Contract analysis

I. PURPOSE AND BACKGROUND This memorandum provides practical, section-by-section instructions for Skybridge Fintech Ltd. ("Skybridge" or "SBF") to use the Data Processing Agreement negotiated with Meridian Federal Savings Bank ("Meridian") as the standard bank-grade DPA template for future FDIC-insured bank and credit union clients. The Meridian DPA was executed on February 15, 2026, and represents the culmination of

II. OVERVIEW OF THE TEMPLATE STRUCTURE Before proceeding to the provision-by-provision analysis, it is helpful to summarize the overall structure of the template DPA. The main body of the agreement is organized into the following sections:

1. Definitions — GDPR-aligned definitions of key terms used throughout the agreement

2. Scope of Processing — Description of the processing activities and the relationship between the parties

3. Processor Obligations — Core obligations of Skybridge as Processor, including duty to process only on documented instructions, confidentiality, and personnel obligations

4. Controller Obligations — Acknowledgements and obligations of the bank client as Controller

5. Sub-Processors — Framework for Skybridge's engagement of sub-processors, including the general authorization model, notice requirements, and flow-down obligations

6. Security Measures — Skybridge's technical and organizational measures, with detailed specifications in Schedule B

7. Data Breach Notification — Notification timelines, procedures, and cooperation obligations, with operational details in Schedule D

8. Audit Rights — Controller and regulator audit rights, including the SOC 2 report mechanism

9. Data Subject Rights — Processor cooperation with data subject access, correction, deletion, and portability requests

10. Liability and Indemnification — Liability caps, consequential damages exclusion, and indemnification obligations

11. International Data Transfers and SCCs — Framework for cross-border transfers, incorporation of SCCs, and supplementary measures including the EU-US Data Privacy Framework

12. Term and Termination — DPA term aligned with the SaaS subscription agreement, termination rights, and survival provisions

13. Data Return/Deletion — Post-termination obligations regarding return and secure deletion of personal data

14. Insurance — Processor's obligation to maintain cyber-liability insurance coverage

15. General Provisions — Miscellaneous provisions including notices, amendments, severability, entire agreement, and counterparts The Schedules (A through D) and the SCC package (Modules 2 and 3, Annexes I through III) supplement the main body and contain both standard and customer-specific content as described in detail in Sections III and IV below. It is important to note that the template was designed for the spec

III. STANDARD PROVISIONS — RETAIN UNCHANGED ACROSS ALL BANK CLIENTS The following provisions of the template DPA should remain substantively unchanged in each new bank client engagement. These provisions reflect either (a) legally mandated formulations (e.g., GDPR Article 28 requirements, SCC clauses), (b) Skybridge's actual operational practices and security posture, or (c) carefully negotiated positions that repres

I. Post-Termination Data Retention and Return/Deletion The template DPA provides that Skybridge shall retain personal data processed on behalf of the Controller for the duration of the SaaS subscription agreement plus 90 calendar days following termination or expiration of the subscription agreement (the "Post-Termination Period"). During the Post-Termination Period, the Controller may request the return of its perso

Clause 17 Governing Law: The SCCs are governed by the law of the Netherlands. This choice is standard across all Skybridge bank clients, as it is determined by the location of Skybridge's EU establishment (Skybridge Fintech Europe B.V., Amsterdam, the Netherlands), and should not be altered. Supplementary Measure — EU-US Data Privacy Framework. The template DPA references Skybridge's self-certification under the EU-U

IV. CUSTOMER-SPECIFIC PROVISIONS — REQUIRING ADAPTATION FOR EACH BANK CLIENT The following provisions of the template DPA contain elements that must be adapted for each new bank client engagement. For each provision, we identify the customer-specific elements, provide instructions for populating those elements, and offer negotiation guidance where applicable. A. Party Identification and Recitals The opening provision

I. Regulatory Supervisor References The Meridian DPA references the OCC, FDIC, and CFPB as Meridian's regulatory supervisors. For each new bank client, the regulatory supervisor references throughout the DPA (including in the recitals, audit rights provisions, and Schedule D) must be updated to reflect the client's actual regulatory supervisors based on its charter type. The following chart provides guidance: It is e

V. TYPICAL BANK NEGOTIATION POINTS AND RECOMMENDED POSITIONS Beyond the customer-specific adaptations described in Section IV, certain provisions of the template DPA are likely to be the subject of negotiation with bank clients and their outside counsel. The following summarizes the most common negotiation points and Skybridge's recommended positions. A. Limitation of Liability — Consequential Damages Exclusion The t