Contract analysis

From: Amy Chesterton <achesterton@calderwoodharkness.com> To: Simone Alcott <salcott@alcottgrenier.com> Cc: Angela Fontaine <afontaine@calderwoodharkness.com> Subject: Skybridge Fintech Ltd. / Meridian National Bank, N.A. — MSA for Pinnacle Ridge Consent Review

We represent Skybridge Fintech Ltd. ("Skybridge") in connection with the negotiation and execution of an enterprise Software-as-a-Service agreement between Skybridge, as Licensor, and Meridian National Bank, National Association ("Meridian"), as Licensee, for the deployment of Skybridge's SkyComply™ AML and transaction-monitoring platform (Calderwood & Harkness Matter No. 1009-00007).

I am writing to transmit for review by Pinnacle Ridge Capital Partners, LP ("PRCP") the near-final Master Software-as-a-Service Agreement (the "MSA") and the related Order Form, together with a form of written consent for PRCP's execution. As you know, PRCP's contractual consent right is triggered with respect to Skybridge contracts exceeding $25,000,000 in total contract value. The transaction described below substa

**Summary of Transaction and Key Commercial Terms**

*Parties.* Skybridge Fintech Ltd. (Licensor) and Meridian National Bank, N.A. (Licensee).

*Nature of Agreement.* The MSA governs the deployment of SkyComply™, Skybridge's AI-driven AML and transaction-monitoring platform, across Meridian's retail banking, commercial banking, and wealth management divisions. By way of background, Meridian National Bank is a top-10 U.S. commercial bank by total assets (approximately $485 billion). Its holding company, Meridian Financial Group, Inc., is NYSE-listed, and Meri

*Total Contract Value (TCV).* $50,000,000 over a five-year initial term, exceeding the $25,000,000 PRCP consent threshold.

- Year 1 fees: $12,700,000, inclusive of platform subscription, a one-time implementation fee of $3,600,000, and support/managed services. - Years 2–5 annual fees: $9,325,000 per year. - The foregoing reflects a 6.72% volume discount from undiscounted TCV of $53,600,000. - 32,000 named licensed users, with incremental users priced at $275/user/year. - Quarterly-in-advance payment terms, net 30 days. - 3.0% annual CPI

*Initial Term.* Five years, commencing on the Platform Go-Live Date (targeted March 1, 2026), with an implementation period running from September 15, 2025 through February 28, 2026.

*Renewal.* Two successive one-year automatic renewal terms unless either party provides 180 days' written notice of non-renewal.

*Termination for Convenience.* Meridian may terminate after Year 2 upon 12 months' prior written notice and payment of an early termination fee equal to 50% of remaining annual contract value for the then-current term.

*Service Level Agreement.* The MSA provides for a platform availability target of 99.9% monthly uptime. This was a negotiated point—Meridian initially demanded 99.95%, which Skybridge was unable to accept. SLA credits are tiered from 5% to 30% of monthly subscription fees, subject to an annual credit cap of 15% of annual fees. Meridian holds a termination right if uptime falls below 98.0% in three of any consecutive

*Indemnification.* The parties have mutual indemnification obligations. Skybridge's intellectual property indemnification is uncapped. Data breach indemnification is subject to a separate negotiated cap (this was a heavily negotiated term). General indemnification obligations are capped at 1× annual fees (approximately $9,325,000).

*Limitation of Liability.* Aggregate liability is capped at 2× annual fees (approximately $18,650,000), with a separate super-cap for data security and confidentiality breaches at 3× annual fees (approximately $27,975,000). The MSA includes a mutual exclusion of consequential damages with limited carve-outs.

*Security.* Skybridge is required to maintain SOC 2 Type II and ISO 27001 certifications. Encryption standards are AES-256 at rest and TLS 1.2+ in transit. Data residency is restricted to the continental United States (Orion Cloud Services, Inc. US-East and US-West regions). The MSA includes security incident notification obligations, annual penetration testing requirements, and regulatory examination rights for fede

*Source Code Escrow.* A three-party escrow arrangement with Sentinel Escrow Services, Inc. (Escrow Agreement No. SCE-2025-04417) provides for customary release triggers.

*Insurance.* Skybridge is required to maintain technology E&O/cyber liability coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate. This coverage is currently maintained through Coastal Assurance Corporation.

I have also attached a form of written consent for PRCP's review and, if acceptable, execution by Elise Drummond as Managing Partner of Pinnacle Ridge Capital Partners, LP. The consent authorizes Skybridge's entry into the MSA and all related transaction documents with Meridian. We are happy to revise the form if Alcott & Grenier has any comments.

The MSA is near-final. A small number of remaining points are being closed out between our firm and Hargrove, Tully & Cascade Insurance Brokers, Meridian's outside counsel. As noted above, the implementation period is targeted to commence September 15, 2025 (or as promptly as practicable), and accordingly the parties are working toward execution in the near term. We would appreciate it if you could advise us of any q

Please do not hesitate to reach out if you would like to discuss the transaction or any specific provisions. I am happy to arrange a call with David Shimura or Angela Fontaine if that would be helpful.

**Amy Chesterton** Associate Calderwood & Harkness LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604 T: (312) 555-4218 E: achesterton@calderwoodharkness.com Matter Ref: 1009-00007

*CONFIDENTIALITY NOTICE: This email message and any attachments are intended solely for the use of the individual or entity to whom they are addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and attorney work product doctrine. If you are not the intended recipient, or an agent responsible for delivering this mes