Contract analysis

From: Priscilla Wynn <pwynn@calderwoodharkness.com> To: Thomas Elridge <telridge@skybridgefintech.com> Cc: Kevin Ostrowski <kostrowski@calderwoodharkness.com> Date: Thu, 08 Jan 2026 05:47:00 -0000 Subject: Summary of Key Issues Call with Blackwell Raines — DPA Negotiation [Matter No. 1009-00004]

Thank you for joining the first portion of this afternoon's call — your input on the audit rights framework and breach escalation procedures was very helpful in moving those items forward. This email provides a full summary of the key issues call held today, January 8, 2026, between Calderwood & Harkness and Blackwell, Raines & Stoddard LLP ("BRS") regarding the customer-facing Data Processing Agreement between Skybr

- **Calderwood & Harkness LLP:** Kevin Ostrowski (Partner), Priscilla Wynn (Associate), Alan Burke (Associate) - **Blackwell, Raines & Stoddard LLP:** Constance Liu (Partner), Derek Faulkner (Associate) - **Skybridge Fintech Ltd.:** Thomas Elridge (General Counsel / Chief Privacy Officer) — joined for the first 30 minutes

Meridian's VP of Third-Party Risk Management, Marcus Tibaldi, and Chief Compliance Officer, Andrea Sokolov, did not participate, though Constance Liu indicated she would be briefing both of them following the call.

**ISSUES WHERE SUBSTANTIAL PROGRESS WAS MADE**

BRS's December 20 markup proposed an uncapped liability structure for data breaches attributable to the Processor. On the call, we walked through our position in detail: a liability cap equal to the greater of (a) $5.0 million or (b) 2× the fees paid by Controller in the 12-month period preceding the claim. For Meridian specifically, based on the $2.74M annual contract value, this formula yields a cap of $5.48M (2 ×

Constance Liu acknowledged that this is within the range of what Meridian's TPRM program has accepted from other critical vendors and indicated she believes Meridian will accept the formula structure, though she reserved on the specific dollar floor pending internal discussion with Marcus Tibaldi. We also emphasized that Skybridge maintains cyber-liability insurance through Bastion Mutual Insurance Company with $10M

*Status: Substantially resolved; awaiting Meridian internal confirmation on the $5.0M floor.*

**2. Indemnification Scope — Regulatory Fines Carve-Out**

This was a key area of discussion. The central question is whether Skybridge's indemnification obligation extends to regulatory fines and penalties imposed on Meridian arising from Skybridge's breach of the DPA. BRS's markup included broad indemnification covering all regulatory fines without qualification.

We proposed limiting indemnification for regulatory fines to those that are: (i) directly resulting from Skybridge's material breach of the DPA; (ii) permissible to be indemnified under applicable law (noting that some jurisdictions prohibit indemnification of penalties); and (iii) subject to the overall liability cap.

Constance Liu pushed back on application of the liability cap to regulatory fines, arguing that OCC and FDIC enforcement actions could far exceed the cap. We maintained that the cap must apply to all claims, including regulatory fines, in order to keep the DPA commercially viable as a template across Skybridge's bank client base. We also discussed that Meridian's regulatory supervisors include the OCC, FDIC, and CFPB

*Status: Partially resolved on the "permissible under applicable law" qualifier; the question of whether regulatory fines are subject to or carved out from the liability cap remains open (see Open Item #1 below).*

BRS's December 20 markup requested unlimited on-site audit rights with 15 days' notice. We proposed and discussed the following framework, to which BRS appeared receptive:

- Controller (or its designated third-party auditor) may conduct an audit no more than once per 12-month period, with 30 days' advance written notice, at Controller's expense. - Skybridge may satisfy audit requests by providing its current SOC 2 Type II report (issued by Graystone & Ketchum LLP; current report covers the period October 1, 2024 through September 15, 2025) and written responses to a reasonable suppleme

Constance Liu confirmed this framework is consistent with Meridian's TPRM program requirements.

*Status: Substantially resolved; language reflected in the second redline.*

We reached agreement on a general written authorization model with 30-day prior written notice before engaging any new sub-processor. Controller has the right to object to a new sub-processor within the 30-day notice period on reasonable grounds related to data protection. If Controller objects and the parties cannot resolve the objection within 15 days, Controller may terminate the affected processing (not the entir

- **Osprey Cloud Infrastructure, Inc.** — IaaS/PaaS hosting; US-East data center region in Ashburn, VA, and EU data center region in Frankfurt, Germany - **Skybridge Fintech Europe B.V.** — EU personal data processing; Amsterdam, Netherlands (KvK 82104593)

We also noted the existing Skybridge–Osprey Cloud DPA dated March 1, 2024, which includes Module 3 SCCs (processor-to-sub-processor), and confirmed that flow-down obligations will mirror the customer-facing DPA.

*Status: Resolved; to be reflected in Schedule C and the second redline.*

We confirmed mutual agreement on a 48-hour notification timeline from the point at which Skybridge becomes aware of a Personal Data Breach. This aligns with Meridian's TPRM requirements. We noted that the separate bank-to-regulator notification obligation under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) is 36 hours for "notification incidents," but that is Meridian's obligation, not Sk

The escalation matrix, to be set forth in Schedule D, is as follows:

Skybridge CISO (Rebecca Muñoz) → Skybridge GC (Thomas Elridge) → Meridian CCO (Andrea Sokolov) and VP TPRM (Marcus Tibaldi)

1. **Regulatory Fines and the Liability Cap.** Whether indemnification for regulatory fines imposed on Meridian arising from Skybridge's breach is subject to the overall liability cap or carved out. BRS's position is that regulatory fines should be carved out from the cap; our position is that the cap must apply to all claims. This is the most commercially significant open item in the negotiation.

2. **DPIA Cooperation — Scope and Cost Allocation.** BRS's markup requires Skybridge to provide "all assistance reasonably requested" by Meridian for Data Protection Impact Assessments under GDPR Article 35 and under the anticipated NJ Data Privacy Act (S3377, expected effective January 15, 2026). We agreed to the cooperation obligation in principle but proposed that DPIA assistance beyond a reasonable baseline (to b

3. **SCC Clause 17 Governing Law.** BRS initially proposed that the Standard Contractual Clauses be governed by Irish law. We proposed the law of the Netherlands, reflecting that Skybridge Fintech Europe B.V. is the EU establishment and EU data processing activities occur in the Netherlands. Constance Liu indicated she would consult with Meridian's compliance team and revert. For the avoidance of doubt, the DPA itsel

4. **Definition of "Personal Data Breach" — Inclusion of Unsuccessful Attempts.** BRS's markup defines "Personal Data Breach" to include unsuccessful security incidents (e.g., unsuccessful login attempts, port scans) that do not result in unauthorized access to personal data. Our position is that the definition should be limited to incidents that result in actual unauthorized access, disclosure, alteration, or destru

- **January 8, 2026:** Calderwood & Harkness transmits the second redline to BRS (being sent today), reflecting the resolutions described above. - **January 8–13:** Thomas and Rebecca — we would appreciate your review of the second redline, with particular attention to the updated audit rights framework (Section 8) and the breach notification procedures (Schedule D). - **~January 13–14:** Anticipated BRS response to

As noted, the second redline of the DPA is being transmitted separately via Kevin's formal letter to Constance Liu. For your internal use, I am attaching the updated key terms comparison matrix (spreadsheet format) prepared by Alan, which tracks our positions, BRS's positions, and current status for each negotiated provision.

Thomas, please let me know if it would be helpful to schedule a call — with Rebecca and/or Sanjay Dhillon — to walk through the second redline in detail before BRS responds. I expect we can find time early next week. I would also note that Kevin is available to discuss the regulatory fines / liability cap issue specifically, as it will likely require a commercial decision from Skybridge's leadership — potentially Nad

Please don't hesitate to reach out with any questions in the meantime.

**Priscilla Wynn** Associate, Privacy & Data Security Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103 T: (215) 554-3192 E: pwynn@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email and any attachments are privileged and confidential, and are intended solely for the use of the individual or entity to whom they are addressed. This communication may contain information protected by the attorney-client privilege, the work product doctrine, or other applicable protections. If you are not the intended recipient, please notify the sender immediately, delete this mes