Contract analysis

I. Data Processing Agreement — Execution Version Enclosed is the execution-ready Data Processing Agreement, dated February 5, 2026, between Meridian Federal Savings Bank, in its capacity as Controller, and Skybridge Fintech Ltd., in its capacity as Processor, governing the processing of personal data by Skybridge in connection with the services provided under the Subscription Agreement. The DPA is governed by the law

II. DPA Schedules The following Schedules are appended to and form an integral part of the DPA: Schedule A: Description of Processing. Schedule A sets forth a detailed description of the processing activities to be carried out by Processor on behalf of Controller, including: (i) the categories of data subjects, encompassing approximately 412,000 Meridian accountholders, authorized signers on deposit and lending accou

III. Standard Contractual Clauses — Full Execution-Ready Package Enclosed is the execution-ready Standard Contractual Clauses package, prepared pursuant to the European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as published in the Official Journal of the European Union (OJ L 199, 7.6.2021, pp. 31–61). The SCC package is appended to and forms part of the DPA. The package incorporates the followin

IV. Additional Enclosed and Supplementary Materials For your reference and records, we note the following supplementary materials: Skybridge maintains a current self-certification under the EU-U.S. Data Privacy Framework ("DPF"), Certification ID: DPF-2025-03912, effective as of July 1, 2025. Skybridge's DPF self-certification is listed on the Data Privacy Framework Program website maintained by the International Tra

V. Requested Actions by Meridian In order to maintain the parties' agreed-upon timeline for execution on February 15, 2026, we respectfully request the following actions by Meridian and its counsel:

1. Review and Approval. We request confirmation that Meridian's management team — including Chief Executive Officer Lawrence C. Driscoll, General Counsel Vanessa Hartwell, Chief Compliance Officer Andrea Sokolov, and Vice President, Third-Party Risk Management, Marcus Tibaldi — has completed its review of the execution-ready DPA and SCC package enclosed herewith, and that Meridian has approved the package in all mate

2. Board or Management Sign-Off. We request confirmation that any required board-level or senior management sign-off on Meridian's part can be obtained no later than February 10, 2026, consistent with the execution timeline agreed upon by the parties. If any additional internal governance approvals are required at Meridian (e.g., approval by the board's technology or risk committee), we would appreciate prompt notice

3. Officer's Certificate. We request that Meridian deliver, in advance of the February 15, 2026 signing date, an officer's certificate confirming the authority of the designated signatory (CEO Lawrence C. Driscoll) to execute the DPA and SCC package on behalf of Meridian Federal Savings Bank, and confirming that all requisite corporate authorizations and approvals have been duly obtained. We note for your reference t

VI. Execution Logistics We propose that the DPA and SCC package be executed by counterpart signature pages on February 15, 2026. Enclosed herewith are the pre-prepared signature pages for each party's execution. The signature pages include execution blocks for the following parties and documents: • Data Processing Agreement: Meridian Federal Savings Bank (to be executed by Lawrence C. Driscoll, Chief Executive Office

VII. Closing Remarks We wish to express our sincere appreciation for the collaborative and professional manner in which Blackwell, Raines & Stoddard LLP has engaged throughout this negotiation process. In particular, the contributions of you and your colleague Derek Faulkner have been instrumental in facilitating the efficient resolution of complex data protection, regulatory, and commercial issues, and we are please

1. Data Processing Agreement — Execution Version (dated February 5, 2026)

2. Schedule A: Description of Processing

3. Schedule B: Security Measures

4. Schedule C: Approved Sub-Processor List

5. Schedule D: Data Breach Notification Procedures

6. Standard Contractual Clauses — Full Execution-Ready Package (Modules 2 and 3, with Annexes I, II, and III)

7. Signature Pages — DPA and SCC Package cc: Thomas Elridge, General Counsel / Chief Privacy Officer, Skybridge Fintech Ltd. Derek Faulkner, Esq., Blackwell, Raines & Stoddard LLP Priscilla Wynn, Esq., Calderwood & Harkness LLP Alan Burke, Esq., Calderwood & Harkness LLP