Contract analysis

1. Client Information Client Full Legal Name: Skybridge Fintech Ltd. Short Names Used: Skybridge; SBF Entity Type: Delaware corporation (C-corp) Headquarters: 4100 Silverside Road, Suite 310, Wilmington, DE 19810 Year Founded: 2019 Business Description: Skybridge Fintech Ltd. is a software-as-a-service ("SaaS") fintech company that develops, operates, and licenses a proprietary platform branded as "SBF Core." SBF Cor

2. Matter Type and Description Practice Group: Privacy & Data Security Matter Number: 1009-00004 Matter Type: Data Processing Agreement / Standard Contractual Clauses — Negotiation and Drafting Description of Engagement: Calderwood & Harkness LLP ("C&H") has been engaged by Skybridge Fintech Ltd. ("Skybridge" or "Client") to finalize a standardized customer-facing Data Processing Agreement ("DPA") and Standard Contra

3. Opposing Party Full Legal Name: Meridian Federal Savings Bank Short Names: Meridian; MFSB Entity Type: Federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC") OCC Charter Number: 14-2238 Headquarters: 900 Broad Street, Suite 1200, Newark, NJ 07102 Key Personnel: Total Assets (as of December 31, 2024): $6.1 billion Total Deposits: $4.3 billion Retail Branches: 47 branches acr

4. Opposing Counsel Firm Name: Blackwell, Raines & Stoddard LLP Short Name: BRS Office Address: 200 Park Avenue, 31st Floor, New York, NY 10166 Lead Partner: Constance Liu, Partner, Financial Services / Data Privacy Practice Group. Ms. Liu is known to this firm from prior transactions and is regarded as an experienced and commercially reasonable negotiator in the bank TPRM and data privacy space. She is expected to t

5. Key Third Parties The following third parties are material to this engagement and should be reflected in the matter file: 5.1 Osprey Cloud Infrastructure, Inc. ("Osprey Cloud" or "OCI") Osprey Cloud Infrastructure, Inc. is a Delaware corporation with its headquarters at 2200 Campus Drive, San Jose, CA 95131. Its Chief Executive Officer is Martin Cho. Osprey Cloud serves as Skybridge's primary infrastructure-as-a-s

6. Engagement Team The following Calderwood & Harkness professionals are assigned to this matter: Kevin Ostrowski will serve as the responsible partner and primary relationship manager for this engagement. He will supervise all substantive work product and participate in key negotiation sessions with opposing counsel. Rachel Bernstein will serve as billing partner and will be responsible for billing oversight, invoic

7. Billing Arrangements Fee Arrangement: Hourly Estimated Total Fees: $185,000 – $225,000 This estimate reflects the anticipated scope of work described in Section 9, including the negotiation and drafting of the DPA and SCC package, preparation of all supporting schedules and annexes, completion of the Transfer Impact Assessment, and the development of Skybridge's standardized bank-grade DPA template with accompanyi

8. Conflict Check A comprehensive conflict check was completed on November 20, 2025, by Alan Burke, Working Associate, and was reviewed and cleared by Kevin Ostrowski, Responsible Partner. The following parties were run through the firm's conflict-checking system (SterlingConflict v4.2): • Meridian Federal Savings Bank (and all known affiliates and subsidiaries) • Halcyon Ridge Capital Partners, LP (and related fund

9. Scope of Representation The scope of Calderwood & Harkness's representation in this matter encompasses the following workstreams: 9.1 Review and Analysis of Meridian's TPRM Materials C&H will review and analyze Meridian's Third-Party Risk Management due-diligence questionnaire and Meridian's form Data Processing Agreement, both of which are expected to be received from BRS on or about November 25, 2025. The due-di

10. Data Processing Overview The following information summarizes the data processing activities that will be governed by the DPA/SCC package. This overview is based on information provided by Thomas Elridge and Rebecca Muñoz during the initial kickoff call on November 20, 2025, and is subject to refinement as the engagement progresses. 10.1 Data Subjects The personal data processed by Skybridge through SBF Core on b

11. Anticipated Timeline The following table sets forth the anticipated timeline for this engagement, based on discussions with Thomas Elridge during the initial kickoff call on November 20, 2025: This timeline is subject to adjustment based on the pace of negotiations and the complexity of open issues. The engagement team should plan staffing and resource allocation accordingly. Of particular note, the NJ Data Priva

12. Key Regulatory Considerations The DPA/SCC package must be drafted and negotiated with careful attention to the following regulatory frameworks, each of which imposes obligations on one or both parties: 12.1 OCC Bulletin 2023-17 (Third-Party Risk Management) OCC Bulletin 2023-17, issued June 6, 2023, and superseding OCC Bulletin 2013-29, establishes the OCC's expectations for the risk management of third-party rel

13. Special Considerations The following special considerations should be taken into account throughout this engagement: 13.1 Dual-Purpose Template The DPA must serve dual purposes. First, it must satisfy the specific TPRM requirements of Meridian Federal Savings Bank and be acceptable to Meridian's Chief Compliance Officer, VP of Third-Party Risk Management, and external counsel at BRS. Second, it must be structured

14. File and Administrative Notes The following administrative items are noted for the file:

1. Engagement Letter: The engagement letter for this matter was executed on November 20, 2025, by Thomas Elridge on behalf of Skybridge Fintech Ltd. and by Kevin Ostrowski on behalf of Calderwood & Harkness LLP.

2. Conflict Check Memorandum: A separate conflict check memorandum, documenting the full search parameters, results, and clearance analysis, is on file under Matter No. 1009-00004, dated November 20, 2025.

3. Document Filing: All documents, correspondence, work product, and communications related to this matter shall be filed and maintained under Matter No. 1009-00004 in the firm's document management system (SterlingDMS).

4. Invoice Direction: Client invoices are to be directed to: Thomas Elridge General Counsel / Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, DE 19810

5. Billing Partner Designation: Rachel Bernstein is designated as the billing partner for this matter and is responsible for reviewing all invoices prior to submission to the Client. This memorandum is intended solely for the internal use of Calderwood & Harkness LLP in connection with the administration of Matter No. 1009-00004. It is protected by the attorney-client privilege and the attorney work-product doctrine.