Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the existing insurance portfolio maintained by Skybridge Fintech Ltd. ("Skybridge") against the contractual insurance requirements imposed by Meridian National Bank, N.A. ("Meridian") under the proposed Master Software-as-a-Service Agreement (the "MSA") for the SkyComply™ regulatory compliance platform. The MSA, currently under active negotiation, cont

II. Scope of Analysis Materials Reviewed. This memorandum is based on a review of the following materials: (a) The draft Master Software-as-a-Service Agreement between Skybridge Fintech Ltd. and Meridian National Bank, N.A., dated August 22, 2025, including the insurance requirements set forth in Article XIV (the "Insurance Article"), as proposed by Meridian's outside counsel, Hargrove, Tully & Cascade Insurance Brok

III. Meridian's Contractual Insurance Requirements The following section summarizes the insurance requirements set forth in Article XIV of the draft MSA, as proposed by Meridian. We note that Skybridge has not proposed material redlines to Article XIV in its September 3 response draft, with the exception of language relating to the additional insured endorsement on the cyber/E&O policy, which remains under negotiatio

IV. Skybridge's Existing Insurance Coverage A. Technology E&O / Cyber Liability Policy — Coastal Assurance Corporation

1. Policy Details. Skybridge maintains its primary technology errors and omissions and cyber liability coverage through a policy issued by Coastal Assurance Corporation, a Connecticut stock insurance corporation rated A (Excellent) by A.M. Best with a Financial Size Category of XV ($2 billion or greater). The relevant policy details are as follows: Carrier: Coastal Assurance Corporation (Hartford, Connecticut) Policy

2. Scope of Coverage. Based on our review of the policy forms and coverage summaries provided by Skybridge, the Coastal Assurance policy provides coverage for the following insuring agreements: (a) Technology Errors and Omissions. The policy covers claims arising from actual or alleged errors, omissions, negligent acts, or failures to perform in the rendering or failure to render technology services, including the pr

3. Key Policy Terms and Conditions. The following key terms and conditions of the Coastal Assurance policy warrant attention in the context of the MSA: (a) Claims-Made Basis. The policy is written on a claims-made and reported basis, which is standard for technology E&O and cyber liability insurance. Under a claims-made policy, coverage is triggered when a claim is first made against the insured and reported to the c

V. Gap Analysis — Coverage-by-Coverage Comparison A. Technology E&O / Cyber Liability

1. Coverage Limits. Meridian Requires: $25,000,000 per occurrence / $50,000,000 aggregate. Skybridge Has: $25,000,000 per claim / $50,000,000 aggregate (Coastal Assurance Policy No. CA-TECH-2025-07831). Finding: No gap on a contractual compliance basis. Skybridge's current coverage limits exactly match Meridian's stated minimum requirements. On a strict reading of the MSA's insurance provisions, Skybridge's Coastal A

2. Policy Period / Term Alignment. Current Policy Period: April 1, 2025 – March 31, 2026 (one-year term). MSA Initial Term: March 1, 2026 – February 28, 2031 (five years). MSA Tail Requirement: Coverage must be maintained for two (2) years following termination or expiration of the MSA, i.e., through approximately February 28, 2033. Finding: Gap identified — structural term mismatch requiring proactive management. Th

3. Subprocessor / Subcontractor Coverage. Context: Orion Cloud Services, Inc. ("Orion Cloud") is Skybridge's infrastructure-as-a-service ("IaaS") subprocessor, providing the cloud hosting environment for the SkyComply™ platform. The platform is deployed in Orion Cloud's US-East (Northern Virginia) and US-West (Oregon) regions. Orion Cloud handles substantial quantities of NPI, PII, and BSA/AML data in connection with

VI. Analysis of Additional Insured Request A. Meridian's Request

Article XIV of the draft MSA requires Skybridge to cause Meridian National Bank, N.A. to be named as an additional insured on two categories of policies: (i) The commercial general liability policy; and (ii) The technology errors and omissions / cyber liability policy (i.e., Coastal Assurance Policy No. CA-TECH-2025-07831). The additional insured endorsement must provide coverage for claims against Meridian arising o

VII. Certificate of Insurance — Delivery Obligations The MSA imposes the following obligations on Skybridge with respect to certificates of insurance: (a) Initial Delivery. Skybridge must deliver a certificate of insurance to Meridian within ten (10) business days of execution of the MSA. Based on the current negotiation timeline, MSA execution is targeted for late January or early February 2026, meaning that the ini

VIII. Regulatory Considerations The insurance provisions of the MSA must be understood in the broader regulatory context governing Meridian's third-party risk management obligations. The following regulatory considerations are relevant to this analysis: OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships (June 2023). As discussed in Section II above, the federal banking regulators expect ba

IX. Interaction with Indemnification and Liability Cap Provisions The insurance coverage analysis presented in this memorandum should not be viewed in isolation. The adequacy of Skybridge's insurance program is directly affected by the indemnification and liability cap provisions currently under negotiation in the MSA. The insurance coverage serves as a financial backstop for Skybridge's contractual liabilities; if t