Contract analysis

From: Kevin Ostrowski <kostrowski@calderwoodharkness.com> To: Thomas Elridge <telridge@skybridgefintech.com> Cc: Priscilla Wynn <pwynn@calderwoodharkness.com> Date: Fri, 30 Jan 2026 05:47:00 -0000 Subject: Skybridge / Meridian DPA-SCC Negotiations — Status Update and Resolution of Open Items [C&H Matter No. 1009-00004]

I'm pleased to report that we had a productive call this afternoon with Constance Liu and Derek Faulkner at Blackwell, Raines & Stoddard, during which we reached agreement on the four remaining open items in the DPA and SCC package with Meridian Federal Savings Bank. Priscilla, Alan, and I were on the line for Calderwood & Harkness, and Marcus Tibaldi (VP, Third-Party Risk Management) and Andrea Sokolov (Chief Compli

This has been a detailed and at times painstaking negotiation since we kicked off on November 20, but we are now at the finish line. Below is a summary of today's resolutions, the status of the broader package, and the path to execution.

The following items had remained open as of the near-final DPA circulated on January 22, 2026. Each is now fully resolved.

As you'll recall, Meridian initially sought uncapped liability for data breaches, and we countered with a structured cap. The agreed formulation is as follows:

Skybridge's aggregate liability under the DPA is capped at the **greater of (a) $5,000,000 or (b) two times (2×) the fees paid by Controller in the twelve-month period immediately preceding the claim giving rise to liability**.

For Meridian specifically, based on the $2.74M annual contract value, the operative cap is $5.48M (since 2 × $2.74M = $5.48M, which exceeds the $5.0M floor). BRS confirmed Meridian's acceptance of this structure on the call.

I'd note that this formula is designed to function as a scalable template provision for future bank clients, keyed to each client's ACV — a point I'll return to below.

**2. Indemnification Scope — Regulatory Fines**

The central question here was whether Skybridge's indemnification obligation extends to regulatory fines and penalties imposed on Meridian arising from Skybridge's breach of the DPA. The agreed position is:

Skybridge shall provide indemnification to Controller for third-party claims arising from Skybridge's breach of the DPA, **including regulatory fines to the extent permissible under applicable law**, subject to the liability cap described in Item 1 above. Critically, BRS agreed that the indemnification obligation sits within the overall DPA liability cap and does not constitute an uncapped carve-out. This is consiste

The indemnification provision is mutual — Controller also indemnifies Processor for claims arising from Controller's unlawful processing instructions — but the primary commercial focus throughout the negotiation was on Skybridge's indemnification of Meridian, and I believe we've landed in a balanced and defensible place.

**3. Audit Rights — Scope and Regulator Access**

Meridian (through BRS) had initially sought unlimited on-site audit rights with minimal notice. We negotiated this down to the following framework:

- Controller (or its designated third-party auditor) may audit Processor **once per twelve-month period**, with **30 days' advance written notice**, at Controller's expense. - Skybridge may satisfy audit requests by providing its **current SOC 2 Type II report** (most recent report issued by Graystone & Ketchum LLP on September 15, 2025, covering the period October 1, 2024 through September 15, 2025) and supplemental

BRS confirmed that both Andrea Sokolov and Marcus Tibaldi are satisfied with this framework.

**4. Sub-Processor Approval — Objection Remedy**

The remaining issue was what happens if Controller objects to a proposed new sub-processor during the notice period. The agreed resolution:

- **General written authorization** with **30-day prior written notice** before engaging any new sub-processor. - Controller has the right to object on **reasonable data protection grounds** within the 30-day window. - If Controller objects and the parties cannot resolve the objection within **15 additional business days**, Controller may **terminate the affected processing** (but not necessarily the entire DPA or su

The current approved sub-processor list remains unchanged: (1) **Osprey Cloud Infrastructure, Inc.** (IaaS/PaaS hosting, US-East Ashburn, VA and EU Frankfurt, Germany data center regions) and (2) **Skybridge Fintech Europe B.V.** (EU personal data processing, Amsterdam, Netherlands).

This objection-and-termination mechanism is consistent with GDPR Article 28(2) requirements and will carry over to the template.

The Standard Contractual Clauses package is finalized, with all Annexes locked as of the January 15 third redline:

- **Module 2 (Controller-to-Processor):** Meridian → Skybridge — finalized - **Module 3 (Processor-to-Sub-processor):** Skybridge → Osprey Cloud Infrastructure, Inc. — finalized - **Module 3 (Processor-to-Sub-processor):** Skybridge → Skybridge Fintech Europe B.V. (KvK No. 82104593) — finalized - **Annexes I** (Description of Transfer), **II** (Technical and Organizational Measures), and **III** (List of Sub-processo

The SCCs are governed by the law of the Netherlands per Clause 17 (Member State of SBF Europe). The DPA itself is governed by Delaware law.

The Transfer Impact Assessment that Alan prepared on December 8, 2025, addressing Schrems II / CJEU C-311/18 requirements and Skybridge's EU-US Data Privacy Framework self-certification (Certification ID DPF-2025-03912), remains current and will be kept on file.

For completeness, the remaining schedules are all finalized:

- **Schedule A (Description of Processing):** Covers approximately 412,000 Meridian accountholders (including ~3,200 EU-resident data subjects), authorized signers, beneficial owners, and Meridian employees. Categories of personal data include full name, DOB, SSN, TIN, account numbers, routing numbers, transaction data, IP addresses, device identifiers, geolocation, email, phone, and behavioral biometric data (keystr

- **Schedule B (Security Measures):** References SOC 2 Type II, AES-256 encryption at rest, TLS 1.2+ in transit, MFA for admin access, and annual penetration testing by Ironvault Security Group LLC.

- **Schedule C (Approved Sub-Processor List):** Osprey Cloud and SBF Europe, with 30-day notice and objection mechanics as resolved in Item 4 above.

- **Schedule D (Data Breach Notification Procedures):** 48-hour notification timeline from Skybridge becoming aware of a Personal Data Breach. Escalation matrix: CISO Rebecca Muñoz → GC Thomas Elridge → Meridian CCO Andrea Sokolov and VP TPRM Marcus Tibaldi. Cross-references to the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) 36-hour bank-to-regulator obligation.

1. **By February 5, 2026:** Calderwood & Harkness will circulate the execution-ready DPA and SCC package to BRS. Priscilla and Alan are incorporating the final resolutions from today's call into clean execution versions now.

2. **February 5–10:** Both parties' management and board review and sign-off. Tom, could you confirm that Nadia will be available during this window to review and approve as the anticipated Skybridge signatory? BRS indicated that Lawrence C. Driscoll (Meridian CEO) will be signing on the Meridian side.

3. **February 10:** Target date for board/management sign-off on both sides.

4. **February 15, 2026:** Target signing date — DPA and SCC package to be executed concurrently with the SaaS subscription agreement (5-year term, $2.74M/yr ACV, $13.7M TCV).

The following ancillary items must be in hand by execution:

- **Officer's certificate** from Skybridge certifying authority to execute (Tom — this will be for your preparation and signature). - **Delivery of current SOC 2 Type II report** (Graystone & Ketchum LLP, September 15, 2025) to Meridian. - **Certificate of insurance** from Bastion Mutual Insurance Company (Policy No. CYB-2025-04821) evidencing cyber-liability coverage of $10M per occurrence / $20M aggregate. **One fl

Once the Meridian DPA is executed, Priscilla will prepare a customization guide memorandum explaining how to adapt this agreement as Skybridge's standard "bank-grade" template for future similarly situated bank clients. The liability cap formula (greater of $5.0M or 2× trailing-12-month fees) is designed to scale across different ACVs. Certain provisions — data subject volumes, specific regulatory supervisors, ACV fi

A brief note: the New Jersey Data Privacy Act (S3377), which took effect January 15, 2026, is now in force, and the DPA as negotiated addresses controller/processor obligations consistent with that statute. I've asked Alan to prepare a brief ongoing compliance obligations memo before closing, covering key recurring dates — insurance renewal, SOC 2 refresh, DPF re-certification, sub-processor list updates, and NJ S337

Tom and Nadia, thank you both for your engagement and trust throughout this negotiation. I also want to recognize Rebecca and Sanjay Dhillon — their responsiveness on technical and security questions was instrumental in keeping things moving, particularly during the audit rights and security measures discussions.

If either of you would like to walk through any of the resolved items before the execution-ready package goes out, I'm happy to schedule a brief call early next week. Just let me know your availability.

Finally, for your internal budgeting purposes, the matter remains on track within the fee estimate of $185,000–$225,000 (capped at $240,000). If you need an updated accrual figure, Rachel Bernstein on our end can provide one promptly.

Have a good weekend, and we'll be in touch early next week with the closing checklist and clean documents.

**Kevin M. Ostrowski** Partner Calderwood & Harkness LLP 1200 Avenue of the Americas, 34th Floor New York, NY 10036 T: (212) 555-4100 | D: (212) 555-4127 kostrowski@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the individual(s) to whom it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and work product doctrine. If you are not the intended recipient, any review, dissemination, distribution, copying, or other use of this com