Contract analysis

1. PURPOSE AND SCOPE 1.1. This Schedule C (the "Schedule") is attached to and forms an integral part of the Data Processing Agreement dated February 15, 2026 (the "DPA"), entered into by and between Meridian Federal Savings Bank, a federally chartered savings bank organized under the laws of the United States and operating pursuant to Office of the Comptroller of the Currency Charter No. 14-2238, with its principal o

2. GENERAL WRITTEN AUTHORIZATION 2.1. Authorization. Controller hereby provides general written authorization for Processor to engage sub-processors to process Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement, subject to the conditions set forth in this Schedule C and the DPA. 2.2. Legal Basis. This general written authorization is provided in accordan

3. NOTICE AND OBJECTION PROCEDURE FOR NEW SUB-PROCESSORS 3.1 Prior Written Notice 3.1.1. Processor shall provide Controller with no less than thirty (30) calendar days' prior written notice before engaging any new sub-processor, or before replacing any existing sub-processor, to process Personal Data on Controller's behalf under the DPA (a "Sub-Processor Change Notice"). 3.1.2. Such Sub-Processor Change Notice shall

4. APPROVED SUB-PROCESSOR LIST The following sub-processors have been approved by Controller as of the Effective Date for the processing of Personal Data on Controller's behalf in connection with the services provided under the DPA and the SaaS Agreement. This list constitutes the initial Approved Sub-Processor List and shall be updated from time to time in accordance with Sections 3 and 8 of this Schedule. Sub-Proce

5. FLOW-DOWN OBLIGATIONS 5.1. Processor shall ensure that each sub-processor listed in the Approved Sub-Processor List set forth in Section 4 above, and each sub-processor added to the Approved Sub-Processor List in accordance with the notice and objection procedures set forth in Section 3, is bound by a written data processing agreement (a "Sub-Processing Agreement") executed prior to the commencement of any process

6. PROCESSOR'S ONGOING OBLIGATIONS REGARDING SUB-PROCESSORS 6.1. Maintenance of Sub-Processor List. Processor shall maintain an up-to-date and accurate list of all sub-processors engaged to process Controller's Personal Data (the "Current Sub-Processor List"), and shall make such list available to Controller upon written request within five (5) business days. Processor shall also publish the Current Sub-Processor Lis

7. INSURANCE 7.1. Processor shall ensure that its engagement of sub-processors does not diminish, limit, or otherwise adversely affect the cyber-liability insurance coverage required under Section 14.3 of the DPA. As of the Effective Date, Processor maintains cyber-liability insurance through Bastion Mutual Insurance Company (Policy No. CYB-2025-04821), with the following coverage limits: (a) Per-Occurrence Coverage:

8. UPDATES TO THIS SCHEDULE 8.1. This Schedule C shall be updated by Processor from time to time as sub-processors are added to, removed from, or replaced on the Approved Sub-Processor List, in accordance with the notice and objection procedures set forth in Section 3 of this Schedule. 8.2. Updated versions of this Schedule shall be provided to Controller in writing (including by email to the designated contacts iden

9. INTERACTION WITH SCC ANNEX III 9.1. This Schedule C is intended to be consistent with, and supplementary to, SCC Annex III (List of Sub-processors) appended to the Standard Contractual Clauses package forming part of the DPA. The information set forth in Section 4 of this Schedule has been used as the basis for completing SCC Annex III, and the parties acknowledge that SCC Annex III is derived from and should be r

10. INCORPORATION AND CROSS-REFERENCES 10.1. This Schedule C is incorporated by reference into the Data Processing Agreement dated February 15, 2026, entered into by and between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), and forms an integral part thereof. 10.2. No separate signature is required for this Schedule C. This Schedule C shall become effective upon, and is deemed exe