Contract analysis

I. Purpose and Executive Summary The purpose of this memorandum is threefold. First, it provides a comprehensive summary of the key terms of the proposed enterprise Software-as-a-Service agreement between our client, Skybridge Fintech Ltd. ("Skybridge" or "SBF"), as licensor and SaaS provider, and the counterparty, Meridian National Bank, National Association ("Meridian" or "MNB"), as licensee. Second, it identifies

II. Transaction Overview A. The Parties Skybridge Fintech Ltd. Skybridge Fintech Ltd. is a Delaware limited company (alternative entity) with its headquarters at 1400 Concord Pike, Suite 320, Wilmington, Delaware 19803. Skybridge is a growth-stage financial technology SaaS company founded in 2018 that specializes in compliance automation solutions for the banking and financial services industry. Its flagship product,

III. Summary of Eight Key Open Negotiation Issues Based on our review of Meridian's initial term sheet comments, the preliminary discussions between Tara Bellingham and Luis Arriaga, and the positions articulated by Catherine Woo in her August 22, 2025 email to David Shimura, we have identified eight principal open negotiation issues. These issues represent the core risk allocation disputes between the parties and wi

1. SLA Uptime Standard (99.95% vs. 99.9%). Meridian demands a 99.95% monthly uptime commitment; Skybridge proposes 99.9%. The gap represents approximately 22 minutes of additional permitted monthly downtime.

2. SLA Credit Cap (Uncapped vs. 15% Annual Cap). Meridian demands uncapped SLA credits; Skybridge proposes a monthly cap of 30% and an annual cap of 15% of the applicable subscription fee.

3. Data Breach Indemnity Cap (Uncapped vs. 2× Annual Fees). Meridian demands uncapped indemnification for data breach claims; Skybridge proposes a cap at 2× the annual fees paid in the preceding 12-month period.

4. Consequential Damages Carve-Out for Regulatory Fines. Meridian seeks to carve out regulatory fines and penalties from the mutual exclusion of consequential damages; Skybridge resists the carve-out.

5. Security Incident Notification Window (12 Hours vs. 24 Hours). Meridian demands 12-hour notification following discovery of a confirmed Security Incident; Skybridge proposes 24 hours.

6. Penetration Testing Scope (Infrastructure + Application vs. Application Only). Meridian demands the right to conduct penetration testing covering both infrastructure-layer and application-layer testing; Skybridge permits application-layer testing only.

7. Confidentiality/Data Security Super-Cap (Uncapped vs. 3× Annual Fees). Meridian demands uncapped liability for confidentiality and data security breaches; Skybridge proposes a "super-cap" at 3× annual fees.

8. Additional Insured Status on Cyber Policy. Meridian requests additional insured status on Skybridge's Cyber/E&O policy; Skybridge is reviewing feasibility with its carrier. These issues are interconnected in several important respects. Issues 3, 4, and 7 collectively define the liability architecture for data-related claims and should be negotiated as an integrated package. Issues 1 and 2 together determine the fi

IV. Detailed Analysis and Negotiation Strategy for Each Open Issue Issue 1: SLA Uptime Standard Meridian's Position. Meridian demands a monthly uptime commitment of 99.95%, measured exclusive of scheduled maintenance windows. Meridian's negotiating posture on this issue is driven by its status as a systemically important financial institution and the critical nature of the SkyComply™ platform to Meridian's BSA/AML co