual penetration testing of the SBF Core platform by an independent, qualified third-party security firm. The results of the penetration test, including a summary of findings and remediation actions, must be made available to Meridian upon reasonable request, consistent with the audit rights provisions

1. Calendar Annual Test. The annual penetration test should be calendared by Rebecca Muñoz, with scheduling coordinated between Skybridge's security team and Ironvault Security Group LLC. The test should be scheduled to align with the SOC 2 Type II audit cycle to the extent practicable, so that the most recent penetration test results can be incorporated into the SOC 2 report.

2. Test Scope. The scope of the penetration test must cover the SBF Core platform in its entirety, including: (a) the payment processing module; (b) the anti-fraud analytics module; (c) the regulatory reporting module; (d) all application programming interfaces (APIs) and integrations with Osprey Cloud Infrastructure (including both the US-East and EU data center regions); (e) administrative access controls, includin

3. Remediation. Any vulnerabilities or findings identified during the penetration test must be remediated within the timelines agreed upon between Skybridge and Ironvault, prioritized by severity level. Critical and high-severity findings should be addressed within thirty (30) days; medium-severity findings within sixty (60) days; and low-severity findings within ninety (90) days or the next scheduled maintenance win

4. Reporting to Controllers. Penetration test summary reports (redacted to remove specific exploit details that could create security risks if disclosed) should be made available to Meridian and other bank clients upon reasonable request, consistent with the DPA's audit rights provisions. Rebecca Muñoz should maintain a standard redacted summary format suitable for Controller distribution.

5. OCC Bulletin 2023-17 Considerations. Skybridge should consider whether Meridian's Third-Party Risk Management program, which is aligned with OCC Bulletin 2023-17, imposes any specific penetration testing scope, methodology, or reporting requirements beyond those established in the DPA. If Meridian's TPRM program requires specific testing standards (e.g., OWASP, PTES, or NIST SP 800-115), Rebecca Muñoz should coord

X. Audit Rights Preparedness Contractual Obligation. Under DPA Section 8, Meridian (as Controller) or its regulators — including the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Consumer Financial Protection Bureau (CFPB) — may audit Skybridge's processing activities with thirty (30) days' advance written notice. The audit right may be exercised no more th

1. Standing Audit Readiness File. Rebecca Muñoz should maintain a standing audit readiness file containing the following documents, updated on a rolling basis: (a) the current SOC 2 Type II report; (b) the most recent penetration test summary report; (c) the current certificate of cyber-liability insurance; (d) the current sub-processor list (SCC Annex III / DPA Schedule C); (e) the data processing description (DPA S

2. Designated Audit Contacts. Rebecca Muñoz is designated as the primary point of contact for audit requests, with Thomas Elridge serving as the secondary contact. All audit requests should be routed to Rebecca Muñoz upon receipt and acknowledged within five (5) business days.

3. On-Site Audit Coordination. If an on-site audit is requested — for example, following a data breach or in connection with a regulatory examination — Rebecca Muñoz should coordinate the logistics of the audit with Meridian's VP Third-Party Risk Management Marcus Tibaldi. On-site audits should be conducted at mutually agreed times during normal business hours, and Skybridge should designate appropriate personnel to

4. Twelve-Month Audit Window. The twelve-month limitation on routine Controller audits should be tracked to ensure that Skybridge does not inadvertently consent to more than one routine audit per twelve-month period. If Meridian requests an audit within twelve months of a prior audit, Skybridge should confirm whether the request is triggered by a breach or regulatory inquiry (which would be exempt from the limitation

5. Pooled Audits for Multiple Controllers. As Skybridge onboards additional bank clients under the standardized DPA template, multiple Controllers may request audits during overlapping or closely spaced periods. To reduce operational disruption, Skybridge should consider proposing pooled or consolidated audit arrangements — for example, a single annual audit conducted by an independent third party on behalf of multip

XI. Post-Termination Data Retention and Deletion Contractual Obligation. DPA Section 9.3, in conjunction with SCC Clause 8.5, provides that upon the termination or expiration of the SaaS subscription agreement, Skybridge must retain all personal data processed under the DPA for a period of ninety (90) days solely for the purpose of returning the data to Meridian in a standard, machine-readable format or securely dele

1. Data Return and Deletion Procedures. Sanjay Dhillon should establish — and document — internal procedures and technical capabilities for: (a) the return of all personal data to Meridian in a standard, machine-readable format (e.g., CSV, JSON, or XML, as specified by Meridian at the time of termination); and (b) the certified deletion of all personal data, including data stored in backup systems, logs, and archival

2. Sub-Processor Coordination. Skybridge must ensure that its sub-processors — Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V. — have parallel data return and deletion obligations under their respective data processing agreements and sub-processing agreements. Sanjay Dhillon should confirm that the Skybridge–Osprey Cloud DPA (dated March 1, 2024) and the SBF Europe intra-group DPA both include pro

3. Legal Hold and Regulatory Retention Carve-Outs. Thomas Elridge should identify any legal hold obligations or regulatory data retention requirements — including those arising under the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act / Anti-Money Laundering (BSA/AML) regulations, or other applicable federal or state financial regulations — that may require Skybridge to retain certain categories of personal data

4. Calendar Contract Expiration. The anticipated contract expiration date (February 15, 2031) and the ninety-day post-termination window (expiring approximately May 16, 2031) should be calendared with at least one hundred eighty (180) days of advance notice to allow sufficient time for planning and coordination. This calendar entry should be updated if the contract is terminated early or renewed.

XII. Encryption and Security Standards Maintenance Contractual Obligation. DPA Schedule B and SCC Annex II set forth the specific technical and organizational security measures that Skybridge is required to implement and maintain throughout the term of the DPA. These measures include, without limitation: (a) Encryption at Rest: All personal data stored within the SBF Core platform must be encrypted using the Advanced

1. Ongoing Monitoring and Currency. Rebecca Muñoz and Sanjay Dhillon should continuously monitor industry developments, NIST guidance, and applicable regulatory standards to ensure that the encryption standards specified in the DPA remain current and adequate. Given the five-year term of the SaaS subscription agreement (through approximately February 2031), it is possible that advances in cryptography — including, po

2. Notice to Controller. If any changes to encryption protocols, key management practices, or other security standards specified in DPA Schedule B or SCC Annex II are implemented — whether in response to regulatory changes, industry developments, or security incidents — Thomas Elridge should assess whether notice to Meridian is required under the DPA and whether Schedule B and/or SCC Annex II require formal amendment

3. Sub-Processor Security Alignment. Skybridge must ensure that Osprey Cloud Infrastructure, Inc. maintains equivalent or stronger security measures at its US-East data center region (Ashburn, Virginia), its EU data center region (Frankfurt, Germany), and its disaster recovery secondary availability zone (Ashburn, Virginia). Rebecca Muñoz should periodically verify Osprey Cloud's security posture through review of Os