Contract analysis

From: Amy Chesterton <achesterton@calderwoodharkness.com> To: David Shimura <dshimura@skybridgefintech.com> Cc: Angela Fontaine <afontaine@calderwoodharkness.com> Subject: Skybridge / Meridian National Bank SaaS Agreement — Negotiation Status Update and Recommendations [1009-00007]

I hope this finds you well. I'm writing to provide a comprehensive status update on the negotiation of the Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, N.A. for the SkyComply™ platform.

As you know, we transmitted Skybridge's initial draft MSA and exhibits to Hargrove, Tully & Cascade Insurance Brokers (Meridian's outside counsel; lead partner Douglas Krenshaw, senior associate Megan Faircloth) on September 5. We have now received and thoroughly reviewed HTM's first markup on Meridian's behalf and have prepared Skybridge's counter-positions on all material points.

The purpose of this email is to: (1) summarize the eight key open negotiation issues, (2) recommend compromise positions on several of them, and (3) request your authority to present revised positions in advance of a scheduled call with Meridian's team. Given that implementation is targeted to commence on September 15 (now past) and Go-Live is set for March 1, 2026, we need to move efficiently to close out the remain

For context, a quick summary of the key commercial terms:

- **Total Contract Value:** $50,000,000 over a five-year initial term - **Named Users:** 32,000 for SkyComply™ - **Year 1 Fees:** $12,700,000 (includes $3,600,000 implementation fee and $1,800,000 support/managed services) - **Years 2–5 Fees:** $9,325,000/year - **Volume discount:** 6.72% applied - **Targeted Go-Live Date:** March 1, 2026; implementation period commencing September 15, 2025 - **Pinnacle Ridge Consent

**ISSUE-BY-ISSUE STATUS AND RECOMMENDATIONS**

Below is a detailed breakdown of each of the eight open issues, along with our recommended positions.

**Issue 1: SLA Uptime Standard** — STATUS: OPEN

- **Meridian's position:** 99.95% monthly uptime. - **Skybridge's position:** 99.9% monthly uptime. - **Analysis:** Orion Cloud Services' upstream platform SLA provides 99.95% monthly uptime. Committing to 99.95% downstream to Meridian leaves Skybridge with zero margin for any application-layer latency, configuration issues, or other factors beyond Orion Cloud's infrastructure. The industry benchmark for enterprise f

**Issue 2: SLA Credit Cap** — STATUS: OPEN

- **Meridian's position:** Uncapped SLA credits. - **Skybridge's position:** Monthly cap at 30% of monthly subscription fee; annual cap at 15% of annual subscription fee (maximum approximately $317,500/month and $1,905,000/year in Year 1; approximately $233,125/month and $1,398,750/year in Years 2–5). - **Meridian's additional protection:** Termination right if uptime falls below 98.0% in 3 of any consecutive 6 month

**Issue 3: Data Breach Indemnification Cap** — STATUS: OPEN — **MOST CONTENTIOUS ISSUE**

- **Meridian's position:** Uncapped indemnification for data breaches and unauthorized disclosure of Meridian data. - **Skybridge's position:** Cap at 2× annual fees paid in the preceding 12 months (approximately $18,650,000 in steady state based on $9,325,000 annual fees). - **Analysis:** This is the most contentious remaining issue in the negotiation, and it warrants detailed treatment.

Meridian, as a systemically important financial institution with approximately $485 billion in total assets and regulated by the OCC, Federal Reserve, and FDIC, faces potentially enormous exposure from a data breach involving nonpublic personal information under GLBA and personally identifiable information more broadly. HTM's position reflects the bank's view that the licensor should bear unlimited risk for its own s

However, uncapped data breach indemnification would expose Skybridge to liability that could be existential relative to its financial profile. With FY 2024 revenue of $78.3 million and EBITDA of $11.7 million, an uncapped obligation in connection with a major breach involving a SIFI counterparty could dwarf the economics of the deal and threaten the company's viability. The 2× annual fees cap (approximately $18.65 mi

- **Recommendation:** Hold firmly at the 2× annual fees cap as the initial position. If pressed further, I recommend the following fallback: offer a data security "super-cap" at 3× annual fees (approximately $27,975,000), structured as a separate, higher cap applicable solely to breaches of confidentiality and data security obligations. This would be distinct from the general aggregate liability cap of 2× annual fees

I want to flag that Jonathan Kreske should weigh in on the financial exposure analysis before we deploy the 3× fallback. **This issue requires your specific authority on whether we are authorized to present the 3× super-cap if Meridian will not accept the 2× cap.**

**Issue 4: Consequential Damages — Regulatory Fines Carve-Out** — STATUS: OPEN

- **Meridian's position:** Carve out regulatory fines and penalties from the mutual exclusion of consequential damages — meaning Skybridge would be liable for Meridian's regulatory fines arising from a Skybridge breach. - **Skybridge's position:** Standard mutual exclusion of indirect, incidental, consequential, and punitive damages, with existing carve-outs only for breaches of confidentiality, IP indemnification, a

**Issue 5: Security Incident Notification Window** — STATUS: OPEN

- **Meridian's position:** 12 hours from discovery of a confirmed Security Incident affecting Meridian data. - **Skybridge's position:** 24 hours from discovery. - **Analysis:** Amara Okafor has confirmed that 24 hours is the minimum time needed for Skybridge's incident response team to conduct initial triage, confirm the scope of the incident, and prepare a meaningful notification. A 12-hour window risks premature,

**Issue 6: Penetration Testing Scope** — STATUS: OPEN

- **Meridian's position:** Right to conduct annual penetration testing at Meridian's expense covering both application-layer and infrastructure-layer testing. - **Skybridge's position:** Meridian-initiated testing limited to application-layer only; infrastructure-layer testing requires Skybridge's prior written consent. - **Analysis:** Infrastructure-layer penetration testing implicates Orion Cloud Services' environm

**Issue 7: Confidentiality / Data Security Super-Cap** — STATUS: OPEN

- **Meridian's position:** Uncapped liability for breaches of confidentiality and data security obligations. - **Skybridge's position:** Separate super-cap of 3× annual fees (approximately $27,975,000), above the general aggregate liability cap of 2× annual fees (approximately $18,650,000). - **Analysis:** This issue is closely linked to Issue 3 and should be presented as a package. The super-cap is designed to provi

**Issue 8: Additional Insured Status on Cyber Policy** — STATUS: OPEN (Pending Coastal Assurance Response)

- **Meridian's position:** Named as additional insured on Skybridge's technology E&O / cyber liability policy (Coastal Assurance, Policy No. CA-TECH-2025-07831) and CGL policy. - **Skybridge's position:** Under review with Coastal Assurance. - **Analysis:** We have sent a preliminary inquiry to Coastal Assurance regarding the feasibility of adding Meridian as additional insured. CGL additional insured endorsements ar

Catherine Woo (Associate General Counsel, Technology, Meridian) and Douglas Krenshaw (HTM) have proposed a call to discuss the remaining open points. I recommend that you participate directly — a principals-level discussion between you and Catherine may be particularly effective for resolving the most contentious items, especially the data breach indemnification cap and the regulatory fines carve-out. If you prefer,

We should aim to schedule this call within the next week to keep the timeline on track. The implementation commencement date of September 15 has already passed, and any further delays in finalizing the MSA will compress the implementation timeline and put the March 1, 2026 Go-Live Date at risk.

David, I would appreciate your direction on the following specific points so that we can prepare the revised draft and be ready for the call with Meridian's team:

1. **SLA Credit Tiers (Issue 2):** Permission to present the enhanced SLA credit tiers (5% → 7.5% at Tier 1; 10% → 15% at Tier 2) as a tradeoff for holding firm at 99.9% uptime.

2. **Data Security Super-Cap (Issues 3 and 7):** Permission to deploy the 3× annual fees data security super-cap (~$27,975,000) as a fallback position on the data breach indemnification cap and confidentiality/data security super-cap. This is the most significant authority request.

3. **Regulatory Fines Carve-Out (Issue 4):** Guidance on whether Skybridge will consider any version of a regulatory fines carve-out from the consequential damages exclusion, even as a last resort and subject to the super-cap.

4. **Incident Notification (Issue 5):** Confirmation that the 18-hour compromise with tiered telephonic/written notification is acceptable to Skybridge's security operations team.

5. **Penetration Test Report Sharing (Issue 6):** Authorization to share Crestfield Cyber Advisors penetration test results with Meridian as part of the pen testing scope compromise. Note: this may require Marcus Holt's sign-off given the sensitivity of the reports.

I would also recommend that you loop in Jonathan Kreske on the financial exposure analysis related to the data breach indemnification cap and super-cap (Issues 3 and 7), and Amara Okafor on the security operational items (Issues 5 and 6), to the extent you haven't already.

As noted above, the Pinnacle Ridge consent process is being initiated in parallel. I am preparing the supporting materials for Simone Alcott at Alcott & Grenier LLP and will circulate a draft of the consent request for your review early next week.

The following documents have been separately transmitted or are available in the deal room for your reference:

- Skybridge's initial draft MSA and exhibits - HTM's first markup with C&H response annotations - Deal Summary and Negotiation Strategy Memo - SLA Terms Analysis Memo - Indemnification and Liability Cap Analysis Memo

Once you approve the recommended positions, we will prepare the second revised draft of the MSA and exhibits for transmission to HTM.

David, I know this is a lot to digest. I'd welcome the opportunity to schedule a call with you — and Angela and Liam as needed — to walk through these issues before we engage with Meridian's team. Please let me know your availability over the next few days, and we will get something on the calendar.

Thank you for your time, and please don't hesitate to reach out with any questions in the interim.

**Amy Chesterton** Associate Calderwood & Harkness LLP 200 South Ashbury Asset Advisors, Suite 1800 Chicago, IL 60604 T: (312) 555-0184 | F: (312) 555-0100 achesterton@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. This communication may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and attorney work product doctrine. If you are not the intended recipient, any dissemination, distribution, or copying of this commu