Contract analysis

I. Executive Summary This memorandum provides a plain-language summary of the executed National Security Agreement, designated NSA-2024-0019 (the "NSA"), dated January 19, 2024, entered into by and among Halcyon Semiconductor Aktiengesellschaft ("HSAG"), Halcyon US Holdings Inc. ("Halcyon US Holdings"), Marlowe Asset Management Photonics Inc. ("VPI"), and the United States of America, acting through the U.S. Departme

II. Overview of the NSA Structure Parties The NSA was executed by the following parties: • Halcyon Semiconductor Aktiengesellschaft ("HSAG"), Industriestraße 44, 01099 Dresden, Saxony, Germany — the ultimate parent entity and acquiror. • Halcyon US Holdings Inc. ("Halcyon US Holdings"), 160 Greentree Drive, Suite 101, Dover, DE 19904 — the direct acquiror, a Delaware C-corporation and wholly owned subsidiary of HSAG

III. Board Governance Obligations The governance provisions of the NSA are among the most significant and far-reaching obligations imposed on HSAG and VPI. They fundamentally restructure VPI's board of directors and establish a Government Security Committee with exclusive authority over classified, ITAR-controlled, and security-related matters. HSAG's ability to exercise control over VPI is expressly limited in these

III.A. Reconstitution of VPI Board of Directors Pursuant to NSA §§ 3.1 through 3.4, VPI's board of directors must be reconstituted as a five-member board effective as of the closing of the Transaction (targeted for February 9, 2024). The composition requirements are as follows: Security Board Members (3 seats): Three members of the board must be "Security Board Members" as defined in the NSA and Annex A. Each Securit

1. Col. (Ret.) Bryce Hendrickson — Currently Vice President, Government Programs and Facility Security Officer (FSO) of VPI. Col. Hendrickson holds an active TS/SCI security clearance. He will continue in his current operational role at VPI in addition to serving on the board.

2. Adrienne Delacroix — Currently an independent director on VPI's existing board of directors. Ms. Delacroix holds an active SECRET-level security clearance. She has served on VPI's board since 2019 and brings continuity and familiarity with VPI's government programs.

3. Independent Security Director — To be identified and submitted for approval by CFIUS and DCSA prior to or promptly after closing. As of the date of this memorandum, the candidate for this position has not been finalized. We recommend that HSAG prioritize the identification and submission of a qualified candidate, as the appointment of the Independent Security Director is a condition to full compliance with the NSA

III.B. Government Security Committee (GSC) Pursuant to NSA §§ 4.1 through 4.9 and Annex C (the GSC Charter), a Government Security Committee ("GSC") must be established, composed exclusively of the three Security Board Members. The GSC exercises exclusive authority over the following matters: (a) All classified programs and classified information held by or accessible to VPI; (b) All ITAR-controlled programs and rela

III.C. Practical Implementation Steps — Governance In light of the foregoing governance obligations, we recommend the following implementation steps be completed at or immediately following closing:

1. Execute VPI Post-Closing Board Resolutions. VPI's new five-member board must adopt resolutions formally (a) reconstituting the board in accordance with the NSA, (b) establishing the GSC, (c) adopting the GSC Charter (Annex C), (d) adopting the Technology Control Plan (Annex B), and (e) adopting the Cybersecurity Requirements (Annex D). Draft resolutions have been prepared by Calderwood & Harkness and are being cir

2. File DCSA Notification of Board Reconstitution. VPI, through its FSO (Col. Hendrickson), must notify DCSA of the reconstitution of its board of directors within five business days of closing. A draft notification letter has been prepared.

3. Identify and Submit Candidate for Independent Security Director. If a candidate for Independent Security Director has not been finalized prior to closing, HSAG must promptly identify a qualified candidate and submit the candidate's name, qualifications, and security clearance status to CFIUS and DCSA for approval. We emphasize that this position must be filled as soon as practicable.

4. Establish Internal Protocols for HSAG Designees. HSAG's corporate governance team should develop and implement written internal protocols to ensure that HSAG Designees do not inadvertently access classified or ITAR-controlled information. These protocols should address, at minimum, the handling of VPI board materials, the segregation of GSC materials from general board materials, and the procedures for routing inf

IV. Personnel Continuity Obligations NSA §§ 5.1 through 5.5 impose personnel continuity requirements designed to ensure that VPI retains key leadership personnel with institutional knowledge of its government programs, classified operations, and security infrastructure during the post-acquisition transition period. These provisions reflect CFIUS's concern that the departure of critical personnel shortly after acquisi

1. Dr. Nathan Trevorrow — Founder and Chief Executive Officer of VPI. Dr. Trevorrow possesses deep technical expertise in gallium nitride-on-silicon carbide (GaN-on-SiC) photonic device fabrication and is the architect of VPI's core intellectual property portfolio.

2. Marissa Sung-Avila — President and Chief Operating Officer of VPI. Ms. Sung-Avila oversees VPI's day-to-day operations, including production scheduling, supply chain management, and customer relations for both commercial and government customers.

3. Col. (Ret.) Bryce Hendrickson — Vice President, Government Programs and Facility Security Officer. Col. Hendrickson manages VPI's classified and unclassified government contracts, serves as the Facility Security Officer responsible for VPI's FCL, and is a designated Security Board Member and GSC member. If any of these Key Personnel departs VPI — whether voluntarily or involuntarily — before the expiration of the

V. Technology Control Plan (TCP) Obligations The Technology Control Plan, set forth in NSA Annex B and referenced throughout the body of the NSA (particularly §§ 6.1 through 6.14), is the central mechanism by which the NSA protects against the unauthorized transfer of controlled technology from VPI to HSAG, HSAG affiliates, or other non-U.S. persons. VPI is a manufacturer of advanced GaN-on-SiC photonic devices used

1. Appoint TCP Review Committee. The GSC should establish the TCP Review Committee at closing, designating its members and adopting written procedures for the review and approval process.

2. Implement Document Classification/Marking System. VPI should review and, if necessary, update its existing document marking protocols to ensure consistency with the TCP requirements in Annex B.

3. File DDTC Change-of-Ownership Notification. Calderwood & Harkness will prepare and file the ITAR § 122.4(a) notification within sixty days of closing.

4. Initiate DSP-5 License Amendment Applications. Calderwood & Harkness will coordinate with VPI's export control team to prepare and file the three DSP-5 license amendment applications.

5. Schedule First Annual TCP Training. VPI's compliance team should schedule the first TCP training session for all VPI and relevant HSAG personnel within thirty days of closing.

6. Brief HSAG Personnel. All HSAG employees who may interact with VPI — including HSAG Designees on the VPI board, HSAG finance and treasury personnel, HSAG IT personnel, and HSAG management — must be briefed on the TCP restrictions and the prohibition on receiving controlled technical data without prior government authorization.

VI. Facility Security Clearance (FCL) and Facility Access Obligations

VI.A. FCL Maintenance VPI currently holds a Facility Security Clearance ("FCL") at the SECRET level for its fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92). This facility houses a 45,000 square-foot gallium nitride-on-silicon carbide (GaN-on-SiC) fabrication line and associated clean room and testing areas, including classified processing areas (Sections C-7

VI.B. Facility Access Restrictions (Annex F) NSA Annex F establishes detailed facility access procedures governing the circumstances under which HSAG personnel may visit or access VPI facilities. These restrictions are tiered based on the sensitivity of the area in question: Classified Areas (Albuquerque Fab — Sections C-7 through C-12): HSAG personnel may not access the classified areas of the Albuquerque fabricatio

1. Develop HSAG Internal Visitor Request and Approval Workflow. HSAG should establish a formal internal process for requesting and approving visits to VPI facilities. This process should include a review by the HSAG General Counsel's office (or the designated CFIUS/NSA Compliance Officer) to ensure compliance with the NSA's facility access restrictions and to route requests for classified-area access to DCSA and the

2. Designate VPI Escort Personnel. VPI should designate a pool of appropriately cleared employees to serve as escorts for HSAG visitors at each facility. Escort personnel should be trained on the Annex F requirements, including the prohibited items list and the scope of areas accessible to visitors.

3. Implement Visitor Log System. VPI should implement a visitor log system compliant with the Annex F requirements, including electronic recordkeeping, five-year retention, and reporting capabilities.

VII. Data Segregation and Cybersecurity Obligations

VII.A. Data Segregation (IT Systems) NSA §§ 7.1 through 7.6 and the TCP (Annex B) impose strict requirements for the segregation of VPI's information technology systems from HSAG's global network. These requirements are designed to prevent the unauthorized electronic transfer of controlled technical data from VPI to HSAG, HSAG affiliates, or other non-U.S. persons. The data segregation requirements are as follows: (a

VII.B. Cybersecurity Requirements (Annex D) NSA Annex D establishes cybersecurity requirements for VPI's IT systems and networks. These requirements are designed to protect Controlled Unclassified Information ("CUI"), classified information, and export-controlled technical data against unauthorized access, exfiltration, and compromise. The principal requirements are as follows: (a) NIST SP 800-171 Compliance. VPI mus

1. Confirm NIST SP 800-171 Compliance Status. VPI should conduct an assessment of its current compliance with NIST SP 800-171 within thirty (30) days of closing. Any identified gaps should be documented in a POA&M and remediated on an expedited basis. Calderwood & Harkness can recommend qualified assessment firms if needed.

2. Engage Annual Penetration Testing Vendor. VPI should identify and engage a U.S.-based penetration testing vendor, subject to GSC approval. The first annual penetration test should be scheduled within twelve months of closing (i.e., by approximately February 2025).

3. Establish 72-Hour Incident Reporting Protocol. VPI should establish a written protocol for the 72-hour cybersecurity incident reporting obligation, including designated points of contact at DCSA and the Monitor. The protocol should include an internal escalation procedure that ensures VPI's IT security team notifies the FSO, the GSC, and external counsel promptly upon discovery of any incident.

4. Brief HSAG IT Security Leadership. HSAG's Chief Information Security Officer (or equivalent) and relevant IT security personnel should be briefed on the 72-hour reporting obligation and the chain of communication. Although the reporting obligation runs to VPI and DCSA, HSAG should be aware that cybersecurity incidents at VPI may trigger NSA compliance implications and may require coordination with Calderwood & Har

VIII. Third-Party Compliance Monitor

VIII.A. Monitor Identity and Engagement As noted in Section II above, CFIUS has required the appointment of a third-party compliance monitor to provide independent oversight of compliance with the NSA. The approved Monitor is Whitmore Compliance Group LLC, located at 1300 Crystal Drive, Suite 710, Arlington, VA 22202. The Monitor's principal is Gerald Whitmore, a former senior official of the Federal Bureau of Invest

VIII.B. Scope of Monitoring The Monitor's scope of authority is comprehensive and extends to all obligations imposed by the NSA. Specifically, the Monitor is authorized and directed to conduct: (a) Annual Comprehensive Compliance Audits. The Monitor will conduct a comprehensive compliance audit on an annual basis, covering all categories of NSA obligations, including: board governance and GSC functioning, TCP adheren

VIII.C. Cost Obligations The costs of the Monitor are borne entirely by HSAG. The fee structure is as follows: All payments are made directly to Whitmore Compliance Group LLC. The annual fee is subject to adjustment annually based on the Consumer Price Index ("CPI"), with the first CPI adjustment effective January 19, 2025. The NSA specifies that neither VPI nor the U.S. Government bears any portion of the Monitor's

VIII.D. Annual Compliance Audit The Monitor's annual compliance audit is a key enforcement mechanism under the NSA. The audit follows the template set forth in NSA Annex E and covers all obligation categories. The key parameters are as follows: • Template: NSA Annex E (Annual Compliance Report Template) • First Annual Audit Due: January 19, 2025 (12 months after NSA execution) • Report Submission: To CFIUS monitoring

IX. Pre-Notification of Material Changes NSA § 9.1 requires HSAG to notify CFIUS in writing at least thirty (30) days before implementing any "material change" to VPI's business. This pre-notification requirement serves as an ongoing check on HSAG's ability to alter VPI's operations in ways that could affect the national security mitigation achieved by the NSA. The term "material change" is defined broadly in the NSA

X. Penalty Provisions HSAG management must be fully aware of the enforcement and penalty provisions of the NSA. The consequences of non-compliance are substantial and include both monetary and non-monetary remedies available to the U.S. Government. NSA § 12.3 provides that a violation of any provision of the NSA may result in the following: (a) Civil Monetary Penalties. Penalties of up to $250,000 per violation per d

XI. Government Contracts and Export Control Compliance Obligations (Supplementary) Although the following obligations are not all contained within the four corners of the NSA itself, they arise directly from the change in ownership of VPI and are integral to maintaining the conditions on which CFIUS clearance was granted. Non-compliance with these obligations could jeopardize VPI's ability to perform its government c

XII. Consolidated Compliance Calendar The following tables consolidate all compliance deadlines and obligations identified in this memorandum. HSAG and VPI management should use this calendar as a reference tool and should integrate these deadlines into HSAG's internal compliance tracking systems.

XII.A. One-Time Post-Closing Obligations (Target: February 9, 2024 and Immediately Following)

XII.C. Event-Triggered Obligations

XIII. Cost Summary The following table summarizes the estimated annual recurring costs of NSA compliance. These costs are borne entirely by HSAG; they are not allocated to VPI or to the U.S. Government. These cost estimates do not include certain one-time post-closing costs, such as the costs of filing novation agreements, export license amendments, and DDTC notifications, or the costs of establishing the initial com

XIV. Recommended Internal Compliance Infrastructure Based on our experience representing foreign acquirors subject to CFIUS national security agreements, we strongly recommend that HSAG establish the following internal compliance infrastructure prior to or immediately after closing. A well-designed compliance program not only reduces the risk of inadvertent violations but also demonstrates good faith to the CFIUS mon

1. Designate a CFIUS/NSA Compliance Officer. HSAG should designate a single individual as the CFIUS/NSA Compliance Officer, with primary responsibility for overseeing all NSA obligations on a day-to-day basis. This individual should preferably be U.S.-based (to facilitate coordination with VPI, the Monitor, and DCSA) or should be the HSAG General Counsel's designee with the authority to act on behalf of the Vorstand

2. Establish an NSA Compliance Committee. HSAG should establish a cross-functional NSA Compliance Committee at the parent level, comprising representatives from the following departments: • Legal (General Counsel's office) • Finance and Treasury • Information Technology • Human Resources • Corporate Governance / Board Secretariat The NSA Compliance Committee should meet at least quarterly (aligned with the GSC meetin

3. Implement Internal Written Policies. HSAG should develop and implement written internal policies covering the following areas: (a) Information Sharing Protocols. A clear, written policy defining what information may and may not be shared between VPI and HSAG, the process for requesting TCP Review Committee approval of proposed information transfers, and the consequences of unauthorized information sharing. This po