Contract analysis

I. Introduction and Acknowledgment of Receipt Thank you for transmitting Meridian's first markup of the Master Software-as-a-Service Agreement (the "MSA"), the Order Form, the Service Level Agreement (Exhibit A, the "SLA Exhibit"), the Security Exhibit (Exhibit B, the "Security Exhibit"), the Data Processing Addendum (Exhibit C, the "DPA"), and the Acceptable Use Policy (Exhibit D, the "AUP") relating to Meridian's p

II. Summary of Open Issues For ease of reference, the following table identifies the eight open negotiation issues addressed in this letter, together with the relevant document section references: Each of these issues is addressed in detail in the sections that follow.

III. Issue 1 — SLA Uptime Standard (Exhibit A, Section 2.1) A. Meridian's Position We understand that Meridian's markup proposes to increase the monthly platform availability commitment from 99.9% to 99.95%, in each case measured exclusive of scheduled maintenance windows and Force Majeure events as defined in the MSA. B. Skybridge's Counter-Position Skybridge respectfully maintains its proposed monthly uptime target

IV. Issue 2 — SLA Credit Cap (Exhibit A, Section 3.2) A. Meridian's Position Meridian's markup proposes to eliminate the monthly and annual caps on SLA credits — in effect, making credits uncapped such that there would be no ceiling on the total credits Meridian could claim in any given month or year. B. Skybridge's Counter-Position Skybridge maintains that SLA credits must be subject to defined monthly and annual ca

V. Issue 3 — Data Breach Indemnification Cap (MSA, Section 12.3(b)) A. Meridian's Position Meridian's markup proposes that Skybridge's indemnification obligation for data breaches — specifically, breaches of Skybridge's data security and confidentiality obligations resulting in the unauthorized access to, disclosure of, or exfiltration of Meridian data — be entirely uncapped, with no dollar limitation on Skybridge's

VI. Issue 4 — Consequential Damages Carve-Out for Regulatory Fines (MSA, Section 11.2(b)) A. Meridian's Position Meridian's markup seeks to carve out regulatory fines and penalties from the mutual exclusion of indirect, incidental, consequential, and punitive damages set forth in MSA Section 11.2(a). Under Meridian's proposed revision, Skybridge would be liable for regulatory fines imposed on Meridian by the Office o

VII. Issue 5 — Security Incident Notification Window (Exhibit B, Section 5.1) A. Meridian's Position Meridian's markup proposes that Skybridge be required to notify Meridian of any confirmed Security Incident (as defined in the Security Exhibit) affecting Meridian data within twelve (12) hours of Skybridge's discovery of the incident. B. Skybridge's Counter-Position Skybridge's initial draft proposed a twenty-four (2

VIII. Issue 6 — Penetration Testing Scope (Exhibit B, Section 7.3) A. Meridian's Position Meridian's markup requests the right to conduct annual penetration testing of the SkyComply™ platform at Meridian's expense, encompassing both application-layer testing and infrastructure-layer testing. B. Skybridge's Counter-Position Skybridge's initial draft limits Meridian-initiated penetration testing to application-layer te

IX. Issue 7 — Confidentiality/Data Security Super-Cap (MSA, Section 11.4) A. Meridian's Position Meridian's markup proposes that liability for breaches of confidentiality and data security obligations be entirely uncapped — that is, carved out in full from the general aggregate liability cap — with no dollar limitation whatsoever on Skybridge's liability for such breaches. B. Skybridge's Counter-Position Skybridge pr

X. Issue 8 — Additional Insured Status on Cyber Liability Policy (MSA, Section 14.2) A. Meridian's Position Meridian's markup requests that Meridian be named as an additional insured on (i) Skybridge's technology errors & omissions / cyber liability insurance policy (Coastal Assurance Corporation, Policy No. CA-TECH-2025-07831) and (ii) Skybridge's commercial general liability ("CGL") insurance policy. B. Skybridge's

XI. Summary of Accepted Revisions For completeness and to confirm the substantial areas of agreement between the parties, Skybridge has accepted — in whole or with minor clarifying modifications reflected in the enclosed redline — a number of Meridian's proposed revisions across the MSA and Exhibits A through D. The principal accepted revisions include, without limitation, the following: (a) Regulatory Examination Ri

XII. Proposed Path Forward The eight issues identified in Sections III through X of this letter represent the remaining substantive gaps between the parties' positions. We are encouraged by the significant areas of agreement reflected in Section XI and believe that the remaining open issues are capable of resolution through focused and constructive negotiation. Skybridge is committed to reaching mutually acceptable t

XIII. Reservation of Rights Nothing in this letter constitutes, or shall be construed as constituting, a binding agreement between Skybridge and Meridian with respect to the MSA, the Order Form, any Exhibit, or any other matter discussed herein. All terms, positions, and proposals discussed in this letter are subject to final agreement on all open issues, mutual satisfaction of all conditions, and execution and deliv

1. Annotated Redline of Master Software-as-a-Service Agreement (reflecting Skybridge's responses to Meridian's first markup)

2. Annotated Redline of Exhibit A (Service Level Agreement)

3. Annotated Redline of Exhibit B (Security Exhibit)

4. Annotated Redline of Exhibit C (Data Processing Addendum)

5. Annotated Redline of Exhibit D (Acceptable Use Policy) cc: (via email) Angela Fontaine, Esq., Partner, Calderwood & Harkness LLP Liam Prescott, Esq., Senior Associate, Calderwood & Harkness LLP David Shimura, Esq., General Counsel, Skybridge Fintech Ltd. Catherine Woo, Esq., Associate General Counsel (Technology), Meridian National Bank, N.A. Megan Faircloth, Esq., Senior Associate, Hargrove, Tully & Cascade Insur